{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T14:56:01Z","timestamp":1784300161693,"version":"3.55.0"},"reference-count":97,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"10","license":[{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62306065"],"award-info":[{"award-number":["62306065"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62220106008"],"award-info":[{"award-number":["62220106008"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62222203"],"award-info":[{"award-number":["62222203"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62476201"],"award-info":[{"award-number":["62476201"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2025,10]]},"DOI":"10.1109\/tpami.2025.3582518","type":"journal-article","created":{"date-parts":[[2025,6,23]],"date-time":"2025-06-23T13:27:19Z","timestamp":1750685239000},"page":"8923-8937","source":"Crossref","is-referenced-by-count":28,"title":["Evidence-Based Multi-Feature Fusion for Adversarial Robustness"],"prefix":"10.1109","volume":"47","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9318-0084","authenticated-orcid":false,"given":"Zheng","family":"Wang","sequence":"first","affiliation":[{"name":"Tongji University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5685-3123","authenticated-orcid":false,"given":"Xing","family":"Xu","sequence":"additional","affiliation":[{"name":"Tongji University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2993-7142","authenticated-orcid":false,"given":"Lei","family":"Zhu","sequence":"additional","affiliation":[{"name":"Tongji University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9714-8738","authenticated-orcid":false,"given":"Yi","family":"Bin","sequence":"additional","affiliation":[{"name":"Tongji University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3938-5994","authenticated-orcid":false,"given":"Guoqing","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5070-4511","authenticated-orcid":false,"given":"Yang","family":"Yang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2999-2088","authenticated-orcid":false,"given":"Heng Tao","family":"Shen","sequence":"additional","affiliation":[{"name":"Tongji University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3193611"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2023.3275156"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2024.3381347"},{"key":"ref4","first-page":"10347","article-title":"Training data-efficient image transformers & distillation through attention","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Touvron"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02301"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/ICME57554.2024.10687833"},{"key":"ref8","first-page":"1","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Ian J"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2023.3331087"},{"key":"ref10","first-page":"1","article-title":"Delving into transferable adversarial examples and black-box attacks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Liu"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00777"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00059"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00624"},{"key":"ref16","first-page":"501","article-title":"Adversarial training for free!","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Shafahi"},{"key":"ref17","first-page":"51","article-title":"Attacks which do not kill training make adversarial learning stronger","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00772"},{"key":"ref19","first-page":"23433","article-title":"Removing batch normalization boosts adversarial training","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Wang"},{"key":"ref20","first-page":"125","article-title":"Adversarial examples are not bugs, they are features","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Ilyas"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00791"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref23","first-page":"1","article-title":"Improving adversarial robustness via channel-wise activation suppressing","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Bai"},{"key":"ref24","first-page":"11693","article-title":"CIFS: Improving adversarial robustness of CNNs via channel-wise importance-based feature selection","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Yan"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00406"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1088\/1742-5468\/ac9830"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01805"},{"key":"ref28","first-page":"7047","article-title":"Predictive uncertainty estimation via prior networks","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Malinin"},{"key":"ref29","first-page":"3183","article-title":"Evidential deep learning to quantify classification uncertainty","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Sensoy"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1515\/9780691214696"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3359820"},{"key":"ref32","first-page":"1","article-title":"Adversarial examples in the physical world","volume-title":"Proc. Int. Conf. Learn. Representations Workshop","author":"Alexey"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref34","first-page":"1","article-title":"Nesterov accelerated gradient and scale invariance for adversarial attacks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Lin"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3169802"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3226572"},{"key":"ref37","first-page":"23","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2024.3367773"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/LCOMM.2023.3269768"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-45857-6_13"},{"key":"ref44","first-page":"1","article-title":"Nesterov accelerated gradient and scale invariance for adversarial attacks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Lin"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00196"},{"key":"ref46","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang"},{"key":"ref47","first-page":"1","article-title":"Improving adversarial robustness requires revisiting misclassified examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wang"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01578"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01304"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01484"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00435"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01305"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3207917"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2023.3341639"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02336"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02340"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02318"},{"key":"ref58","first-page":"12","article-title":"Stochastic activation pruning for robust adversarial defense","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Dhillon"},{"key":"ref59","first-page":"6575","article-title":"Adversarial neural pruning with latent vulnerability suppression","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Madaan"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00348"},{"key":"ref61","article-title":"Interpreting adversarial examples by activation promotion and suppression","author":"Xu","year":"2019"},{"key":"ref62","first-page":"1","article-title":"Enhancing adversarial defense by k-winners-take-all","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Xiao"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/FOCS52979.2021.00098"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3174724"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3306933"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3189638"},{"key":"ref67","first-page":"1321","article-title":"On calibration of modern neural networks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Guo"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-44792-4_1"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-42337-1"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01310"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.02201"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.01630"},{"key":"ref73","first-page":"14927","article-title":"Deep evidential regression","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Amini"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00684"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00299"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2023.3308571"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.5244\/C.30.87"},{"key":"ref78","article-title":"Introduction to the dirichlet distribution and related processes","author":"Frigyik","year":"2010"},{"key":"ref79","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.2118\/18761-MS"},{"key":"ref81","first-page":"81","article-title":"ImageNette","author":"Howard","year":"2021"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01543"},{"key":"ref83","first-page":"18599","article-title":"When adversarial training meets vision transformers: Recipes from training to architecture","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Mo"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00088"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.106"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2024.3387282"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2024.3417329"},{"key":"ref88","first-page":"4907","article-title":"Bayesian uncertainty estimation for batch normalized deep networks","volume-title":"Proc. 35th Int. Conf. Mach. Learn.","author":"Teye"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00415"},{"key":"ref90","first-page":"2958","article-title":"Adversarial weight perturbation helps robust generalization","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Wu"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2024.3416308"},{"key":"ref92","first-page":"6405","article-title":"Simple and scalable predictive uncertainty estimation using deep ensembles","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Lakshminarayanan"},{"key":"ref93","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Cohen"},{"key":"ref94","first-page":"11289","article-title":"Provably robust deep learning via adversarially trained smoothed classifiers","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Salman"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00095"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00894"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2024.3411035"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/34\/11163533\/11048677.pdf?arnumber=11048677","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,16]],"date-time":"2025-09-16T13:11:37Z","timestamp":1758028297000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11048677\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10]]},"references-count":97,"journal-issue":{"issue":"10"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2025.3582518","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"value":"0162-8828","type":"print"},{"value":"2160-9292","type":"electronic"},{"value":"1939-3539","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,10]]}}}