{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,6]],"date-time":"2026-03-06T22:21:30Z","timestamp":1772835690485,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":42,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,10,28]],"date-time":"2024-10-28T00:00:00Z","timestamp":1730073600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,10,28]]},"DOI":"10.1145\/3664647.3681398","type":"proceedings-article","created":{"date-parts":[[2024,10,26]],"date-time":"2024-10-26T06:59:49Z","timestamp":1729925989000},"page":"5771-5779","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":2,"title":["PAIR: Pre-denosing Augmented Image Retrieval Model for Defending Adversarial Patches"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-3107-7311","authenticated-orcid":false,"given":"Ziyang","family":"Zhou","sequence":"first","affiliation":[{"name":"MOE KLINNS Lab, Xi'an Jiaotong University, Xi'an, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1434-837X","authenticated-orcid":false,"given":"Pinghui","family":"Wang","sequence":"additional","affiliation":[{"name":"MOE KLINNS Lab, Xi'an Jiaotong University, Xi'an, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-1418-9537","authenticated-orcid":false,"given":"Zi","family":"Liang","sequence":"additional","affiliation":[{"name":"The Hong Kong Polytechnic University, Hong Kong, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4063-0109","authenticated-orcid":false,"given":"Ruofei","family":"Zhang","sequence":"additional","affiliation":[{"name":"Apple, Cupertino, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-4248-4587","authenticated-orcid":false,"given":"Haitao","family":"Bai","sequence":"additional","affiliation":[{"name":"MOE KLINNS Lab, Xi'an Jiaotong University, Xi'an, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2024,10,28]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Anish Athalye Nicholas Carlini and David Wagner. 2018. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In ICML. 274--283."},{"key":"e_1_3_2_1_2_1","unstructured":"Anish Athalye Logan Engstrom Andrew Ilyas and Kevin Kwok. 2018. Synthesizing robust adversarial examples. In ICML. PMLR 284--293."},{"key":"e_1_3_2_1_3_1","volume-title":"Targeted attack for deep hashing based retrieval","author":"Bai Jiawang","unstructured":"Jiawang Bai, Bin Chen, Yiming Li, Dongxian Wu, Weiwei Guo, Shu-tao Xia, and En-hui Yang. 2020. Targeted attack for deep hashing based retrieval. In ECCV. Springer, 618--634."},{"key":"e_1_3_2_1_4_1","volume-title":"Adversarial patch. arXiv preprint arXiv:1712.09665","author":"Brown Tom B","year":"2017","unstructured":"Tom B Brown, Dandelion Man\u00e9, Aurko Roy, Mart\u00edn Abadi, and Justin Gilmer. 2017. Adversarial patch. arXiv preprint arXiv:1712.09665 (2017)."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"crossref","unstructured":"Yue Cao Mingsheng Long Bin Liu and Jianmin Wang. 2018. Deep cauchy hashing for hamming space retrieval. In CVPR. 1229--1237.","DOI":"10.1109\/CVPR.2018.00134"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"crossref","unstructured":"Nicholas Carlini and David Wagner. 2017. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp). Ieee 39--57.","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"crossref","unstructured":"Zhaoyu Chen Bo Li Jianghe Xu Shuang Wu Shouhong Ding and Wenqiang Zhang. 2022. Towards Practical Certifiable Patch Defense with Vision Transformer. In CVPR. 15148--15158.","DOI":"10.1109\/CVPR52688.2022.01472"},{"key":"e_1_3_2_1_8_1","unstructured":"Ping-yeh Chiang Renkun Ni Ahmed Abdelkader Chen Zhu Christoph Studor and Tom Goldstein. 2018. Certified Defenses for Adversarial Patches. In ICLR."},{"key":"e_1_3_2_1_9_1","volume-title":"Imagenet: A large-scale hierarchical image database. In CVPR. Ieee, 248--255.","author":"Deng Jia","year":"2009","unstructured":"Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. 2009. Imagenet: A large-scale hierarchical image database. In CVPR. Ieee, 248--255."},{"key":"e_1_3_2_1_10_1","unstructured":"Alexey Dosovitskiy Lucas Beyer Alexander Kolesnikov Dirk Weissenborn Xiaohua Zhai Thomas Unterthiner Mostafa Dehghani Matthias Minderer Georg Heigold Sylvain Gelly et al. 2020. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929 (2020)."},{"key":"e_1_3_2_1_11_1","volume-title":"A study of the effect of jpg compression on adversarial images. arXiv preprint arXiv:1608.00853","author":"Dziugaite Gintare Karolina","year":"2016","unstructured":"Gintare Karolina Dziugaite, Zoubin Ghahramani, and Daniel M Roy. 2016. A study of the effect of jpg compression on adversarial images. arXiv preprint arXiv:1608.00853 (2016)."},{"key":"e_1_3_2_1_12_1","unstructured":"Kaiming He Xinlei Chen Saining Xie Yanghao Li Piotr Doll\u00e1r and Ross Girshick. 2022. Masked autoencoders are scalable vision learners. In CVPR. 16000--16009."},{"key":"e_1_3_2_1_13_1","volume-title":"Jonathan Craig Mitchell, and Song-Chun Zhu","author":"Hill Mitch","year":"2020","unstructured":"Mitch Hill, Jonathan Craig Mitchell, and Song-Chun Zhu. 2020. Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Models. In ICLR."},{"key":"e_1_3_2_1_14_1","volume-title":"Towards making a Trojan-Horse attack on text-to-image retrieval","author":"Hu Fan","unstructured":"Fan Hu, Aozhu Chen, and Xirong Li. 2023. Towards making a Trojan-Horse attack on text-to-image retrieval. In ICASSP. IEEE, 1--5."},{"key":"e_1_3_2_1_15_1","volume-title":"Minghui Li, and Hai Jin.","author":"Hu Shengshan","year":"2021","unstructured":"Shengshan Hu, Yechao Zhang, Xiaogeng Liu, Leo Yu Zhang, Minghui Li, and Hai Jin. 2021. Advhash: Set-to-set targeted attack on deep hashing with one single adversarial patch. In ACM MM. 2335--2343."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/3626772.3657773"},{"key":"e_1_3_2_1_17_1","first-page":"6465","article-title":"(De) Randomized smoothing for certifiable defense against patch attacks","volume":"33","author":"Levine Alexander","year":"2020","unstructured":"Alexander Levine and Soheil Feizi. 2020. (De) Randomized smoothing for certifiable defense against patch attacks. Advances in Neural Information Processing Systems, Vol. 33 (2020), 6465--6475.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_1_18_1","volume-title":"Microsoft coco: Common objects in context","author":"Lin Tsung-Yi","unstructured":"Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll\u00e1r, and C Lawrence Zitnick. 2014. Microsoft coco: Common objects in context. In ECCV. Springer, 740--755."},{"key":"e_1_3_2_1_19_1","volume-title":"Rama Chellappa, and Soheil Feizi.","author":"Liu Jiang","year":"2022","unstructured":"Jiang Liu, Alexander Levine, Chun Pong Lau, Rama Chellappa, and Soheil Feizi. 2022. Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection. In CVPR. 14973--14982."},{"key":"e_1_3_2_1_20_1","volume-title":"Dpatch: An adversarial patch attack on object detectors. arXiv preprint arXiv:1806.02299","author":"Liu Xin","year":"2018","unstructured":"Xin Liu, Huanrui Yang, Ziwei Liu, Linghao Song, Hai Li, and Yiran Chen. 2018. Dpatch: An adversarial patch attack on object detectors. arXiv preprint arXiv:1806.02299 (2018)."},{"key":"e_1_3_2_1_21_1","unstructured":"Zheyuan Liu Cristian Rodriguez-Opazo Damien Teney and Stephen Gould. 2021. Image retrieval on real-life images with pre-trained vision-and-language models. In ICCV. 2125--2134."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/TFUZZ.2020.2984991"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/APSIPAASC58517.2023.10317132"},{"key":"e_1_3_2_1_24_1","volume-title":"Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083","author":"Madry Aleksander","year":"2017","unstructured":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)."},{"key":"e_1_3_2_1_25_1","volume-title":"Local gradients smoothing: Defense against localized adversarial attacks","author":"Naseer Muzammal","unstructured":"Muzammal Naseer, Salman Khan, and Fatih Porikli. 2019. Local gradients smoothing: Defense against localized adversarial attacks. In WACV. IEEE, 1300--1307."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"crossref","unstructured":"Bryan A Plummer Liwei Wang Chris M Cervantes Juan C Caicedo Julia Hockenmaier and Svetlana Lazebnik. 2015. Flickr30k entities: Collecting region-to-phrase correspondences for richer image-to-sentence models. In ICCV. 2641--2649.","DOI":"10.1109\/ICCV.2015.303"},{"key":"e_1_3_2_1_27_1","volume-title":"Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al.","author":"Radford Alec","year":"2021","unstructured":"Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. 2021. Learning transferable visual models from natural language supervision. In ICML. PMLR, 8748--8763."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"crossref","unstructured":"Jerome Revaud Jon Almaz\u00e1n Rafael S Rezende and Cesar Roberto de Souza. 2019. Learning with average precision: Training image retrieval with a listwise loss. In ICCV. 5107--5116.","DOI":"10.1109\/ICCV.2019.00521"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"crossref","unstructured":"Hadi Salman Saachi Jain Eric Wong and Aleksander Madry. 2022. Certified patch robustness via smoothed vision transformers. In CVPR. 15137--15147.","DOI":"10.1109\/CVPR52688.2022.01471"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"crossref","unstructured":"Sijin Wang Ruiping Wang Ziwei Yao Shiguang Shan and Xilin Chen. 2020. Cross-modal scene graph matching for relationship-aware image-text retrieval. In WACV. 1508--1517.","DOI":"10.1109\/WACV45572.2020.9093614"},{"key":"e_1_3_2_1_32_1","volume-title":"Image quality assessment: from error visibility to structural similarity","author":"Wang Zhou","year":"2004","unstructured":"Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. 2004. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, Vol. 13, 4 (2004), 600--612."},{"key":"e_1_3_2_1_33_1","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Xiang Chong","year":"2021","unstructured":"Chong Xiang, Arjun Nitin Bhagoji, Vikash Sehwag, and Prateek Mittal. 2021. PatchGuard: A provably robust defense against adversarial patches via small receptive fields and masking. In 30th USENIX Security Symposium (USENIX Security 21). 2237--2254."},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/WACV56688.2023.00461"},{"key":"e_1_3_2_1_35_1","volume-title":"Zequn Jie, Wei Liu, and Jiashi Feng.","author":"Yuan Li","year":"2020","unstructured":"Li Yuan, Tao Wang, Xiaopeng Zhang, Francis EH Tay, Zequn Jie, Wei Liu, and Jiashi Feng. 2020. Central similarity quantization for efficient image and video retrieval. In CVPR. 3083--3092."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"crossref","unstructured":"Qi Zhang Zhen Lei Zhaoxiang Zhang and Stan Z Li. 2020. Context-aware attention network for image-text retrieval. In CVPR. 3536--3545.","DOI":"10.1109\/CVPR42600.2020.00359"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/3637870"},{"key":"e_1_3_2_1_38_1","unstructured":"Dawei Zhou Tongliang Liu Bo Han Nannan Wang Chunlei Peng and Xinbo Gao. 2021. Towards defending against adversarial examples via attack-invariant features. In ICML. PMLR 12835--12845."},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"crossref","unstructured":"Dawei Zhou Nannan Wang Chunlei Peng Xinbo Gao Xiaoyu Wang Jun Yu and Tongliang Liu. 2021. Removing adversarial noise in class activation feature space. In ICCV. 7878--7887.","DOI":"10.1109\/ICCV48922.2021.00778"},{"key":"e_1_3_2_1_40_1","volume-title":"Adversarial ranking attack and defense","author":"Zhou Mo","unstructured":"Mo Zhou, Zhenxing Niu, Le Wang, Qilin Zhang, and Gang Hua. 2020. Adversarial ranking attack and defense. In ECCV. Springer, 781--799."},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"crossref","unstructured":"Mo Zhou and Vishal M Patel. 2022. Enhancing Adversarial Robustness for Deep Metric Learning. In CVPR. 15325--15334.","DOI":"10.1109\/CVPR52688.2022.01489"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"crossref","unstructured":"Alon Zolfi Moshe Kravchik Yuval Elovici and Asaf Shabtai. 2021. The translucent patch: A physical and universal attack on object detectors. In CVPR. 15232--15241.","DOI":"10.1109\/CVPR46437.2021.01498"}],"event":{"name":"MM '24: The 32nd ACM International Conference on Multimedia","location":"Melbourne VIC Australia","acronym":"MM '24","sponsor":["SIGMM ACM Special Interest Group on Multimedia"]},"container-title":["Proceedings of the 32nd ACM International Conference on Multimedia"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3664647.3681398","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3664647.3681398","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:17:44Z","timestamp":1750295864000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3664647.3681398"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,10,28]]},"references-count":42,"alternative-id":["10.1145\/3664647.3681398","10.1145\/3664647"],"URL":"https:\/\/doi.org\/10.1145\/3664647.3681398","relation":{},"subject":[],"published":{"date-parts":[[2024,10,28]]},"assertion":[{"value":"2024-10-28","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}