{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T20:00:59Z","timestamp":1781035259193,"version":"3.54.1"},"reference-count":74,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"7","license":[{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100004826","name":"Beijing Natural Science Foundation","doi-asserted-by":"publisher","award":["L252032"],"award-info":[{"award-number":["L252032"]}],"id":[{"id":"10.13039\/501100004826","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62476199"],"award-info":[{"award-number":["62476199"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62376196"],"award-info":[{"award-number":["62376196"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U23A20387"],"award-info":[{"award-number":["U23A20387"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100006606","name":"Natural Science Foundation of Tianjin Municipality","doi-asserted-by":"publisher","award":["24JCJQJC00190"],"award-info":[{"award-number":["24JCJQJC00190"]}],"id":[{"id":"10.13039\/501100006606","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2026,7]]},"DOI":"10.1109\/tpami.2026.3669252","type":"journal-article","created":{"date-parts":[[2026,3,2]],"date-time":"2026-03-02T20:55:14Z","timestamp":1772484914000},"page":"8185-8198","source":"Crossref","is-referenced-by-count":0,"title":["Complementary Text-Guided Attention for Zero-Shot Adversarial Robustness"],"prefix":"10.1109","volume":"48","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0578-6869","authenticated-orcid":false,"given":"Lu","family":"Yu","sequence":"first","affiliation":[{"name":"School of Computer Science and Engineering, Tianjin University of Technology, Tianjin, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-5717-7004","authenticated-orcid":false,"given":"Haiyang","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Tianjin University of Technology, Tianjin, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8343-9665","authenticated-orcid":false,"given":"Changsheng","family":"Xu","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Multimodal Artificial Intelligence Systems, Institute of Automation, Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","first-page":"8748","article-title":"Learning transferable visual models from natural language supervision","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Radford"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1810.04805"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.findings-emnlp.58"},{"key":"ref4","article-title":"RoBERTa: A robustly optimized bert pretraining approach","author":"Liu","year":"2019"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-023-01891-x"},{"key":"ref6","article-title":"Exploiting the semantic knowledge of pre-trained text-encoders for continual learning","author":"Yu","year":"2024"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2024.3424302"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01755"},{"key":"ref9","article-title":"ClipCap: CLIP prefix for image captioning","author":"Mokady","year":"2021"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW59228.2023.00593"},{"key":"ref11","first-page":"7058","article-title":"Understanding zero-shot adversarial robustness for large-scale models","volume-title":"Proc. 11th Int. Conf. Learn. Representations","author":"Mao"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02313"},{"key":"ref13","article-title":"BEV-CLIP: Multi-modal BEV retrieval methodology for complex scene in autonomous driving","author":"Wei","year":"2024"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.01934"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/TSMC.2024.3451718"},{"key":"ref16","first-page":"3358","article-title":"Adversarial training for free","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Shafahi"},{"key":"ref17","first-page":"2958","article-title":"Adversarial weight perturbation helps robust generalization","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Wu"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.485"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.52202\/079017-3056"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02331"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52734.2025.01413"},{"key":"ref22","first-page":"611","article-title":"An image is worth 16 \u00d7 16 words: Transformers for image recognition at scale","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Dosovitskiy"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00986"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref26","first-page":"1877","article-title":"Language models are few-shot learners","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Brown"},{"key":"ref27","first-page":"4904","article-title":"Scaling up visual and vision-language representation learning with noisy text supervision","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Jia"},{"key":"ref28","first-page":"9613","article-title":"FILIP: Fine-grained interactive language-image pre-training","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Yao","year":"2022"},{"key":"ref29","first-page":"12888","article-title":"BLIP: Bootstrapping language-image pre-training for unified vision-language understanding and generation","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Li"},{"key":"ref30","article-title":"ImageBERT: Cross-modal pre-training with large-scale weak-supervised image-text data","author":"Qi","year":"2020"},{"key":"ref31","first-page":"9694","article-title":"Align before fuse: Vision and language representation learning with momentum distillation","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Li"},{"key":"ref32","first-page":"1","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Szegedy"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-acl.212"},{"key":"ref36","first-page":"23591","article-title":"Data augmentation alone can improve adversarial training","volume-title":"Proc. 11th Int. Conf. Learn. Representations","author":"Li","year":"2023"},{"key":"ref37","first-page":"237","article-title":"AugMax: Adversarial composition of random augmentations for robust training","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Wang"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-024-02206-4"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2023\/697"},{"key":"ref40","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01594"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00397"},{"key":"ref43","first-page":"37657","article-title":"Adversarial robustness through random weight sampling","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Ma"},{"key":"ref44","first-page":"16805","article-title":"Diffusion models for adversarial purification","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Nie"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00019"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i15.29574"},{"key":"ref47","first-page":"37427","article-title":"ADBM: Adversarial diffusion bridge model for reliable adversarial purification","volume-title":"Proc. 13th Int. Conf. Learn. Representations","author":"Li"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2025.3542964"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2023.3237935"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i1.25152"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00653"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52734.2025.01395"},{"key":"ref53","first-page":"43685","article-title":"Robust CLIP: Unsupervised adversarial fine-tuning of vision embeddings for robust large vision-language models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Schlarmann"},{"key":"ref54","article-title":"Rethinking natural adversarial examples for classification models","author":"Li","year":"2021"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00372"},{"key":"ref56","article-title":"Exploring visual interpretability for contrastive language-image pre-training","author":"Li","year":"2022"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref58","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref59","first-page":"215","article-title":"An analysis of single-layer networks in unsupervised feature learning","volume-title":"Proc. 14th Int. Conf. Artif. Intell. Statist.","author":"Coates"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2004.383"},{"key":"ref61","article-title":"Caltech-256 object category dataset","author":"Griffin","year":"2007"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW.2013.77"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/ICVGIP.2008.47"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10599-4_29"},{"key":"ref65","article-title":"Fine-grained visual classification of aircraft","author":"Maji","year":"2013"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2012.6248092"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2010.5539970"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00934-2_24"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/JSTARS.2019.2918242"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2014.461"},{"key":"ref71","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref73","first-page":"1633","article-title":"On adaptive attacks to adversarial example defenses","volume-title":"Proc. 34th Int. Conf. Neural Inf. Process. Syst.","author":"Tram\u00e8r"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.74"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/34\/11552636\/11417939.pdf?arnumber=11417939","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T19:52:17Z","timestamp":1781034737000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11417939\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7]]},"references-count":74,"journal-issue":{"issue":"7"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2026.3669252","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"value":"0162-8828","type":"print"},{"value":"2160-9292","type":"electronic"},{"value":"1939-3539","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7]]}}}