{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,30]],"date-time":"2025-10-30T22:32:19Z","timestamp":1761863539366,"version":"build-2065373602"},"reference-count":60,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"8","license":[{"start":{"date-parts":[[2025,8,1]],"date-time":"2025-08-01T00:00:00Z","timestamp":1754006400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"},{"start":{"date-parts":[[2025,8,1]],"date-time":"2025-08-01T00:00:00Z","timestamp":1754006400000},"content-version":"am","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"NSFC General Program","award":["62376235"],"award-info":[{"award-number":["62376235"]}]},{"name":"RGC Young Collaborative Research","award":["C2005-24Y"],"award-info":[{"award-number":["C2005-24Y"]}]},{"DOI":"10.13039\/501100021171","name":"Basic and Applied Basic Research Foundation of Guangdong Province","doi-asserted-by":"publisher","award":["2022A1515011652","2024A1515012399"],"award-info":[{"award-number":["2022A1515011652","2024A1515012399"]}],"id":[{"id":"10.13039\/501100021171","id-type":"DOI","asserted-by":"publisher"}]},{"name":"HKBU Faculty Niche Research Areas","award":["RC-FNRA-IG\/22-23\/SCI\/04"],"award-info":[{"award-number":["RC-FNRA-IG\/22-23\/SCI\/04"]}]},{"name":"HKBU CSD Departmental Incentive Scheme"},{"DOI":"10.13039\/501100000923","name":"Australian Research Council","doi-asserted-by":"publisher","award":["DE240101089","LP240100101","DP230101540"],"award-info":[{"award-number":["DE240101089","LP240100101","DP230101540"]}],"id":[{"id":"10.13039\/501100000923","id-type":"DOI","asserted-by":"publisher"}]},{"name":"NSF&CSIRO Responsible AI program","award":["2303037"],"award-info":[{"award-number":["2303037"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U22A2096"],"award-info":[{"award-number":["U22A2096"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62376282"],"award-info":[{"award-number":["62376282"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"NSFC\/RGC Joint Research Scheme","award":["N_HKBU214\/21"],"award-info":[{"award-number":["N_HKBU214\/21"]}]},{"name":"RGC Senior Research Fellow Scheme","award":["SRFS2324-2S02"],"award-info":[{"award-number":["SRFS2324-2S02"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2025,8]]},"DOI":"10.1109\/tpami.2025.3558267","type":"journal-article","created":{"date-parts":[[2025,4,4]],"date-time":"2025-04-04T19:41:43Z","timestamp":1743795703000},"page":"6382-6395","source":"Crossref","is-referenced-by-count":0,"title":["Unknown-Aware Bilateral Dependency Optimization for Defending Against Model Inversion Attacks"],"prefix":"10.1109","volume":"47","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9267-3944","authenticated-orcid":false,"given":"Xiong","family":"Peng","sequence":"first","affiliation":[{"name":"Department of Computer Science, Hong Kong Baptist University, Hong Kong"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5005-9129","authenticated-orcid":false,"given":"Feng","family":"Liu","sequence":"additional","affiliation":[{"name":"School of Computing and Information Systems, University of Melbourne, Parkville, VIC, Australia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4695-6134","authenticated-orcid":false,"given":"Nannan","family":"Wang","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Integrated Services Networks, School of Telecommunications Engineering, Xidian University, Xi’an, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4238-8985","authenticated-orcid":false,"given":"Long","family":"Lan","sequence":"additional","affiliation":[{"name":"State Key Laboratory of High Performance Computing, School of Computer, National University of Defense Technology, Changsha, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9640-6472","authenticated-orcid":false,"given":"Tongliang","family":"Liu","sequence":"additional","affiliation":[{"name":"Sydney AI Centre, School of Computer Science, Faculty of Engineering, The University of Sydney, Camperdown, NSW, Australia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7629-4648","authenticated-orcid":false,"given":"Yiu-Ming","family":"Cheung","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Hong Kong Baptist University, Hong Kong"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6338-0958","authenticated-orcid":false,"given":"Bo","family":"Han","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Hong Kong Baptist University, Hong Kong"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298682"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2014.220"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1038\/s41587-020-0546-8"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3326467.3326468"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i13.17387"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3624010"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3229593"},{"article-title":"A baseline for detecting misclassified and out-of-distribution examples in neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Hendrycks","key":"ref8"},{"key":"ref9","first-page":"17","article-title":"Privacy in pharmacogenetics: An end-to-end case study of personalized warfarin dosing","volume-title":"Proc. USENIX Secur. Symp.","author":"Fredrikson"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00033"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01587"},{"key":"ref12","first-page":"9706","article-title":"Variational model inversion attacks","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Wang"},{"key":"ref13","first-page":"20522","article-title":"Plug & play attacks: Towards robust and flexible model inversion attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Struppek"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2019.00201"},{"article-title":"Deep anomaly detection with outlier exposure","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Hendrycks","key":"ref15"},{"issue":"12","key":"ref16","first-page":"2075","article-title":"Kernel methods for measuring independence","volume":"6","author":"Gretton","year":"2005","journal-title":"J. Mach. Learn. Res."},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/11564089_7"},{"key":"ref18","first-page":"21464","article-title":"Energy-based out-of-distribution detection","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Liu"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3534678.3539376"},{"key":"ref20","first-page":"1964","article-title":"Label-only membership inference attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Choquette-Choo"},{"article-title":"Thieves on sesame street! model extraction of BERT-based apis","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Krishna","key":"ref21"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01572"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813677"},{"article-title":"Unsupervised representation learning with deep convolutional generative adversarial networks","year":"2015","author":"Radford","key":"ref24"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i3.25442"},{"key":"ref26","doi-asserted-by":"crossref","DOI":"10.14722\/ndss.2022.24335","article-title":"Mirror: Model inversion for deep learning network with high fidelity","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp.","author":"An"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01964"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01462"},{"key":"ref29","first-page":"68895","article-title":"Label-only model inversion attacks via knowledge transfer","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Nguyen"},{"article-title":"Be careful what you smooth for: Label smoothing can be a privacy shield but also a catalyst for model inversion attacks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Struppek","key":"ref30"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.01158"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CSR51186.2021.9527945"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i9.26289"},{"article-title":"Enhancing the reliability of out-of-distribution image detection in neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Liang","key":"ref34"},{"key":"ref35","first-page":"7167","article-title":"A simple unified framework for detecting out-of-distribution samples and adversarial attacks","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Lee"},{"key":"ref36","first-page":"23631","article-title":"Mitigating neural network overconfidence with logit normalization","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Wei"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20053-3_40"},{"article-title":"Training confidence-calibrated classifiers for detecting out-of-distribution samples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Lee","key":"ref38"},{"article-title":"VOS: Learning what you don\u2019t know by virtual outlier synthesis","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Du","key":"ref39"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-86523-8_26"},{"key":"ref41","first-page":"15650","article-title":"Poem: Out-of-distribution detection with posterior sampling","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Ming"},{"key":"ref42","first-page":"723","article-title":"A kernel two-sample test","volume":"13","author":"Gretton","year":"2012","journal-title":"J. Mach. Learn. Res."},{"key":"ref43","first-page":"6316","article-title":"Learning deep kernels for non-parametric two-sample tests","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Liu"},{"key":"ref44","first-page":"3564","article-title":"Maximum mean discrepancy test is aware of adversarial attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Gao"},{"key":"ref45","first-page":"5848","article-title":"Meta two-sample testing: Learning kernels for testing with limited data","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Liu"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2023.3328883"},{"key":"ref47","first-page":"73274","article-title":"Learning to augment distributions for out-of-distribution detection","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Wang"},{"key":"ref48","first-page":"15067","article-title":"Detecting out-of-distribution data through in-distribution class prior","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Jiang"},{"article-title":"Adam: A method for stochastic optimization","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Kingma","key":"ref49"},{"article-title":"Mibench: A comprehensive benchmark for model inversion attack and defense","year":"2024","author":"Qiu","key":"ref50"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.425"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00453"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP.2014.7025068"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2017.7966217"},{"article-title":"Very deep convolutional networks for large-scale image recognition","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Simonyan","key":"ref56"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.243"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW.2017.227"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/1143844.1143874"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"https:\/\/ieeexplore.ieee.org\/ielam\/34\/11068886\/10949821-aam.pdf","content-type":"application\/pdf","content-version":"am","intended-application":"syndication"},{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/34\/11068886\/10949821.pdf?arnumber=10949821","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,8]],"date-time":"2025-07-08T17:38:30Z","timestamp":1751996310000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10949821\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,8]]},"references-count":60,"journal-issue":{"issue":"8"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2025.3558267","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"type":"print","value":"0162-8828"},{"type":"electronic","value":"2160-9292"},{"type":"electronic","value":"1939-3539"}],"subject":[],"published":{"date-parts":[[2025,8]]}}}