{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,21]],"date-time":"2026-02-21T18:14:18Z","timestamp":1771697658961,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":55,"publisher":"ACM","license":[{"start":{"date-parts":[[2021,11,12]],"date-time":"2021-11-12T00:00:00Z","timestamp":1636675200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"National Science Foundation","award":["1953813"],"award-info":[{"award-number":["1953813"]}]},{"name":"National Science Foundation","award":["1953893"],"award-info":[{"award-number":["1953893"]}]},{"name":"National Science Foundation","award":["1951729"],"award-info":[{"award-number":["1951729"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2021,11,12]]},"DOI":"10.1145\/3460120.3484538","type":"proceedings-article","created":{"date-parts":[[2021,11,13]],"date-time":"2021-11-13T12:05:34Z","timestamp":1636805134000},"page":"516-534","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":18,"title":["Cert-RNN: Towards Certifying the Robustness of Recurrent Neural Networks"],"prefix":"10.1145","author":[{"given":"Tianyu","family":"Du","sequence":"first","affiliation":[{"name":"Zhejiang University, Hangzhou, China"}]},{"given":"Shouling","family":"Ji","sequence":"additional","affiliation":[{"name":"Zhejiang University & Binjiang Institute of Zhejiang University, Hangzhou, China"}]},{"given":"Lujia","family":"Shen","sequence":"additional","affiliation":[{"name":"Zhejiang University, Hangzhou, China"}]},{"given":"Yao","family":"Zhang","sequence":"additional","affiliation":[{"name":"Zhejiang University, Hangzhou, China"}]},{"given":"Jinfeng","family":"Li","sequence":"additional","affiliation":[{"name":"Zhejiang University, Hangzhou, China"}]},{"given":"Jie","family":"Shi","sequence":"additional","affiliation":[{"name":"Huawei International, Singapore, Singapore, Singapore"}]},{"given":"Chengfang","family":"Fang","sequence":"additional","affiliation":[{"name":"Huawei International, Singapore, Singapore, Singapore"}]},{"given":"Jianwei","family":"Yin","sequence":"additional","affiliation":[{"name":"Zhejiang University & Binjiang Institute of Zhejiang University, Hangzhou, China"}]},{"given":"Raheem","family":"Beyah","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}]},{"given":"Ting","family":"Wang","sequence":"additional","affiliation":[{"name":"Pennsylvania State University, State College, PA, USA"}]}],"member":"320","published-online":{"date-parts":[[2021,11,13]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33016006"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"crossref","unstructured":"Moustafa Alzantot Yash Sharma Ahmed Elgohary Bo-Jhang Ho Mani Srivastava and Kai-Wei Chang. 2018. Generating Natural Language Adversarial Examples. In EMNLP. 2890--2896.","DOI":"10.18653\/v1\/D18-1316"},{"key":"e_1_3_2_1_3_1","volume-title":"International conference on machine learning. 173--182","author":"Amodei Dario","year":"2016","unstructured":"Dario Amodei, Sundaram Ananthanarayanan, Rishita Anubhai, Jingliang Bai, Eric Battenberg, Carl Case, Jared Casper, Bryan Catanzaro, Qiang Cheng, Guoliang Chen, et al. 2016. Deep speech 2: End-to-end speech recognition in english and mandarin. In International conference on machine learning. 173--182."},{"key":"e_1_3_2_1_4_1","volume-title":"International Conference on Machine Learning. 274--283","author":"Athalye Anish","year":"2018","unstructured":"Anish Athalye, Nicholas Carlini, and David Wagner. 2018. Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples. In International Conference on Machine Learning. 274--283."},{"key":"e_1_3_2_1_5_1","volume-title":"End-to-end attention-based large vocabulary speech recognition","author":"Bahdanau Dzmitry","unstructured":"Dzmitry Bahdanau, Jan Chorowski, Dmitriy Serdyuk, Philemon Brakel, and Yoshua Bengio. 2016. End-to-end attention-based large vocabulary speech recognition. In ICASSP. IEEE, 4945--4949."},{"key":"e_1_3_2_1_6_1","volume-title":"Reconciling modern machine learning practice and the bias-variance trade-off. arXiv preprint arXiv:1812.11118","author":"Belkin Mikhail","year":"2018","unstructured":"Mikhail Belkin, Daniel Hsu, Siyuan Ma, and Soumik Mandal. 2018. Reconciling modern machine learning practice and the bias-variance trade-off. arXiv preprint arXiv:1812.11118 (2018)."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"crossref","unstructured":"Yoshua Bengio Patrice Simard Paolo Frasconi et al. 1994. Learning long-term dependencies with gradient descent is difficult. IEEE transactions on neural networks Vol. 5 2 (1994) 157--166.","DOI":"10.1109\/72.279181"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"crossref","unstructured":"Minhao Cheng Jinfeng Yi Huan Zhang Pin-Yu Chen and Cho-Jui Hsieh. 2020. Seq2sick: Evaluating the robustness of sequence-to-sequence models with adversarial examples. In AAAI .","DOI":"10.1609\/aaai.v34i04.5767"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"crossref","unstructured":"Patrick Cousot and Radhia Cousot. 1977. Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints. In POPL. ACM 238--252.","DOI":"10.1145\/512950.512973"},{"key":"e_1_3_2_1_11_1","unstructured":"Tianyu Du Shouling Ji Jinfeng Li Qinchen Gu Ting Wang and Raheem Beyah. 2020. SirenAttack: Generating Adversarial Audio for End-to-End Acoustic Systems. In ASIACCS ."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"crossref","unstructured":"Javid Ebrahimi Anyi Rao Daniel Lowd and Dejing Dou. 2018. HotFlip: White-Box Adversarial Examples for Text Classification. In ACL. 31--36.","DOI":"10.18653\/v1\/P18-2006"},{"key":"e_1_3_2_1_13_1","volume-title":"Formal verification of piece-wise linear feed-forward neural networks","author":"Ehlers Ruediger","unstructured":"Ruediger Ehlers. 2017. Formal verification of piece-wise linear feed-forward neural networks. In ATVA. Springer, 269--286."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00058"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"crossref","unstructured":"Khalil Ghorbal Eric Goubault and Sylvie Putot. 2009. The zonotope abstract domain taylor1","DOI":"10.1007\/978-3-642-02658-4_47"},{"key":"e_1_3_2_1_16_1","volume-title":"International Conference on Computer Aided Verification. Springer, 627--633","unstructured":". In International Conference on Computer Aided Verification. Springer, 627--633."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/N19-1139"},{"key":"e_1_3_2_1_18_1","unstructured":"Ian J Goodfellow Jonathon Shlens and Christian Szegedy. 2015. Explaining and Harnessing Adversarial Examples. In ICLR ."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00494"},{"key":"e_1_3_2_1_20_1","volume-title":"11th $$USENIX$$ Workshop on Offensive Technologies ($$WOOT$$ 17) .","author":"He Warren","unstructured":"Warren He, James Wei, Xinyun Chen, Nicholas Carlini, and Dawn Song. 2017. Adversarial example defense: Ensembles of weak defenses are not strong. In 11th $$USENIX$$ Workshop on Offensive Technologies ($$WOOT$$ 17) ."},{"key":"e_1_3_2_1_21_1","volume-title":"Long short-term memory. Neural computation","author":"Hochreiter Sepp","year":"1997","unstructured":"Sepp Hochreiter and J\u00fcrgen Schmidhuber. 1997. Long short-term memory. Neural computation, Vol. 9, 8 (1997), 1735--1780."},{"key":"e_1_3_2_1_22_1","volume-title":"Safety verification of deep neural networks","author":"Huang Xiaowei","unstructured":"Xiaowei Huang, Marta Kwiatkowska, Sen Wang, and Min Wu. 2017. Safety verification of deep neural networks. In ICCAV. Springer, 3--29."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"crossref","unstructured":"Robin Jia and Percy Liang. 2017. Adversarial Examples for Evaluating Reading Comprehension Systems. In EMNLP. 2021--2031.","DOI":"10.18653\/v1\/D17-1215"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1423"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-63387-9_5"},{"key":"e_1_3_2_1_26_1","volume-title":"POPQORN: Quantifying Robustness of Recurrent Neural Networks. In International Conference on Machine Learning. 3468--3477","author":"Ko Ching-Yun","year":"2019","unstructured":"Ching-Yun Ko, Zhaoyang Lyu, Lily Weng, Luca Daniel, Ngai Wong, and Dahua Lin. 2019. POPQORN: Quantifying Robustness of Recurrent Neural Networks. In International Conference on Machine Learning. 3468--3477."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/N16-1062"},{"key":"e_1_3_2_1_28_1","volume-title":"Textshield: Robust text classification based on multimodal embedding and neural machine translation. In USENIX Security 20. 1381--1398.","author":"Li Jinfeng","year":"2020","unstructured":"Jinfeng Li, Tianyu Du, Shouling Ji, Rong Zhang, Quan Lu, Min Yang, and Ting Wang. 2020. Textshield: Robust text classification based on multimodal embedding and neural machine translation. In USENIX Security 20. 1381--1398."},{"key":"e_1_3_2_1_29_1","volume-title":"Enhancing Model Robustness by Incorporating Adversarial Knowledge into Semantic Representation","author":"Li Jinfeng","unstructured":"Jinfeng Li, Tianyu Du, Xiangyu Liu, Rong Zhang, Hui Xue, and Shouling Ji. 2021. Enhancing Model Robustness by Incorporating Adversarial Knowledge into Semantic Representation. In ICASSP. IEEE, 7708--7712."},{"key":"e_1_3_2_1_30_1","unstructured":"Jinfeng Li Shouling Ji Tianyu Du Bo Li and Ting Wang. 2019. TextBugger: Generating Adversarial Text Against Real-world Applications. NDSS ."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"e_1_3_2_1_32_1","volume-title":"Proceedings of the Twenty-Fifth International Joint Conference on Artificial Intelligence. 2873--2879","author":"Liu Pengfei","year":"2016","unstructured":"Pengfei Liu, Xipeng Qiu, and Xuanjing Huang. 2016. Recurrent neural network for text classification with multi-task learning. In Proceedings of the Twenty-Fifth International Joint Conference on Artificial Intelligence. 2873--2879."},{"key":"e_1_3_2_1_33_1","volume-title":"International Conference on Learning Representations (ICLR) .","author":"Madry Aleksander","year":"2018","unstructured":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR) ."},{"key":"e_1_3_2_1_34_1","volume-title":"International Conference on Machine Learning. 3575--3583","author":"Mirman Matthew","year":"2018","unstructured":"Matthew Mirman, Timon Gehr, and Martin Vechev. 2018. Differentiable abstract interpretation for provably robust neural networks. In International Conference on Machine Learning. 3575--3583."},{"key":"e_1_3_2_1_35_1","volume-title":"Seeing stars: Exploiting class relationships for sentiment categorization with respect to rating scales","author":"Pang Bo","unstructured":"Bo Pang and Lillian Lee. 2005. Seeing stars: Exploiting class relationships for sentiment categorization with respect to rating scales. In ACL. Association for Computational Linguistics, 115--124."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1561\/1500000011"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"e_1_3_2_1_38_1","volume-title":"2nd International Conference on Learning Representations, ICLR 2014 .","author":"Pascanu Razvan","year":"2014","unstructured":"Razvan Pascanu, Caglar Gulcehre, Kyunghyun Cho, and Yoshua Bengio. 2014. How to construct deep recurrent neural networks: Proceedings of the Second International Conference on Learning Representations (ICLR 2014). In 2nd International Conference on Learning Representations, ICLR 2014 ."},{"key":"e_1_3_2_1_39_1","volume-title":"International Conference on Machine Learning. 5231--5240","author":"Qin Yao","year":"2019","unstructured":"Yao Qin, Nicholas Carlini, Garrison Cottrell, Ian Goodfellow, and Colin Raffel. 2019. Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition. In International Conference on Machine Learning. 5231--5240."},{"key":"e_1_3_2_1_40_1","unstructured":"Shuhuai Ren Yihe Deng Kun He and Wanxiang Che. 2019. Generating natural language adversarial examples through probability weighted word saliency. In ACL. 1085--1097."},{"key":"e_1_3_2_1_41_1","unstructured":"Cicero D Santos and Bianca Zadrozny. 2014. Learning character-level representations for part-of-speech tagging. In ICML. 1818--1826."},{"key":"e_1_3_2_1_42_1","unstructured":"Karsten Scheibler Leonore Winterer Ralf Wimmer and Bernd Becker. 2015. Towards Verification of Artificial Neural Networks.. In MBMV. 30--40."},{"key":"e_1_3_2_1_43_1","unstructured":"Zhouxing Shi Huan Zhang Kai-Wei Chang Minlie Huang and Cho-Jui Hsieh. 2019. Robustness Verification for Transformers. In ICLR ."},{"key":"e_1_3_2_1_44_1","unstructured":"Gagandeep Singh Timon Gehr Matthew Mirman Markus P\u00fcschel and Martin Vechev. 2018. Fast and effective robustness certification. In Advances in Neural Information Processing Systems. 10802--10813."},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1145\/3290354"},{"key":"e_1_3_2_1_46_1","volume-title":"International Conference on Learning Representations (ICLR)","author":"Szegedy Christian","year":"2014","unstructured":"Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. Intriguing properties of neural networks. International Conference on Learning Representations (ICLR) (2014)."},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"crossref","unstructured":"Betty van Aken Julian Risch Ralf Krestel and Alexander L\u00f6ser. 2018. Challenges for Toxic Comment Classification: An In-Depth Error Analysis. In ALW2. 33--42.","DOI":"10.18653\/v1\/W18-5105"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"crossref","unstructured":"Fei Wang Mengqing Jiang Chen Qian Shuo Yang Cheng Li Honggang Zhang Xiaogang Wang and Xiaoou Tang. 2017. Residual attention network for image classification. In CVPR. 3156--3164.","DOI":"10.1109\/CVPR.2017.683"},{"key":"e_1_3_2_1_49_1","volume-title":"Cnn-rnn: A unified framework for multi-label image classification. In CVPR. 2285--2294.","author":"Wang Jiang","year":"2016","unstructured":"Jiang Wang, Yi Yang, Junhua Mao, Zhiheng Huang, Chang Huang, and Wei Xu. 2016. Cnn-rnn: A unified framework for multi-label image classification. In CVPR. 2285--2294."},{"key":"e_1_3_2_1_50_1","unstructured":"Tsui-Wei Weng Huan Zhang Hongge Chen Zhao Song Cho-Jui Hsieh Luca Daniel Duane Boning and Inderjit Dhillon. 2018. Towards Fast Computation of Certified Robustness for ReLU Networks. In ICML. 5273--5282."},{"key":"e_1_3_2_1_51_1","unstructured":"Eric Wong and J Zico Kolter. 2018. Provable defenses against adversarial examples via the convex outer adversarial polytope. In ICML. 5283--5292."},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"crossref","unstructured":"Hiromu Yakura and Jun Sakuma. 2019. Robust audio adversarial example for a physical attack. In IJCAI. 5334--5341.","DOI":"10.24963\/ijcai.2019\/741"},{"key":"e_1_3_2_1_53_1","unstructured":"Huan Zhang Tsui-Wei Weng Pin-Yu Chen Cho-Jui Hsieh and Luca Daniel. 2018. Efficient neural network robustness certification with general activation functions. In Advances in neural information processing systems. 4939--4948."},{"key":"e_1_3_2_1_54_1","first-page":"253","article-title":"A Sensitivity Analysis of (and Practitioners' Guide to) Convolutional Neural Networks for Sentence Classification","volume":"1","author":"Zhang Ye","year":"2017","unstructured":"Ye Zhang and Byron Wallace. 2017. A Sensitivity Analysis of (and Practitioners' Guide to) Convolutional Neural Networks for Sentence Classification. In IJCNLP, Vol. 1. 253--263.","journal-title":"IJCNLP"},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"crossref","unstructured":"Peilin Zhao and Steven CH Hoi. 2013. Cost-sensitive online active learning with application to malicious URL detection. In KDD. 919--927.","DOI":"10.1145\/2487575.2487647"}],"event":{"name":"CCS '21: 2021 ACM SIGSAC Conference on Computer and Communications Security","location":"Virtual Event Republic of Korea","acronym":"CCS '21","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3460120.3484538","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3460120.3484538","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3460120.3484538","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,18]],"date-time":"2025-11-18T20:52:33Z","timestamp":1763499153000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3460120.3484538"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,11,12]]},"references-count":55,"alternative-id":["10.1145\/3460120.3484538","10.1145\/3460120"],"URL":"https:\/\/doi.org\/10.1145\/3460120.3484538","relation":{},"subject":[],"published":{"date-parts":[[2021,11,12]]},"assertion":[{"value":"2021-11-13","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}