{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,21]],"date-time":"2026-01-21T10:33:42Z","timestamp":1768991622252,"version":"3.49.0"},"reference-count":47,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"CityU MF_EXT","award":["9678180"],"award-info":[{"award-number":["9678180"]}]},{"DOI":"10.13039\/501100010410","name":"Education University of Hong Kong","doi-asserted-by":"publisher","award":["RG110\/2024-2025R"],"award-info":[{"award-number":["RG110\/2024-2025R"]}],"id":[{"id":"10.13039\/501100010410","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Rel."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/tr.2025.3642046","type":"journal-article","created":{"date-parts":[[2026,1,12]],"date-time":"2026-01-12T22:00:08Z","timestamp":1768255208000},"page":"679-693","source":"Crossref","is-referenced-by-count":0,"title":["HiCert: Toward Patch Robustness Certification and Detection for Deep Learning Systems Beyond Consistent Samples"],"prefix":"10.1109","volume":"75","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2289-9849","authenticated-orcid":false,"given":"Qilin","family":"Zhou","sequence":"first","affiliation":[{"name":"City University of Hong Kong, HKSAR, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5966-1338","authenticated-orcid":false,"given":"Zhengyuan","family":"Wei","sequence":"additional","affiliation":[{"name":"The Education University of Hong Kong, HKSAR, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7410-393X","authenticated-orcid":false,"given":"Haipeng","family":"Wang","sequence":"additional","affiliation":[{"name":"City University of Hong Kong, HKSAR, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-5735-2401","authenticated-orcid":false,"given":"Zhuo","family":"Wang","sequence":"additional","affiliation":[{"name":"City University of Hong Kong, HKSAR, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7726-6235","authenticated-orcid":false,"given":"Wing-Kwong","family":"Chan","sequence":"additional","affiliation":[{"name":"City University of Hong Kong, HKSAR, China"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2024.3458805"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2022.3171420"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2023.3298685"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2024.3394894"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2023.3303923"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2022.3161138"},{"key":"ref7","article-title":"Adversarial patch","author":"Brown","year":"2017"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58601-0_24"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3176760"},{"key":"ref11","first-page":"697","article-title":"Hard-label black-box universal adversarial patch attack","volume-title":"Proc. USENIX Secur.","author":"Tao","year":"2023"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3231886"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/543"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3579856.3582816"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/WACV.2019.00143"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2018.00210"},{"key":"ref18","article-title":"Certified defenses for adversarial patches","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Chiang","year":"2020"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19806-9_33"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3591870"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-61638-0_31"},{"key":"ref22","first-page":"28169","article-title":"Scalecert: Scalable certified defense against adversarial patches with sparse superficial layers","volume":"34","author":"Han","year":"2021","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref23","article-title":"Patchguard++: Efficient provable attack detection against adversarial patches","author":"Xiang","year":"2021"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3660827"},{"key":"ref25","article-title":"Facial recognition system to be used at border town checkpoint","volume-title":"The Standard","author":"Wang","year":"2024"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.7551\/mitpress\/8179.001.0001"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1016\/j.ress.2004.02.003"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1038\/s41598-019-39384-y"},{"key":"ref29","article-title":"Technical report for hicert","year":"2025"},{"key":"ref30","first-page":"6465","article-title":"(De)randomized smoothing for certifiable defense against patch attacks","volume-title":"Proc. 34th Int. Conf. Neural Inf. Process. Syst.","author":"Levine","year":"2020"},{"key":"ref31","first-page":"2237","article-title":"Patchguard: A provably robust defense against adversarial patches via small receptive fields and masking","volume-title":"Proc. USENIX Secur.","author":"Xiang","year":"2021"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref33","first-page":"2065","article-title":"Patchcleanser: Certifiably robust defense against adversarial patches for any image classifier","volume-title":"Proc. USENIX Secur.","author":"Xiang","year":"2022"},{"key":"ref34","article-title":"Implementation of hicert","year":"2025"},{"key":"ref35","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2011.6033395"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01553"},{"key":"ref38","article-title":"An image is worth 16x16 words: Transformers for image recognition at scale","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Dosovitskiy","year":"2021"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3591870"},{"key":"ref41","article-title":"Certified defences against adversarial patch attacks on semantic segmentation","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Yatsura","year":"2023"},{"key":"ref42","first-page":"1633","article-title":"On adaptive attacks to adversarial example defenses","volume":"33","author":"Tramer","year":"2020","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179303"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01471"},{"key":"ref45","article-title":"Efficient certified defenses against patch attacks on image classifiers","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Metzen","year":"2021"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/ASE56229.2023.00137"},{"key":"ref47","first-page":"3675","article-title":"PATCHCURE: Improving certifiable robustness, model utility, and computation efficiency of adversarial patch defenses","volume-title":"Proc. 33rd USENIX Secur. Symp.","author":"Xiang","year":"2024"}],"container-title":["IEEE Transactions on Reliability"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/24\/11317936\/11342369.pdf?arnumber=11342369","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,20]],"date-time":"2026-01-20T20:39:52Z","timestamp":1768941592000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11342369\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":47,"URL":"https:\/\/doi.org\/10.1109\/tr.2025.3642046","relation":{},"ISSN":["0018-9529","1558-1721"],"issn-type":[{"value":"0018-9529","type":"print"},{"value":"1558-1721","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}