{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,13]],"date-time":"2025-11-13T07:24:55Z","timestamp":1763018695950,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":57,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,7,14]],"date-time":"2024-07-14T00:00:00Z","timestamp":1720915200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U19B2044"],"award-info":[{"award-number":["U19B2044"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,7,14]]},"DOI":"10.1145\/3638530.3664104","type":"proceedings-article","created":{"date-parts":[[2024,8,1]],"date-time":"2024-08-01T14:54:43Z","timestamp":1722524083000},"page":"1563-1572","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":2,"title":["Tightening the Approximation Error of Adversarial Risk with Auto Loss Function Search"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8268-2057","authenticated-orcid":false,"given":"Pengfei","family":"Xia","sequence":"first","affiliation":[{"name":"University of Science and Technology of China, Hefei, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9484-2310","authenticated-orcid":false,"given":"Ziqiang","family":"Li","sequence":"additional","affiliation":[{"name":"University of Science and Technology of China, Hefei, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2332-3959","authenticated-orcid":false,"given":"Bin","family":"Li","sequence":"additional","affiliation":[{"name":"University of Science and Technology of China, Hefei, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2024,8]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Sravanti Addepalli Samyak Jain Gaurang Sriramanan and Venkatesh Babu Radhakrishnan. 2021. Towards Achieving Adversarial Robustness Beyond Perceptual Limits. (2021)."},{"key":"e_1_3_2_1_2_1","volume-title":"Generating natural language adversarial examples. arXiv preprint arXiv:1804.07998","author":"Alzantot Moustafa","year":"2018","unstructured":"Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. 2018. Generating natural language adversarial examples. arXiv preprint arXiv:1804.07998 (2018)."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1006\/jcss.1997.1472"},{"key":"e_1_3_2_1_4_1","volume-title":"International conference on machine learning. PMLR, 274--283","author":"Athalye Anish","year":"2018","unstructured":"Anish Athalye, Nicholas Carlini, and David Wagner. 2018. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning. PMLR, 274--283."},{"key":"e_1_3_2_1_5_1","volume-title":"On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705","author":"Carlini Nicholas","year":"2019","unstructured":"Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. 2019. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705 (2019)."},{"volume-title":"Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp)","author":"Carlini Nicholas","key":"e_1_3_2_1_6_1","unstructured":"Nicholas Carlini and David Wagner. 2017. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp). IEEE, 39--57."},{"key":"e_1_3_2_1_7_1","volume-title":"Unlabeled data improves adversarial robustness. Advances in Neural Information Processing Systems 32","author":"Carmon Yair","year":"2019","unstructured":"Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy S Liang. 2019. Unlabeled data improves adversarial robustness. Advances in Neural Information Processing Systems 32 (2019)."},{"key":"e_1_3_2_1_8_1","volume-title":"International conference on machine learning. PMLR, 2206--2216","author":"Croce Francesco","year":"2020","unstructured":"Francesco Croce and Matthias Hein. 2020. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning. PMLR, 2206--2216."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01543"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/2330784.2330799"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"e_1_3_2_1_12_1","volume-title":"d.]. Robustness (python library)","author":"Engstrom Logan","year":"2019","unstructured":"Logan Engstrom, Andrew Ilyas, Shibani Santurkar, and Dimitris Tsipras. [n. d.]. Robustness (python library), 2019. URL https:\/\/github.com\/MadryLab\/robustness 4, 4 ([n. d.]), 4--3."},{"key":"e_1_3_2_1_13_1","unstructured":"Logan Engstrom Brandon Tran Dimitris Tsipras Ludwig Schmidt and Aleksander Madry. 2018. A rotation and a translation suffice: Fooling cnns with simple transformations. (2018)."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.169"},{"volume-title":"Foundations of genetic algorithms.","author":"Goldberg David E","key":"e_1_3_2_1_15_1","unstructured":"David E Goldberg and Kalyanmoy Deb. 1991. A comparative analysis of selection schemes used in genetic algorithms. In Foundations of genetic algorithms. Vol. 1. Elsevier, 69--93."},{"key":"e_1_3_2_1_16_1","volume-title":"Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572","author":"Goodfellow Ian J","year":"2014","unstructured":"Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1002\/rob.21918"},{"key":"e_1_3_2_1_18_1","volume-title":"Countering adversarial images using input transformations. arXiv preprint arXiv:1711.00117","author":"Guo Chuan","year":"2017","unstructured":"Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. 2017. Countering adversarial images using input transformations. arXiv preprint arXiv:1711.00117 (2017)."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2020.106622"},{"key":"e_1_3_2_1_20_1","volume-title":"International Conference on Machine Learning. PMLR, 2712--2721","author":"Hendrycks Dan","year":"2019","unstructured":"Dan Hendrycks, Kimin Lee, and Mantas Mazeika. 2019. Using pre-training can improve model robustness and uncertainty. In International Conference on Machine Learning. PMLR, 2712--2721."},{"key":"e_1_3_2_1_21_1","volume-title":"Self-adaptive training: beyond empirical risk minimization. Advances in neural information processing systems 33","author":"Huang Lang","year":"2020","unstructured":"Lang Huang, Chao Zhang, and Hongyang Zhang. 2020. Self-adaptive training: beyond empirical risk minimization. Advances in neural information processing systems 33 (2020), 19365--19376."},{"key":"e_1_3_2_1_22_1","volume-title":"International Conference on Learning Representations.","author":"Kou Connie","year":"2019","unstructured":"Connie Kou, Hwee Kuan Lee, Ee-Chien Chang, and Teck Khim Ng. 2019. Enhancing transformation-based defenses against adversarial attacks with a distribution classifier. In International Conference on Learning Representations."},{"volume-title":"Genetic programming: on the programming of computers by means of natural selection","author":"Koza John R","key":"e_1_3_2_1_23_1","unstructured":"John R Koza. 1992. Genetic programming: on the programming of computers by means of natural selection. Vol. 1. MIT press."},{"key":"e_1_3_2_1_24_1","unstructured":"A. Krizhevsky and G. Hinton. 2009. Learning multiple layers of features from tiny images. Master's thesis Department of Computer Science University of Toronto (2009)."},{"key":"e_1_3_2_1_25_1","volume-title":"Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236","author":"Kurakin Alexey","year":"2016","unstructured":"Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2016. Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236 (2016)."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00850"},{"key":"e_1_3_2_1_27_1","volume-title":"AutoLoss-Zero: Searching Loss Functions from Scratch for Generic Tasks. arXiv preprint arXiv:2103.14026","author":"Li Hao","year":"2021","unstructured":"Hao Li, Tianwen Fu, Jifeng Dai, Hongsheng Li, Gao Huang, and Xizhou Zhu. 2021. AutoLoss-Zero: Searching Loss Functions from Scratch for Generic Tasks. arXiv preprint arXiv:2103.14026 (2021)."},{"key":"e_1_3_2_1_28_1","volume-title":"Auto Seg-Loss: Searching Metric Surrogates for Semantic Segmentation. arXiv preprint arXiv:2010.07930","author":"Li Hao","year":"2020","unstructured":"Hao Li, Chenxin Tao, Xizhou Zhu, Xiaogang Wang, Gao Huang, and Jifeng Dai. 2020. Auto Seg-Loss: Searching Metric Surrogates for Semantic Segmentation. arXiv preprint arXiv:2010.07930 (2020)."},{"key":"e_1_3_2_1_29_1","volume-title":"Loss Function Discovery for Object Detection via Convergence-Simulation Driven Search. arXiv preprint arXiv:2102.04700","author":"Liu Peidong","year":"2021","unstructured":"Peidong Liu, Gengwei Zhang, Bochao Wang, Hang Xu, Xiaodan Liang, Yong Jiang, and Zhenguo Li. 2021. Loss Function Discovery for Object Detection via Convergence-Simulation Driven Search. arXiv preprint arXiv:2102.04700 (2021)."},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298965"},{"key":"e_1_3_2_1_31_1","volume-title":"Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083","author":"Madry Aleksander","year":"2017","unstructured":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)."},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"e_1_3_2_1_33_1","unstructured":"Adam Paszke Sam Gross Soumith Chintala Gregory Chanan Edward Yang Zachary DeVito Zeming Lin Alban Desmaison Luca Antiga and Adam Lerer. 2017. Automatic differentiation in pytorch. (2017)."},{"key":"e_1_3_2_1_34_1","volume-title":"International Conference on Machine Learning. PMLR, 8093--8104","author":"Rice Leslie","year":"2020","unstructured":"Leslie Rice, Eric Wong, and Zico Kolter. 2020. Overfitting in adversarially robust deep learning. In International Conference on Machine Learning. PMLR, 8093--8104."},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.11504"},{"key":"e_1_3_2_1_36_1","volume-title":"Improving adversarial robustness using proxy distributions. arXiv preprint arXiv:2104.09425","author":"Sehwag Vikash","year":"2021","unstructured":"Vikash Sehwag, Saeed Mahloujifar, Tinashe Handina, Sihui Dai, Chong Xiang, Mung Chiang, and Prateek Mittal. 2021. Improving adversarial robustness using proxy distributions. arXiv preprint arXiv:2104.09425 (2021)."},{"key":"e_1_3_2_1_37_1","volume-title":"Adversarial training for free! arXiv preprint arXiv:1904.12843","author":"Shafahi Ali","year":"2019","unstructured":"Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. 2019. Adversarial training for free! arXiv preprint arXiv:1904.12843 (2019)."},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/3190618"},{"key":"e_1_3_2_1_40_1","volume-title":"Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199","author":"Szegedy Christian","year":"2013","unstructured":"Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)."},{"key":"e_1_3_2_1_41_1","volume-title":"On adaptive attacks to adversarial example defenses. arXiv preprint arXiv:2002.08347","author":"Tramer Florian","year":"2020","unstructured":"Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. 2020. On adaptive attacks to adversarial example defenses. arXiv preprint arXiv:2002.08347 (2020)."},{"key":"e_1_3_2_1_42_1","volume-title":"International Conference on Machine Learning. PMLR, 5025--5034","author":"Uesato Jonathan","year":"2018","unstructured":"Jonathan Uesato, Brendan O'donoghue, Pushmeet Kohli, and Aaron Oord. 2018. Adversarial risk and the dangers of evaluating against weak attacks. In International Conference on Machine Learning. PMLR, 5025--5034."},{"key":"e_1_3_2_1_43_1","volume-title":"International Conference on Machine Learning. PMLR, 10029--10038","author":"Wang Xiaobo","year":"2020","unstructured":"Xiaobo Wang, Shuo Wang, Cheng Chi, Shifeng Zhang, and Tao Mei. 2020. Loss function search for face recognition. In International Conference on Machine Learning. PMLR, 10029--10038."},{"key":"e_1_3_2_1_44_1","volume-title":"International Conference on Learning Representations.","author":"Wang Yisen","year":"2019","unstructured":"Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. 2019. Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations."},{"key":"e_1_3_2_1_45_1","volume-title":"Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.03994","author":"Wong Eric","year":"2020","unstructured":"Eric Wong, Leslie Rice, and J Zico Kolter. 2020. Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.03994 (2020)."},{"key":"e_1_3_2_1_46_1","first-page":"2958","article-title":"Adversarial weight perturbation helps robust generalization","volume":"33","author":"Wu Dongxian","year":"2020","unstructured":"Dongxian Wu, Shu-Tao Xia, and Yisen Wang. 2020. Adversarial weight perturbation helps robust generalization. Advances in Neural Information Processing Systems 33 (2020), 2958--2969.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2021.05.055"},{"key":"e_1_3_2_1_48_1","volume-title":"Understanding the error in evaluating adversarial robustness. arXiv preprint arXiv:2101.02325","author":"Xia Pengfei","year":"2021","unstructured":"Pengfei Xia, Ziqiang Li, Hongjing Niu, and Bin Li. 2021. Understanding the error in evaluating adversarial robustness. arXiv preprint arXiv:2101.02325 (2021)."},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2022\/554"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.patrec.2021.10.024"},{"key":"e_1_3_2_1_51_1","volume-title":"Enhancing Backdoor Attacks with Multi-Level MMD Regularization","author":"Xia Pengfei","year":"2022","unstructured":"Pengfei Xia, Hongjing Niu, Ziqiang Li, and Bin Li. 2022. Enhancing Backdoor Attacks with Multi-Level MMD Regularization. IEEE Transactions on Dependable and Secure Computing (2022)."},{"key":"e_1_3_2_1_52_1","volume-title":"Spatially transformed adversarial examples. arXiv preprint arXiv:1801.02612","author":"Xiao Chaowei","year":"2018","unstructured":"Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. 2018. Spatially transformed adversarial examples. arXiv preprint arXiv:1801.02612 (2018)."},{"key":"e_1_3_2_1_53_1","volume-title":"Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155","author":"Xu Weilin","year":"2017","unstructured":"Weilin Xu, David Evans, and Yanjun Qi. 2017. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155 (2017)."},{"key":"e_1_3_2_1_54_1","volume-title":"You only propagate once: Accelerating adversarial training via maximal principle. arXiv preprint arXiv:1905.00877","author":"Zhang Dinghuai","year":"2019","unstructured":"Dinghuai Zhang, Tianyuan Zhang, Yiping Lu, Zhanxing Zhu, and Bin Dong. 2019. You only propagate once: Accelerating adversarial training via maximal principle. arXiv preprint arXiv:1905.00877 (2019)."},{"key":"e_1_3_2_1_55_1","volume-title":"International Conference on Machine Learning. PMLR, 7472--7482","author":"Zhang Hongyang","year":"2019","unstructured":"Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. 2019. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning. PMLR, 7472--7482."},{"key":"e_1_3_2_1_56_1","volume-title":"International conference on machine learning. PMLR, 11278--11287","author":"Zhang Jingfeng","year":"2020","unstructured":"Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankanhalli. 2020. Attacks which do not kill training make adversarial learning stronger. In International conference on machine learning. PMLR, 11278--11287."},{"key":"e_1_3_2_1_57_1","volume-title":"Neural architecture search with reinforcement learning. arXiv preprint arXiv:1611.01578","author":"Zoph Barret","year":"2016","unstructured":"Barret Zoph and Quoc V Le. 2016. Neural architecture search with reinforcement learning. arXiv preprint arXiv:1611.01578 (2016)."}],"event":{"name":"GECCO '24 Companion: Genetic and Evolutionary Computation Conference Companion","sponsor":["SIGEVO ACM Special Interest Group on Genetic and Evolutionary Computation"],"location":"Melbourne VIC Australia","acronym":"GECCO '24 Companion"},"container-title":["Proceedings of the Genetic and Evolutionary Computation Conference Companion"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3638530.3664104","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3638530.3664104","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T00:06:11Z","timestamp":1750291571000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3638530.3664104"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,7,14]]},"references-count":57,"alternative-id":["10.1145\/3638530.3664104","10.1145\/3638530"],"URL":"https:\/\/doi.org\/10.1145\/3638530.3664104","relation":{},"subject":[],"published":{"date-parts":[[2024,7,14]]},"assertion":[{"value":"2024-08-01","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}