{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,10]],"date-time":"2026-03-10T19:29:22Z","timestamp":1773170962323,"version":"3.50.1"},"reference-count":85,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T00:00:00Z","timestamp":1775001600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"NSFC General Program","award":["62376235"],"award-info":[{"award-number":["62376235"]}]},{"name":"RGC General Research","award":["12200725"],"award-info":[{"award-number":["12200725"]}]},{"name":"RGC Young Collaborative Research","award":["C2005-24Y"],"award-info":[{"award-number":["C2005-24Y"]}]},{"DOI":"10.13039\/501100021171","name":"Basic and Applied Basic Research Foundation of Guangdong Province","doi-asserted-by":"publisher","award":["2024A151501239"],"award-info":[{"award-number":["2024A151501239"]}],"id":[{"id":"10.13039\/501100021171","id-type":"DOI","asserted-by":"publisher"}]},{"name":"HKBU CSD Departmental Incentive Scheme"},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62306178"],"award-info":[{"award-number":["62306178"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000923","name":"Australian Research Council","doi-asserted-by":"publisher","award":["FT220100318"],"award-info":[{"award-number":["FT220100318"]}],"id":[{"id":"10.13039\/501100000923","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000923","name":"Australian Research Council","doi-asserted-by":"publisher","award":["DP220102121"],"award-info":[{"award-number":["DP220102121"]}],"id":[{"id":"10.13039\/501100000923","id-type":"DOI","asserted-by":"publisher"}]},{"name":"RGC","award":["R1015-23"],"award-info":[{"award-number":["R1015-23"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2026,4]]},"DOI":"10.1109\/tpami.2025.3646649","type":"journal-article","created":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T18:41:22Z","timestamp":1766428882000},"page":"4420-4439","source":"Crossref","is-referenced-by-count":0,"title":["Slack Federated Adversarial Training"],"prefix":"10.1109","volume":"48","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3964-3364","authenticated-orcid":false,"given":"Jianing","family":"Zhu","sequence":"first","affiliation":[{"name":"Department of Computer Science, Hong Kong Baptist University, Hong Kong, SAR, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6338-0958","authenticated-orcid":false,"given":"Bo","family":"Han","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Hong Kong Baptist University, Hong Kong, SAR, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6115-5194","authenticated-orcid":false,"given":"Jiangchao","family":"Yao","sequence":"additional","affiliation":[{"name":"Cooperative Medianet Innovation Center, Shanghai Jiao Tong University, Shanghai, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8944-8618","authenticated-orcid":false,"given":"Quanming","family":"Yao","sequence":"additional","affiliation":[{"name":"Department of Electronic Engineering, Tsinghua University, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9640-6472","authenticated-orcid":false,"given":"Tongliang","family":"Liu","sequence":"additional","affiliation":[{"name":"Sydney AI Centre and the School of Computer Science, Faculty of Engineering, The University of Sydney, Camperdown, NSW, Australia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9404-5848","authenticated-orcid":false,"given":"Jianliang","family":"Xu","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Hong Kong Baptist University, Hong Kong, SAR, China"}]}],"member":"263","reference":[{"key":"ref1","first-page":"1273","article-title":"Communication-efficient learning of deep networks from decentralized data","volume-title":"Proc. Artif. Intell. Statist.","author":"McMahan","year":"2017"},{"key":"ref2","first-page":"4427","article-title":"Federated multi-task learning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Smith","year":"2017"},{"key":"ref3","first-page":"429","article-title":"Federated optimization in heterogeneous networks","volume-title":"Proc. Mach. Learn. Syst.","author":"Li","year":"2018"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1561\/2200000083"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2020.2975749"},{"key":"ref6","first-page":"5132","article-title":"SCAFFOLD: Stochastic controlled averaging for federated learning","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Karimireddy","year":"2020"},{"key":"ref7","first-page":"19184","article-title":"Federated hyperparameter tuning: Challenges, baselines, and connections to weight-sharing","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Khodak","year":"2021"},{"key":"ref8","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Goodfellow","year":"2015"},{"key":"ref9","article-title":"Adversarial machine learning at scale","author":"Kurakin","year":"2017"},{"key":"ref10","first-page":"29578","article-title":"Neural architecture dilation for adversarial robustness","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Li","year":"2021"},{"key":"ref11","article-title":"How benign is benign overfitting?","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Sanyal","year":"2021"},{"key":"ref12","article-title":"FAT: Federated adversarial training","volume":"abs\/2012.01791","author":"Zizzo","year":"2020"},{"key":"ref13","article-title":"Adversarial training in communication constrained federated learning","volume":"abs\/2103.01319","author":"Shah","year":"2021","journal-title":"ArXiv"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i7.25955"},{"key":"ref15","article-title":"Towards deep learning models resistant to adversarial attacks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Madry","year":"2018"},{"key":"ref16","article-title":"On the convergence of fedavg on non-IID data","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Li","year":"2019"},{"key":"ref17","article-title":"Combating exacerbated heterogeneity for robust models in federated learning","volume-title":"Proc. 11th Int. Conf. Learn. Representations","author":"Zhu","year":"2023"},{"key":"ref18","first-page":"7611","article-title":"Tackling the objective inconsistency problem in heterogeneous federated optimization","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Wang","year":"2020"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01057"},{"key":"ref20","first-page":"21554","article-title":"Robust federated learning: The case of affine distribution shifts","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Reisizadeh","year":"2020"},{"key":"ref21","first-page":"4615","article-title":"Agnostic federated learning","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Mohri","year":"2019"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2025\/628"},{"key":"ref23","first-page":"38894","article-title":"Improving generalization in federated learning with highly heterogeneous data via momentum-based stochastic controlled weight averaging","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Liu","year":"2025"},{"key":"ref24","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang","year":"2019"},{"key":"ref25","first-page":"16199","article-title":"Robust pre-training by adversarial contrastive learning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Jiang","year":"2020"},{"key":"ref26","article-title":"Geometry-aware instance-reweighted adversarial training","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Zhang","year":"2021"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref28","first-page":"3564","article-title":"Maximum mean discrepancy test is aware of adversarial attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Gao","year":"2021"},{"key":"ref29","article-title":"Improving adversarial robustness requires revisiting misclassified examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wang","year":"2020"},{"key":"ref30","first-page":"11278","article-title":"Attacks which do not kill training make adversarial learning stronger","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang","year":"2020"},{"key":"ref31","first-page":"2958","article-title":"Adversarial weight perturbation helps robust generalization","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Wu","year":"2020"},{"key":"ref32","article-title":"Fast is better than free: Revisiting adversarial training","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wong","year":"2020"},{"key":"ref33","first-page":"16048","article-title":"Understanding and improving fast adversarial training","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Andriushchenko","year":"2020"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52734.2025.01442"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02312"},{"key":"ref36","article-title":"Adversarial robustness may be at odds with simplicity","volume-title":"ArXiv","volume":"abs\/1901.00532","author":"Nakkiran","year":"2019"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.3399\/bjgp18X695213"},{"key":"ref38","article-title":"Fooling a real car with adversarial traffic signs","volume":"abs\/1907.00374","author":"Morgulis","year":"2019","journal-title":"ArXiv"},{"key":"ref39","article-title":"Ensemble federated adversarial training with non-IID data","volume":"abs\/2110.14814","author":"Luo","year":"2021","journal-title":"ArXiv"},{"key":"ref40","article-title":"FADE: Enabling large-scale federated adversarial training on resource-constrained edge devices","volume-title":"ArXiv","volume":"abs\/2209.03839","author":"Tang","year":"2022"},{"key":"ref41","first-page":"19932","article-title":"Federated adversarial learning: A framework with convergence analysis","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Li","year":"2023"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.52202\/068431-0258"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i9.26331"},{"key":"ref44","article-title":"Federated learning with non-IID data","volume":"abs\/1806.00582","author":"Zhao","year":"2018","journal-title":"ArXiv"},{"key":"ref45","article-title":"Categorical reparameterization with gumbel-softmax","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Jang","year":"2017"},{"key":"ref46","article-title":"Certifying some distributional robustness with principled adversarial training","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Sinha","year":"2018"},{"key":"ref47","article-title":"FedBN: Federated learning on non-IID features via local batch normalization","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Li","year":"2021"},{"key":"ref48","first-page":"3750","article-title":"SGD and Hogwild! Convergence without the bounded gradients assumption","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Nguyen","year":"2018"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/3580305.3599829"},{"key":"ref50","first-page":"463","article-title":"Rademacher and Gaussian complexities: Risk bounds and structural results","volume":"3","author":"Bartlett","year":"2002","journal-title":"J. Mach. Learn. Res."},{"key":"ref51","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref52","article-title":"Reading digits in natural images with unsupervised feature learning","volume-title":"Proc. NeurIPS Workshop Deep Learn. Unsupervised Feature Learn.","author":"Netzer","year":"2011"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2014.461"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2008.128"},{"key":"ref55","article-title":"Leaf: A benchmark for federated settings","volume":"abs\/1812.01097","author":"Caldas","year":"2018","journal-title":"ArXiv"},{"key":"ref56","first-page":"8093","article-title":"Overfitting in adversarially robust deep learning","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Rice","year":"2020"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref58","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce","year":"2020"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.52202\/079017-3127"},{"key":"ref60","article-title":"Sigma-zero: Gradient-based optimization of $\\ell_{0}$\u21130-norm adversarial examples","volume-title":"Proc. 13th Int. Conf. Learn. Representations","author":"Cin\u00e0","year":"2025"},{"key":"ref61","article-title":"Network in network","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Lin","year":"2014"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref63","first-page":"11192","article-title":"Unlabeled data improves adversarial robustness","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Carmon","year":"2019"},{"issue":"1","key":"ref64","first-page":"3321","article-title":"Communication-efficient algorithms for statistical optimization","volume":"14","author":"Zhang","year":"2013","journal-title":"J. Mach. Learn. Res."},{"key":"ref65","first-page":"12214","article-title":"Are labels required for improving adversarial robustness?","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Alayrac","year":"2019"},{"key":"ref66","first-page":"7449","article-title":"Once-for-all adversarial training: In-situ tradeoff between robustness and accuracy for free","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Wang","year":"2020"},{"key":"ref67","article-title":"Robust overfitting may be mitigated by properly learned smoothening","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Chen","year":"2021"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00078"},{"key":"ref69","article-title":"MMA training: Direct input space margin maximization through adversarial training","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Ding","year":"2020"},{"key":"ref70","article-title":"Sparsity winning twice: Better robust generaliztion from more efficient training","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Chen","year":"2022"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1561\/0600000071"},{"key":"ref72","first-page":"1196","article-title":"Learning with noisy labels","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Natarajan","year":"2013"},{"key":"ref73","article-title":"A baseline for detecting misclassified and out-of-distribution examples in neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Hendrycks","year":"2017"},{"key":"ref74","article-title":"Spatially transformed adversarial examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Xiao","year":"2018"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA55696.2022.00120"},{"key":"ref76","article-title":"Towards understanding ensemble, knowledge distillation and self-distillation in deep learning","volume-title":"Proc. 11th Int. Conf. Learn. Representations","author":"Allen-Zhu","year":"2023"},{"issue":"2","key":"ref77","volume-title":"Deep Learning","volume":"1","author":"Goodfellow","year":"2016"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2022.3178211"},{"key":"ref79","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Cohen","year":"2019"},{"key":"ref80","article-title":"Certified federated adversarial training","volume":"abs\/2112.10525","author":"Zizzo","year":"2021","journal-title":"ArXiv"},{"key":"ref81","article-title":"Certified robustness in federated learning","volume":"abs\/2206.02535","author":"Alfarra","year":"2022","journal-title":"ArXiv"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5816"},{"key":"ref83","article-title":"Reliable adversarial distillation with unreliable teachers","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Zhu","year":"2022"},{"key":"ref84","article-title":"Test-time robust personalization for federated learning","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Jiang","year":"2023"},{"key":"ref85","article-title":"Turning the curse of heterogeneity in federated learning into a blessing for out-of-distribution detection","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Yu","year":"2023"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/34\/11424231\/11311342.pdf?arnumber=11311342","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,10]],"date-time":"2026-03-10T01:34:35Z","timestamp":1773106475000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11311342\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4]]},"references-count":85,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2025.3646649","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"value":"0162-8828","type":"print"},{"value":"2160-9292","type":"electronic"},{"value":"1939-3539","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,4]]}}}