{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,13]],"date-time":"2026-07-13T20:12:00Z","timestamp":1783973520540,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":41,"publisher":"ACM","license":[{"start":{"date-parts":[[2021,10,17]],"date-time":"2021-10-17T00:00:00Z","timestamp":1634428800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2021,10,17]]},"DOI":"10.1145\/3474085.3475591","type":"proceedings-article","created":{"date-parts":[[2021,10,18]],"date-time":"2021-10-18T20:56:12Z","timestamp":1634590572000},"page":"4417-4425","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":123,"title":["DAWN"],"prefix":"10.1145","author":[{"given":"Sebastian","family":"Szyller","sequence":"first","affiliation":[{"name":"Aalto University, Espoo, Finland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Buse Gul","family":"Atli","sequence":"additional","affiliation":[{"name":"Aalto University, Espoo, Finland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Samuel","family":"Marchal","sequence":"additional","affiliation":[{"name":"Aalto University & F-Secure Corporation, Espoo, Finland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"N.","family":"Asokan","sequence":"additional","affiliation":[{"name":"University of Waterloo & Aalto University, Waterloo, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2021,10,17]]},"reference":[{"key":"e_1_3_2_2_1_1","doi-asserted-by":"publisher","DOI":"10.5555\/3277203.3277324"},{"key":"e_1_3_2_2_2_1","doi-asserted-by":"publisher","DOI":"10.5555\/1162264"},{"key":"e_1_3_2_2_3_1","volume-title":"Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526","author":"Chen Xinyun","year":"2017"},{"key":"e_1_3_2_2_4_1","volume-title":"Certified adversarial robustness via randomized smoothing. arXiv preprint arXiv:1902.02918","author":"Cohen Jeremy M","year":"2019"},{"key":"e_1_3_2_2_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2018.8489592"},{"key":"e_1_3_2_2_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3297858.3304051"},{"key":"e_1_3_2_2_7_1","volume-title":"Kai Li, and Li Fei-fei.","author":"Deng Jia","year":"2009"},{"key":"e_1_3_2_2_8_1","volume-title":"The Untapped Potential of Trusted Execution Environments on Mobile Devices. IEEE Security & Privacy","volume":"12","author":"Ekberg Jan-Erik","year":"2014"},{"key":"e_1_3_2_2_9_1","volume-title":"et almbox","author":"Fisher Ronald Aylmer","year":"1949"},{"key":"e_1_3_2_2_10_1","volume-title":"Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572","author":"Goodfellow Ian J","year":"2014"},{"key":"e_1_3_2_2_11_1","unstructured":"Gregory Scott Griffin Alex Holub and Pietro Perona. 2007. Caltech-256 Object Category Dataset.  Gregory Scott Griffin Alex Holub and Pietro Perona. 2007. Caltech-256 Object Category Dataset."},{"key":"e_1_3_2_2_12_1","unstructured":"Kaiming He Xiangyu Zhang Shaoqing Ren and Jian Sun. 2016. Deep residual learning for image recognition. In CVPR. 770--778.  Kaiming He Xiangyu Zhang Shaoqing Ren and Jian Sun. 2016. Deep residual learning for image recognition. In CVPR. 770--778."},{"key":"e_1_3_2_2_13_1","volume-title":"Laurens Van Der Maaten, and Kilian Q Weinberger","author":"Huang Gao","year":"2017"},{"key":"e_1_3_2_2_14_1","volume-title":"Entangled watermarks as a defense against model extraction. arXiv preprint arXiv:2002.12200","author":"Jia Hengrui","year":"2020"},{"key":"e_1_3_2_2_15_1","volume-title":"IEEE European Symposium on Security & Privacy. IEEE, 1--16","author":"Juuti Mika"},{"key":"e_1_3_2_2_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/3274694.3274740"},{"key":"e_1_3_2_2_18_1","doi-asserted-by":"publisher","DOI":"10.5555\/2986916.2987033"},{"key":"e_1_3_2_2_19_1","unstructured":"Yann LeCun Corinna Cortes and CJ Burges. 2010. MNIST handwritten digit database. http:\/\/yann.lecun.com\/exdb\/mnist. AT&T Labs (2010).  Yann LeCun Corinna Cortes and CJ Burges. 2010. MNIST handwritten digit database. http:\/\/yann.lecun.com\/exdb\/mnist. AT&T Labs (2010)."},{"key":"e_1_3_2_2_20_1","volume-title":"Defending Against Model Stealing Attacks Using Deceptive Perturbations. arXiv preprint arXiv:1806.00054","author":"Lee Taesung","year":"2018"},{"key":"e_1_3_2_2_21_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"e_1_3_2_2_22_1","volume-title":"Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083","author":"Madry Aleksander","year":"2017"},{"key":"e_1_3_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134057"},{"key":"e_1_3_2_2_24_1","volume-title":"Adversarial frontier stitching for remote neural network watermarking. arXiv preprint arXiv:1711.01894","author":"Merrer Erwan Le","year":"2017"},{"key":"e_1_3_2_2_25_1","volume-title":"Knockoff Nets: Stealing Functionality of Black-Box Models. In CVPR. 4954--4963.","author":"Orekondy Tribhuvanesh","year":"2019"},{"key":"e_1_3_2_2_26_1","volume-title":"Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks. In 8th International Conference on Learning Representations, ICLR. http:\/\/arxiv.org\/abs\/1906","author":"Orekondy Tribhuvanesh","year":"2020"},{"key":"e_1_3_2_2_27_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i01.5432"},{"key":"e_1_3_2_2_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"e_1_3_2_2_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/5.771065"},{"key":"e_1_3_2_2_30_1","volume-title":"Forgotten Siblings: Unifying Attacks on Machine Learning and Digital Watermarking. In IEEE European Symposium on Security & Privacy. 488--502","author":"Quiring E."},{"key":"e_1_3_2_2_31_1","doi-asserted-by":"publisher","DOI":"10.5555\/2627435.2670313"},{"key":"e_1_3_2_2_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2011.6033395"},{"key":"e_1_3_2_2_33_1","doi-asserted-by":"publisher","DOI":"10.5555\/2831143.2831179"},{"key":"e_1_3_2_2_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3474085.3475591"},{"key":"e_1_3_2_2_35_1","volume-title":"How tech giants are investing in artificial intelligence. https:\/\/www.techworld.com\/picture-gallery\/data\/tech-giants-investing-in-artificial-intelligence-3629737. Online","year":"2019"},{"key":"e_1_3_2_2_36_1","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241142"},{"key":"e_1_3_2_2_37_1","doi-asserted-by":"publisher","DOI":"10.5555\/1558977.1558979"},{"key":"e_1_3_2_2_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/3078971.3078974"},{"key":"e_1_3_2_2_39_1","doi-asserted-by":"publisher","DOI":"10.5555\/2534766.2534788"},{"key":"e_1_3_2_2_40_1","unstructured":"Chiyuan Zhang Samy Bengio Moritz Hardt Benjamin Recht and Oriol Vinyals. 2017. Understanding deep learning requires rethinking generalization. https:\/\/arxiv.org\/abs\/1611.03530  Chiyuan Zhang Samy Bengio Moritz Hardt Benjamin Recht and Oriol Vinyals. 2017. Understanding deep learning requires rethinking generalization. https:\/\/arxiv.org\/abs\/1611.03530"},{"key":"e_1_3_2_2_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/3196494.3196550"},{"key":"e_1_3_2_2_42_1","volume-title":"BDPL: A Boundary Differentially Private Layer Against Machine Learning Model Extraction Attacks. In Computer Security -- ESORICS","author":"Zheng Huadi","year":"2019"}],"event":{"name":"MM '21: ACM Multimedia Conference","location":"Virtual Event China","acronym":"MM '21","sponsor":["SIGMM ACM Special Interest Group on Multimedia"]},"container-title":["Proceedings of the 29th ACM International Conference on Multimedia"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3474085.3475591","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3474085.3475591","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T20:48:23Z","timestamp":1750193303000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3474085.3475591"}},"subtitle":["Dynamic Adversarial Watermarking of Neural Networks"],"short-title":[],"issued":{"date-parts":[[2021,10,17]]},"references-count":41,"alternative-id":["10.1145\/3474085.3475591","10.1145\/3474085"],"URL":"https:\/\/doi.org\/10.1145\/3474085.3475591","relation":{},"subject":[],"published":{"date-parts":[[2021,10,17]]},"assertion":[{"value":"2021-10-17","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}