{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,7]],"date-time":"2026-05-07T16:22:57Z","timestamp":1778170977577,"version":"3.51.4"},"reference-count":61,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2024,4,1]],"date-time":"2024-04-01T00:00:00Z","timestamp":1711929600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2024,4,1]],"date-time":"2024-04-01T00:00:00Z","timestamp":1711929600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2024,4,1]],"date-time":"2024-04-01T00:00:00Z","timestamp":1711929600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Med. Imaging"],"published-print":{"date-parts":[[2024,4]]},"DOI":"10.1109\/tmi.2023.3335098","type":"journal-article","created":{"date-parts":[[2023,11,23]],"date-time":"2023-11-23T19:04:38Z","timestamp":1700766278000},"page":"1296-1307","source":"Crossref","is-referenced-by-count":9,"title":["Adversarial Medical Image With Hierarchical Feature Hiding"],"prefix":"10.1109","volume":"43","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4379-6910","authenticated-orcid":false,"given":"Qingsong","family":"Yao","sequence":"first","affiliation":[{"name":"Institute of Computing Technology, Chinese Academy of Sciences, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2639-2826","authenticated-orcid":false,"given":"Zecheng","family":"He","sequence":"additional","affiliation":[{"name":"Meta Reality Laboratories, Burlingame, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8076-2619","authenticated-orcid":false,"given":"Yuexiang","family":"Li","sequence":"additional","affiliation":[{"name":"Tencent YouTu Laboratory, Jarvis Research Center, Shenzhen, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7635-2518","authenticated-orcid":false,"given":"Yi","family":"Lin","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, The Hong Kong University of Science and Technology, Sai Kung, Hong Kong"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2805-3692","authenticated-orcid":false,"given":"Kai","family":"Ma","sequence":"additional","affiliation":[{"name":"Tencent YouTu Laboratory, Jarvis Research Center, Shenzhen, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2195-2847","authenticated-orcid":false,"given":"Yefeng","family":"Zheng","sequence":"additional","affiliation":[{"name":"Tencent YouTu Laboratory, Jarvis Research Center, Shenzhen, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6881-4444","authenticated-orcid":false,"given":"S. Kevin","family":"Zhou","sequence":"additional","affiliation":[{"name":"University of Chinese Academic of Science, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","first-page":"1","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Szegedy"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2021.3054390"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP48549.2020.00017"},{"key":"ref5","volume-title":"Medical Image Recognition, Segmentation and Parsing: Machine Learning and Multiple Object Approaches","author":"Zhou","year":"2015"},{"key":"ref6","volume-title":"Deep Learning for Medical Image Analysis","author":"Zhou","year":"2017"},{"key":"ref7","volume-title":"Handbook of Medical Image Computing and Computer Assisted Intervention","author":"Zhou","year":"2019"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-32245-8_34"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00928-1_56"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1126\/science.aaw4399"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2020.107332"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-59719-1_67"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/ISBI45749.2020.9098628"},{"key":"ref15","first-page":"2579","article-title":"Visualizing data using t-SNE","volume":"9","author":"van der Maaten","year":"2008","journal-title":"J. Mach. Learn. Res."},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref17","article-title":"Characterizing adversarial subspaces using local intrinsic dimensionality","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Ma"},{"key":"ref18","first-page":"7167","article-title":"A simple unified framework for detecting out-of-distribution samples and adversarial attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Lee"},{"key":"ref19","article-title":"Adversarial machine learning at scale","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Kurakin"},{"key":"ref20","article-title":"Adversarial manipulation of deep representations","volume-title":"Proc. IEEE Symp. Secur. Privacy","author":"Sabour"},{"key":"ref21","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Athalye"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-87199-4_4"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref26","article-title":"Adam: A method for stochastic optimization","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Kingma"},{"key":"ref27","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Goodfellow"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref32","article-title":"A study of the effect of JPG compression on adversarial images","author":"Dziugaite","year":"2016","journal-title":"arXiv:1608.00853"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.11504"},{"key":"ref34","first-page":"854","article-title":"Parseval networks: Improving robustness to adversarial examples","volume-title":"Proc. ICML","author":"Cisse"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01234-2_23"},{"key":"ref37","article-title":"Stochastic activation pruning for robust adversarial defense","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Dhillon"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.01160"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33018417"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00040"},{"key":"ref41","article-title":"Ensemble adversarial training: Attacks and defenses","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Tram\u00e8r"},{"key":"ref42","first-page":"1633","article-title":"On adaptive attacks to adversarial example defenses","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Tramer"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134057"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2020.2970615"},{"key":"ref45","first-page":"7913","article-title":"Robust detection of adversarial attacks by modeling the intrinsic properties of deep neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zheng"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.615"},{"key":"ref47","article-title":"On detecting adversarial perturbations","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Metzen"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.56"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00897"},{"key":"ref50","article-title":"Deep k-nearest neighbors: Towards confident, interpretable and robust deep learning","author":"Papernot","year":"2018","journal-title":"arXiv:1803.04765"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01446"},{"key":"ref52","article-title":"Detecting adversarial samples from artifacts","author":"Feinman","year":"2017","journal-title":"arXiv:1703.00410"},{"key":"ref53","volume-title":"APTOS 2019 Blindness Detection","year":"2019"},{"key":"ref54","volume-title":"Learning Multiple Layers of Features From Tiny Images","author":"Krizhevsky","year":"2012"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1016\/j.cell.2018.02.010"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.2307\/2984875"},{"key":"ref58","article-title":"Very deep convolutional networks for large-scale image recognition","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Simonyan"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00717"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/TMI.2021.3066161"},{"key":"ref61","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. ICML","author":"Croce"}],"container-title":["IEEE Transactions on Medical Imaging"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/42\/10490289\/10328635.pdf?arnumber=10328635","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,4,4]],"date-time":"2025-04-04T19:54:54Z","timestamp":1743796494000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10328635\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,4]]},"references-count":61,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/tmi.2023.3335098","relation":{},"ISSN":["0278-0062","1558-254X"],"issn-type":[{"value":"0278-0062","type":"print"},{"value":"1558-254X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,4]]}}}