{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T20:21:37Z","timestamp":1792786897108,"version":"4.5.0"},"reference-count":78,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"10","license":[{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"National Natural Science Foundation of China","award":["62576020"],"award-info":[{"award-number":["62576020"]}],"id":[{"id":"https:\/\/ror.org\/01h0zpd94","id-type":"ROR","asserted-by":"crossref"}]},{"name":"Fundamental Research Funds for the Central Universities"},{"name":"Shandong Provincial Natural Science Foundation","award":["ZR2022ZD01"],"award-info":[{"award-number":["ZR2022ZD01"]}]},{"name":"Beijing Natural Science Foundation","award":["L247011"],"award-info":[{"award-number":["L247011"]}]},{"name":"High Performance Computing Center, Tsinghua University","id":[{"id":"https:\/\/ror.org\/03cve4549","id-type":"ROR","asserted-by":"crossref"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2026,10]]},"DOI":"10.1109\/tpami.2026.3705256","type":"journal-article","created":{"date-parts":[[2026,6,18]],"date-time":"2026-06-18T20:10:26Z","timestamp":1781813426000},"page":"13270-13286","source":"Crossref","is-referenced-by-count":1,"title":["Improving Viewpoint Robustness for Visual Recognition via Adversarial Training"],"prefix":"10.1109","volume":"48","author":[{"ORCID":"https:\/\/orcid.org\/0009-0007-0481-5855","authenticated-orcid":false,"given":"Shouwei","family":"Ruan","sequence":"first","affiliation":[{"name":"Beihang University","place":["Beijing, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1299-683X","authenticated-orcid":false,"given":"Yinpeng","family":"Dong","sequence":"additional","affiliation":[{"name":"Institute for Artificial Intelligence, Beijing National Research Center for Information Science and Technology, Department of Computer Science and Technology. Tsinghua University","place":["Beijing, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8294-6315","authenticated-orcid":false,"given":"Hang","family":"Su","sequence":"additional","affiliation":[{"name":"Institute for Artificial Intelligence, Beijing National Research Center for Information Science and Technology, Department of Computer Science and Technology. Tsinghua University","place":["Beijing, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0600-8033","authenticated-orcid":false,"given":"Ning","family":"Chen","sequence":"additional","affiliation":[{"name":"Institute for Artificial Intelligence, Beijing National Research Center for Information Science and Technology, Department of Computer Science and Technology. Tsinghua University","place":["Beijing, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4926-3202","authenticated-orcid":false,"given":"Haibin","family":"Duan","sequence":"additional","affiliation":[{"name":"School of Automation Science and Electrical Engineering Beihang University","place":["Beijing, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0778-8377","authenticated-orcid":false,"given":"Xingxing","family":"Wei","sequence":"additional","affiliation":[{"name":"Beihang University","place":["Beijing, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2013.50"},{"key":"ref2","first-page":"646","article-title":"Measuring invariances in deep networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"22","author":"Goodfellow","year":"2009"},{"key":"ref3","first-page":"1802","article-title":"Exploring the landscape of spatial robustness","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Engstrom","year":"2019"},{"key":"ref4","first-page":"2990","article-title":"Group equivariant convolutional networks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Cohen","year":"2016"},{"key":"ref5","first-page":"299","article-title":"Discovering viewpoint-invariant relationships that characterize objects","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Zemel","year":"1990"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00498"},{"key":"ref7","first-page":"9453","article-title":"ObjectNet: A large-scale bias-controlled dataset for pushing the limits of object recognition models","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Barbu","year":"2019"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.52202\/068431-2666"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1037\/0033-295X.94.2.115"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref12","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang","year":"2019"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00467"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58452-8_24"},{"key":"ref15","first-page":"19730","article-title":"BLIP-2: Bootstrapping language-image pre-training with frozen image encoders and large language models","volume-title":"Proc. 40th Int. Conf. Mach. Learn","author":"Li","year":"2023"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.52202\/075280-1516"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3528223.3530127"},{"key":"ref18","first-page":"8270","article-title":"Adversarial distributional training for robust deep learning","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Dong","year":"2020"},{"issue":"2","key":"ref19","first-page":"1","article-title":"LoRA: Low-rank adaptation of large language models","volume-title":"Proc. Int. Conf. Learn. Representations","volume":"1","author":"Hu","year":"2022"},{"key":"ref20","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Cohen","year":"2019"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.52202\/075280-1516"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02484"},{"key":"ref23","article-title":"Qwen2.5 technical report","author":"Yang","year":"2024"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00434"},{"key":"ref25","first-page":"1","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Goodfellow","year":"2015"},{"key":"ref26","first-page":"1","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Szegedy","year":"2014"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2020.10.028"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00760"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/3793659"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01187"},{"key":"ref31","first-page":"2507","article-title":"LAVAN: Localized and visible adversarial noise","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Karmon","year":"2018"},{"key":"ref32","article-title":"Adversarial patch","author":"Brown","year":"2017"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3176760"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3231886"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i6.20546"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01491"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01501"},{"key":"ref38","article-title":"OOD-CV: A benchmark for robustness to individual nuisances in real-world out-of-distribution shifts","volume-title":"ICML 2022 Shift Happens Workshop","author":"Zhao","year":"2022"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00823"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-66415-2_2"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1038\/s42256-021-00437-5"},{"key":"ref42","article-title":"On the robustness of the CVPR 2018 white-box adversarial example defenses","author":"Athalye","year":"2018"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/591"},{"key":"ref44","first-page":"1","article-title":"Ensemble adversarial training: Attacks and defenses","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Tram\u00e8r","year":"2018"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP.2019.8803770"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01397"},{"key":"ref47","first-page":"1","article-title":"Adversarial training methods for semi-supervised text classification","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Miyato","year":"2017"},{"key":"ref48","first-page":"1","article-title":"MACER: Attack-free and scalable robust training via maximizing certified radius","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Zhai","year":"2020"},{"key":"ref49","first-page":"10693","article-title":"Randomized smoothing of all shapes and sizes","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Yang","year":"2020"},{"key":"ref50","first-page":"15169","article-title":"3DeformRS: Certifying spatial deformations on point clouds","volume-title":"Proc. IEEE Conf. Comput. Vis. Pattern Recognit.","author":"P\u00e9rez","year":"2022"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-46092-0"},{"issue":"1","key":"ref52","first-page":"949","article-title":"Natural evolution strategies","volume":"15","author":"Wierstra","year":"2014","journal-title":"J. Mach. Learn. Res."},{"key":"ref53","first-page":"1","article-title":"Auto-encoding variational Bayes","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Kingma","year":"2014"},{"key":"ref54","article-title":"GPT-4o","year":"2024"},{"key":"ref55","article-title":"Detecting language model attacks with perplexity","author":"Alon","year":"2023"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1023\/B:VISI.0000042993.50813.60"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00526"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00945"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01072"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.02045"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2010.11929"},{"key":"ref62","first-page":"8748","article-title":"Learning transferable visual models from natural language supervision","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Radford","year":"2021"},{"key":"ref63","first-page":"1","article-title":"Adam: A method for stochastic optimization","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Kingma","year":"2015"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00773"},{"key":"ref65","first-page":"1","article-title":"Very deep convolutional networks for large-scale image recognition","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Simonyan","year":"2015"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.5555\/3298023.3298188"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.243"},{"key":"ref68","first-page":"6105","article-title":"EfficientNet: Rethinking model scaling for convolutional neural networks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Tan","year":"2019"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00474"},{"key":"ref70","first-page":"10347","article-title":"Training data-efficient image transformers & distillation through attention","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Touvron","year":"2021"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00986"},{"key":"ref72","first-page":"24261","article-title":"MLP-mixer: An all-MLP architecture for vision","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Tolstikhin","year":"2021"},{"key":"ref73","first-page":"3533","article-title":"Do adversarially robust imagenet models transfer better?","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Salman","year":"2020"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01553"},{"key":"ref75","first-page":"1","article-title":"AugMix: A simple data processing method to improve robustness and uncertainty","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Hendrycks","year":"2020"},{"key":"ref76","first-page":"9694","article-title":"Align before fuse: Vision and language representation learning with momentum distillation","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","volume":"34","author":"Li","year":"2021"},{"key":"ref77","first-page":"12888","article-title":"Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Li","year":"2022"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.emnlp-main.138"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/34\/11674301\/11570071.pdf?arnumber=11570071","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,24]],"date-time":"2026-09-24T16:27:05Z","timestamp":1790267225000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11570071\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,10]]},"references-count":78,"journal-issue":{"issue":"10"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2026.3705256","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"value":"0162-8828","type":"print"},{"value":"2160-9292","type":"electronic"},{"value":"1939-3539","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,10]]}}}