{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,13]],"date-time":"2026-04-13T21:53:31Z","timestamp":1776117211390,"version":"3.50.1"},"reference-count":59,"publisher":"Association for Computing Machinery (ACM)","issue":"2","license":[{"start":{"date-parts":[[2025,5,15]],"date-time":"2025-05-15T00:00:00Z","timestamp":1747267200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Natural Sciences and Engineering Research Council of Canada (NSERC) Discovery Grant","award":["#RGPIN-2020-03966"],"award-info":[{"award-number":["#RGPIN-2020-03966"]}]},{"name":"Canada Foundation for Innovation (CFI) John R. Evans Leaders Fund","award":["#42371"],"award-info":[{"award-number":["#42371"]}]},{"name":"University of Waterloo Interdisciplinary Trailblazer Grant"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Interact. Intell. Syst."],"published-print":{"date-parts":[[2025,6,30]]},"abstract":"<jats:p>\n            Adversarial machine learning (AML) studies attacks that can fool machine learning algorithms into generating incorrect outcomes as well as the defenses against worst-case attacks to strengthen model robustness. Specifically for image classification, it is challenging to understand adversarial attacks due to their use of subtle perturbations that are not human-interpretable, as well as the variability of attack impacts influenced by diverse methodologies, instance differences, and model architectures. Through a design study with AML learners, and teachers, we introduce\n            <jats:sc>AdvEx<\/jats:sc>\n            , a multi-level interactive visualization system that comprehensively presents the properties and impacts of evasion attacks on different image classifiers for novice AML learners. We quantitatively and qualitatively assessed\n            <jats:sc>AdvEx<\/jats:sc>\n            in a two-part evaluation including user studies and expert interviews. Our results show that\n            <jats:sc>AdvEx<\/jats:sc>\n            is not only highly effective as a visualization tool for understanding AML mechanisms but also provides an engaging and enjoyable learning experience, thus demonstrating its overall benefits for AML learners.\n          <\/jats:p>","DOI":"10.1145\/3725739","type":"journal-article","created":{"date-parts":[[2025,3,25]],"date-time":"2025-03-25T09:52:26Z","timestamp":1742896346000},"page":"1-31","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":3,"title":["Panda or Not Panda? Understanding Adversarial Attacks with Interactive Visualization"],"prefix":"10.1145","volume":"15","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-7830-4239","authenticated-orcid":false,"given":"Yuzhe","family":"You","sequence":"first","affiliation":[{"name":"School of Computer Science, University of Waterloo, Waterloo, Ontario, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4001-4610","authenticated-orcid":false,"given":"Jarvis","family":"Tse","sequence":"additional","affiliation":[{"name":"School of Computer Science, University of Waterloo, Waterloo, Ontario, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5008-4319","authenticated-orcid":false,"given":"Jian","family":"Zhao","sequence":"additional","affiliation":[{"name":"School of Computer Science, University of Waterloo, Waterloo, Ontario, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,5,15]]},"reference":[{"key":"e_1_3_2_2_2","first-page":"325","volume-title":"Proceedings of the NeurIPS 2020 Workshop on Pre-registration in Machine Learning","author":"Benz Philipp","year":"2021","unstructured":"Philipp Benz, Chaoning Zhang, Adil Karjauv, and In So Kweon. 2021. Robustness may be at odds with fairness: An empirical study on class-wise accuracy. In Proceedings of the NeurIPS 2020 Workshop on Pre-registration in Machine Learning. PMLR, 325\u2013342."},{"key":"e_1_3_2_3_2","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2020.2969185"},{"key":"e_1_3_2_4_2","first-page":"1","volume-title":"Proceedings of the 2018 IEEE Security and Privacy Workshops (SPW)","author":"Carlini Nicholas","year":"2018","unstructured":"Nicholas Carlini and David Wagner. 2018. Audio adversarial examples: Targeted attacks on speech-to-text. In Proceedings of the 2018 IEEE Security and Privacy Workshops (SPW). IEEE, 1\u20137."},{"key":"e_1_3_2_5_2","doi-asserted-by":"crossref","first-page":"1277","DOI":"10.1109\/SP40000.2020.00045","volume-title":"Proceedings of the 2020 IEEE Symposium on Security and Privacy (SP)","author":"Chen Jianbo","year":"2020","unstructured":"Jianbo Chen, Michael I. Jordan, and Martin J. Wainwright. 2020. HopSkipJumpAttack: A query-efficient decision-based attack. In Proceedings of the 2020 IEEE Symposium on Security and Privacy (SP). IEEE, 1277\u20131294. DOI: 10.1109\/SP40000.2020.00045"},{"key":"e_1_3_2_6_2","doi-asserted-by":"crossref","first-page":"15","DOI":"10.1145\/3128572.3140448","volume-title":"Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security","author":"Chen Pin-Yu","year":"2017","unstructured":"Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. 2017. ZOO: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, 15\u201326. DOI: 10.1145\/3128572.3140448"},{"issue":"4","key":"e_1_3_2_7_2","doi-asserted-by":"crossref","first-page":"219","DOI":"10.1080\/00461520.2014.965823","article-title":"The ICAP framework: Linking cognitive engagement to active learning outcomes","volume":"49","author":"Chi Michelene T. H.","year":"2014","unstructured":"Michelene T. H. Chi and Ruth Wylie. 2014. The ICAP framework: Linking cognitive engagement to active learning outcomes. Educational Psychologist 49, 4 (2014), 219\u2013243.","journal-title":"Educational Psychologist"},{"key":"e_1_3_2_8_2","doi-asserted-by":"crossref","first-page":"322","DOI":"10.1145\/3298689.3347031","volume-title":"Proceedings of the 13th ACM Conference on Recommender Systems","author":"Christakopoulou Konstantina","year":"2019","unstructured":"Konstantina Christakopoulou and Arindam Banerjee. 2019. Adversarial attacks on an oblivious recommender. In Proceedings of the 13th ACM Conference on Recommender Systems, 322\u2013330."},{"key":"e_1_3_2_9_2","unstructured":"Francesco Croce Maksym Andriushchenko Vikash Sehwag Edoardo Debenedetti Nicolas Flammarion Mung Chiang Prateek Mittal and Matthias Hein. 2020. RobustBench: A standardized adversarial robustness benchmark. arXiv:2010.09670. Retrieved from https:\/\/arxiv.org\/abs\/2010.09670"},{"key":"e_1_3_2_10_2","first-page":"2206","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Croce Francesco","year":"2020","unstructured":"Francesco Croce and Matthias Hein. 2020. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In Proceedings of the International Conference on Machine Learning. PMLR, 2206\u20132216."},{"key":"e_1_3_2_11_2","first-page":"271","volume-title":"Proceedings of the 2020 IEEE Visualization Conference (VIS)","author":"Das Nilaksh","year":"2020","unstructured":"Nilaksh Das, Haekyu Park, Zijie J. Wang, Fred Hohman, Robert Firstman, Emily Rogers, and Duen Horng Polo Chau. 2020. Bluff: Interactively deciphering adversarial attacks on deep neural networks. In Proceedings of the 2020 IEEE Visualization Conference (VIS). IEEE, 271\u2013275. DOI: 10.1109\/VIS47514.2020.00061"},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2012.2211477"},{"key":"e_1_3_2_13_2","first-page":"1625","volume-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","author":"Eykholt Kevin","year":"2018","unstructured":"Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. 2018. Robust physical-world attacks on deep learning visual classification. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 1625\u20131634. DOI: 10.1109\/CVPR.2018.00175"},{"key":"e_1_3_2_14_2","first-page":"8410","volume-title":"Proceedings of the National Academy of Sciences","volume":"111","author":"Freeman Scott","year":"2014","unstructured":"Scott Freeman, Sarah L. Eddy, Miles McDonough, Michelle K. Smith, Nnadozie Okoroafor, Hannah Jordt, and Mary Pat Wenderoth. 2014. Active learning increases student performance in science, engineering, and mathematics. Proceedings of the National Academy of Sciences 111, 23 (2014), 8410\u20138415."},{"issue":"1","key":"e_1_3_2_15_2","first-page":"891","article-title":"TransforLearn: Interactive visual tutorial for the transformer model","volume":"30","author":"Gao Lin","year":"2023","unstructured":"Lin Gao, Zekai Shao, Ziqin Luo, Haibo Hu, Cagatay Turkay, and Siming Chen. 2023. TransforLearn: Interactive visual tutorial for the transformer model. IEEE Transactions on Visualization and Computer Graphics 30, 1 (2023), 891\u2013901.","journal-title":"IEEE Transactions on Visualization and Computer Graphics"},{"key":"e_1_3_2_16_2","unstructured":"Ian J. Goodfellow Jonathon Shlens and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv:1412.6572. Retrieved from https:\/\/arxiv.org\/abs\/1412.6572"},{"key":"e_1_3_2_17_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cviu.2019.102805"},{"key":"e_1_3_2_18_2","first-page":"588","volume-title":"Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition","author":"He Zhezhi","year":"2019","unstructured":"Zhezhi He, Adnan Siraj Rakin, and Deliang Fan. 2019. Parametric noise injection: Trainable randomness to improve deep neural network robustness against adversarial attack. In Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, 588\u2013597. DOI: 10.1109\/CVPR.2019.00068"},{"key":"e_1_3_2_19_2","unstructured":"Dan Hendrycks and Kevin Gimpel. 2016. Early methods for detecting adversarial images. arXiv:1608.00530. Retrieved from https:\/\/arxiv.org\/abs\/1608.00530"},{"key":"e_1_3_2_20_2","volume-title":"Proceedings of the Advances in Neural Information Processing Systems","volume":"32","author":"Hendrycks Dan","year":"2019","unstructured":"Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. 2019. Using self-supervised learning can improve model robustness and uncertainty. In Proceedings of the Advances in Neural Information Processing Systems 32."},{"key":"e_1_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.23915\/distill.00028"},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2019.2934659"},{"key":"e_1_3_2_23_2","volume-title":"Proceedings of the Advances in Neural Information Processing Systems","volume":"32","author":"Ilyas Andrew","year":"2019","unstructured":"Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. 2019. Adversarial examples are not bugs, they are features. In Proceedings of the Advances in Neural Information Processing Systems 32."},{"issue":"1","key":"e_1_3_2_24_2","doi-asserted-by":"crossref","first-page":"88","DOI":"10.1109\/TVCG.2017.2744718","article-title":"ActiVis: Visual exploration of industry-scale deep neural network models","volume":"24","author":"Kahng Minsuk","year":"2017","unstructured":"Minsuk Kahng, Pierre Y. Andrews, Aditya Kalro, and Duen Horng Chau. 2017. ActiVis: Visual exploration of industry-scale deep neural network models. IEEE Transactions on Visualization and Computer Graphics 24, 1 (2017), 88\u201397.","journal-title":"IEEE Transactions on Visualization and Computer Graphics"},{"key":"e_1_3_2_25_2","volume-title":"Proceedings of the IEEE VIS 2019 Workshop on EValuation of Interactive VisuAl Machine Learning Systems","author":"Kahng Minsuk","year":"2019","unstructured":"Minsuk Kahng and Duen Horng Chau. 2019. How does visualization help people learn deep learning? Evaluation of GAN Lab. In Proceedings of the IEEE VIS 2019 Workshop on EValuation of Interactive VisuAl Machine Learning Systems."},{"key":"e_1_3_2_26_2","unstructured":"A. Krizhevsky. 2009. Learning Multiple Layers of Features from Tiny Images. Master\u2019s thesis University of Toronto."},{"key":"e_1_3_2_27_2","doi-asserted-by":"crossref","first-page":"99","DOI":"10.1201\/9781351251389-8","volume-title":"Artificial Intelligence Safety and Security","author":"Kurakin Alexey","year":"2018","unstructured":"Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. 2018. Adversarial examples in the physical world. In Artificial Intelligence Safety and Security. Roman V. Yampolskiy (Ed.), Chapman and Hall\/CRC, 99\u2013112."},{"key":"e_1_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2019.2962338"},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1109\/LSP.2022.3229558"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2013.179"},{"key":"e_1_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2019.2934631"},{"key":"e_1_3_2_32_2","unstructured":"Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv:1706.06083. Retrieved from https:\/\/arxiv.org\/abs\/1706.06083"},{"key":"e_1_3_2_33_2","first-page":"2574","volume-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","author":"Moosavi-Dezfooli Seyed-Mohsen","year":"2016","unstructured":"Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. 2016. DeepFool: A simple and accurate method to fool deep neural networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2574\u20132582. DOI: 10.1109\/CVPR.2016.282"},{"key":"e_1_3_2_34_2","doi-asserted-by":"crossref","DOI":"10.1201\/b17511","volume-title":"Visualization Analysis and Design","author":"Munzner Tamara","year":"2014","unstructured":"Tamara Munzner. 2014. Visualization Analysis and Design. CRC Press."},{"key":"e_1_3_2_35_2","first-page":"1","volume-title":"Proceedings of the 2017 IEEE Symposium on Visualization for Cyber Security (VizSec)","author":"Norton Andrew P.","year":"2017","unstructured":"Andrew P. Norton and Yanjun Qi. 2017. Adversarial-Playground: A visualization suite showing how adversarial examples fool deep learning. In Proceedings of the 2017 IEEE Symposium on Visualization for Cyber Security (VizSec). IEEE, 1\u20134. DOI: 10.1109\/VIZSEC.2017.8062202"},{"key":"e_1_3_2_36_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2021.04.008"},{"key":"e_1_3_2_37_2","doi-asserted-by":"crossref","first-page":"506","DOI":"10.1145\/3052973.3053009","volume-title":"Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security","author":"Papernot Nicolas","year":"2017","unstructured":"Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami. 2017. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, 506\u2013519. DOI: 10.1145\/3052973.3053009"},{"key":"e_1_3_2_38_2","volume-title":"Proceedings of the Eurographics Conference on Visualization (EuroVis)","author":"Park Cheonbok","year":"2021","unstructured":"Cheonbok Park, Soyoung Yang, Inyoup Na, Sunghyo Chung, Sungbok Shin, Bum Chul Kwon, Deokgun Park, and Jaegul Choo. 2021. VATUN: Visual analytics for testing and understanding convolutional neural networks. In Proceedings of the Eurographics Conference on Visualization (EuroVis). The Eurographics Association. DOI: 10.2312\/evs.20211047"},{"key":"e_1_3_2_39_2","doi-asserted-by":"publisher","DOI":"10.1080\/14786440109462720"},{"key":"e_1_3_2_40_2","doi-asserted-by":"publisher","unstructured":"Huy Phan. 2021. huyvnphan\/PyTorch_CIFAR10. DOI: 10.5281\/zenodo.4431043","DOI":"10.5281\/zenodo.4431043"},{"key":"e_1_3_2_41_2","volume-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)","author":"Qi Charles R.","year":"2017","unstructured":"Charles R. Qi, Hao Su, Kaichun Mo, and Leonidas J. Guibas. 2017. PointNet: Deep learning on point sets for 3D classification and segmentation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). DOI: 10.1109\/CVPR.2017.16"},{"key":"e_1_3_2_42_2","volume-title":"Proceedings of the Advances in Neural Information Processing Systems","volume":"32","author":"Qin Chongli","year":"2019","unstructured":"Chongli Qin, James Martens, Sven Gowal, Dilip Krishnan, Krishnamurthy Dvijotham, Alhussein Fawzi, Soham De, Robert Stanforth, and Pushmeet Kohli. 2019. Adversarial robustness through local linearization. In Proceedings of the Advances in Neural Information Processing Systems 32."},{"key":"e_1_3_2_43_2","first-page":"7909","volume-title":"Proceedings of the 37th International Conference on Machine Learning","author":"Raghunathan Aditi","year":"2020","unstructured":"Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John C. Duchi, and Percy Liang. 2020. Understanding and mitigating the tradeoff between robustness and accuracy. In Proceedings of the 37th International Conference on Machine Learning, 7909\u20137919."},{"key":"e_1_3_2_44_2","first-page":"1","volume-title":"Proceedings of the 2020 International Joint Conference on Neural Networks (IJCNN)","author":"Rathore Pradeep","year":"2020","unstructured":"Pradeep Rathore, Arghya Basak, Sri Harsha Nistala, and Venkataramana Runkana. 2020. Untargeted, targeted and universal adversarial attacks and defenses on time series. In Proceedings of the 2020 International Joint Conference on Neural Networks (IJCNN). IEEE, 1\u20138. DOI: 10.1109\/IJCNN48605.2020.9207272"},{"issue":"1","key":"e_1_3_2_45_2","first-page":"61","article-title":"Squares: Supporting interactive performance analysis for multiclass classifiers","volume":"23","author":"Ren Donghao","year":"2016","unstructured":"Donghao Ren, Saleema Amershi, Bongshin Lee, Jina Suh, and Jason D. Williams. 2016. Squares: Supporting interactive performance analysis for multiclass classifiers. IEEE Transactions on Visualization and Computer Graphics 23, 1 (2016), 61\u201370.","journal-title":"IEEE Transactions on Visualization and Computer Graphics"},{"key":"e_1_3_2_46_2","first-page":"631","volume-title":"Proceedings of the European Conference on Computer Vision (ECCV)","author":"Su Dong","year":"2018","unstructured":"Dong Su, Huan Zhang, Hongge Chen, Jinfeng Yi, Pin-Yu Chen, and Yupeng Gao. 2018. Is robustness the cost of accuracy?\u2013A comprehensive study on the robustness of 18 deep image classification models. In Proceedings of the European Conference on Computer Vision (ECCV), 631\u2013648. DOI: 10.1007\/978-3-030-01258-8_39"},{"key":"e_1_3_2_47_2","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"e_1_3_2_48_2","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-018-0012-9"},{"key":"e_1_3_2_49_2","first-page":"1","volume-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","author":"Szegedy Christian","year":"2015","unstructured":"Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. 2015. Going deeper with convolutions. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 1\u20139. DOI: 10.1109\/CVPR.2015.7298594"},{"key":"e_1_3_2_50_2","volume-title":"Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition Workshops","author":"Thys Simen","year":"2019","unstructured":"Simen Thys, Wiebe Van Ranst, and Toon Goedem\u00e9. 2019. Fooling automated surveillance cameras: Adversarial patches to attack person detection. In Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition Workshops. DOI: 10.1109\/CVPRW.2019.00012"},{"issue":"11","key":"e_1_3_2_51_2","article-title":"Visualizing data using t-SNE","volume":"9","author":"Van der Maaten Laurens","year":"2008","unstructured":"Laurens Van der Maaten and Geoffrey Hinton. 2008. Visualizing data using t-SNE. Journal of Machine Learning Research 9, 11 (2008).","journal-title":"Journal of Machine Learning Research"},{"key":"e_1_3_2_52_2","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2020.3030418"},{"key":"e_1_3_2_53_2","first-page":"1369","volume-title":"Proceedings of the IEEE International Conference on Computer Vision","author":"Xie Cihang","year":"2017","unstructured":"Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. 2017. Adversarial examples for semantic segmentation and object detection. In Proceedings of the IEEE International Conference on Computer Vision, 1369\u20131378."},{"key":"e_1_3_2_54_2","doi-asserted-by":"publisher","DOI":"10.1109\/LWC.2017.2757490"},{"key":"e_1_3_2_55_2","doi-asserted-by":"publisher","DOI":"10.1109\/LWC.2022.3207348"},{"key":"e_1_3_2_56_2","doi-asserted-by":"crossref","first-page":"160","DOI":"10.1109\/SMC42975.2020.9282889","volume-title":"Proceedings of the 2020 IEEE International Conference on Systems, Man, and Cybernetics (SMC)","author":"Zago Jo\u00e3o G.","year":"2020","unstructured":"Jo\u00e3o G. Zago, Eric A. Antonelo, Fabio L. Baldissera, and Rodrigo T. Saad. 2020. It is double pleasure to deceive the deceiver: Disturbing classifiers against adversarial attacks. In Proceedings of the 2020 IEEE International Conference on Systems, Man, and Cybernetics (SMC), 160\u2013165. DOI: 10.1109\/SMC42975.2020.9282889"},{"key":"e_1_3_2_57_2","doi-asserted-by":"crossref","first-page":"39","DOI":"10.1145\/3128572.3140449","volume-title":"Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security","author":"Zantedeschi Valentina","year":"2017","unstructured":"Valentina Zantedeschi, Maria-Irina Nicolae, and Ambrish Rawat. 2017. Efficient defenses against adversarial attacks. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, 39\u201349. DOI: 10.1145\/3128572.3140449"},{"key":"e_1_3_2_58_2","first-page":"7472","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Zhang Hongyang","year":"2019","unstructured":"Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. 2019. Theoretically principled trade-off between robustness and accuracy. In Proceedings of the International Conference on Machine Learning. PMLR, 7472\u20137482."},{"issue":"3","key":"e_1_3_2_59_2","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3374217","article-title":"Adversarial attacks on deep-learning models in natural language processing: A survey","volume":"11","author":"Zhang Wei Emma","year":"2020","unstructured":"Wei Emma Zhang, Quan Z. Sheng, Ahoud Alhazmi, and Chenliang Li. 2020. Adversarial attacks on deep-learning models in natural language processing: A survey. ACM Transactions on Intelligent Systems and Technology 11, 3 (2020), 1\u201341.","journal-title":"ACM Transactions on Intelligent Systems and Technology"},{"key":"e_1_3_2_60_2","first-page":"5654","volume-title":"Proceedings of the 2019 IEEE International Conference on Big Data (Big Data)","author":"Zhang Yu","year":"2019","unstructured":"Yu Zhang, Gongbo Liang, Tawfiq Salem, and Nathan Jacobs. 2019. Defense-PointNet: Protecting PointNet against adversarial attacks. In Proceedings of the 2019 IEEE International Conference on Big Data (Big Data). IEEE, 5654\u20135660. DOI: 10.1109\/BigData47090.2019.9006307"}],"container-title":["ACM Transactions on Interactive Intelligent Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3725739","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3725739","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:57:04Z","timestamp":1750298224000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3725739"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,5,15]]},"references-count":59,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2025,6,30]]}},"alternative-id":["10.1145\/3725739"],"URL":"https:\/\/doi.org\/10.1145\/3725739","relation":{},"ISSN":["2160-6455","2160-6463"],"issn-type":[{"value":"2160-6455","type":"print"},{"value":"2160-6463","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,5,15]]},"assertion":[{"value":"2024-06-13","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-02-26","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-05-15","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}