{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,10]],"date-time":"2026-01-10T01:47:23Z","timestamp":1768009643112,"version":"3.49.0"},"publisher-location":"New York, NY, USA","reference-count":28,"publisher":"ACM","funder":[{"name":"NSFC-ISF Joint Program","award":["62161146001"],"award-info":[{"award-number":["62161146001"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,10,13]]},"DOI":"10.1145\/3733821.3763024","type":"proceedings-article","created":{"date-parts":[[2025,11,13]],"date-time":"2025-11-13T08:58:58Z","timestamp":1763024338000},"page":"13-23","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Providing Certified Triggers in Trigger Set-Based Watermarking for Ownership Validation against Image Transformation"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3707-4623","authenticated-orcid":false,"given":"Jingyang","family":"Li","sequence":"first","affiliation":[{"name":"Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-3406-7520","authenticated-orcid":false,"given":"Minyu","family":"Chen","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9005-7112","authenticated-orcid":false,"given":"Guoqiang","family":"Li","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,11,13]]},"reference":[{"key":"e_1_3_3_1_2_2","first-page":"1615","volume-title":"27th USENIX Security Symposium, USENIX Security 2018, Baltimore, MD, USA, August 15-17, 2018","author":"Adi Yossi","year":"2018","unstructured":"Yossi Adi, Carsten Baum, Moustapha Ciss\u00e9, Benny Pinkas, and Joseph Keshet. 2018. Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring. In 27th USENIX Security Symposium, USENIX Security 2018, Baltimore, MD, USA, August 15-17, 2018. USENIX Association, 1615\u20131631."},{"key":"e_1_3_3_1_3_2","doi-asserted-by":"publisher","DOI":"10.1145\/3323873.3325042"},{"key":"e_1_3_3_1_4_2","unstructured":"S. Chen Z. He C. Sun J. Yang and X. Huang. 2022. Universal Adversarial Attack on Attention and the Resulting Dataset DAmageNet. IEEE Transactions on Pattern Analysis and Machine Intelligence 44 4 (2022) 2188\u20132197."},{"key":"e_1_3_3_1_5_2","doi-asserted-by":"crossref","unstructured":"Sumanth Dathathri Abigail See Sumedh Ghaisas Po-Sen Huang Rob McAdam Johannes Welbl Vandana Bachani Alex Kaskasoli Robert Stanforth Tatiana Matejovicova Jamie Hayes Nidhi Vyas Majd\u00a0Al Merey Jonah Brown-Cohen Rudy Bunel Borja Balle A.\u00a0Taylan Cemgil Zahra Ahmed Kitty Stacpoole Ilia Shumailov Ciprian Baetu Sven Gowal Demis Hassabis and Pushmeet Kohli. 2024. Scalable watermarking for identifying large language model outputs. Nat. 634 8035 (2024) 818\u2013823.","DOI":"10.1038\/s41586-024-08025-4"},{"key":"e_1_3_3_1_6_2","first-page":"4716","volume-title":"Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada","author":"Fan Lixin","year":"2019","unstructured":"Lixin Fan, Kam\u00a0Woh Ng, and Chee\u00a0Seng Chan. 2019. Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attacks. In Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada. 4716\u20134725."},{"key":"e_1_3_3_1_7_2","volume-title":"3rd International Conference on Learning Representations","author":"Goodfellow Ian\u00a0J.","year":"2015","unstructured":"Ian\u00a0J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and Harnessing Adversarial Examples. In 3rd International Conference on Learning Representations. San Diego, CA, USA, 11\u00a0pages."},{"key":"e_1_3_3_1_8_2","first-page":"1937","volume-title":"30th USENIX Security Symposium, USENIX Security 2021, August 11-13, 2021","author":"Jia Hengrui","year":"2021","unstructured":"Hengrui Jia, Christopher\u00a0A. Choquette-Choo, Varun Chandrasekaran, and Nicolas Papernot. 2021. Entangled Watermarks as a Defense against Model Extraction. In 30th USENIX Security Symposium, USENIX Security 2021, August 11-13, 2021. USENIX Association, 1937\u20131954."},{"key":"e_1_3_3_1_9_2","doi-asserted-by":"crossref","unstructured":"Suyoung Lee Wonho Song Suman Jana Meeyoung Cha and Sooel Son. 2023. Evaluating the Robustness of Trigger Set-Based Watermarks Embedded in Deep Neural Networks. IEEE Trans. Dependable Secur. Comput. 20 4 (2023) 3434\u20133448.","DOI":"10.1109\/TDSC.2022.3196790"},{"key":"e_1_3_3_1_10_2","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359801"},{"key":"e_1_3_3_1_11_2","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"crossref","first-page":"273","DOI":"10.1007\/978-3-030-00470-5_13","volume-title":"Research in Attacks, Intrusions, and Defenses - 21st International Symposium, RAID 2018, Heraklion, Crete, Greece, September 10-12, 2018, Proceedings","volume":"11050","author":"Liu Kang","year":"2018","unstructured":"Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2018. Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks. In Research in Attacks, Intrusions, and Defenses - 21st International Symposium, RAID 2018, Heraklion, Crete, Greece, September 10-12, 2018, Proceedings(Lecture Notes in Computer Science, Vol.\u00a011050). Springer, 273\u2013294."},{"key":"e_1_3_3_1_12_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833693"},{"key":"e_1_3_3_1_13_2","volume-title":"6th International Conference on Learning Representations, (ICLR 2018)","author":"Madry A.","year":"2018","unstructured":"A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. In 6th International Conference on Learning Representations, (ICLR 2018)."},{"key":"e_1_3_3_1_14_2","doi-asserted-by":"crossref","unstructured":"S.\u00a0M. Moosavi-Dezfooli A. Fawzi and P. Frossard. 2016. DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks. 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (2016) 2574\u20132582.","DOI":"10.1109\/CVPR.2016.282"},{"key":"e_1_3_3_1_15_2","first-page":"485","volume-title":"Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS 2019, Providence, RI, USA, April 13-17, 2019","author":"Rouhani Bita\u00a0Darvish","year":"2019","unstructured":"Bita\u00a0Darvish Rouhani, Huili Chen, and Farinaz Koushanfar. 2019. DeepSigns: An End-to-End Watermarking Framework for Ownership Protection of Deep Neural Networks. In Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS 2019, Providence, RI, USA, April 13-17, 2019. ACM, 485\u2013497."},{"key":"e_1_3_3_1_16_2","first-page":"857","volume-title":"Proceedings of the 1998 IEEE International Conference on Image Processing, ICIP-98, Chicago, Illinois, USA, October 4-7, 1998","author":"Shen Bo","year":"1998","unstructured":"Bo Shen, Ishwar\u00a0K. Sethi, and Vasudev Bhaskaran. 1998. DCT Domain Alpha Blending. In Proceedings of the 1998 IEEE International Conference on Image Processing, ICIP-98, Chicago, Illinois, USA, October 4-7, 1998. IEEE Computer Society, 857\u2013861."},{"key":"e_1_3_3_1_17_2","first-page":"6369","volume-title":"31st Annual Conference on Neural Information Processing Systems, (NeurIPS 2018)","author":"S.Jana S.Wang and K.Pei and J.Whitehouse and J.Yang and","year":"2018","unstructured":"S.Wang and K.Pei and J.Whitehouse and J.Yang and S.Jana. 2018. Efficient Formal Safety Analysis of Neural Networks. In 31st Annual Conference on Neural Information Processing Systems, (NeurIPS 2018). 6369\u20136379."},{"key":"e_1_3_3_1_18_2","volume-title":"2nd International Conference on Learning Representations, (ICLR 2014)","author":"Szegedy C.","year":"2014","unstructured":"C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus. 2014. Intriguing properties of neural networks. In 2nd International Conference on Learning Representations, (ICLR 2014)."},{"key":"e_1_3_3_1_19_2","doi-asserted-by":"publisher","DOI":"10.1145\/3078971.3078974"},{"key":"e_1_3_3_1_20_2","first-page":"1599","volume-title":"27th USENIX Security Symposium, (USENIX Security 2018)","author":"Wang S.","year":"2018","unstructured":"S. Wang, K. Pei, J. Whitehouse, J. Yang, and S. Jana. 2018. Formal Security Analysis of Neural Networks using Symbolic Intervals. In 27th USENIX Security Symposium, (USENIX Security 2018). 1599\u20131614."},{"key":"e_1_3_3_1_21_2","first-page":"29909","volume-title":"34th Annual Conference on Neural Information Processing Systems, (NeurIPS 2021)","author":"Wang Shiqi","year":"2021","unstructured":"Shiqi Wang, Huan Zhang, Kaidi Xu, Xue Lin, Suman\u00a0Sekhar Jana, Cho-Jui Hsieh, and J.\u00a0Zico Kolter. 2021. Beta-CROWN: Efficient Bound Propagation with Per-neuron Split Constraints for Neural Network Robustness Verification. In 34th Annual Conference on Neural Information Processing Systems, (NeurIPS 2021). 29909\u201329921."},{"key":"e_1_3_3_1_22_2","first-page":"5286","volume-title":"International Conference on Machine Learning","author":"Wong Eric","year":"2018","unstructured":"Eric Wong and Zico Kolter. 2018. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Conference on Machine Learning. PMLR, 5286\u20135295."},{"key":"e_1_3_3_1_23_2","unstructured":"Eric Wong Frank Schmidt Jan\u00a0Hendrik Metzen and J\u00a0Zico Kolter. 2018. Scaling provable adversarial defenses. Advances in Neural Information Processing Systems 31 (2018)."},{"key":"e_1_3_3_1_24_2","volume-title":"NeurIPS 2023","author":"Xue Haotian","year":"2023","unstructured":"Haotian Xue, Alexandre Araujo, Bin Hu, and Yongxin Chen. 2023. Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllability. In NeurIPS 2023."},{"key":"e_1_3_3_1_25_2","first-page":"4944","volume-title":"31st Annual Conference on Neural Information Processing Systems 2018, (NeurIPS 2018)","author":"Zhang Huan","year":"2018","unstructured":"Huan Zhang, Tsui-Wei Weng, Pin-Yu Chen, Cho-Jui Hsieh, and Luca Daniel. 2018. Efficient Neural Network Robustness Certification with General Activation Functions. In 31st Annual Conference on Neural Information Processing Systems 2018, (NeurIPS 2018). 4944\u20134953."},{"key":"e_1_3_3_1_26_2","doi-asserted-by":"publisher","DOI":"10.1145\/3196494.3196550"},{"key":"e_1_3_3_1_27_2","volume-title":"ICLR 2021","author":"Zhang Linjun","year":"2021","unstructured":"Linjun Zhang, Zhun Deng, Kenji Kawaguchi, Amirata Ghorbani, and James Zou. 2021. How Does Mixup Help With Robustness and Generalization?. In ICLR 2021."},{"key":"e_1_3_3_1_28_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-acl.678"},{"key":"e_1_3_3_1_29_2","volume-title":"6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Workshop Track Proceedings","author":"Zhu Michael","year":"2018","unstructured":"Michael Zhu and Suyog Gupta. 2018. To Prune, or Not to Prune: Exploring the Efficacy of Pruning for Model Compression. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Workshop Track Proceedings. OpenReview.net."}],"event":{"name":"CCS '25: ACM SIGSAC Conference on Computer and Communications Security","location":"Taipei Taiwan","acronym":"ARTMAN '25","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2025 Workshop on Recent Advances in Resilient and Trustworthy MAchine learning-driveN systems"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3733821.3763024","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,9]],"date-time":"2026-01-09T18:58:10Z","timestamp":1767985090000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3733821.3763024"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,13]]},"references-count":28,"alternative-id":["10.1145\/3733821.3763024","10.1145\/3733821"],"URL":"https:\/\/doi.org\/10.1145\/3733821.3763024","relation":{},"subject":[],"published":{"date-parts":[[2025,10,13]]},"assertion":[{"value":"2025-11-13","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}