{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T17:28:43Z","timestamp":1777656523420,"version":"3.51.4"},"reference-count":76,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"6","license":[{"start":{"date-parts":[[2025,6,1]],"date-time":"2025-06-01T00:00:00Z","timestamp":1748736000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,6,1]],"date-time":"2025-06-01T00:00:00Z","timestamp":1748736000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,6,1]],"date-time":"2025-06-01T00:00:00Z","timestamp":1748736000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U22A2096"],"award-info":[{"award-number":["U22A2096"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62036007"],"award-info":[{"award-number":["62036007"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Shaanxi Province Core Technology Research and Development Project","award":["2024QY2-GJHX-11"],"award-info":[{"award-number":["2024QY2-GJHX-11"]}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["QTZX23042"],"award-info":[{"award-number":["QTZX23042"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000923","name":"Australian Research Council","doi-asserted-by":"publisher","award":["FT220100318"],"award-info":[{"award-number":["FT220100318"]}],"id":[{"id":"10.13039\/501100000923","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000923","name":"Australian Research Council","doi-asserted-by":"publisher","award":["DP220102121"],"award-info":[{"award-number":["DP220102121"]}],"id":[{"id":"10.13039\/501100000923","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000923","name":"Australian Research Council","doi-asserted-by":"publisher","award":["LP220100527"],"award-info":[{"award-number":["LP220100527"]}],"id":[{"id":"10.13039\/501100000923","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000923","name":"Australian Research Council","doi-asserted-by":"publisher","award":["LP220200949"],"award-info":[{"award-number":["LP220200949"]}],"id":[{"id":"10.13039\/501100000923","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000923","name":"Australian Research Council","doi-asserted-by":"publisher","award":["IC190100031"],"award-info":[{"award-number":["IC190100031"]}],"id":[{"id":"10.13039\/501100000923","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2025,6]]},"DOI":"10.1109\/tpami.2025.3540200","type":"journal-article","created":{"date-parts":[[2025,2,10]],"date-time":"2025-02-10T18:32:04Z","timestamp":1739212324000},"page":"4330-4342","source":"Crossref","is-referenced-by-count":5,"title":["Improving Adversarial Training From the Perspective of Class-Flipping Distribution"],"prefix":"10.1109","volume":"47","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0694-3603","authenticated-orcid":false,"given":"Dawei","family":"Zhou","sequence":"first","affiliation":[{"name":"State Key Laboratory of Integrated Services Networks, Xidian University, Xi’an, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4695-6134","authenticated-orcid":false,"given":"Nannan","family":"Wang","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Integrated Services Networks, Xidian University, Xi’an, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9640-6472","authenticated-orcid":false,"given":"Tongliang","family":"Liu","sequence":"additional","affiliation":[{"name":"School of Computer Science, Facult of Engineering, The University of Sydney, Camperdown, NSW, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7985-0037","authenticated-orcid":false,"given":"Xinbo","family":"Gao","sequence":"additional","affiliation":[{"name":"Chongqing Key Laboratory of Image Cognition, Chongqing University of Posts and Telecommunications, Chongqing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Goodfellow"},{"key":"ref2","first-page":"1115","article-title":"Adversarial attack on graph structured data","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Dai"},{"key":"ref3","first-page":"284","article-title":"Synthesizing robust adversarial examples","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Athalye"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-36204-1_33"},{"key":"ref5","article-title":"Skip connections matter: On the transferability of adversarial examples generated with resnets","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wu"},{"key":"ref6","first-page":"1633","article-title":"On adaptive attacks to adversarial example defenses","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Tramer"},{"key":"ref7","first-page":"15486","article-title":"Adversarial examples for K-nearest neighbor classifiers based on higher-order Voronoi diagrams","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Sitawarin"},{"key":"ref8","first-page":"19716","article-title":"Isometric 3 D adversarial examples in the physical world","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Dong"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1016\/j.patrec.2023.03.001"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3165024"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00020"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00401"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref14","article-title":"On the sensitivity of adversarial robustness to input data distributions","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Ding"},{"key":"ref15","first-page":"2958","article-title":"Adversarial weight perturbation helps robust generalization","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Wu"},{"key":"ref16","first-page":"25595","article-title":"Understanding robust overfitting of adversarial training and beyond","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Yu"},{"key":"ref17","first-page":"23621","article-title":"Adversarial training with complementary labels: On the benefit of gradually informative attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zhou"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2022\/512"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00792"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00015"},{"key":"ref21","article-title":"Eliminating catastrophic overfitting via abnormal adversarial examples regularization","volume-title":"Proc. 37th Conf. Neural Inf. Process. Syst.","volume":"36","author":"Lin"},{"key":"ref22","first-page":"11492","article-title":"To be robust or to be fair: Towards fairness in adversarial training","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Xu"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i12.26769"},{"key":"ref24","article-title":"DAFA: Distance-aware fair adversarial training","volume-title":"Proc. 12th Int. Conf. Learn. Representations","author":"Lee"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1093\/acprof:oso\/9780198239765.001.0001"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1097\/j.pain.0000000000001367"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1098\/rstb.1980.0090"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1016\/j.jmp.2020.102447"},{"key":"ref29","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Szegedy"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref31","article-title":"Improving black-box adversarial attacks with a transfer-based prior","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Cheng"},{"key":"ref32","first-page":"10377","article-title":"Stronger and faster wasserstein adversarial attacks","volume-title":"Proc. 37th Int. Conf. Mach. Learn.","author":"Wu"},{"key":"ref33","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2021.3126733"},{"key":"ref35","first-page":"20566","article-title":"On the robustness of deep clustering models: Adversarial attacks and defenses","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Chhabra"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2019.2936378"},{"key":"ref37","article-title":"Preprocessors matter! realistic decision-based attacks on machine learning systems","author":"Sitawarin","year":"2022"},{"key":"ref38","first-page":"19319","article-title":"Towards lightweight black-box attack against deep neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Sun"},{"key":"ref39","first-page":"7144","article-title":"Fast and reliable evaluation of adversarial robustness with minimum-margin attack","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Gao"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2022.3216981"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3169802"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3176760"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/TSUSC.2023.3263510"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00396"},{"key":"ref45","first-page":"38428","article-title":"Probabilistic categorical adversarial attack and adversarial training","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Xu"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00196"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00445"},{"key":"ref49","first-page":"2196","article-title":"Minimally distorted adversarial examples with a fast adaptive boundary attack","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2019.8683044"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref52","first-page":"12062","article-title":"Adversarial purification with score-based generative models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Yoon"},{"key":"ref53","first-page":"12835","article-title":"Towards defending against adversarial examples via attack-invariant features","volume-title":"Proc. 38th Int. Conf. Mach. Learn.","author":"Zhou"},{"key":"ref54","article-title":"Enhanced countering adversarial attacks via input denoising and feature restoring","author":"Li","year":"2021"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00778"},{"key":"ref56","article-title":"DensePure: Understanding diffusion models towards adversarial robustness","author":"Xiao","year":"2022"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2939352"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00034"},{"key":"ref59","article-title":"Online adversarial purification based on self-supervised learning","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Shi"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"ref61","article-title":"Countering adversarial images using input transformations","volume-title":"Proc. 6th Int. Conf. Learn. Representations","author":"Guo"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/3219819.3219910"},{"key":"ref63","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang"},{"key":"ref64","article-title":"Improving adversarial robustness requires revisiting misclassified examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wang"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i12.26749"},{"key":"ref66","article-title":"Averaging weights leads to wider optima and better generalization","author":"Izmailov","year":"2018"},{"key":"ref67","article-title":"Self-ensemble adversarial training for improved robustness","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wang"},{"key":"ref68","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref69","first-page":"3637","article-title":"Matching networks for one shot learning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Vinyals"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46493-0_38"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.5244\/C.30.87"},{"key":"ref72","article-title":"Torchattacks: A PyTorch repository for adversarial attacks","author":"Kim","year":"2020"},{"key":"ref73","article-title":"Advertorch v0. 1: An adversarial robustness toolbox based on PyTorch","author":"Ding","year":"2019"},{"key":"ref74","first-page":"11278","article-title":"Attacks which do not kill training make adversarial learning stronger","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang"},{"key":"ref75","first-page":"8093","article-title":"Overfitting in adversarially robust deep learning","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Rice"},{"key":"ref76","article-title":"Bag of tricks for adversarial training","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Pang"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/34\/10990047\/10878818.pdf?arnumber=10878818","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,5,8]],"date-time":"2025-05-08T04:25:34Z","timestamp":1746678334000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10878818\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6]]},"references-count":76,"journal-issue":{"issue":"6"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2025.3540200","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"value":"0162-8828","type":"print"},{"value":"2160-9292","type":"electronic"},{"value":"1939-3539","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,6]]}}}