{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,13]],"date-time":"2026-03-13T15:43:30Z","timestamp":1773416610038,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":81,"publisher":"ACM","license":[{"start":{"date-parts":[[2020,11,8]],"date-time":"2020-11-08T00:00:00Z","timestamp":1604793600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"the National Key Research and Development Program","award":["2017YFB1001904"],"award-info":[{"award-number":["2017YFB1001904"]}]},{"name":"the National Natural Science Foundation of China","award":["61772042"],"award-info":[{"award-number":["61772042"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2020,11,8]]},"DOI":"10.1145\/3368089.3409676","type":"proceedings-article","created":{"date-parts":[[2020,11,10]],"date-time":"2020-11-10T21:09:10Z","timestamp":1605042550000},"page":"838-850","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":32,"title":["Dynamic slicing for deep neural networks"],"prefix":"10.1145","author":[{"given":"Ziqi","family":"Zhang","sequence":"first","affiliation":[{"name":"Peking University, China"}]},{"given":"Yuanchun","family":"Li","sequence":"additional","affiliation":[{"name":"Microsoft Research, China"}]},{"given":"Yao","family":"Guo","sequence":"additional","affiliation":[{"name":"Peking University, China"}]},{"given":"Xiangqun","family":"Chen","sequence":"additional","affiliation":[{"name":"Peking University, China"}]},{"given":"Yunxin","family":"Liu","sequence":"additional","affiliation":[{"name":"Microsoft Research, China"}]}],"member":"320","published-online":{"date-parts":[[2020,11,8]]},"reference":[{"key":"e_1_3_2_2_1_1","doi-asserted-by":"crossref","unstructured":"Hiralal Agrawal Richard A DeMillo and Eugene H Spaford. 1993. Debugging with dynamic slicing and backtracking. Software: Practice and Experience 23 6 ( 1993 ) 589-616.  Hiralal Agrawal Richard A DeMillo and Eugene H Spaford. 1993. Debugging with dynamic slicing and backtracking. Software: Practice and Experience 23 6 ( 1993 ) 589-616.","DOI":"10.1002\/spe.4380230603"},{"key":"e_1_3_2_2_2_1","volume-title":"ADef: an iterative algorithm to construct adversarial deformations. arXiv preprint arXiv","author":"Alaifari Rima","year":"1804","unstructured":"Rima Alaifari , Giovanni S Alberti , and Tandri Gauksson . 2018. ADef: an iterative algorithm to construct adversarial deformations. arXiv preprint arXiv : 1804 . 07729 ( 2018 ). Rima Alaifari, Giovanni S Alberti, and Tandri Gauksson. 2018. ADef: an iterative algorithm to construct adversarial deformations. arXiv preprint arXiv: 1804. 07729 ( 2018 )."},{"key":"e_1_3_2_2_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/2610384.2610391"},{"key":"e_1_3_2_2_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00118"},{"key":"e_1_3_2_2_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/2635868.2635893"},{"key":"e_1_3_2_2_6_1","doi-asserted-by":"crossref","unstructured":"David W Binkley and Mark Harman. 2004. A survey of empirical results on program slicing. Adv. Comput. 62 105178 ( 2004 ) 105-178.  David W Binkley and Mark Harman. 2004. A survey of empirical results on program slicing. Adv. Comput. 62 105178 ( 2004 ) 105-178.","DOI":"10.1016\/S0065-2458(03)62003-6"},{"key":"e_1_3_2_2_7_1","volume-title":"Classification and regression trees","author":"Breiman Leo","unstructured":"Leo Breiman . 2017. Classification and regression trees . Routledge . Leo Breiman. 2017. Classification and regression trees. Routledge."},{"key":"e_1_3_2_2_8_1","unstructured":"Wieland Brendel Jonas Rauber and Matthias Bethge. 2017. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprint arXiv:1712.04248 ( 2017 ).  Wieland Brendel Jonas Rauber and Matthias Bethge. 2017. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprint arXiv:1712.04248 ( 2017 )."},{"key":"e_1_3_2_2_9_1","volume-title":"Beng Chin Ooi, and Jinyang Gao","author":"Cai Shaofeng","year":"2019","unstructured":"Shaofeng Cai , Gang Chen , Beng Chin Ooi, and Jinyang Gao . 2019 . Model slicing for supporting complex analytics with elastic inference cost and resource constraints. VLDB Endowment 13, 2 ( 2019 ), 86-99. Shaofeng Cai, Gang Chen, Beng Chin Ooi, and Jinyang Gao. 2019. Model slicing for supporting complex analytics with elastic inference cost and resource constraints. VLDB Endowment 13, 2 ( 2019 ), 86-99."},{"key":"e_1_3_2_2_10_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0950-5849(98)00086-X"},{"key":"e_1_3_2_2_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_2_2_12_1","unstructured":"Edward Chou Josh Beal Daniel Levy Serena Yeung Albert Haque and Li Fei-Fei. 2018. Faster cryptonets: Leveraging sparsity for real-world encrypted inference. arXiv preprint arXiv:1811. 09953 ( 2018 ).  Edward Chou Josh Beal Daniel Levy Serena Yeung Albert Haque and Li Fei-Fei. 2018. Faster cryptonets: Leveraging sparsity for real-world encrypted inference. arXiv preprint arXiv:1811. 09953 ( 2018 )."},{"key":"e_1_3_2_2_13_1","doi-asserted-by":"crossref","unstructured":"Dan Cire\u015fAn Ueli Meier Jonathan Masci and J\u00fcrgen Schmidhuber. 2012. Multicolumn deep neural network for trafic sign classification. Neural networks 32 ( 2012 ) 333-338.  Dan Cire\u015fAn Ueli Meier Jonathan Masci and J\u00fcrgen Schmidhuber. 2012. Multicolumn deep neural network for trafic sign classification. Neural networks 32 ( 2012 ) 333-338.","DOI":"10.1016\/j.neunet.2012.02.023"},{"key":"e_1_3_2_2_14_1","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-48153-2_22"},{"key":"e_1_3_2_2_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2018.8489592"},{"key":"e_1_3_2_2_16_1","volume-title":"IACR Cryptology ePrint Archive","author":"Costan Victor","year":"2016","unstructured":"Victor Costan and Srinivas Devadas . 2016. Intel SGX Explained. IACR Cryptology ePrint Archive 2016 , 086 ( 2016 ), 1-118. Victor Costan and Srinivas Devadas. 2016. Intel SGX Explained. IACR Cryptology ePrint Archive 2016, 086 ( 2016 ), 1-118."},{"key":"e_1_3_2_2_17_1","first-page":"857","volume-title":"25th USENIX Security Symposium (USENIX Security 16)","author":"Costan Victor","year":"2016","unstructured":"Victor Costan , Ilia Lebedev , and Srinivas Devadas . 2016 . Sanctum: Minimal hardware extensions for strong software isolation . In 25th USENIX Security Symposium (USENIX Security 16) . 857 - 874 . Victor Costan, Ilia Lebedev, and Srinivas Devadas. 2016. Sanctum: Minimal hardware extensions for strong software isolation. In 25th USENIX Security Symposium (USENIX Security 16). 857-874."},{"key":"e_1_3_2_2_18_1","volume-title":"BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. ( 2019 ).","author":"Devlin Jacob","year":"2019","unstructured":"Jacob Devlin , Ming-Wei Chang , Kenton Lee , and Kristina Toutanova . 2019 . BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. ( 2019 ). Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. ( 2019 )."},{"key":"e_1_3_2_2_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3338906.3338954"},{"key":"e_1_3_2_2_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/2736277.2741667"},{"key":"e_1_3_2_2_21_1","unstructured":"Logan Engstrom Dimitris Tsipras Ludwig Schmidt and Aleksander Madry. 2017. A rotation and a translation sufice: Fooling cnns with simple transformations. arXiv preprint arXiv:1712.02779 1 2 ( 2017 ) 3.  Logan Engstrom Dimitris Tsipras Ludwig Schmidt and Aleksander Madry. 2017. A rotation and a translation sufice: Fooling cnns with simple transformations. arXiv preprint arXiv:1712.02779 1 2 ( 2017 ) 3."},{"key":"e_1_3_2_2_22_1","volume-title":"When Explainability Meets Adversarial Learning: Detecting Adversarial Examples using SHAP Signatures. arXiv preprint arXiv","author":"Fidel Gil","year":"1909","unstructured":"Gil Fidel , Ron Bitton , and Asaf Shabtai . 2019. When Explainability Meets Adversarial Learning: Detecting Adversarial Examples using SHAP Signatures. arXiv preprint arXiv : 1909 . 03418 ( 2019 ). Gil Fidel, Ron Bitton, and Asaf Shabtai. 2019. When Explainability Meets Adversarial Learning: Detecting Adversarial Examples using SHAP Signatures. arXiv preprint arXiv: 1909. 03418 ( 2019 )."},{"key":"e_1_3_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/32.83912"},{"key":"e_1_3_2_2_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00058"},{"key":"e_1_3_2_2_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/72.963769"},{"key":"e_1_3_2_2_26_1","volume-title":"International Conference on Machine Learning. 201-210","author":"Gilad-Bachrach Ran","year":"2016","unstructured":"Ran Gilad-Bachrach , Nathan Dowlin , Kim Laine , Kristin Lauter , Michael Naehrig , and John Wernsing . 2016 . Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy . In International Conference on Machine Learning. 201-210 . Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing. 2016. Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. In International Conference on Machine Learning. 201-210."},{"key":"e_1_3_2_2_27_1","unstructured":"Ian J Goodfellow Jonathon Shlens and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 ( 2014 ).  Ian J Goodfellow Jonathon Shlens and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 ( 2014 )."},{"key":"e_1_3_2_2_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2019.00079"},{"key":"e_1_3_2_2_29_1","unstructured":"Divya Gopinath Kaiyuan Wang Mengshi Zhang Corina S Pasareanu and Sarfraz Khurshid. 2018. Symbolic execution for deep neural networks. arXiv preprint arXiv:1807. 10439 ( 2018 ).  Divya Gopinath Kaiyuan Wang Mengshi Zhang Corina S Pasareanu and Sarfraz Khurshid. 2018. Symbolic execution for deep neural networks. arXiv preprint arXiv:1807. 10439 ( 2018 )."},{"key":"e_1_3_2_2_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/2950290.2950334"},{"key":"e_1_3_2_2_31_1","volume-title":"4th International Conference on Learning Representations, ICLR.","author":"Han Song","year":"2016","unstructured":"Song Han , Huizi Mao , and William J Dally . 2016 . Deep compression: compressing deep neural networks with pruning, trained quantization and hufman coding . In 4th International Conference on Learning Representations, ICLR. Song Han, Huizi Mao, and William J Dally. 2016. Deep compression: compressing deep neural networks with pruning, trained quantization and hufman coding. In 4th International Conference on Learning Representations, ICLR."},{"key":"e_1_3_2_2_32_1","unstructured":"Song Han Jef Pool John Tran and William Dally. 2015. Learning both weights and connections for eficient neural network. In Advances in neural information processing systems. 1135-1143.  Song Han Jef Pool John Tran and William Dally. 2015. Learning both weights and connections for eficient neural network. In Advances in neural information processing systems. 1135-1143."},{"key":"e_1_3_2_2_33_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0164-1212(02)00135-8"},{"key":"e_1_3_2_2_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_2_2_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.155"},{"key":"e_1_3_2_2_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/77606.77608"},{"key":"e_1_3_2_2_37_1","volume-title":"Neural network model extraction attacks in edge devices by hearing architectural hints. arXiv preprint arXiv","author":"Hu Xing","year":"1903","unstructured":"Xing Hu , Ling Liang , Lei Deng , Shuangchen Li , Xinfeng Xie , Yu Ji , Yufei Ding , Chang Liu , Timothy Sherwood , and Yuan Xie . 2019. Neural network model extraction attacks in edge devices by hearing architectural hints. arXiv preprint arXiv : 1903 . 03916 ( 2019 ). Xing Hu, Ling Liang, Lei Deng, Shuangchen Li, Xinfeng Xie, Yu Ji, Yufei Ding, Chang Liu, Timothy Sherwood, and Yuan Xie. 2019. Neural network model extraction attacks in edge devices by hearing architectural hints. arXiv preprint arXiv: 1903. 03916 ( 2019 )."},{"key":"e_1_3_2_2_38_1","unstructured":"Matthew Jagielski Nicholas Carlini David Berthelot Alex Kurakin and Nicolas Papernot. 2019. High-fidelity extraction of neural network models. arXiv preprint arXiv:1909. 01838 ( 2019 ).  Matthew Jagielski Nicholas Carlini David Berthelot Alex Kurakin and Nicolas Papernot. 2019. High-fidelity extraction of neural network models. arXiv preprint arXiv:1909. 01838 ( 2019 )."},{"key":"e_1_3_2_2_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"e_1_3_2_2_40_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-63387-9_5"},{"key":"e_1_3_2_2_41_1","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-48405-1_25"},{"key":"e_1_3_2_2_42_1","doi-asserted-by":"publisher","DOI":"10.1016\/0020-0190(88)90054-3"},{"key":"e_1_3_2_2_43_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6810"},{"key":"e_1_3_2_2_44_1","volume-title":"Yao Guo, Gang Huang, Matthew Fredrikson, Yuvraj Agarwal, and Jason I Hong.","author":"Li Yuanchun","year":"2017","unstructured":"Yuanchun Li , Fanglin Chen , Toby Jia-Jun Li , Yao Guo, Gang Huang, Matthew Fredrikson, Yuvraj Agarwal, and Jason I Hong. 2017 . Privacystreams : Enabling transparency in personal data processing for mobile apps. ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies 1, 3 ( 2017 ), 1-26. Yuanchun Li, Fanglin Chen, Toby Jia-Jun Li, Yao Guo, Gang Huang, Matthew Fredrikson, Yuvraj Agarwal, and Jason I Hong. 2017. Privacystreams: Enabling transparency in personal data processing for mobile apps. ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies 1, 3 ( 2017 ), 1-26."},{"key":"e_1_3_2_2_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2019.00104"},{"key":"e_1_3_2_2_46_1","volume-title":"Rethinking the value of network pruning. arXiv preprint arXiv","author":"Liu Zhuang","year":"1810","unstructured":"Zhuang Liu , Mingjie Sun , Tinghui Zhou , Gao Huang , and Trevor Darrell . 2018. Rethinking the value of network pruning. arXiv preprint arXiv : 1810 . 05270 ( 2018 ). Zhuang Liu, Mingjie Sun, Tinghui Zhou, Gao Huang, and Trevor Darrell. 2018. Rethinking the value of network pruning. arXiv preprint arXiv: 1810. 05270 ( 2018 )."},{"key":"e_1_3_2_2_47_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23415"},{"key":"e_1_3_2_2_48_1","volume-title":"Characterizing adversarial subspaces using local intrinsic dimensionality. arXiv preprint arXiv","author":"Ma Xingjun","year":"1801","unstructured":"Xingjun Ma , Bo Li , Yisen Wang , Sarah M Erfani , Sudanthi Wijewickrema , Grant Schoenebeck , Dawn Song , Michael E Houle , and James Bailey . 2018. Characterizing adversarial subspaces using local intrinsic dimensionality. arXiv preprint arXiv : 1801 . 02613 ( 2018 ). Xingjun Ma, Bo Li, Yisen Wang, Sarah M Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Dawn Song, Michael E Houle, and James Bailey. 2018. Characterizing adversarial subspaces using local intrinsic dimensionality. arXiv preprint arXiv: 1801. 02613 ( 2018 )."},{"key":"e_1_3_2_2_49_1","unstructured":"Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 ( 2017 ).  Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 ( 2017 )."},{"key":"e_1_3_2_2_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"e_1_3_2_2_51_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00348"},{"key":"e_1_3_2_2_52_1","unstructured":"Nina Narodytska and Shiva Prasad Kasiviswanathan. 2016. Simple black-box adversarial perturbations for deep networks. arXiv preprint arXiv:1612.06299 ( 2016 ).  Nina Narodytska and Shiva Prasad Kasiviswanathan. 2016. Simple black-box adversarial perturbations for deep networks. arXiv preprint arXiv:1612.06299 ( 2016 )."},{"key":"e_1_3_2_2_53_1","volume-title":"IEEE Conference on Computer Vision and Pattern Recognition (CVPR). 4954-4963","author":"Orekondy Tribhuvanesh","year":"2019","unstructured":"Tribhuvanesh Orekondy , Bernt Schiele , and Mario Fritz . 2019 . Knockof nets: Stealing functionality of black-box models . In IEEE Conference on Computer Vision and Pattern Recognition (CVPR). 4954-4963 . Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. 2019. Knockof nets: Stealing functionality of black-box models. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR). 4954-4963."},{"key":"e_1_3_2_2_54_1","volume-title":"Prediction poisoning: Utility-constrained defenses against model stealing attacks. arXiv preprint arXiv","author":"Orekondy Tribhuvanesh","year":"1906","unstructured":"Tribhuvanesh Orekondy , Bernt Schiele , and Mario Fritz . 2019. Prediction poisoning: Utility-constrained defenses against model stealing attacks. arXiv preprint arXiv : 1906 . 10908 ( 2019 ). Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. 2019. Prediction poisoning: Utility-constrained defenses against model stealing attacks. arXiv preprint arXiv: 1906. 10908 ( 2019 )."},{"key":"e_1_3_2_2_55_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"e_1_3_2_2_56_1","doi-asserted-by":"publisher","DOI":"10.1145\/3132747.3132785"},{"key":"e_1_3_2_2_57_1","volume-title":"Adversarial Defense Through Network Profiling Based Path Extraction. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR). 4777-4786","author":"Qiu Yuxian","year":"2019","unstructured":"Yuxian Qiu , Jingwen Leng , Cong Guo , Quan Chen , Chao Li , Minyi Guo , and Yuhao Zhu . 2019 . Adversarial Defense Through Network Profiling Based Path Extraction. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR). 4777-4786 . Yuxian Qiu, Jingwen Leng, Cong Guo, Quan Chen, Chao Li, Minyi Guo, and Yuhao Zhu. 2019. Adversarial Defense Through Network Profiling Based Path Extraction. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR). 4777-4786."},{"key":"e_1_3_2_2_58_1","volume-title":"Foolbox: A python toolbox to benchmark the robustness of machine learning models. arXiv preprint arXiv:1707.04131 ( 2017 ).","author":"Rauber Jonas","year":"2017","unstructured":"Jonas Rauber , Wieland Brendel , and Matthias Bethge . 2017 . Foolbox: A python toolbox to benchmark the robustness of machine learning models. arXiv preprint arXiv:1707.04131 ( 2017 ). Jonas Rauber, Wieland Brendel, and Matthias Bethge. 2017. Foolbox: A python toolbox to benchmark the robustness of machine learning models. arXiv preprint arXiv:1707.04131 ( 2017 )."},{"key":"e_1_3_2_2_59_1","doi-asserted-by":"publisher","DOI":"10.1145\/3338498.3358646"},{"key":"e_1_3_2_2_60_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.11504"},{"key":"e_1_3_2_2_61_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.606"},{"key":"e_1_3_2_2_62_1","doi-asserted-by":"crossref","unstructured":"Josep Silva. 2012. A vocabulary of program slicing-based techniques. ACM Computing Surveys (CSUR) 44 3 ( 2012 ) 1-41.  Josep Silva. 2012. A vocabulary of program slicing-based techniques. ACM Computing Surveys (CSUR) 44 3 ( 2012 ) 1-41.","DOI":"10.1145\/2187671.2187674"},{"key":"e_1_3_2_2_63_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298594"},{"key":"e_1_3_2_2_64_1","unstructured":"Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian Goodfellow and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 ( 2013 ).  Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian Goodfellow and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 ( 2013 )."},{"key":"e_1_3_2_2_65_1","volume-title":"Eficientnet: Rethinking model scaling for convolutional neural networks. arXiv preprint arXiv:1905. 11946 ( 2019 ).","author":"Tan Mingxing","year":"2019","unstructured":"Mingxing Tan and Quoc V Le . 2019 . Eficientnet: Rethinking model scaling for convolutional neural networks. arXiv preprint arXiv:1905. 11946 ( 2019 ). Mingxing Tan and Quoc V Le. 2019. Eficientnet: Rethinking model scaling for convolutional neural networks. arXiv preprint arXiv:1905. 11946 ( 2019 )."},{"key":"e_1_3_2_2_66_1","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180220"},{"key":"e_1_3_2_2_67_1","unstructured":"Frank Tip. 1994. A survey of program slicing techniques. Centrum voor Wiskunde en Informatica Amsterdam.  Frank Tip. 1994. A survey of program slicing techniques. Centrum voor Wiskunde en Informatica Amsterdam."},{"key":"e_1_3_2_2_68_1","volume-title":"Slalom: Fast, verifiable and private execution of neural networks in trusted hardware. arXiv preprint arXiv","author":"Tramer Florian","year":"2018","unstructured":"Florian Tramer and Dan Boneh . 2018 . Slalom: Fast, verifiable and private execution of neural networks in trusted hardware. arXiv preprint arXiv : 1806. 03287 ( 2018 ). Florian Tramer and Dan Boneh. 2018. Slalom: Fast, verifiable and private execution of neural networks in trusted hardware. arXiv preprint arXiv: 1806. 03287 ( 2018 )."},{"key":"e_1_3_2_2_69_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2007.47"},{"key":"e_1_3_2_2_70_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00126"},{"key":"e_1_3_2_2_71_1","first-page":"6367","article-title":"Eficient formal safety analysis of neural networks","author":"Wang Shiqi","year":"2018","unstructured":"Shiqi Wang , Kexin Pei , Justin Whitehouse , Junfeng Yang , and Suman Jana . 2018 . Eficient formal safety analysis of neural networks . In Advances in Neural Information Processing Systems (NeurIPS). 6367 - 6377 . Shiqi Wang, Kexin Pei, Justin Whitehouse, Junfeng Yang, and Suman Jana. 2018. Eficient formal safety analysis of neural networks. In Advances in Neural Information Processing Systems (NeurIPS). 6367-6377.","journal-title":"Advances in Neural Information Processing Systems (NeurIPS)."},{"key":"e_1_3_2_2_72_1","first-page":"1599","volume-title":"27th USENIX Security Symposium (USENIX Security 18)","author":"Wang Shiqi","year":"2018","unstructured":"Shiqi Wang , Kexin Pei , Justin Whitehouse , Junfeng Yang , and Suman Jana . 2018 . Formal security analysis of neural networks using symbolic intervals . In 27th USENIX Security Symposium (USENIX Security 18) . 1599 - 1614 . Shiqi Wang, Kexin Pei, Justin Whitehouse, Junfeng Yang, and Suman Jana. 2018. Formal security analysis of neural networks using symbolic intervals. In 27th USENIX Security Symposium (USENIX Security 18). 1599-1614."},{"key":"e_1_3_2_2_73_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00928"},{"key":"e_1_3_2_2_74_1","doi-asserted-by":"publisher","DOI":"10.5555\/800078.802557"},{"key":"e_1_3_2_2_75_1","doi-asserted-by":"publisher","DOI":"10.1145\/3293882.3330579"},{"key":"e_1_3_2_2_76_1","doi-asserted-by":"crossref","unstructured":"Roman V Yampolskiy. 2011. AI-complete CAPTCHAs as zero knowledge proofs of access to an artificially intelligent system. ISRN Artificial Intelligence 2012 ( 2011 ).  Roman V Yampolskiy. 2011. AI-complete CAPTCHAs as zero knowledge proofs of access to an artificially intelligent system. ISRN Artificial Intelligence 2012 ( 2011 ).","DOI":"10.5402\/2012\/271878"},{"key":"e_1_3_2_2_77_1","first-page":"227","article-title":"You only propagate once: Accelerating adversarial training via maximal principle","author":"Zhang Dinghuai","year":"2019","unstructured":"Dinghuai Zhang , Tianyuan Zhang , Yiping Lu , Zhanxing Zhu , and Bin Dong . 2019 . You only propagate once: Accelerating adversarial training via maximal principle . In Advances in Neural Information Processing Systems. 227 - 238 . Dinghuai Zhang, Tianyuan Zhang, Yiping Lu, Zhanxing Zhu, and Bin Dong. 2019. You only propagate once: Accelerating adversarial training via maximal principle. In Advances in Neural Information Processing Systems. 227-238.","journal-title":"Advances in Neural Information Processing Systems."},{"key":"e_1_3_2_2_78_1","volume-title":"Machine learning testing: Survey, landscapes and horizons","author":"Zhang Jie M","year":"2020","unstructured":"Jie M Zhang , Mark Harman , Lei Ma , and Yang Liu . 2020. Machine learning testing: Survey, landscapes and horizons . IEEE Transactions on Software Engineering ( 2020 ). Jie M Zhang, Mark Harman, Lei Ma, and Yang Liu. 2020. Machine learning testing: Survey, landscapes and horizons. IEEE Transactions on Software Engineering ( 2020 )."},{"key":"e_1_3_2_2_79_1","volume-title":"CHEETAH: An Ultra-Fast, Approximation-Free, and Privacy-Preserved Neural Network Framework based on Joint Obscure Linear and Nonlinear Computations. arXiv preprint arXiv","author":"Zhang Qiao","year":"2019","unstructured":"Qiao Zhang , Cong Wang , Chunsheng Xin , and Hongyi Wu . 2019 . CHEETAH: An Ultra-Fast, Approximation-Free, and Privacy-Preserved Neural Network Framework based on Joint Obscure Linear and Nonlinear Computations. arXiv preprint arXiv : 1911. 05184 ( 2019 ). Qiao Zhang, Cong Wang, Chunsheng Xin, and Hongyi Wu. 2019. CHEETAH: An Ultra-Fast, Approximation-Free, and Privacy-Preserved Neural Network Framework based on Joint Obscure Linear and Nonlinear Computations. arXiv preprint arXiv: 1911. 05184 ( 2019 )."},{"key":"e_1_3_2_2_80_1","doi-asserted-by":"crossref","unstructured":"Quan-shi Zhang and Song-Chun Zhu. 2018. Visual interpretability for deep learning: a survey. Frontiers of Information Technology & Electronic Engineering 19 1 ( 2018 ) 27-39.  Quan-shi Zhang and Song-Chun Zhu. 2018. Visual interpretability for deep learning: a survey. Frontiers of Information Technology & Electronic Engineering 19 1 ( 2018 ) 27-39.","DOI":"10.1631\/FITEE.1700808"},{"key":"e_1_3_2_2_81_1","doi-asserted-by":"publisher","DOI":"10.5555\/776816.776855"}],"event":{"name":"ESEC\/FSE '20: 28th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering","location":"Virtual Event USA","acronym":"ESEC\/FSE '20","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering"]},"container-title":["Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3368089.3409676","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3368089.3409676","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T23:44:39Z","timestamp":1750203879000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3368089.3409676"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,11,8]]},"references-count":81,"alternative-id":["10.1145\/3368089.3409676","10.1145\/3368089"],"URL":"https:\/\/doi.org\/10.1145\/3368089.3409676","relation":{},"subject":[],"published":{"date-parts":[[2020,11,8]]},"assertion":[{"value":"2020-11-08","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}