{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,9]],"date-time":"2026-02-09T23:27:50Z","timestamp":1770679670401,"version":"3.49.0"},"reference-count":91,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"12","license":[{"start":{"date-parts":[[2020,12,1]],"date-time":"2020-12-01T00:00:00Z","timestamp":1606780800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2020,12,1]],"date-time":"2020-12-01T00:00:00Z","timestamp":1606780800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2020,12,1]],"date-time":"2020-12-01T00:00:00Z","timestamp":1606780800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"EPSRC, Clarendon Fund"},{"name":"ERC","award":["ERC-2012-AdG 321162-HELIOS"],"award-info":[{"award-number":["ERC-2012-AdG 321162-HELIOS"]}]},{"DOI":"10.13039\/501100000266","name":"Engineering and Physical Sciences Research Council","doi-asserted-by":"publisher","award":["EP\/M013774\/1"],"award-info":[{"award-number":["EP\/M013774\/1"]}],"id":[{"id":"10.13039\/501100000266","id-type":"DOI","asserted-by":"publisher"}]},{"name":"EPSRC\/MURI","award":["EP\/N019474\/1"],"award-info":[{"award-number":["EP\/N019474\/1"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2020,12,1]]},"DOI":"10.1109\/tpami.2019.2919707","type":"journal-article","created":{"date-parts":[[2019,5,29]],"date-time":"2019-05-29T20:00:35Z","timestamp":1559160035000},"page":"3040-3053","source":"Crossref","is-referenced-by-count":29,"title":["On the Robustness of Semantic Segmentation Models to Adversarial Attacks"],"prefix":"10.1109","volume":"42","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5216-4838","authenticated-orcid":false,"given":"Anurag","family":"Arnab","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8528-2956","authenticated-orcid":false,"given":"Ondrej","family":"Miksik","sequence":"additional","affiliation":[]},{"given":"Philip H. S.","family":"Torr","sequence":"additional","affiliation":[]}],"member":"263","reference":[{"key":"ref73","article-title":"ENet: A deep neural network architecture for real-time semantic segmentation","author":"paszke","year":"2016","journal-title":"ArXiv 1606 02147"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978392"},{"key":"ref77","article-title":"Very deep convolutional networks for large-scale image recognition","author":"simonyan","year":"2015","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-24947-6_43"},{"key":"ref39","article-title":"On the (statistical) detection of adversarial examples","author":"grosse","year":"2017","journal-title":"arXiv 1702 06280"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00894"},{"key":"ref38","article-title":"Explaining and harnessing adversarial examples","author":"goodfellow","year":"2015","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref78","article-title":"PixelDefend: Leveraging generative models to understand and defend against adversarial examples","author":"song","year":"2018","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.5244\/C.29.106"},{"key":"ref32","first-page":"1625","article-title":"Robust physical-world attacks on machine learning models","author":"evtimov","year":"2018","journal-title":"Proc IEEE Conf Comput Vis Pattern Recognit"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-009-0275-4"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1038\/nature21056"},{"key":"ref37","article-title":"DeepMask: Masking DNN models for robustness against adversarial samples","author":"gao","year":"2017","journal-title":"Proc Workshop Int Conf Learn Represent"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-61750-7_36"},{"key":"ref35","article-title":"Adversarial examples for semantic image segmentation","author":"fischer","year":"2017","journal-title":"Proc Workshop Int Conf Learn Represent"},{"key":"ref34","article-title":"Detecting adversarial samples from artifacts","author":"feinman","year":"2017","journal-title":"arXiv 1703 00410"},{"key":"ref60","article-title":"Standard detectors aren't (currently) fooled by physical adversarial stop signs","author":"lu","year":"2017","journal-title":"arXiv 1710 03337v1"},{"key":"ref62","article-title":"On detecting adversarial perturbations","author":"metzen","year":"2017","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref61","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"2018","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.300"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/1014052.1014066"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.300"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.191"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref29","article-title":"A study of the effect of JPG compression on adversarial images","author":"dziugaite","year":"2016","journal-title":"arXiv 1608 00853"},{"key":"ref67","author":"murphy","year":"2012","journal-title":"Machine Learning A Probabilistic Perspective"},{"key":"ref68","first-page":"1310","article-title":"Simple black-box adversarial perturbations for deep networks","author":"narodytska","year":"2017","journal-title":"Proc IEEE Conf Comp Vis Pattern Recognit"},{"key":"ref69","article-title":"Transferability in machine learning: From phenomena to black-box attacks using adversarial samples","author":"papernot","year":"2016","journal-title":"arXiv 1605 07270"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00099"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46475-6_33"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46478-7_25"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2017.2699184"},{"key":"ref21","article-title":"Semantic image segmentation with deep convolutional nets and fully connected CRFs","author":"chen","year":"2015","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref24","first-page":"854","article-title":"Parseval networks: Improving robustness to adversarial examples","author":"cisse","year":"2017","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref23","first-page":"6977","article-title":"Houdini: Fooling deep structured prediction models","author":"cisse","year":"2017","journal-title":"Proc Int Conf Neural Inf Process"},{"key":"ref26","article-title":"Intriguing properties of adversarial examples","author":"cubuk","year":"2018","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.350"},{"key":"ref50","first-page":"109","article-title":"Efficient inference in fully connected CRFs with Gaussian edge potentials","author":"kr\u00e4henb\u00fchl","year":"2011","journal-title":"Proc Int Conf Neural Inf Process"},{"key":"ref51","first-page":"1097","article-title":"ImageNet classification with deep convolutional neural networks","author":"krizhevsky","year":"2012","journal-title":"Proc Int Conf Neural Inf Process"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.179"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.660"},{"key":"ref59","first-page":"1","article-title":"No need to worry about adversarial examples in object detection in autonomous vehicles","author":"lu","year":"2017","journal-title":"Proc IEEE Conf Comput Vis Pattern Recognit Workshop"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298965"},{"key":"ref57","article-title":"Delving into transferable adversarial examples and black-box attacks","author":"liu","year":"2017","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref56","first-page":"740","article-title":"Microsoft COCO: Common objects in context","author":"lin","year":"2014","journal-title":"Proc Eur Conf Comput Vis"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.348"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref53","article-title":"Adversarial machine learning at scale","author":"kurakin","year":"2017","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref52","article-title":"Adversarial examples in the physical world","author":"kurakin","year":"2017","journal-title":"Proc Workshop Int Conf Learn Represent"},{"key":"ref10","first-page":"387","article-title":"Evasion attacks against machine learning at test time","author":"biggio","year":"2013","journal-title":"Proc Eur Conf Mach Learn Knowl Discovery Databases"},{"key":"ref11","first-page":"1467","article-title":"Poisoning attacks against support vector machines","author":"biggio","year":"2012","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref40","article-title":"Towards deep neural network architectures robust to adversarial examples","author":"gu","year":"2015","journal-title":"Proc Workshop Int Conf Learn Represent"},{"key":"ref12","first-page":"1","article-title":"Adversarial patch","author":"brown","year":"2017","journal-title":"Proc Conf Neural Inf Process Syst"},{"key":"ref13","article-title":"Thermometer encoding: One hot way to resist adversarial examples","author":"buckman","year":"2018","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref14","first-page":"4790","article-title":"Piecewise linear neural network verification: A comparative study","author":"bunel","year":"2018","journal-title":"Proc Conf Neural Inf Process Syst"},{"key":"ref15","first-page":"201","article-title":"Conditional mean field","author":"carbonetto","year":"2007","journal-title":"Proc Int Conf Neural Inf Process"},{"key":"ref82","article-title":"Ensemble adversarial training: Attacks and defenses","author":"tram\u00e8r","year":"2018","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref16","article-title":"Defensive distillation is not robust to adversarial examples","author":"carlini","year":"2016","journal-title":"arXiv 1607 04311"},{"key":"ref81","article-title":"Intriguing properties of neural networks","author":"szegedy","year":"2014","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"ref84","article-title":"Mitigating adversarial effects through randomization","author":"xie","year":"2018","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref83","first-page":"5025","article-title":"Adversarial risk and the dangers of evaluating against weak attacks","author":"uesato","year":"2018","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref19","first-page":"181","article-title":"Visual causal feature learning","author":"chalupka","year":"2015","journal-title":"Proc Conf Uncertainty Artif Intell"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01219-9_25"},{"key":"ref4","article-title":"On the robustness of the CVPR 2018 white-box adversarial example defenses","author":"athalye","year":"2018","journal-title":"arXiv 1804 03286"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2017.2762355"},{"key":"ref6","first-page":"284","article-title":"Synthesizing robust adversarial examples","author":"athalye","year":"2018","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref5","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","author":"athalye","year":"2018","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.153"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1016\/0004-3702(81)90021-7"},{"key":"ref86","first-page":"1","article-title":"Feature squeezing: Detecting adversarial examples in deep neural networks","author":"xu","year":"2017","journal-title":"Proc Conf Neural Inf Process Syst"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2016.2644615"},{"key":"ref49","first-page":"1885","article-title":"Understanding black-box predictions via influence functions","author":"koh","year":"2017","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00520"},{"key":"ref88","article-title":"Multi-scale context aggregation by dilated convolutions","author":"yu","year":"2016","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref9","article-title":"Estimating or propagating gradients through stochastic neurons for conditional computation","author":"bengio","year":"2013","journal-title":"arXiv 1308 3432"},{"key":"ref46","article-title":"Computer vision for autonomous vehicles: Problems, datasets and state-of-the-art","author":"janai","year":"2017"},{"key":"ref45","first-page":"1461","article-title":"Warped convolutions: Efficient invariance to spatial transformations","author":"henriques","year":"2017","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref48","first-page":"5","article-title":"La cryptographie militaire","volume":"9","author":"kerckhoffs","year":"1883","journal-title":"J Sci Militaires"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-63387-9_5"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2011.6126343"},{"key":"ref41","article-title":"Countering adversarial images using input transformations","author":"guo","year":"2018","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref44","first-page":"1","article-title":"Adversarial example defenses: Ensembles of weak defenses are not strong","author":"he","year":"2017","journal-title":"Proc USENIX Workshop Offensive Technol"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/34\/9247540\/08725541.pdf?arnumber=8725541","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,4,27]],"date-time":"2022-04-27T13:59:24Z","timestamp":1651067964000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/8725541\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,12,1]]},"references-count":91,"journal-issue":{"issue":"12"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2019.2919707","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"value":"0162-8828","type":"print"},{"value":"2160-9292","type":"electronic"},{"value":"1939-3539","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,12,1]]}}}