{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,10]],"date-time":"2026-08-10T19:38:25Z","timestamp":1786390705374,"version":"build-2736575974"},"reference-count":421,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"9","license":[{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"ARC","award":["DP230101196"],"award-info":[{"award-number":["DP230101196"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Knowl. Data Eng."],"published-print":{"date-parts":[[2026,9]]},"DOI":"10.1109\/tkde.2026.3709786","type":"journal-article","created":{"date-parts":[[2026,8,7]],"date-time":"2026-08-07T19:04:59Z","timestamp":1786129499000},"page":"5736-5764","source":"Crossref","is-referenced-by-count":0,"title":["Data-Centric Challenges, Techniques, and Impacts: A Survey on Image Data Perturbation"],"prefix":"10.1109","volume":"38","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6790-2098","authenticated-orcid":false,"given":"Peng-Fei","family":"Zhang","sequence":"first","affiliation":[{"name":"The University of Queensland","place":["Brisbane, QLD, Australia"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6390-9890","authenticated-orcid":false,"given":"Guangdong","family":"Bai","sequence":"additional","affiliation":[{"name":"The University of Queensland","place":["Brisbane, QLD, Australia"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9972-7370","authenticated-orcid":false,"given":"Xin-Shun","family":"Xu","sequence":"additional","affiliation":[{"name":"Shandong University","place":["Jinan, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9738-4949","authenticated-orcid":false,"given":"Zi","family":"Huang","sequence":"additional","affiliation":[{"name":"The University of Queensland","place":["Brisbane, QLD, Australia"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Szegedy","year":"2013"},{"key":"ref2","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Goodfellow","year":"2014"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2023.3313059"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2023.3322129"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3404835.3462837"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00500"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3650205"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3343031.3351088"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58565-5_15"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v39i21.34367"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2024.128779"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2022.119110"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D18-1316"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140451"},{"key":"ref16","first-page":"6106","article-title":"Poison frogs! Targeted clean-label poisoning attacks on neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Shafahi","year":"2018"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref18","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017"},{"key":"ref19","article-title":"Adversarial logit pairing","author":"Kannan","year":"2018"},{"key":"ref20","article-title":"Towards deep learning models resistant to adversarial attacks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Madry","year":"2017"},{"key":"ref21","article-title":"Improving adversarial robustness requires revisiting misclassified examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wang","year":"2019"},{"key":"ref22","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang","year":"2019"},{"key":"ref23","article-title":"ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Geirhos","year":"2018"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.7000"},{"key":"ref25","first-page":"1","article-title":"Why do deep convolutional networks generalize so poorly to small image transformations?","volume":"20","author":"Azulay","year":"2019","journal-title":"J. Mach. Learn. Res."},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00823"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00044"},{"key":"ref28","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Cohen","year":"2019"},{"key":"ref29","first-page":"10693","article-title":"Randomized smoothing of all shapes and sizes","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Yang","year":"2020"},{"key":"ref30","article-title":"Incremental randomized smoothing certification","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Ugare","year":"2023"},{"key":"ref31","article-title":"Benchmarking neural network robustness to common corruptions and perturbations","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Hendrycks","year":"2018"},{"key":"ref32","first-page":"1097","article-title":"ImageNet classification with deep convolutional neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Krizhevsky","year":"2012"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2018.00212"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00123"},{"key":"ref35","article-title":"Unrestricted adversarial examples via semantic manipulation","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Bhattad","year":"2019"},{"key":"ref36","article-title":"Countering adversarial images using input transformations","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Guo","year":"2018"},{"key":"ref37","article-title":"AugMix: A simple data processing method to improve robustness and uncertainty","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Hendrycks","year":"2019"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01585"},{"key":"ref39","article-title":"Adversarial attacks and defences: A survey","author":"Chakraborty","year":"2018"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3594869"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3551636"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2022.3182979"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2021.3130903"},{"key":"ref44","article-title":"Very deep convolutional networks for large-scale image recognition","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Simonyan","year":"2015"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i3.20169"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00392"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2024.3480519"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00421"},{"key":"ref49","first-page":"36246","article-title":"Better diffusion models further improve adversarial training","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Wang","year":"2023"},{"key":"ref50","first-page":"8748","article-title":"Learning transferable visual models from natural language supervision","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Radford","year":"2021"},{"key":"ref51","first-page":"12888","article-title":"BLIP: Bootstrapping language-image pre-training for unified vision-language understanding and generation","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Li","year":"2022"},{"key":"ref52","article-title":"On the opportunities and risks of foundation models","author":"Bommasani","year":"2021"},{"key":"ref53","article-title":"Emergent abilities of large language models","author":"Wei","year":"2022","journal-title":"Trans. Mach. Learn. Res."},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2807385"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/3547330"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3719292"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1049\/cit2.12028"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978392"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i12.26773"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.52202\/068431-0548"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00112"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00764"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1016\/j.patrec.2021.03.033"},{"key":"ref64","article-title":"Perceptual adversarial robustness: Defense against unseen threat models","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Laidlaw","year":"2021"},{"key":"ref65","first-page":"6808","article-title":"Wasserstein adversarial examples via projected sinkhorn iterations","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Wong","year":"2019"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00467"},{"key":"ref67","first-page":"1802","article-title":"Exploring the landscape of spatial robustness","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Engstrom","year":"2019"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"ref69","article-title":"Adversarial patch","author":"Brown","year":"2017"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58558-7_39"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref72","article-title":"Delving into transferable adversarial examples and black-box attacks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Liu","year":"2016"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33012253"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00376"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1145\/3534678.3539241"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00777"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCN.2017.8038465"},{"key":"ref81","article-title":"Examining the impact of blur on recognition by convolutional networks","author":"Vasiljevic","year":"2016"},{"key":"ref82","first-page":"7324","article-title":"Making convolutional networks shift-invariant again","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang","year":"2019"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-022-01672-y"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2023.03.023"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01567"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00772"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.52202\/068431-1184"},{"key":"ref88","first-page":"5416","article-title":"Blending anti-aliasing into vision transformer","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Qian","year":"2021"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.00532"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01007"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19775-8_24"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00400"},{"key":"ref93","first-page":"23296","article-title":"Intriguing properties of vision transformers","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Naseer","year":"2021"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01850"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01173"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52734.2025.02786"},{"key":"ref97","first-page":"30339","article-title":"Adversarial examples make strong poisons","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Fowl","year":"2021"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP49357.2023.10096034"},{"key":"ref99","article-title":"Adversarial machine learning at scale","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Kurakin","year":"2016"},{"key":"ref100","article-title":"Certifying some distributional robustness with principled adversarial training","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Sinha","year":"2017"},{"key":"ref101","first-page":"11292","article-title":"Provably robust deep learning via adversarially trained smoothed classifiers","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Salman","year":"2019"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3264850"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i14.29504"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01967"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW60793.2023.00391"},{"key":"ref106","first-page":"3571","article-title":"On interaction between augmentations and corruptions in natural corruption robustness","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Mintun","year":"2021"},{"key":"ref107","first-page":"13276","article-title":"A fourier perspective on model robustness in computer vision","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Yin","year":"2019"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20053-3_26"},{"key":"ref109","first-page":"22473","article-title":"Image shortcut squeezing: Countering perturbative availability poisons with compression","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Liu","year":"2023"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP39728.2021.9414862"},{"key":"ref111","article-title":"Mitigating adversarial effects through randomization","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Xie","year":"2018"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2018.00210"},{"key":"ref113","article-title":"Backdoor attack in the physical world","volume-title":"Proc. Int. Conf. Learn. Representations Workshop","author":"Li","year":"2021"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5888"},{"key":"ref115","first-page":"4910","article-title":"Tight certificates of adversarial robustness for randomly smoothed classifiers","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Lee","year":"2019"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.52202\/075280-2945"},{"key":"ref117","first-page":"3938","article-title":"Wasserstein smoothing: Certified robustness against wasserstein adversarial attacks","volume-title":"Proc. Int. Conf. Artif. Intell. Statist.","author":"Levine","year":"2020"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485258"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW59228.2023.00225"},{"key":"ref120","first-page":"9464","article-title":"Certified adversarial robustness with additive noise","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Li","year":"2019"},{"key":"ref121","first-page":"28976","article-title":"Dimension-independent certified neural network watermarks via mollifier smoothing","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Ren","year":"2023"},{"key":"ref122","first-page":"21945","article-title":"Denoised smoothing: A provable defense for pretrained classifiers","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Salman","year":"2020"},{"key":"ref123","first-page":"4787","article-title":"$\\lbrace${DiffSmooth$\\rbrace$}: Certifiably robust learning via diffusion models and local smoothing","volume-title":"Proc. 32nd USENIX Secur.","author":"Zhang","year":"2023"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.52202\/075280-2167"},{"key":"ref125","first-page":"8465","article-title":"GSmooth: Certified robustness against semantic transformations via generalized randomized smoothing","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Hao","year":"2022"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.52202\/075280-1856"},{"key":"ref127","article-title":"AutoAugment: Learning augmentation policies from data","author":"Cubuk","year":"2018"},{"key":"ref128","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Athalye","year":"2018"},{"key":"ref129","article-title":"MACER: Attack-free and scalable robust training via maximizing certified radius","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Zhai","year":"2019"},{"key":"ref130","article-title":"Understanding noise-augmented training for randomized smoothing","author":"Pal","year":"2023","journal-title":"Trans. Mach. Learn. Res."},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00465"},{"key":"ref133","article-title":"Black-box adversarial attack with transferable model-based embedding","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Huang","year":"2019"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.3301742"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_10"},{"key":"ref137","article-title":"Prior convictions: Black-box adversarial attacks with bandits and priors","volume-title":"Proc. Int. Conf. Learn. Representations","volume":"2019","author":"Ilyas"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.6173"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00045"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20065-6_10"},{"key":"ref141","first-page":"10934","article-title":"Improving black-box adversarial attacks with a transfer-based prior","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Cheng","year":"2019"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.52202\/068431-0386"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01166"},{"key":"ref144","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i6.20595"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3307908"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00506"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3289298"},{"key":"ref149","article-title":"Improving adversarial robustness via channel-wise activation suppressing","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Bai","year":"2020"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW59228.2023.00229"},{"key":"ref151","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_39"},{"key":"ref152","article-title":"Skip connections matter: On the transferability of adversarial examples generated with resnets","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wu","year":"2019"},{"key":"ref153","doi-asserted-by":"publisher","DOI":"10.1109\/sp54263.2024.00010"},{"key":"ref154","first-page":"837","article-title":"Towards understanding and improving the transferability of adversarial examples in deep neural networks","volume-title":"Proc. 12th Asian Conf. Mach. Learn.","author":"Wu","year":"2020"},{"key":"ref155","first-page":"125","article-title":"Adversarial examples are not bugs, they are features","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Ilyas","year":"2019"},{"key":"ref156","article-title":"The space of transferable adversarial examples","author":"Tram\u00e8r","year":"2017"},{"key":"ref157","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2022.3211736"},{"key":"ref158","first-page":"321","article-title":"Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks","volume-title":"Proc. 28th USENIX Secur.","author":"Demontis","year":"2019"},{"key":"ref159","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00790"},{"key":"ref161","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02297"},{"key":"ref162","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i1.19936"},{"key":"ref163","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00788"},{"key":"ref164","doi-asserted-by":"publisher","DOI":"10.5244\/C.35.186"},{"key":"ref165","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i13.29323"},{"key":"ref166","article-title":"Nesterov accelerated gradient and scale invariance for adversarial attacks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Lin","year":"2019"},{"key":"ref167","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00430"},{"key":"ref168","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i3.27947"},{"key":"ref169","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3380248"},{"key":"ref170","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00789"},{"key":"ref171","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i6.28365"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2023.3347835"},{"key":"ref173","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i2.25239"},{"key":"ref174","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3352913"},{"key":"ref175","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i6.28470"},{"key":"ref176","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00016"},{"key":"ref177","doi-asserted-by":"publisher","DOI":"10.1145\/3626772.3657781"},{"key":"ref178","doi-asserted-by":"publisher","DOI":"10.52202\/075280-2303"},{"key":"ref179","doi-asserted-by":"publisher","DOI":"10.1145\/3503161.3547989"},{"key":"ref180","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i7.28541"},{"key":"ref181","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01575"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2023.3315550"},{"key":"ref183","first-page":"12849","article-title":"Practical no-box adversarial attacks against DNNs","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Li","year":"2020"},{"key":"ref184","first-page":"1633","article-title":"On adaptive attacks to adversarial example defenses","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Tramer","year":"2020"},{"key":"ref185","doi-asserted-by":"publisher","DOI":"10.52202\/075280-3234"},{"key":"ref186","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.6017"},{"key":"ref187","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00072"},{"key":"ref188","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref189","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02336"},{"key":"ref190","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00034"},{"key":"ref191","doi-asserted-by":"publisher","DOI":"10.52202\/075280-2253"},{"key":"ref192","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2023.3327017"},{"key":"ref193","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.11672"},{"key":"ref194","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/543"},{"key":"ref195","doi-asserted-by":"publisher","DOI":"10.1145\/3394171.3413976"},{"key":"ref196","first-page":"289","article-title":"A causal view on robustness of neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zhang","year":"2020"},{"key":"ref197","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01501"},{"key":"ref198","article-title":"Invariant risk minimization","author":"Arjovsky","year":"2019"},{"key":"ref199","article-title":"Adversarial robustness through the lens of causality","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Zhang","year":"2021"},{"key":"ref200","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3156809"},{"key":"ref201","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"ref202","first-page":"2137","article-title":"Black-box adversarial attacks with limited queries and information","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Ilyas","year":"2018"},{"key":"ref203","first-page":"3866","article-title":"NATTACK: Learning the distributions of adversarial examples for an improved black-box attack on deep neural networks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Li","year":"2019"},{"key":"ref204","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00130"},{"key":"ref205","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103541"},{"key":"ref206","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19772-7_32"},{"key":"ref207","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3393745"},{"key":"ref208","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20065-6_1"},{"key":"ref209","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103674"},{"key":"ref210","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00425"},{"key":"ref211","doi-asserted-by":"publisher","DOI":"10.1145\/3581783.3612070"},{"key":"ref212","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01456"},{"key":"ref213","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00414"},{"key":"ref214","article-title":"Rethinking model ensemble in transfer-based adversarial attacks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Chen","year":"2023"},{"key":"ref215","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00196"},{"key":"ref216","first-page":"85","article-title":"Backpropagating linearly improves transferability of adversarial examples","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Guo","year":"2020"},{"key":"ref217","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00723"},{"key":"ref218","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00483"},{"key":"ref219","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01457"},{"key":"ref220","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00124"},{"key":"ref221","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00754"},{"key":"ref222","first-page":"2259","article-title":"On the role of generalization in transferability of adversarial examples","volume-title":"Proc. 39th Uncertainty Artif. Intell.","author":"Wang","year":"2023"},{"key":"ref223","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01464"},{"key":"ref224","doi-asserted-by":"publisher","DOI":"10.1145\/3581783.3612110"},{"key":"ref225","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i2.25362"},{"key":"ref226","first-page":"13950","article-title":"Learning transferable adversarial perturbations","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Salzmann","year":"2021"},{"key":"ref227","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00102"},{"key":"ref228","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2024.3349925"},{"key":"ref229","article-title":"An image is worth 1000 lies: Transferability of adversarial images across prompts on vision-language models","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Luo","year":"2023"},{"key":"ref230","doi-asserted-by":"publisher","DOI":"10.52202\/068431-0088"},{"key":"ref231","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00401"},{"key":"ref232","article-title":"On improving adversarial transferability of vision transformers","volume-title":"Proc. Int. Conf. Learn. Representations","volume":"2022","author":"Naseer"},{"key":"ref233","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00774"},{"key":"ref234","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00871"},{"key":"ref235","first-page":"26831","article-title":"Are transformers more robust than CNNs?","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Bai","year":"2021"},{"key":"ref236","article-title":"On the adversarial robustness of vision transformers","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Shao","year":"2022"},{"key":"ref237","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2023.119474"},{"key":"ref238","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00427"},{"key":"ref239","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02301"},{"key":"ref240","article-title":"Ensemble adversarial training: Attacks and defenses","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Tram\u00e8r","year":"2017"},{"key":"ref241","article-title":"MMA training: Direct input space margin maximization through adversarial training","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Ding","year":"2018"},{"key":"ref242","article-title":"Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Ghiasi","year":"2019"},{"key":"ref243","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce","year":"2020"},{"key":"ref244","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00445"},{"key":"ref245","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00395"},{"key":"ref246","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00068"},{"key":"ref247","first-page":"2196","article-title":"Minimally distorted adversarial examples with a fast adaptive boundary attack","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce","year":"2020"},{"key":"ref248","first-page":"12817","article-title":"Accurate, Reliable and Fast Robustness Evaluation","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Brendel","year":"2020"},{"key":"ref249","first-page":"20052","article-title":"Fast minimum-norm adversarial attacks through adaptive norm constraints","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Pintor","year":"2021"},{"key":"ref250","article-title":"How robust is google\u2019s bard to adversarial image attacks?","author":"Dong","year":"2023"},{"key":"ref251","doi-asserted-by":"publisher","DOI":"10.52202\/075280-2355"},{"key":"ref252","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2025.3526248"},{"key":"ref253","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v39i22.34568"},{"key":"ref254","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-73464-9_11"},{"key":"ref255","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52734.2025.00884"},{"key":"ref256","article-title":"Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Shayegani","year":"2023"},{"key":"ref257","first-page":"12080","article-title":"MetaPoison: Practical general-purpose clean-label data poisoning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Huang","year":"2020"},{"key":"ref258","article-title":"Label-consistent backdoor attacks","author":"Turner","year":"2019"},{"key":"ref259","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2023.109512"},{"key":"ref260","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616617"},{"key":"ref261","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01615"},{"key":"ref262","first-page":"3454","article-title":"Input-aware dynamic backdoor attack","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Nguyen","year":"2020"},{"key":"ref263","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2020.3021407"},{"key":"ref264","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01616"},{"key":"ref265","article-title":"Unlearnable examples: Making personal data unexploitable","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Huang","year":"2020"},{"key":"ref266","article-title":"Robust unlearnable examples: Protecting data privacy against adversarial learning","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Fu","year":"2021"},{"key":"ref267","first-page":"7614","article-title":"Transferable clean-label poisoning attacks on deep neural nets","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhu","year":"2019"},{"key":"ref268","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP51992.2021.00021"},{"key":"ref269","article-title":"Witches\u2019 brew: Industrial scale data poisoning via gradient matching","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Geiping","year":"2020"},{"key":"ref270","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00388"},{"key":"ref271","article-title":"Sharpness-aware data poisoning attack","volume-title":"Proc. Int. Conf. Learn. Representations","author":"He","year":"2024"},{"key":"ref272","article-title":"Transferable unlearnable examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Ren","year":"2023"},{"key":"ref273","first-page":"3629","article-title":"$\\lbrace${PoisonedEncoder$\\rbrace$}: Poisoning the unlabeled pre-training data in contrastive learning","volume-title":"31st USENIX Secur. Symp.","author":"Liu","year":"2022"},{"key":"ref274","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01298"},{"key":"ref275","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833644"},{"key":"ref276","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00403"},{"key":"ref277","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00029"},{"key":"ref278","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02299"},{"key":"ref279","article-title":"Indiscriminate poisoning attacks on unsupervised contrastive learning","volume-title":"Proc. Int. Conf. Learn. Representations","author":"He","year":"2022"},{"key":"ref280","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58607-2_11"},{"key":"ref281","doi-asserted-by":"publisher","DOI":"10.1145\/3374664.3375751"},{"key":"ref282","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6871"},{"key":"ref283","doi-asserted-by":"publisher","DOI":"10.52202\/068431-1393"},{"key":"ref284","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP53844.2022.00049"},{"key":"ref285","doi-asserted-by":"publisher","DOI":"10.1109\/SPW50608.2020.00024"},{"key":"ref286","first-page":"12215","article-title":"Re-thinking data availablity attacks against deep neural networks","volume-title":"Proc. IEEE\/CVF Conf. Comput. Vis. Pattern Recognit.","author":"Fang","year":"2024"},{"key":"ref287","article-title":"Wanet-imperceptible warping-based backdoor attack","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Nguyen","year":"2020"},{"key":"ref288","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP48485.2024.10448363"},{"key":"ref289","doi-asserted-by":"publisher","DOI":"10.1109\/TCSI.2023.3298802"},{"key":"ref290","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i2.16201"},{"key":"ref291","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i3.27954"},{"key":"ref292","first-page":"16209","article-title":"Better safe than sorry: Preventing delusive adversaries with adversarial training","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Tao","year":"2021"},{"key":"ref293","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref294","doi-asserted-by":"publisher","DOI":"10.52202\/068431-1922"},{"key":"ref295","doi-asserted-by":"publisher","DOI":"10.1109\/WACV57701.2024.00383"},{"key":"ref296","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i1.25125"},{"key":"ref297","first-page":"12062","article-title":"Adversarial purification with score-based generative models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Yoon","year":"2021"},{"key":"ref298","first-page":"16805","article-title":"Diffusion models for adversarial purification","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Nie","year":"2022"},{"key":"ref299","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02329"},{"key":"ref300","first-page":"16048","article-title":"Understanding and improving fast adversarial training","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Andriushchenko","year":"2020"},{"key":"ref301","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i9.16989"},{"key":"ref302","first-page":"3358","article-title":"Adversarial training for free!","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Shafahi","year":"2019"},{"key":"ref303","article-title":"Fast is better than free: Revisiting adversarial training","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wong","year":"2019"},{"key":"ref304","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2022.3184255"},{"key":"ref305","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2024.3381180"},{"key":"ref306","doi-asserted-by":"publisher","DOI":"10.52202\/075280-2968"},{"key":"ref307","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.02364"},{"key":"ref308","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i6.28330"},{"key":"ref309","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00766"},{"key":"ref310","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00103"},{"key":"ref311","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW59228.2023.00227"},{"key":"ref312","article-title":"Catastrophic overfitting can be induced with discriminative non-robust features","author":"Ortiz-Jimenez","journal-title":"Trans. Mach. Learn. Res."},{"key":"ref313","article-title":"On the over-memorization during natural, robust and catastrophic overfitting","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Lin","year":"2023"},{"key":"ref314","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2023.3326398"},{"key":"ref315","article-title":"Efficient local linearity regularization to overcome catastrophic overfitting","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Rocamora","year":"2023"},{"key":"ref316","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2024.110356"},{"key":"ref317","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00435"},{"key":"ref318","doi-asserted-by":"publisher","DOI":"10.52202\/068431-0936"},{"key":"ref319","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01305"},{"key":"ref320","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19781-9_3"},{"key":"ref321","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00035"},{"key":"ref322","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-024-02103-w"},{"key":"ref323","article-title":"Geometry-aware instance-reweighted adversarial training","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Zhang","year":"2020"},{"key":"ref324","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2022\/95"},{"key":"ref325","first-page":"25595","article-title":"Understanding robust overfitting of adversarial training and beyond","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Yu","year":"2022"},{"key":"ref326","article-title":"Robust local features for improving the generalization of adversarial training","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Song","year":"2019"},{"key":"ref327","first-page":"9155","article-title":"Confidence-calibrated adversarial training: Generalizing to unseen attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Stutz","year":"2020"},{"key":"ref328","article-title":"Exploring memorization in adversarial training","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Dong","year":"2021"},{"key":"ref329","doi-asserted-by":"publisher","DOI":"10.1016\/j.artint.2023.103877"},{"key":"ref330","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00399"},{"key":"ref331","first-page":"876","article-title":"Averaging weights leads to wider optima and better generalization","volume-title":"Proc. 34th Conf. Uncertainty Artif. Intell.","author":"Izmailov","year":"2018"},{"key":"ref332","article-title":"Robust overfitting may be mitigated by properly learned smoothening","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Chen","year":"2021"},{"key":"ref333","article-title":"Fixing data augmentation to improve adversarial robustness","author":"Rebuffi","year":"2021"},{"key":"ref334","first-page":"2958","article-title":"Adversarial weight perturbation helps robust generalization","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Wu","year":"2020"},{"key":"ref335","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2022.109229"},{"key":"ref336","first-page":"12214","article-title":"Are labels required for improving adversarial robustness?","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Alayrac","year":"2019"},{"key":"ref337","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2023.3286772"},{"key":"ref338","doi-asserted-by":"publisher","DOI":"10.52202\/075280-0694"},{"key":"ref339","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01611"},{"key":"ref340","article-title":"Intriguing properties of adversarial training at scale","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Xie","year":"2019"},{"key":"ref341","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i12.26738"},{"key":"ref342","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2022.10.059"},{"key":"ref343","article-title":"Adversarial robustness may be at odds with simplicity","author":"Nakkiran","year":"2019"},{"key":"ref344","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00059"},{"key":"ref345","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00791"},{"key":"ref346","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01484"},{"key":"ref347","doi-asserted-by":"publisher","DOI":"10.1109\/TCYB.2024.3380437"},{"key":"ref348","first-page":"480","article-title":"Metric learning for adversarial robustness","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Mao","year":"2019"},{"key":"ref349","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3359820"},{"key":"ref350","first-page":"10796","article-title":"Improving adversarial robustness via information bottleneck distillation","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Kuang","year":"2024"},{"key":"ref351","first-page":"10077","article-title":"Theoretically grounded loss functions and algorithms for adversarial robustness","volume-title":"Proc. Int. Conf. Artif. Intell. Statist.","author":"Awasthi","year":"2023"},{"key":"ref352","first-page":"2983","article-title":"Adversarial self-supervised contrastive learning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Kim","year":"2020"},{"key":"ref353","first-page":"11492","article-title":"To be robust or to be fair: Towards fairness in adversarial training","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Xu","year":"2021"},{"key":"ref354","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i12.26769"},{"key":"ref355","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00792"},{"key":"ref356","first-page":"325","article-title":"Robustness may be at odds with fairness: An empirical study on class-wise accuracy","volume-title":"Proc. Adv. Neural Inf. Process. Syst. Pre-Registration Workshop","author":"Benz","year":"2021"},{"key":"ref357","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i9.26352"},{"key":"ref358","article-title":"Reducing excessive margin to achieve a better accuracy vs. robustness trade-off","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Rade","year":"2021"},{"key":"ref359","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3263637"},{"key":"ref360","doi-asserted-by":"publisher","DOI":"10.52202\/075280-0680"},{"key":"ref361","doi-asserted-by":"publisher","DOI":"10.1109\/TAI.2024.3364121"},{"key":"ref362","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2022.109054"},{"key":"ref363","first-page":"1831","article-title":"Defense against adversarial attacks using feature scattering-based adversarial training","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zhang","year":"2019"},{"key":"ref364","doi-asserted-by":"publisher","DOI":"10.1109\/iccv.2019.00673"},{"key":"ref365","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2024.106224"},{"key":"ref366","doi-asserted-by":"publisher","DOI":"10.52202\/075280-3211"},{"key":"ref367","first-page":"4218","article-title":"Improving robustness using generated data","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Gowal","year":"2021"},{"key":"ref368","first-page":"15669","article-title":"One-vs-the-rest loss to focus on important samples in adversarial training","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Kanai","year":"2023"},{"key":"ref369","first-page":"11278","article-title":"Attacks which do not kill training make adversarial learning stronger","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang","year":"2020"},{"key":"ref370","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00397"},{"key":"ref371","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2024.3411035"},{"key":"ref372","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01578"},{"key":"ref373","doi-asserted-by":"publisher","DOI":"10.1109\/WACV56688.2023.00238"},{"key":"ref374","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00408"},{"key":"ref375","article-title":"Conserve-update-revise to cure generalization and robustness trade-off in adversarial training","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Gowda","year":"2014"},{"key":"ref376","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00090"},{"key":"ref377","first-page":"23433","article-title":"Removing batch normalization boosts adversarial training","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Wang","year":"2022"},{"key":"ref378","doi-asserted-by":"publisher","DOI":"10.1109\/WACV.2019.00143"},{"key":"ref379","doi-asserted-by":"publisher","DOI":"10.1109\/WACV56688.2023.00461"},{"key":"ref380","first-page":"5866","article-title":"Adversarial training and robustness for multiple perturbations","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Tram\u00e8r","year":"2019"},{"key":"ref381","first-page":"6640","article-title":"Adversarial robustness against the union of multiple perturbation models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Maini","year":"2020"},{"key":"ref382","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.02362"},{"key":"ref383","doi-asserted-by":"publisher","DOI":"10.52202\/068431-0629"},{"key":"ref384","first-page":"16199","article-title":"Robust pre-training by adversarial contrastive learning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Jiang","year":"2020"},{"key":"ref385","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-022-06269-7"},{"key":"ref386","first-page":"2712","article-title":"Using pre-training can improve model robustness and uncertainty","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Hendrycks","year":"2019"},{"key":"ref387","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01577"},{"key":"ref388","article-title":"AutoLoRa: A parameter-free automated robust fine-tuning framework","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Xu","year":"2023"},{"key":"ref389","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00244"},{"key":"ref390","first-page":"227","article-title":"You only propagate once: Accelerating adversarial training via maximal principle","volume-title":"Proc. Proc. Adv. Neural Inf. Process. Syst.","author":"Zhang","year":"2019"},{"key":"ref391","first-page":"18527","article-title":"BulletTrain: Accelerating robust neural network training via boundary example mining","volume-title":"Proc. Proc. Adv. Neural Inf. Process. Syst.","author":"Hua","year":"2021"},{"key":"ref392","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3377004"},{"key":"ref393","first-page":"8093","article-title":"Overfitting in adversarially robust deep learning","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Rice","year":"2020"},{"key":"ref394","first-page":"29935","article-title":"Data augmentation can improve robustness","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Rebuffi","year":"2021"},{"key":"ref395","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i8.20817"},{"key":"ref396","article-title":"Data augmentation alone can improve adversarial training","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Li","year":"2022"},{"key":"ref397","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/520"},{"key":"ref398","first-page":"6586","article-title":"On the convergence and robustness of adversarial training","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Wang","year":"2019"},{"key":"ref399","first-page":"4970","article-title":"Improving adversarial robustness via promoting ensemble diversity","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Pang","year":"2019"},{"key":"ref400","article-title":"Robustness may be at odds with accuracy","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Tsipras","year":"2018"},{"key":"ref401","article-title":"Smooth adversarial training","author":"Xie","year":"2020"},{"key":"ref402","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01543"},{"key":"ref403","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01969"},{"key":"ref404","first-page":"8588","article-title":"A closer look at accuracy vs. robustness","volume-title":"Proc. Proc. Adv. Neural Inf. Process. Syst.","author":"Yang","year":"2020"},{"key":"ref405","first-page":"7909","article-title":"Understanding and mitigating the tradeoff between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Raghunathan","year":"2020"},{"key":"ref406","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00078"},{"key":"ref407","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19778-9_18"},{"key":"ref408","doi-asserted-by":"publisher","DOI":"10.1109\/SaTML54575.2023.00024"},{"key":"ref409","doi-asserted-by":"publisher","DOI":"10.52202\/068431-1351"},{"key":"ref410","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2023.3281872"},{"key":"ref411","article-title":"RobustBench: A standardized adversarial robustness benchmark","volume-title":"Adv. Neural Inf. Process. Syst.","author":"Croce","year":"2020"},{"key":"ref412","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v39i3.32263"},{"key":"ref413","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00040"},{"key":"ref414","first-page":"9389","article-title":"Just how toxic is data poisoning? A unified benchmark for backdoor and data poisoning attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Schwarzschild","year":"2021"},{"key":"ref415","doi-asserted-by":"publisher","DOI":"10.52202\/068431-0766"},{"key":"ref416","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2025.3574432"},{"key":"ref417","first-page":"11973","article-title":"On the trade-off between adversarial and backdoor robustness","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Weng","year":"2020"},{"key":"ref418","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2024.3392760"},{"key":"ref419","first-page":"2280","article-title":"Adversarial examples are a natural consequence of test error in noise","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Gilmer","year":"2019"},{"key":"ref420","first-page":"1012","article-title":"On the effectiveness of adversarial training against common corruptions","volume-title":"Proc. Uncertainty Artif. Intell.","author":"Kireev","year":"2022"},{"key":"ref421","doi-asserted-by":"publisher","DOI":"10.52202\/075280-0734"}],"container-title":["IEEE Transactions on Knowledge and Data Engineering"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/69\/11644801\/11644733.pdf?arnumber=11644733","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,8,10]],"date-time":"2026-08-10T19:07:35Z","timestamp":1786388855000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11644733\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9]]},"references-count":421,"journal-issue":{"issue":"9"},"URL":"https:\/\/doi.org\/10.1109\/tkde.2026.3709786","relation":{},"ISSN":["1041-4347","1558-2191","2326-3865"],"issn-type":[{"value":"1041-4347","type":"print"},{"value":"1558-2191","type":"electronic"},{"value":"2326-3865","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9]]}}}