{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,12]],"date-time":"2026-09-12T17:37:33Z","timestamp":1789234653714,"version":"build-2803163510"},"reference-count":90,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"7","license":[{"start":{"date-parts":[[2023,7,1]],"date-time":"2023-07-01T00:00:00Z","timestamp":1688169600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,7,1]],"date-time":"2023-07-01T00:00:00Z","timestamp":1688169600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,7,1]],"date-time":"2023-07-01T00:00:00Z","timestamp":1688169600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U19B2034"],"award-info":[{"award-number":["U19B2034"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62061136001"],"award-info":[{"award-number":["62061136001"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61836014"],"award-info":[{"award-number":["61836014"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Tsinghua-Toyota Joint Research Fund"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2023,7,1]]},"DOI":"10.1109\/tpami.2023.3237935","type":"journal-article","created":{"date-parts":[[2023,1,18]],"date-time":"2023-01-18T18:48:15Z","timestamp":1674067695000},"page":"8861-8873","source":"Crossref","is-referenced-by-count":32,"title":["Recognizing Object by Components With Human Prior Knowledge Enhances Adversarial Robustness of Deep Neural Networks"],"prefix":"10.1109","volume":"45","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8992-4944","authenticated-orcid":false,"given":"Xiao","family":"Li","sequence":"first","affiliation":[{"name":"Department of Computer Science and Technology, Institute for Artificial Intelligence, State Key Laboratory of Intelligent Technology and Systems, BNRist, Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7772-0338","authenticated-orcid":false,"given":"Ziqi","family":"Wang","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Illinois Urbana-Champaign, Champaign, IL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bo","family":"Zhang","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Technology, Institute for Artificial Intelligence, State Key Laboratory of Intelligent Technology and Systems, BNRist, Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3546-6305","authenticated-orcid":false,"given":"Fuchun","family":"Sun","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Technology, Institute for Artificial Intelligence, State Key Laboratory of Intelligent Technology and Systems, BNRist, Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4907-7354","authenticated-orcid":false,"given":"Xiaolin","family":"Hu","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Technology, Institute for Artificial Intelligence, State Key Laboratory of Intelligent Technology and Systems, BNRist, Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref13","first-page":"1633","article-title":"On adaptive attacks to adversarial example defenses","author":"tram\u00e8r","year":"2020","journal-title":"Proc Int Conf Neural Inf Process"},{"key":"ref57","first-page":"1295","article-title":"Capsule networks - A survey","volume":"34","author":"mensah","year":"2022","journal-title":"J King Saud Univ Comput Inf Sci"},{"key":"ref12","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","author":"athalye","year":"2018","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00100"},{"key":"ref15","first-page":"4218","article-title":"Improving robustness using generated data","author":"gowal","year":"2021","journal-title":"Proc Int Conf Neural Inf Process"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1007\/s11432-020-3181-9"},{"key":"ref14","first-page":"8270","article-title":"Adversarial distributional training for robust deep learning","author":"dong","year":"2020","journal-title":"Proc Int Conf Neural Inf Process"},{"key":"ref58","first-page":"3688","article-title":"Part-object relational visual saliency","volume":"44","author":"liu","year":"2022","journal-title":"IEEE Trans Pattern Anal Mach Intell"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58598-3_24"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00559"},{"key":"ref11","first-page":"11 953","article-title":"Improving gradient regularization using complex-valued neural networks","author":"yeats","year":"2021","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref55","article-title":"CGPart: A part segmentation dataset based on 3D computer graphics models","author":"liu","year":"2022","journal-title":"Proc Conf Comput Vis Pattern Recognit"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.11504"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00927"},{"key":"ref17","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","author":"zhang","year":"2019","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref16","first-page":"7779","article-title":"Boosting adversarial training with hypersphere embedding","author":"pang","year":"2020","journal-title":"Proc Int Conf Neural Inf Process"},{"key":"ref19","article-title":"The limitations of adversarial training and the blind-spot attack","author":"zhang","year":"2019","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref18","first-page":"2958","article-title":"Adversarial weight perturbation helps robust generalization","author":"wu","year":"2020","journal-title":"Proc Int Conf Neural Inf Process"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.715"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2020.3046647"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-88361-4_21"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.1998.710772"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01249-6_14"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.167"},{"key":"ref48","article-title":"Compas: Representation learning with compositional part sharing for few-shot classification","author":"he","year":"2021"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.1999.790410"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.153"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00129"},{"key":"ref41","first-page":"2142","article-title":"Black-box adversarial attacks with limited queries and information","author":"ilyas","year":"2018","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00825"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00099"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00743"},{"key":"ref43","article-title":"Adversarial examples for semantic image segmentation","author":"fischer","year":"2017","journal-title":"Proc Int Conf Learn Representations Workshop"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01760"},{"key":"ref49","article-title":"Attentional constellation nets for few-shot learning","author":"xu","year":"2020","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref8","first-page":"4013","article-title":"Max-mahalanobis linear discriminant analysis networks","author":"pang","year":"2018","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref7","first-page":"12 835","article-title":"Towards defending against adversarial examples via attack-invariant features","volume":"139","author":"zhou","year":"2021","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref9","article-title":"Rethinking softmax cross-entropy loss for adversarial robustness","author":"pang","year":"2020","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref3","article-title":"Intriguing properties of neural networks","author":"szegedy","year":"2013"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i4.16477"},{"key":"ref82","article-title":"An image is worth 16x16 words: Transformers for image recognition at scale","author":"dosovitskiy","year":"2021","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref81","article-title":"Benchmarking neural network robustness to common corruptions and perturbations","author":"hendrycks","year":"2019","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref40","first-page":"5032","article-title":"Adversarial risk and the dangers of evaluating against weak attacks","author":"uesato","year":"2018","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00096"},{"key":"ref83","first-page":"10 347","article-title":"Training data-efficient image transformers & distillation through attention","author":"touvron","year":"2021","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref80","first-page":"29 935","article-title":"Data augmentation can improve robustness","author":"rebuffi","year":"2021","journal-title":"Proc Int Conf Neural Inf Process"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1145\/3394486.3403225"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00040"},{"key":"ref36","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"2017"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2009.167"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00059"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2005.329"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2018.2858826"},{"key":"ref33","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"2018","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref77","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","author":"croce","year":"2020","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2003.1211479"},{"key":"ref76","article-title":"Transferability in machine learning: From phenomena to black-box attacks using adversarial samples","author":"papernot","year":"2016"},{"key":"ref2","article-title":"Explaining and harnessing adversarial examples","author":"goodfellow","year":"2015","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref1","article-title":"On evaluating adversarial robustness","author":"carlini","year":"2019"},{"key":"ref39","article-title":"Mitigating adversarial effects through randomization","author":"xie","year":"2018","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref38","article-title":"Countering adversarial images using input transformations","author":"guo","year":"2018","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.634"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2017.2699184"},{"key":"ref72","article-title":"Mobilenets: Efficient convolutional neural networks for mobile vision applications","author":"howard","year":"2017"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1016\/0010-0285(75)90024-9"},{"key":"ref68","article-title":"Partimagenet: A large, high-quality dataset of parts","author":"he","year":"2021"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.3758\/BF03206794"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2014.254"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1016\/S0022-0965(03)00108-5"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1037\/0096-3445.113.2.169"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-009-0275-4"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1038\/s41467-019-08931-6"},{"key":"ref64","first-page":"614","article-title":"Informed machine learning-a taxonomy and survey of integrating prior knowledge into learning systems","volume":"35","author":"von rueden","year":"2023","journal-title":"IEEE Trans Knowl Data Eng"},{"key":"ref63","first-page":"1039","article-title":"Neural-symbolic VQA: Disentangling reasoning from vision and language understanding","author":"yi","year":"2018","journal-title":"Proc Int Conf Neural Inf Process"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1037\/0033-295X.94.2.115"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298965"},{"key":"ref21","article-title":"Rethinking natural adversarial examples for classification models","author":"li","year":"2021"},{"key":"ref65","first-page":"3976","article-title":"Knowledge enhanced machine learning pipeline against diverse adversarial attacks","author":"g\u00fcrel","year":"2021","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref28","article-title":"ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness","author":"geirhos","year":"2019","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref27","first-page":"125","article-title":"Adversarial examples are not bugs, they are features","author":"ilyas","year":"2019","journal-title":"Proc Int Conf Neural Inf Process"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1007\/BFb0054769"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"ref62","article-title":"On the vulnerability of capsule networks to adversarial attacks","author":"michels","year":"2019"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01408"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/34\/10144448\/10019576.pdf?arnumber=10019576","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,8]],"date-time":"2024-07-08T17:31:10Z","timestamp":1720459870000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10019576\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,7,1]]},"references-count":90,"journal-issue":{"issue":"7"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2023.3237935","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"value":"0162-8828","type":"print"},{"value":"2160-9292","type":"electronic"},{"value":"1939-3539","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,7,1]]}}}