{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T16:00:58Z","timestamp":1783008058957,"version":"3.54.5"},"publisher-location":"New York, NY, USA","reference-count":92,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,12,2]],"date-time":"2024-12-02T00:00:00Z","timestamp":1733097600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100006374","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CNS-2308730, CNS-2302689, CMMI-2326341, CNS-2319277, ECCS-2216926, CNS-2241713, CNS-2331302 and CNS-2339686"],"award-info":[{"award-number":["CNS-2308730, CNS-2302689, CMMI-2326341, CNS-2319277, ECCS-2216926, CNS-2241713, CNS-2331302 and CNS-2339686"]}],"id":[{"id":"10.13039\/501100006374","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,12,2]]},"DOI":"10.1145\/3658644.3690343","type":"proceedings-article","created":{"date-parts":[[2024,12,9]],"date-time":"2024-12-09T12:19:20Z","timestamp":1733746760000},"page":"600-614","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":4,"title":["Certifiable Black-Box Attacks with Randomized Adversarial Examples: Breaking Defenses with Provable Confidence"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0007-0538-6669","authenticated-orcid":false,"given":"Hanbin","family":"Hong","sequence":"first","affiliation":[{"name":"University of Connecticut, Storrs, CT, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7427-5774","authenticated-orcid":false,"given":"Xinyu","family":"Zhang","sequence":"additional","affiliation":[{"name":"Zhejiang University, Hangzhou, Zhejiang, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5616-060X","authenticated-orcid":false,"given":"Binghui","family":"Wang","sequence":"additional","affiliation":[{"name":"Illinois Institute of Technology, Chicago, IL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0921-8869","authenticated-orcid":false,"given":"Zhongjie","family":"Ba","sequence":"additional","affiliation":[{"name":"Zhejiang University, Hangzhou, Zhejiang, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4095-4506","authenticated-orcid":false,"given":"Yuan","family":"Hong","sequence":"additional","affiliation":[{"name":"University of Connecticut, Storrs, CT, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,12,9]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"International Conference on Learning Representations","author":"Al-Dujaili Abdullah","year":"2020","unstructured":"Abdullah Al-Dujaili and Una-May O'Reilly. Sign bits are all you need for blackbox attacks. In International Conference on Learning Representations, 2020."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"e_1_3_2_1_3_1","first-page":"291","volume-title":"ICML","volume":"97","author":"Anil Cem","year":"2019","unstructured":"Cem Anil, James Lucas, and Roger B. Grosse. Sorting out lipschitz function approximation. In ICML, volume 97, pages 291--301. PMLR, 2019."},{"key":"e_1_3_2_1_4_1","first-page":"274","volume-title":"International conference on machine learning","author":"Athalye Anish","year":"2018","unstructured":"Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning, pages 274--283. PMLR, 2018."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_10"},{"key":"e_1_3_2_1_6_1","volume-title":"A survey of black-box adversarial attacks on computer vision models. arXiv preprint arXiv:1912.01667","author":"Bhambri Siddhant","year":"2019","unstructured":"Siddhant Bhambri, Sumanyu Muku, Avinash Tulasi, and Arun Balaji Buduru. A survey of black-box adversarial attacks on computer vision models. arXiv preprint arXiv:1912.01667, 2019."},{"key":"e_1_3_2_1_7_1","volume-title":"ICLR. OpenReview.net","author":"Brendel Wieland","year":"2018","unstructured":"Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In ICLR. OpenReview.net, 2018."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00506"},{"key":"e_1_3_2_1_9_1","volume-title":"ICLR","author":"Buckman Jacob","year":"2018","unstructured":"Jacob Buckman, Aurko Roy, Colin Raffel, and Ian J. Goodfellow. Thermometer encoding: One hot way to resist adversarial examples. In ICLR, 2018."},{"key":"e_1_3_2_1_10_1","volume-title":"Leslie Rice, Mingjie Sun, and J Zico Kolter. (certified!!) adversarial robustness for free! arXiv preprint arXiv:2206.10550","author":"Carlini Nicholas","year":"2022","unstructured":"Nicholas Carlini, Florian Tramer, Krishnamurthy Dj Dvijotham, Leslie Rice, Mingjie Sun, and J Zico Kolter. (certified!!) adversarial robustness for free! arXiv preprint arXiv:2206.10550, 2022."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_2_1_12_1","volume-title":"USENIX Security","author":"Chandrasekaran Varun","year":"2020","unstructured":"Varun Chandrasekaran, Kamalika Chaudhuri, Irene Giacomelli, Somesh Jha, and Songbai Yan. Exploring connections between active learning and model extraction. In USENIX Security. USENIX Association, 2020."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00045"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/3394486.3403225"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"e_1_3_2_1_16_1","volume-title":"NeurIPS","author":"Chen Sizhe","year":"2022","unstructured":"Sizhe Chen, Zhehao Huang, Qinghua Tao, Yingwen Wu, Cihang Xie, and Xiaolin Huang. Adversarial attack on attackers: Post-process to mitigate black-box score-based query attacks. NeurIPS, 2022."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/3385003.3410925"},{"key":"e_1_3_2_1_18_1","volume-title":"ECCV","author":"Chen Weilun","year":"2020","unstructured":"Weilun Chen, Zhaoxiang Zhang, Xiaolin Hu, and BaoyuanWu. Boosting decisionbased black-box adversarial attacks with random sign flip. In ECCV, 2020."},{"key":"e_1_3_2_1_19_1","volume-title":"ICLR. OpenReview.net","author":"Cheng Minhao","year":"2019","unstructured":"Minhao Cheng, Thong Le, Pin-Yu Chen, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsieh. Query-efficient hard-label black-box attack: An optimization-based approach. In ICLR. OpenReview.net, 2019."},{"key":"e_1_3_2_1_20_1","volume-title":"ICLR. OpenReview.net","author":"Cheng Minhao","year":"2020","unstructured":"Minhao Cheng, Simranjit Singh, Patrick H. Chen, Pin-Yu Chen, Sijia Liu, and Cho-Jui Hsieh. Sign-opt: A query-efficient hard-label adversarial attack. In ICLR. OpenReview.net, 2020."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2023.04.005"},{"key":"e_1_3_2_1_22_1","volume-title":"ICML","author":"Cohen Jeremy M.","year":"2019","unstructured":"Jeremy M. Cohen, Elan Rosenfeld, and J. Zico Kolter. Certified adversarial robustness via randomized smoothing. In ICML, 2019."},{"key":"e_1_3_2_1_23_1","volume-title":"ICLR","author":"Dhillon Guneet S.","year":"2018","unstructured":"Guneet S. Dhillon, Kamyar Azizzadenesheli, Zachary C. Lipton, Jeremy Bernstein, Jean Kossaifi, Aran Khanna, and Animashree Anandkumar. Stochastic activation pruning for robust adversarial defense. In ICLR, 2018."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/3270101.3270106"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2022.3167672"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/HPCC-DSS-SmartCity-DependSys53884.2021.00149"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10601-018-9285-6"},{"key":"e_1_3_2_1_29_1","volume-title":"3rd International Conference on Learning Representations, ICLR 2015","author":"Goodfellow Ian J.","year":"2015","unstructured":"Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun, editors, 3rd International Conference on Learning Representations, ICLR 2015, 2015."},{"key":"e_1_3_2_1_30_1","volume-title":"ICML","author":"Guo Chuan","year":"2019","unstructured":"Chuan Guo, Jacob R. Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Q. Weinberger. Simple black-box adversarial attacks. In ICML 2019."},{"key":"e_1_3_2_1_31_1","volume-title":"ICLR","author":"Guo Chuan","year":"2018","unstructured":"Chuan Guo, Mayank Rana, Moustapha Ciss\u00e9, and Laurens van der Maaten. Countering adversarial images using input transformations. In ICLR, 2018."},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00068"},{"key":"e_1_3_2_1_34_1","volume-title":"Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840--6851","author":"Ho Jonathan","year":"2020","unstructured":"Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840--6851, 2020."},{"key":"e_1_3_2_1_35_1","volume-title":"An eye for an eye: Defending against gradient-based attacks with gradients. arXiv preprint arXiv:2202.01117","author":"Hong Hanbin","year":"2022","unstructured":"Hanbin Hong, Yuan Hong, and Yu Kong. An eye for an eye: Defending against gradient-based attacks with gradients. arXiv preprint arXiv:2202.01117, 2022."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20065-6_6"},{"key":"e_1_3_2_1_37_1","volume-title":"Query-efficient black-box adversarial examples","author":"Ilyas Andrew","year":"2017","unstructured":"Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Query-efficient black-box adversarial examples. 2017."},{"key":"e_1_3_2_1_38_1","volume-title":"ICML","author":"Ilyas Andrew","year":"2018","unstructured":"Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In ICML, 2018."},{"key":"e_1_3_2_1_39_1","volume-title":"International Conference on Learning Representations","author":"Ilyas Andrew","year":"2019","unstructured":"Andrew Ilyas, Logan Engstrom, and Aleksander Madry. Prior convictions: Blackbox adversarial attacks with bandits and priors. In International Conference on Learning Representations, 2019."},{"key":"e_1_3_2_1_40_1","volume-title":"USENIX Security Symposium","author":"Jain Shubham","year":"2022","unstructured":"Shubham Jain, Ana-Maria Cret, u, and Yves-Alexandre de Montjoye. Adversarial detection avoidance attacks: Evaluating the robustness of perceptual hashingbased client-side scanning. In USENIX Security Symposium, 2022."},{"key":"e_1_3_2_1_41_1","volume-title":"CAV 2017","author":"Katz Guy","year":"2017","unstructured":"Guy Katz, Clark W. Barrett, David L. Dill, Kyle Julian, and Mykel J. Kochenderfer. Reluplex: An efficient SMT solver for verifying deep neural networks. In Computer Aided Verification - 29th International Conference, CAV 2017, 2017."},{"key":"e_1_3_2_1_42_1","volume-title":"(LREC 2014)","author":"Jurc\u00edcek Filip","year":"2014","unstructured":"Filip Jurc\u00edcek. Free English and Czech telephone speech corpus shared under the CC-BY-SA 3.0 license. In (LREC 2014), 2014."},{"key":"e_1_3_2_1_43_1","volume-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky Alex","year":"2009","unstructured":"Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009."},{"key":"e_1_3_2_1_44_1","volume-title":"International Conference on Learning Representations","author":"Kurakin Alexey","year":"2017","unstructured":"Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In International Conference on Learning Representations, 2017."},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00044"},{"key":"e_1_3_2_1_46_1","volume-title":"USENIX Security","author":"Li Huiying","year":"2022","unstructured":"Huiying Li, Shawn Shan, Emily Wenger, Jiayun Zhang, Haitao Zheng, and Ben Y. Zhao. Blacklight: Scalable defense for neural networks against query-based black-box attacks. In USENIX Security, 2022."},{"key":"e_1_3_2_1_47_1","volume-title":"ICML","author":"Li Yandong","year":"2019","unstructured":"Yandong Li, Lijun Li, Liqiang Wang, Tong Zhang, and Boqing Gong. NATTACK: learning the distributions of adversarial examples for an improved black-box attack on deep neural networks. In ICML, 2019."},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"e_1_3_2_1_49_1","volume-title":"International Conference on Learning Representations","author":"Liu Sijia","year":"2019","unstructured":"Sijia Liu, Pin-Yu Chen, Xiangyi Chen, and Mingyi Hong. signsgd via zeroth-order oracle. In International Conference on Learning Representations, 2019."},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01234-2_23"},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.56"},{"key":"e_1_3_2_1_52_1","volume-title":"International Conference on Learning Representations","author":"Madry Aleksander","year":"2018","unstructured":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018."},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134057"},{"key":"e_1_3_2_1_54_1","volume-title":"ICML","author":"Moon Seungyong","year":"2019","unstructured":"Seungyong Moon, Gaon An, and Hyun Oh Song. Parsimonious black-box adversarial attacks via efficient combinatorial optimization. In ICML, 2019."},{"key":"e_1_3_2_1_55_1","volume-title":"Universal adversarial perturbations. CoRR, abs\/1610.08401","author":"Moosavi-Dezfooli Seyed-Mohsen","year":"2016","unstructured":"Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. CoRR, abs\/1610.08401, 2016."},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484796"},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00034"},{"key":"e_1_3_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"e_1_3_2_1_60_1","first-page":"7650","volume-title":"Random noise defense against query-based black-box attacks","author":"Qin Zeyu","year":"2021","unstructured":"Zeyu Qin, Yanbo Fan, Hongyuan Zha, and Baoyuan Wu. Random noise defense against query-based black-box attacks. pages 7650--7663, 2021."},{"key":"e_1_3_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP57164.2023.00021"},{"key":"e_1_3_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00847"},{"key":"e_1_3_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-24574-4_28"},{"key":"e_1_3_2_1_64_1","volume-title":"ICML","author":"Roth Kevin","year":"2019","unstructured":"Kevin Roth, Yannic Kilcher, and Thomas Hofmann. The odds are odd: A statistical test for detecting adversarial examples. In ICML, 2019."},{"key":"e_1_3_2_1_65_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"e_1_3_2_1_66_1","volume-title":"6th International Conference on Learning Representations, ICLR 2018","author":"Samangouei Pouya","year":"2018","unstructured":"Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gan: Protecting classifiers against adversarial attacks using generative models. In 6th International Conference on Learning Representations, ICLR 2018, 2018."},{"key":"e_1_3_2_1_67_1","volume-title":"ICLR","author":"Schott Lukas","year":"2019","unstructured":"Lukas Schott, Jonas Rauber, Matthias Bethge, and Wieland Brendel. Towards the first adversarially robust neural network model on MNIST. In ICLR, 2019."},{"key":"e_1_3_2_1_68_1","volume-title":"Adversarial training for free! In NeurIPS","author":"Shafahi Ali","year":"2019","unstructured":"Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John P. Dickerson, Christoph Studer, Larry S. Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In NeurIPS, 2019."},{"key":"e_1_3_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00668"},{"key":"e_1_3_2_1_70_1","volume-title":"ICLR","author":"Simonyan Karen","year":"2015","unstructured":"Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In ICLR, 2015."},{"key":"e_1_3_2_1_71_1","volume-title":"6th International Conference on Learning Representations, ICLR 2018","author":"Song Yang","year":"2018","unstructured":"Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. In 6th International Conference on Learning Representations, ICLR 2018. OpenReview.net, 2018."},{"key":"e_1_3_2_1_72_1","first-page":"2229","volume-title":"CIKM","author":"Sun Jingyu","year":"2020","unstructured":"Jingyu Sun, Bingyu Liu, and Yuan Hong. Logbug: Generating adversarial system logs in real time. In CIKM, pages 2229--2232. ACM, 2020."},{"key":"e_1_3_2_1_73_1","volume-title":"a randomized smoothing approach","author":"Teng Jiaye","year":"2019","unstructured":"Jiaye Teng, Guang-He Lee, and Yang Yuan. \\ell_1 adversarial robustness certificates: a randomized smoothing approach. 2019."},{"key":"e_1_3_2_1_74_1","volume-title":"ICML","author":"Tram\u00e8r Florian","year":"2022","unstructured":"Florian Tram\u00e8r. Detecting adversarial examples is (nearly) as hard as classifying them. In ICML 2022."},{"key":"e_1_3_2_1_75_1","first-page":"5858","volume-title":"Hanna M. Wallach, Hugo Larochelle, Alina Beygelzimer, Florence d?Alch\u00e9-Buc, Emily B","author":"Tram\u00e8r Florian","year":"2019","unstructured":"Florian Tram\u00e8r and Dan Boneh. Adversarial training and robustness for multiple perturbations. In Hanna M. Wallach, Hugo Larochelle, Alina Beygelzimer, Florence d?Alch\u00e9-Buc, Emily B. Fox, and Roman Garnett, editors, Advances in Neural Information Processing Systems, NeurIPS 2019, pages 5858--5868, 2019."},{"key":"e_1_3_2_1_76_1","volume-title":"ICLR","author":"Tram\u00e8r Florian","year":"2018","unstructured":"Florian Tram\u00e8r, Alexey Kurakin, Nicolas Papernot, Ian J. Goodfellow, Dan Boneh, and Patrick D. McDaniel. Ensemble adversarial training: Attacks and defenses. In ICLR 2018."},{"key":"e_1_3_2_1_77_1","volume-title":"Visualizing data using t-sne. Journal of machine learning research, 9(11)","author":"der Maaten Laurens Van","year":"2008","unstructured":"Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, 9(11), 2008."},{"key":"e_1_3_2_1_78_1","volume-title":"The Tenth International Conference on Learning Representations, ICLR 2022","author":"Vo Viet Quoc","year":"2022","unstructured":"Viet Quoc Vo, Ehsan Abbasnejad, and Damith Ranasinghe. Query efficient decision based sparse attacks against black-box deep learning models. In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25--29, 2022. OpenReview.net, 2022."},{"key":"e_1_3_2_1_79_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01302"},{"key":"e_1_3_2_1_80_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01573"},{"key":"e_1_3_2_1_81_1","series-title":"Proceedings of Machine Learning Research","first-page":"5283","volume-title":"Jennifer G. Dy and Andreas Krause","author":"Wong Eric","year":"2018","unstructured":"Eric Wong and J. Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In Jennifer G. Dy and Andreas Krause, editors, Proceedings of the 35th International Conference on Machine Learning, ICML 2018, volume 80 of Proceedings of Machine Learning Research, pages 5283--5292. PMLR, 2018."},{"key":"e_1_3_2_1_82_1","series-title":"Proceedings of Machine Learning Research","first-page":"6808","volume-title":"Proceedings of the 36th International Conference on Machine Learning, ICML","author":"Wong Eric","year":"2019","unstructured":"Eric Wong, Frank R. Schmidt, and J. Zico Kolter. Wasserstein adversarial examples via projected sinkhorn iterations. In Kamalika Chaudhuri and Ruslan Salakhutdinov, editors, Proceedings of the 36th International Conference on Machine Learning, ICML 2019, volume 97 of Proceedings of Machine Learning Research, pages 6808--6817. PMLR, 2019."},{"key":"e_1_3_2_1_83_1","volume-title":"6th International Conference on Learning Representations, ICLR 2018","author":"Xie Cihang","year":"2018","unstructured":"Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan L. Yuille. Mitigating adversarial effects through randomization. In 6th International Conference on Learning Representations, ICLR 2018. OpenReview.net, 2018."},{"key":"e_1_3_2_1_84_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.634"},{"key":"e_1_3_2_1_85_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833776"},{"key":"e_1_3_2_1_86_1","article-title":"poisoning attack on video recognition models","author":"Xie Shangyu","year":"2023","unstructured":"Shangyu Xie, Yan Yan, and Yuan Hong. Stealthy 3d poisoning attack on video recognition models. IEEE Trans. Dependable Secur. Comput., 2023.","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"e_1_3_2_1_87_1","volume-title":"USENIX Security","author":"Yan Shenao","year":"2024","unstructured":"Shenao Yan, Shen Wang, Yue Duan, Hanbin Hong, Kiho Lee, Doowon Kim, and Yuan Hong. An llm-assisted easy-to-trigger backdoor attack on code completion models: Injecting disguised vulnerabilities against strong detection. In USENIX Security, 2024."},{"key":"e_1_3_2_1_88_1","volume-title":"ICML","author":"Yang Greg","year":"2020","unstructured":"Greg Yang, Tony Duan, J. Edward Hu, Hadi Salman, Ilya P. Razenshteyn, and Jerry Li. Randomized smoothing of all shapes and sizes. In ICML, 2020."},{"key":"e_1_3_2_1_89_1","volume-title":"Proceedings of the British Machine Vision Conference","author":"Zagoruyko Sergey","year":"2016","unstructured":"Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In Richard C. Wilson, Edwin R. Hancock, and William A. P. Smith, editors, Proceedings of the British Machine Vision Conference, 2016."},{"key":"e_1_3_2_1_90_1","volume-title":"International conference on machine learning","author":"Zhang Hongyang","year":"2019","unstructured":"Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, 2019."},{"key":"e_1_3_2_1_91_1","volume-title":"USENIX Security","author":"Zhang Jiawei","year":"2023","unstructured":"Jiawei Zhang, Zhongzhu Chen, Huan Zhang, Chaowei Xiao, and Bo Li. Diffsmooth: Certifiably robust learning via diffusion models and local smoothing. In USENIX Security, 2023."},{"key":"e_1_3_2_1_92_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00053"}],"event":{"name":"CCS '24: ACM SIGSAC Conference on Computer and Communications Security","location":"Salt Lake City UT USA","acronym":"CCS '24","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3658644.3690343","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3658644.3690343","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T06:10:36Z","timestamp":1755843036000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3658644.3690343"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12,2]]},"references-count":92,"alternative-id":["10.1145\/3658644.3690343","10.1145\/3658644"],"URL":"https:\/\/doi.org\/10.1145\/3658644.3690343","relation":{},"subject":[],"published":{"date-parts":[[2024,12,2]]},"assertion":[{"value":"2024-12-09","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}