{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,8]],"date-time":"2026-10-08T17:07:34Z","timestamp":1791479254899,"version":"4.3.4"},"publisher-location":"New York, NY, USA","reference-count":66,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,7,10]],"date-time":"2023-07-10T00:00:00Z","timestamp":1688947200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,7,10]]},"DOI":"10.1145\/3579856.3582827","type":"proceedings-article","created":{"date-parts":[[2023,7,5]],"date-time":"2023-07-05T14:52:13Z","timestamp":1688568733000},"page":"300-313","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":12,"title":["EMShepherd: Detecting Adversarial Samples via Side-channel Leakage"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0079-8265","authenticated-orcid":false,"given":"Ruyi","family":"Ding","sequence":"first","affiliation":[{"name":"Northeastern University, United States of America"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6423-0871","authenticated-orcid":false,"given":"Cheng","family":"Gongye","sequence":"additional","affiliation":[{"name":"Northeastern University, United States of America"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2952-5882","authenticated-orcid":false,"given":"Siyue","family":"Wang","sequence":"additional","affiliation":[{"name":"Northeastern University, United States of America"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1397-2442","authenticated-orcid":false,"given":"A. Adam","family":"Ding","sequence":"additional","affiliation":[{"name":"Northeastern University, United States of America"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5169-4044","authenticated-orcid":false,"given":"Yunsi","family":"Fei","sequence":"additional","affiliation":[{"name":"Northeastern University, United States of America"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2023,7,10]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2019. F-Score Definition | DeepAI. https:\/\/deepai.org\/machine-learning-glossary-and-terms\/f-score. (Accessed on 01\/23\/2022).  2019. F-Score Definition | DeepAI. https:\/\/deepai.org\/machine-learning-glossary-and-terms\/f-score. (Accessed on 01\/23\/2022)."},{"key":"e_1_3_2_1_2_1","unstructured":"2020. Running Average Power Limit Energy Reporting. https:\/\/www.intel.com\/content\/www\/us\/en\/developer\/articles\/technical\/software-security-guidance\/advisory-guidance\/running-average-power-limit-energy-reporting.html.  2020. Running Average Power Limit Energy Reporting. https:\/\/www.intel.com\/content\/www\/us\/en\/developer\/articles\/technical\/software-security-guidance\/advisory-guidance\/running-average-power-limit-energy-reporting.html."},{"key":"e_1_3_2_1_3_1","unstructured":"2020. Zynq DPU v3.2 IP Product Guide. https:\/\/www.xilinx.com\/support\/documentation\/ip_documentation\/dpu\/v3_2\/pg338-dpu.pdf. (Accessed on 01\/23\/2022).  2020. Zynq DPU v3.2 IP Product Guide. https:\/\/www.xilinx.com\/support\/documentation\/ip_documentation\/dpu\/v3_2\/pg338-dpu.pdf. (Accessed on 01\/23\/2022)."},{"key":"e_1_3_2_1_4_1","volume-title":"https:\/\/www.tensorflow.org [Online","year":"2022","unstructured":"2021. TensorFlow. https:\/\/www.tensorflow.org [Online ; accessed 24. Jan. 2022 ]. 2021. TensorFlow. https:\/\/www.tensorflow.org [Online; accessed 24. Jan. 2022]."},{"key":"e_1_3_2_1_5_1","volume-title":"Welcome to Ultra96-PYNQ\u2019s documentation! \u2014 Ultra96-PYNQ v2.6 documentation. https:\/\/ultra96-pynq.readthedocs.io\/en\/latest [Online","year":"2022","unstructured":"2021. Welcome to Ultra96-PYNQ\u2019s documentation! \u2014 Ultra96-PYNQ v2.6 documentation. https:\/\/ultra96-pynq.readthedocs.io\/en\/latest [Online ; accessed 23. Jan. 2022 ]. 2021. Welcome to Ultra96-PYNQ\u2019s documentation! \u2014 Ultra96-PYNQ v2.6 documentation. https:\/\/ultra96-pynq.readthedocs.io\/en\/latest [Online; accessed 23. Jan. 2022]."},{"key":"e_1_3_2_1_6_1","volume-title":"Probe Set PBS 2 (incl. Preamplifier). https:\/\/aaronia-shop.com\/products\/probe-set-pbs-2-incl-preamplifier [Online","year":"2022","unstructured":"2022. Probe Set PBS 2 (incl. Preamplifier). https:\/\/aaronia-shop.com\/products\/probe-set-pbs-2-incl-preamplifier [Online ; accessed 23. Jan. 2022 ]. 2022. Probe Set PBS 2 (incl. Preamplifier). https:\/\/aaronia-shop.com\/products\/probe-set-pbs-2-incl-preamplifier [Online; accessed 23. Jan. 2022]."},{"key":"e_1_3_2_1_7_1","volume-title":"https:\/\/www.avnet.com\/wps\/portal\/us\/products\/avnet-boards\/avnet-board-families\/ultra96-v2 [Online","author":"Boards Avnet","year":"2022","unstructured":"2022. Ultra96-V2 | Avnet Boards . https:\/\/www.avnet.com\/wps\/portal\/us\/products\/avnet-boards\/avnet-board-families\/ultra96-v2 [Online ; accessed 23. Jan. 2022 ]. 2022. Ultra96-V2 | Avnet Boards. https:\/\/www.avnet.com\/wps\/portal\/us\/products\/avnet-boards\/avnet-board-families\/ultra96-v2 [Online; accessed 23. Jan. 2022]."},{"key":"e_1_3_2_1_8_1","volume-title":"https:\/\/www.xilinx.com\/products\/design-tools\/vitis\/vitis-ai.html [Online","author":"Vitis","year":"2022","unstructured":"2022. Vitis AI. https:\/\/www.xilinx.com\/products\/design-tools\/vitis\/vitis-ai.html [Online ; accessed 24. Jan. 2022 ]. 2022. Vitis AI. https:\/\/www.xilinx.com\/products\/design-tools\/vitis\/vitis-ai.html [Online; accessed 24. Jan. 2022]."},{"key":"e_1_3_2_1_9_1","volume-title":"Int. Workshop on Cryptographic Hardware & Embedded Systems. 29\u201345","author":"Agrawal Dakshi","year":"2002","unstructured":"Dakshi Agrawal , Bruce Archambeault , Josyula\u00a0 R Rao , and Pankaj Rohatgi . 2002 . The EM side-channel (s) . In Int. Workshop on Cryptographic Hardware & Embedded Systems. 29\u201345 . Dakshi Agrawal, Bruce Archambeault, Josyula\u00a0R Rao, and Pankaj Rohatgi. 2002. The EM side-channel (s). In Int. Workshop on Cryptographic Hardware & Embedded Systems. 29\u201345."},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"crossref","unstructured":"D. Agrawal B. Archambeault J.\u00a0R. Rao and P. Rohatgi. 2002. The EM side-channels. In Int. WkShp on Cryptographic Hardware & Embedded Systems.  D. Agrawal B. Archambeault J.\u00a0R. Rao and P. Rohatgi. 2002. The EM side-channels. In Int. WkShp on Cryptographic Hardware & Embedded Systems.","DOI":"10.1007\/3-540-36400-5_4"},{"key":"e_1_3_2_1_11_1","volume-title":"USENIX Security Symp.515\u2013532","author":"Batina Lejla","year":"2019","unstructured":"Lejla Batina , Shivam Bhasin , Dirmanto Jap , and Stjepan Picek . 2019 . { CSI}{ NN} : Reverse Engineering of Neural Network Architectures Through Electromagnetic Side Channel . In USENIX Security Symp.515\u2013532 . Lejla Batina, Shivam Bhasin, Dirmanto Jap, and Stjepan Picek. 2019. { CSI}{ NN} : Reverse Engineering of Neural Network Architectures Through Electromagnetic Side Channel. In USENIX Security Symp.515\u2013532."},{"key":"e_1_3_2_1_12_1","volume-title":"Dimensionality reduction as a defense against evasion attacks on machine learning classifiers. arXiv preprint arXiv:1704.02654 2","author":"Bhagoji Arjun\u00a0Nitin","year":"2017","unstructured":"Arjun\u00a0Nitin Bhagoji , Daniel Cullina , and Prateek Mittal . 2017. Dimensionality reduction as a defense against evasion attacks on machine learning classifiers. arXiv preprint arXiv:1704.02654 2 ( 2017 ), 1. Arjun\u00a0Nitin Bhagoji, Daniel Cullina, and Prateek Mittal. 2017. Dimensionality reduction as a defense against evasion attacks on machine learning classifiers. arXiv preprint arXiv:1704.02654 2 (2017), 1."},{"key":"e_1_3_2_1_13_1","volume-title":"Int. Conf. on Image Information Processing (ICIIP). 1\u20136.","author":"Bhatnagar Shobhit","year":"2017","unstructured":"Shobhit Bhatnagar , Deepanway Ghosal , and Maheshkumar\u00a0 H Kolekar . 2017 . Classification of fashion article images using convolutional neural networks . In Int. Conf. on Image Information Processing (ICIIP). 1\u20136. Shobhit Bhatnagar, Deepanway Ghosal, and Maheshkumar\u00a0H Kolekar. 2017. Classification of fashion article images using convolutional neural networks. In Int. Conf. on Image Information Processing (ICIIP). 1\u20136."},{"key":"e_1_3_2_1_14_1","volume-title":"End to end learning for self-driving cars. arXiv preprint arXiv:1604.07316","author":"Bojarski Mariusz","year":"2016","unstructured":"Mariusz Bojarski , Davide Del\u00a0Testa , Daniel Dworakowski , Bernhard Firner , Beat Flepp , Prasoon Goyal , Lawrence\u00a0 D Jackel , Mathew Monfort , Urs Muller , Jiakai Zhang , 2016. End to end learning for self-driving cars. arXiv preprint arXiv:1604.07316 ( 2016 ). Mariusz Bojarski, Davide Del\u00a0Testa, Daniel Dworakowski, Bernhard Firner, Beat Flepp, Prasoon Goyal, Lawrence\u00a0D Jackel, Mathew Monfort, Urs Muller, Jiakai Zhang, 2016. End to end learning for self-driving cars. arXiv preprint arXiv:1604.07316 (2016)."},{"key":"e_1_3_2_1_15_1","volume-title":"ACM Workshop on Artificial Intelligence & Security. 3\u201314","author":"Carlini Nicholas","year":"2017","unstructured":"Nicholas Carlini and David Wagner . 2017 . Adversarial examples are not easily detected: Bypassing ten detection methods . In ACM Workshop on Artificial Intelligence & Security. 3\u201314 . Nicholas Carlini and David Wagner. 2017. Adversarial examples are not easily detected: Bypassing ten detection methods. In ACM Workshop on Artificial Intelligence & Security. 3\u201314."},{"key":"e_1_3_2_1_16_1","volume-title":"IEEE Symp. on Security & Privacy. IEEE, 39\u201357","author":"Carlini Nicholas","year":"2017","unstructured":"Nicholas Carlini and David Wagner . 2017 . Towards evaluating the robustness of neural networks . In IEEE Symp. on Security & Privacy. IEEE, 39\u201357 . Nicholas Carlini and David Wagner. 2017. Towards evaluating the robustness of neural networks. In IEEE Symp. on Security & Privacy. IEEE, 39\u201357."},{"key":"e_1_3_2_1_17_1","volume-title":"Int. Workshop on Cryptographic Hardware & Embedded Systems. Springer, 13\u201328","author":"Chari Suresh","year":"2002","unstructured":"Suresh Chari , Josyula\u00a0 R Rao , and Pankaj Rohatgi . 2002 . Template attacks . In Int. Workshop on Cryptographic Hardware & Embedded Systems. Springer, 13\u201328 . Suresh Chari, Josyula\u00a0R Rao, and Pankaj Rohatgi. 2002. Template attacks. In Int. Workshop on Cryptographic Hardware & Embedded Systems. Springer, 13\u201328."},{"key":"e_1_3_2_1_18_1","volume-title":"International Conference on Applied Cryptography and Network Security. Springer, 96\u2013113","author":"Chmielewski \u0141ukasz","year":"2021","unstructured":"\u0141ukasz Chmielewski and L\u00e9o Weissbart . 2021 . On reverse engineering neural network implementation on gpu . In International Conference on Applied Cryptography and Network Security. Springer, 96\u2013113 . \u0141ukasz Chmielewski and L\u00e9o Weissbart. 2021. On reverse engineering neural network implementation on gpu. In International Conference on Applied Cryptography and Network Security. Springer, 96\u2013113."},{"key":"e_1_3_2_1_19_1","volume-title":"Proc. Design Automation Conf.1\u20136.","author":"Das Debayan","year":"2019","unstructured":"Debayan Das , Anupam Golder , Josef Danial , Santosh Ghosh , Arijit Raychowdhury , and Shreyas Sen . 2019 . X-DeepSCA: Cross-device deep learning side channel attack . In Proc. Design Automation Conf.1\u20136. Debayan Das, Anupam Golder, Josef Danial, Santosh Ghosh, Arijit Raychowdhury, and Shreyas Sen. 2019. X-DeepSCA: Cross-device deep learning side channel attack. In Proc. Design Automation Conf.1\u20136."},{"key":"e_1_3_2_1_20_1","volume-title":"Adaptive subgradient methods for online learning and stochastic optimization.Journal of machine learning research 12, 7","author":"Duchi John","year":"2011","unstructured":"John Duchi , Elad Hazan , and Yoram Singer . 2011. Adaptive subgradient methods for online learning and stochastic optimization.Journal of machine learning research 12, 7 ( 2011 ). John Duchi, Elad Hazan, and Yoram Singer. 2011. Adaptive subgradient methods for online learning and stochastic optimization.Journal of machine learning research 12, 7 (2011)."},{"key":"e_1_3_2_1_21_1","volume-title":"Detecting adversarial samples from artifacts. arXiv preprint arXiv:1703.00410","author":"Feinman Reuben","year":"2017","unstructured":"Reuben Feinman , Ryan\u00a0 R Curtin , Saurabh Shintre , and Andrew\u00a0 B Gardner . 2017. Detecting adversarial samples from artifacts. arXiv preprint arXiv:1703.00410 ( 2017 ). Reuben Feinman, Ryan\u00a0R Curtin, Saurabh Shintre, and Andrew\u00a0B Gardner. 2017. Detecting adversarial samples from artifacts. arXiv preprint arXiv:1703.00410 (2017)."},{"key":"e_1_3_2_1_22_1","unstructured":"David Forsyth and Jean Ponce. 2011. Computer vision: A modern approach.Prentice hall.  David Forsyth and Jean Ponce. 2011. Computer vision: A modern approach.Prentice hall."},{"key":"e_1_3_2_1_23_1","volume-title":"Machine learning, medical diagnosis, and biomedical engineering research-commentary. Biomedical engineering online 13, 1","author":"Foster R","year":"2014","unstructured":"Kenneth\u00a0 R Foster , Robert Koprowski , and Joseph\u00a0 D Skufca . 2014. Machine learning, medical diagnosis, and biomedical engineering research-commentary. Biomedical engineering online 13, 1 ( 2014 ), 1\u20139. Kenneth\u00a0R Foster, Robert Koprowski, and Joseph\u00a0D Skufca. 2014. Machine learning, medical diagnosis, and biomedical engineering research-commentary. Biomedical engineering online 13, 1 (2014), 1\u20139."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.5555\/2946645.2946704"},{"key":"e_1_3_2_1_25_1","volume-title":"Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572","author":"Goodfellow J","year":"2014","unstructured":"Ian\u00a0 J Goodfellow , Jonathon Shlens , and Christian Szegedy . 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 ( 2014 ). Ian\u00a0J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)."},{"key":"e_1_3_2_1_26_1","volume-title":"On the (statistical) detection of adversarial examples. arXiv preprint arXiv:1702.06280","author":"Grosse Kathrin","year":"2017","unstructured":"Kathrin Grosse , Praveen Manoharan , Nicolas Papernot , Michael Backes , and Patrick McDaniel . 2017. On the (statistical) detection of adversarial examples. arXiv preprint arXiv:1702.06280 ( 2017 ). Kathrin Grosse, Praveen Manoharan, Nicolas Papernot, Michael Backes, and Patrick McDaniel. 2017. On the (statistical) detection of adversarial examples. arXiv preprint arXiv:1702.06280 (2017)."},{"key":"e_1_3_2_1_27_1","unstructured":"Kaiming He Xiangyu Zhang Shaoqing Ren and Jian Sun. 2015. Deep Residual Learning for Image Recognition. arxiv:1512.03385\u00a0[cs.CV]  Kaiming He Xiangyu Zhang Shaoqing Ren and Jian Sun. 2015. Deep Residual Learning for Image Recognition. arxiv:1512.03385\u00a0[cs.CV]"},{"key":"e_1_3_2_1_28_1","volume-title":"MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applications. aXiv:1704.04861","author":"Howard G.","year":"2017","unstructured":"Andrew\u00a0 G. Howard , Menglong Zhu , Bo Chen , Dmitry Kalenichenko , Weijun Wang , Tobias Weyand , Marco Andreetto , and Hartwig Adam . 2017. MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applications. aXiv:1704.04861 ( 2017 ). Andrew\u00a0G. Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andreetto, and Hartwig Adam. 2017. MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applications. aXiv:1704.04861 (2017)."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2005.50"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2021.3089943"},{"key":"e_1_3_2_1_31_1","volume-title":"Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980","author":"Kingma P","year":"2014","unstructured":"Diederik\u00a0 P Kingma and Jimmy Ba . 2014 . Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 (2014). Diederik\u00a0P Kingma and Jimmy Ba. 2014. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 (2014)."},{"key":"e_1_3_2_1_32_1","volume-title":"Annual Int. Cryptology Conf. Springer, 388\u2013397","author":"Kocher Paul","year":"1999","unstructured":"Paul Kocher , Joshua Jaffe , and Benjamin Jun . 1999 . Differential power analysis . In Annual Int. Cryptology Conf. Springer, 388\u2013397 . Paul Kocher, Joshua Jaffe, and Benjamin Jun. 1999. Differential power analysis. In Annual Int. Cryptology Conf. Springer, 388\u2013397."},{"key":"e_1_3_2_1_33_1","unstructured":"Alexey Kurakin Ian Goodfellow Samy Bengio 2016. Adversarial examples in the physical world.  Alexey Kurakin Ian Goodfellow Samy Bengio 2016. Adversarial examples in the physical world."},{"key":"e_1_3_2_1_34_1","volume-title":"http:\/\/cdn.teledynelecroy.com\/files\/pdf\/waverunner_6_zi_datasheet.pdf[Online","author":"LeCroy Teledyne","year":"2022","unstructured":"[ 34 ] Teledyne LeCroy . 2022. http:\/\/cdn.teledynelecroy.com\/files\/pdf\/waverunner_6_zi_datasheet.pdf[Online ; accessed 23. Jan. 2022 ]. [34] Teledyne LeCroy. 2022. http:\/\/cdn.teledynelecroy.com\/files\/pdf\/waverunner_6_zi_datasheet.pdf[Online; accessed 23. Jan. 2022]."},{"key":"e_1_3_2_1_35_1","volume-title":"Proc. IEEE Int. Conf. on Computer Vision. 5764\u20135772","author":"Li Xin","year":"2017","unstructured":"Xin Li and Fuxin Li . 2017 . Adversarial examples detection in deep networks with convolutional filter statistics . In Proc. IEEE Int. Conf. on Computer Vision. 5764\u20135772 . Xin Li and Fuxin Li. 2017. Adversarial examples detection in deep networks with convolutional filter statistics. In Proc. IEEE Int. Conf. on Computer Vision. 5764\u20135772."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00063"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01234-2_23"},{"key":"e_1_3_2_1_38_1","volume-title":"Proc. Network & Distributed System Security Symposium (NDSS","author":"Ma Shiqing","year":"2019","unstructured":"Shiqing Ma and Yingqi Liu . 2019 . Nic: Detecting adversarial samples with neural network invariant checking . In Proc. Network & Distributed System Security Symposium (NDSS 2019). Shiqing Ma and Yingqi Liu. 2019. Nic: Detecting adversarial samples with neural network invariant checking. In Proc. Network & Distributed System Security Symposium (NDSS 2019)."},{"key":"e_1_3_2_1_39_1","volume-title":"Characterizing adversarial subspaces using local intrinsic dimensionality. arXiv preprint arXiv:1801.02613","author":"Ma Xingjun","year":"2018","unstructured":"Xingjun Ma , Bo Li , Yisen Wang , Sarah\u00a0 M Erfani , Sudanthi Wijewickrema , Grant Schoenebeck , Dawn Song , Michael\u00a0 E Houle , and James Bailey . 2018. Characterizing adversarial subspaces using local intrinsic dimensionality. arXiv preprint arXiv:1801.02613 ( 2018 ). Xingjun Ma, Bo Li, Yisen Wang, Sarah\u00a0M Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Dawn Song, Michael\u00a0E Houle, and James Bailey. 2018. Characterizing adversarial subspaces using local intrinsic dimensionality. arXiv preprint arXiv:1801.02613 (2018)."},{"key":"e_1_3_2_1_40_1","volume-title":"Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083","author":"Madry Aleksander","year":"2017","unstructured":"Aleksander Madry , Aleksandar Makelov , Ludwig Schmidt , Dimitris Tsipras , and Adrian Vladu . 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 ( 2017 ). Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)."},{"key":"e_1_3_2_1_41_1","volume-title":"Foundations of statistical natural language processing","author":"Manning Christopher","unstructured":"Christopher Manning and Hinrich Schutze . 1999. Foundations of statistical natural language processing . MIT press . Christopher Manning and Hinrich Schutze. 1999. Foundations of statistical natural language processing. MIT press."},{"key":"e_1_3_2_1_42_1","volume-title":"ACM SIGSAC Conf. on Computer & Communications Security. 135\u2013147","author":"Meng Dongyu","year":"2017","unstructured":"Dongyu Meng and Hao Chen . 2017 . Magnet: a two-pronged defense against adversarial examples . In ACM SIGSAC Conf. on Computer & Communications Security. 135\u2013147 . Dongyu Meng and Hao Chen. 2017. Magnet: a two-pronged defense against adversarial examples. In ACM SIGSAC Conf. on Computer & Communications Security. 135\u2013147."},{"key":"e_1_3_2_1_43_1","volume-title":"Proc. IEEE Conf. Computer Vision & Pattern Recognition. 2574\u20132582","author":"Moosavi-Dezfooli Seyed-Mohsen","year":"2016","unstructured":"Seyed-Mohsen Moosavi-Dezfooli , Alhussein Fawzi , and Pascal Frossard . 2016 . Deepfool: a simple and accurate method to fool deep neural networks . In Proc. IEEE Conf. Computer Vision & Pattern Recognition. 2574\u20132582 . Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. 2016. Deepfool: a simple and accurate method to fool deep neural networks. In Proc. IEEE Conf. Computer Vision & Pattern Recognition. 2574\u20132582."},{"key":"e_1_3_2_1_44_1","volume-title":"Deep face recognition","author":"Parkhi M","unstructured":"Omkar\u00a0 M Parkhi , Andrea Vedaldi , and Andrew Zisserman . 2015. Deep face recognition . British Machine Vision Association . Omkar\u00a0M Parkhi, Andrea Vedaldi, and Andrew Zisserman. 2015. Deep face recognition. British Machine Vision Association."},{"key":"e_1_3_2_1_45_1","volume-title":"Workshop on Reliable Machine Learning in the Wild. http:\/\/arxiv.org\/abs\/1707","author":"Rauber Jonas","year":"2017","unstructured":"Jonas Rauber , Wieland Brendel , and Matthias Bethge . 2017 . Foolbox: A Python toolbox to benchmark the robustness of machine learning models . In Workshop on Reliable Machine Learning in the Wild. http:\/\/arxiv.org\/abs\/1707 .04131 Jonas Rauber, Wieland Brendel, and Matthias Bethge. 2017. Foolbox: A Python toolbox to benchmark the robustness of machine learning models. In Workshop on Reliable Machine Learning in the Wild. http:\/\/arxiv.org\/abs\/1707.04131"},{"key":"e_1_3_2_1_46_1","volume-title":"Real-Time Object Detection. arXiv preprint arXiv:1506.02640","author":"Redmon Joseph","year":"2016","unstructured":"Joseph Redmon , Santosh Divvala , Ross Girshick , and Ali Farhadi . 2016. You Only Look Once: Unified , Real-Time Object Detection. arXiv preprint arXiv:1506.02640 ( 2016 ). Joseph Redmon, Santosh Divvala, Ross Girshick, and Ali Farhadi. 2016. You Only Look Once: Unified, Real-Time Object Detection. arXiv preprint arXiv:1506.02640 (2016)."},{"key":"e_1_3_2_1_47_1","volume-title":"Improving the accuracy of medical diagnosis with causal machine learning. Nature communications 11, 1","author":"Richens G","year":"2020","unstructured":"Jonathan\u00a0 G Richens , Ciarn\u00a0 M Lee , and Saurabh Johri . 2020. Improving the accuracy of medical diagnosis with causal machine learning. Nature communications 11, 1 ( 2020 ), 1\u20139. Jonathan\u00a0G Richens, Ciarn\u00a0M Lee, and Saurabh Johri. 2020. Improving the accuracy of medical diagnosis with causal machine learning. Nature communications 11, 1 (2020), 1\u20139."},{"key":"e_1_3_2_1_48_1","volume-title":"Grad-CAM: Why did you say that?arXiv preprint arXiv:1611.07450","author":"Selvaraju R","year":"2016","unstructured":"Ramprasaath\u00a0 R Selvaraju , Abhishek Das , Ramakrishna Vedantam , Michael Cogswell , Devi Parikh , and Dhruv Batra . 2016. Grad-CAM: Why did you say that?arXiv preprint arXiv:1611.07450 ( 2016 ). Ramprasaath\u00a0R Selvaraju, Abhishek Das, Ramakrishna Vedantam, Michael Cogswell, Devi Parikh, and Dhruv Batra. 2016. Grad-CAM: Why did you say that?arXiv preprint arXiv:1611.07450 (2016)."},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"e_1_3_2_1_50_1","volume-title":"Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556","author":"Simonyan Karen","year":"2014","unstructured":"Karen Simonyan and Andrew Zisserman . 2014. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 ( 2014 ). Karen Simonyan and Andrew Zisserman. 2014. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 (2014)."},{"key":"e_1_3_2_1_51_1","unstructured":"Karen Simonyan and Andrew Zisserman. 2015. Very Deep Convolutional Networks for Large-Scale Image Recognition. arxiv:1409.1556\u00a0[cs.CV]  Karen Simonyan and Andrew Zisserman. 2015. Very Deep Convolutional Networks for Large-Scale Image Recognition. arxiv:1409.1556\u00a0[cs.CV]"},{"key":"e_1_3_2_1_52_1","volume-title":"Dropout: a simple way to prevent neural networks from overfitting. The journal of machine learning research 15, 1","author":"Srivastava Nitish","year":"2014","unstructured":"Nitish Srivastava , Geoffrey Hinton , Alex Krizhevsky , Ilya Sutskever , and Ruslan Salakhutdinov . 2014. Dropout: a simple way to prevent neural networks from overfitting. The journal of machine learning research 15, 1 ( 2014 ), 1929\u20131958. Nitish Srivastava, Geoffrey Hinton, Alex Krizhevsky, Ilya Sutskever, and Ruslan Salakhutdinov. 2014. Dropout: a simple way to prevent neural networks from overfitting. The journal of machine learning research 15, 1 (2014), 1929\u20131958."},{"key":"e_1_3_2_1_53_1","volume-title":"Going Deeper with Convolutions. arXiv preprint arXiv:1409.4842","author":"Szegedy Christian","year":"2014","unstructured":"Christian Szegedy , Wei Liu , Yangqing Jia , Pierre Sermanet , Scott Reed , Dragomir Anguelov , Dumitru Erhan , Vincent Vanhoucke , and Andrew Rabinovich . 2014. Going Deeper with Convolutions. arXiv preprint arXiv:1409.4842 ( 2014 ). Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. 2014. Going Deeper with Convolutions. arXiv preprint arXiv:1409.4842 (2014)."},{"key":"e_1_3_2_1_54_1","volume-title":"Attacks meet interpretability: Attribute-steered detection of adversarial samples. arXiv preprint arXiv:1810","author":"Tao Guanhong","year":"2018","unstructured":"Guanhong Tao , Shiqing Ma , Yingqi Liu , and Xiangyu Zhang . 2018 . Attacks meet interpretability: Attribute-steered detection of adversarial samples. arXiv preprint arXiv:1810 .11580 (2018). Guanhong Tao, Shiqing Ma, Yingqi Liu, and Xiangyu Zhang. 2018. Attacks meet interpretability: Attribute-steered detection of adversarial samples. arXiv preprint arXiv:1810.11580 (2018)."},{"key":"e_1_3_2_1_55_1","first-page":"1633","article-title":"On adaptive attacks to adversarial example defenses","volume":"33","author":"Tramer Florian","year":"2020","unstructured":"Florian Tramer , Nicholas Carlini , Wieland Brendel , and Aleksander Madry . 2020 . On adaptive attacks to adversarial example defenses . Advances in Neural Information Processing Systems 33 (2020), 1633 \u2013 1645 . Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. 2020. On adaptive attacks to adversarial example defenses. Advances in Neural Information Processing Systems 33 (2020), 1633\u20131645.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_1_56_1","volume-title":"Visualizing data using t-SNE.Journal of machine learning research 9, 11","author":"Maaten Laurens Van\u00a0der","year":"2008","unstructured":"Laurens Van\u00a0der Maaten and Geoffrey Hinton . 2008. Visualizing data using t-SNE.Journal of machine learning research 9, 11 ( 2008 ). Laurens Van\u00a0der Maaten and Geoffrey Hinton. 2008. Visualizing data using t-SNE.Journal of machine learning research 9, 11 (2008)."},{"key":"e_1_3_2_1_57_1","volume-title":"Proceedings of the AAAI conference on artificial intelligence, Vol.\u00a034","author":"Vinogradova Kira","year":"2020","unstructured":"Kira Vinogradova , Alexandr Dibrov , and Gene Myers . 2020 . Towards interpretable semantic segmentation via gradient-weighted class activation mapping (student abstract) . In Proceedings of the AAAI conference on artificial intelligence, Vol.\u00a034 . 13943\u201313944. Kira Vinogradova, Alexandr Dibrov, and Gene Myers. 2020. Towards interpretable semantic segmentation via gradient-weighted class activation mapping (student abstract). In Proceedings of the AAAI conference on artificial intelligence, Vol.\u00a034. 13943\u201313944."},{"key":"e_1_3_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1145\/3240765.3264699"},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"crossref","unstructured":"Xiao Wang Siyue Wang Pin-Yu Chen Yanzhi Wang Brian Kulis Xue Lin and Sang\u00a0Peter Chin. 2019. Protecting Neural Networks with Hierarchical Random Switching: Towards Better Robustness-Accuracy Trade-off for Stochastic Defenses. In IJCAI.  Xiao Wang Siyue Wang Pin-Yu Chen Yanzhi Wang Brian Kulis Xue Lin and Sang\u00a0Peter Chin. 2019. Protecting Neural Networks with Hierarchical Random Switching: Towards Better Robustness-Accuracy Trade-off for Stochastic Defenses. In IJCAI.","DOI":"10.24963\/ijcai.2019\/833"},{"key":"e_1_3_2_1_60_1","volume-title":"IEEE Conf. on Computer Communications. IEEE, 2512\u20132520","author":"Wang Zhibo","year":"2019","unstructured":"Zhibo Wang , Mengkai Song , Zhifei Zhang , Yang Song , Qian Wang , and Hairong Qi . 2019 . Beyond inferring class representatives: User-level privacy leakage from federated learning . In IEEE Conf. on Computer Communications. IEEE, 2512\u20132520 . Zhibo Wang, Mengkai Song, Zhifei Zhang, Yang Song, Qian Wang, and Hairong Qi. 2019. Beyond inferring class representatives: User-level privacy leakage from federated learning. In IEEE Conf. on Computer Communications. IEEE, 2512\u20132520."},{"key":"e_1_3_2_1_61_1","volume-title":"Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155","author":"Xu Weilin","year":"2017","unstructured":"Weilin Xu , David Evans , and Yanjun Qi. 2017. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155 ( 2017 ). Weilin Xu, David Evans, and Yanjun Qi. 2017. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155 (2017)."},{"key":"e_1_3_2_1_62_1","volume-title":"What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradiction. arXiv preprint arXiv:2201.09650","author":"Yang Yijun","year":"2022","unstructured":"Yijun Yang , Ruiyuan Gao , Yu Li , Qiuxia Lai , and Qiang Xu. 2022. What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradiction. arXiv preprint arXiv:2201.09650 ( 2022 ). Yijun Yang, Ruiyuan Gao, Yu Li, Qiuxia Lai, and Qiang Xu. 2022. What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradiction. arXiv preprint arXiv:2201.09650 (2022)."},{"key":"e_1_3_2_1_63_1","volume-title":"IEEE Int. Symp. on Hardware Oriented Security & Trust (HOST). IEEE, 209\u2013218","author":"Yu Honggang","year":"2020","unstructured":"Honggang Yu , Haocheng Ma , Kaichen Yang , Yiqiang Zhao , and Yier Jin . 2020 . DeepEM: Deep Neural Networks Model Recovery through EM Side-Channel Information Leakage . In IEEE Int. Symp. on Hardware Oriented Security & Trust (HOST). IEEE, 209\u2013218 . Honggang Yu, Haocheng Ma, Kaichen Yang, Yiqiang Zhao, and Yier Jin. 2020. DeepEM: Deep Neural Networks Model Recovery through EM Side-Channel Information Leakage. In IEEE Int. Symp. on Hardware Oriented Security & Trust (HOST). IEEE, 209\u2013218."},{"key":"e_1_3_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3106169"},{"key":"e_1_3_2_1_65_1","volume-title":"Proceedings of the IEEE\/CVF International Conference on Computer Vision. 7878\u20137887","author":"Zhou Dawei","year":"2021","unstructured":"Dawei Zhou , Nannan Wang , Chunlei Peng , Xinbo Gao , Xiaoyu Wang , Jun Yu , and Tongliang Liu . 2021 . Removing adversarial noise in class activation feature space . In Proceedings of the IEEE\/CVF International Conference on Computer Vision. 7878\u20137887 . Dawei Zhou, Nannan Wang, Chunlei Peng, Xinbo Gao, Xiaoyu Wang, Jun Yu, and Tongliang Liu. 2021. Removing adversarial noise in class activation feature space. In Proceedings of the IEEE\/CVF International Conference on Computer Vision. 7878\u20137887."},{"key":"e_1_3_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2988311"}],"event":{"name":"ASIA CCS '23: ACM ASIA Conference on Computer and Communications Security","location":"Melbourne VIC Australia","acronym":"ASIA CCS '23","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the ACM Asia Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3579856.3582827","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:51:28Z","timestamp":1750182688000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3579856.3582827"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,7,10]]},"references-count":66,"alternative-id":["10.1145\/3579856.3582827","10.1145\/3579856"],"URL":"https:\/\/doi.org\/10.1145\/3579856.3582827","relation":{},"subject":[],"published":{"date-parts":[[2023,7,10]]},"assertion":[{"value":"2023-07-10","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}