{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,25]],"date-time":"2026-03-25T21:21:06Z","timestamp":1774473666066,"version":"3.50.1"},"reference-count":47,"publisher":"Association for Computing Machinery (ACM)","issue":"CoNEXT1","funder":[{"name":"National Natural Science Foundation of China &#x28;NSFC&#x29;","award":["62025201"],"award-info":[{"award-number":["62025201"]}]},{"name":"National Natural Science Foundation of China","award":["U25B2038"],"award-info":[{"award-number":["U25B2038"]}]},{"DOI":"10.13039\/501100004735","name":"Hunan Provincial Natural Science Foundation of China","doi-asserted-by":"crossref","award":["2024JJ3014"],"award-info":[{"award-number":["2024JJ3014"]}],"id":[{"id":"10.13039\/501100004735","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Proc. ACM Netw."],"published-print":{"date-parts":[[2026,3,25]]},"abstract":"<jats:p>Website Fingerprinting (WF) attacks based on Deep Neural Networks (DNN) pose serious threats to user privacy in anonymous communication systems such as Tor. Existing defenses show limited effectiveness in black-box scenarios, facing challenges including poor perturbation transferability, lack of directional and real-time constraints, limited universality, and high overhead. To address these issues, this paper proposes HAAD (Heuristic Ant-based Adversarial Defense), a black-box defense framework based on an ant colony algorithm. HAAD generates perturbations by combining an ensemble substitute model with ant colony optimization, avoiding reliance on gradient information and enhancing transferability to unknown models. Additionally, a per-packet injection method with directional constraints is designed to achieve real-time defense without extra latency. A universal perturbation algorithm is introduced, optimizing perturbations for diverse traffic scenarios via a scoring mechanism, effectively reducing communication overhead.<\/jats:p>\n                  <jats:p>Experimental results show that under various adversarial attack models, HAAD achieves a Defense Success Rate (DSR) exceeding 90% while requiring only 30 injected dummy packets\u2014incurring minimal overhead. When deployed on a P4 switch, the maximum end-to-end latency is only 200 nanoseconds. We further implement HAAD in the Tor pt-plugin, where the full-page load median latency is merely 0.02 seconds. These results highlight HAAD's strong defensive capability and practical applicability.<\/jats:p>","DOI":"10.1145\/3786288","type":"journal-article","created":{"date-parts":[[2026,3,25]],"date-time":"2026-03-25T20:02:04Z","timestamp":1774468924000},"page":"1-23","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["HAAD: A Heuristic Ant Algorithm for Defending Against Website Fingerprinting Attacks"],"prefix":"10.1145","volume":"4","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-1860-7767","authenticated-orcid":false,"given":"Pingfan","family":"Li","sequence":"first","affiliation":[{"name":"Hunan University, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2163-2723","authenticated-orcid":false,"given":"Kun","family":"Xie","sequence":"additional","affiliation":[{"name":"Hunan University, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6964-0995","authenticated-orcid":false,"given":"Ruotian","family":"Xie","sequence":"additional","affiliation":[{"name":"Hunan University, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-3209-1416","authenticated-orcid":false,"given":"Pengcheng","family":"Zhao","sequence":"additional","affiliation":[{"name":"Hunan University, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-8587-3686","authenticated-orcid":false,"given":"Jiajun","family":"He","sequence":"additional","affiliation":[{"name":"Hunan University, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7363-881X","authenticated-orcid":false,"given":"Jigang","family":"Wen","sequence":"additional","affiliation":[{"name":"Hunan University of Science and Technology, Xiangtan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5074-1363","authenticated-orcid":false,"given":"Wei","family":"Liang","sequence":"additional","affiliation":[{"name":"Hunan University of Science and Technology, Xiangtan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8728-2757","authenticated-orcid":false,"given":"Yong","family":"Xie","sequence":"additional","affiliation":[{"name":"Nanjing University of Posts and Telecommunications, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2026,3,25]]},"reference":[{"key":"e_1_2_1_1_1","first-page":"1","volume-title":"QC","author":"Wu T.","year":"2021","unstructured":"T. Wu, Y. Song, F. Zhang, S. Gao, and B. Chen, ''My site knows where you are: A novel browser fingerprint to track user position,'' in ICC 2021 - IEEE International Conference on Communications, Montreal, QC, Canada, 2021, pp. 1-6."},{"key":"e_1_2_1_2_1","first-page":"15","article-title":"Fingerprinting attack on tor anonymity using deep learning","volume":"42","author":"Abe K.","year":"2016","unstructured":"K. Abe and S. Goto, ''Fingerprinting attack on tor anonymity using deep learning,'' Proc. Asia-Pacific Adv. Netw., vol. 42, pp. 15-20, Aug. 2016.","journal-title":"Proc. Asia-Pacific Adv. Netw."},{"key":"e_1_2_1_3_1","first-page":"1","volume-title":"Netw. Distrib. Syst. Secur. Symp.hskip 1em plus 0.5em minus 0.4emrelax Reston, VA, USA: The Internet Society","author":"Rimmer V.","year":"2018","unstructured":"V. Rimmer, D. Preuveneers, M. Juarez, T. V. Goethem, and W. Joosen, ''Automated website fingerprinting through deep learning,'' in Proc. Netw. Distrib. Syst. Secur. Symp.hskip 1em plus 0.5em minus 0.4emrelax Reston, VA, USA: The Internet Society, 2018, pp. 1-15."},{"key":"e_1_2_1_4_1","first-page":"1928","volume-title":"ACM SIGSAC Conf. Comput. Commun. Secur.","author":"Sirinam P.","year":"2018","unstructured":"P. Sirinam, M. Imani, M. Ju\u00e1rez, and M. Wright, ''Deep fingerprinting: Undermining website fingerprinting defenses with deep learning,'' in Proc. ACM SIGSAC Conf. Comput. Commun. Secur., Oct. 2018, pp. 1928-1943."},{"key":"e_1_2_1_5_1","first-page":"23477","article-title":"Website fingerprinting at internet scale","volume":"1","author":"Panchenko A.","year":"2016","unstructured":"A. Panchenko, F. Lanze, J. Pennekamp, K. Wehrle, and T. Engel, ''Website fingerprinting at internet scale,'' in NDSS, vol. 1, 2016, p. 23477.","journal-title":"NDSS"},{"key":"e_1_2_1_6_1","first-page":"1971","volume-title":"Trafficsliver: Fighting website fingerprinting attacks with traffic splitting,'' in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security","author":"De la Cadena W.","year":"2020","unstructured":"W. De la Cadena, A. Mitseva, J. Hiller, J. Pennekamp, S. Reuter, J. Filter, T. Engel, K. Wehrle, and A. Panchenko, ''Trafficsliver: Fighting website fingerprinting attacks with traffic splitting,'' in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, 2020, pp. 1971-1985."},{"key":"e_1_2_1_7_1","first-page":"1997","volume-title":"Robust and reliable early-stage website fingerprinting attacks via spatial-temporal distribution analysis,'' in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","author":"Deng X.","year":"2024","unstructured":"X. Deng, Q. Li, and K. Xu, ''Robust and reliable early-stage website fingerprinting attacks via spatial-temporal distribution analysis,'' in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 1997-2011."},{"key":"e_1_2_1_8_1","first-page":"607","article-title":"website fingerprinting defenses with robust traffic representation","author":"Shen M.","year":"2023","unstructured":"M. Shen, K. Ji, Z. Gao, Q. Li, L. Zhu, and K. Xu, ''Subverting website fingerprinting defenses with robust traffic representation,'' in 32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 607-624.","journal-title":"32nd USENIX Security Symposium (USENIX Security 23)"},{"key":"e_1_2_1_9_1","first-page":"1187","article-title":"k-fingerprinting: A robust scalable website fingerprinting technique","author":"Hayes J.","year":"2016","unstructured":"J. Hayes and G. Danezis, ''k-fingerprinting: A robust scalable website fingerprinting technique,'' in 25th USENIX Security Symposium (USENIX Security 16), 2016, pp. 1187-1203.","journal-title":"25th USENIX Security Symposium (USENIX Security 16)"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2019-0070"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2020-0043"},{"key":"e_1_2_1_12_1","first-page":"1","volume-title":"2nd Int. Conf. Learn. Represent.","author":"Szegedy C.","year":"2014","unstructured":"C. Szegedy et al., ''Intriguing properties of neural networks,'' in Proc. 2nd Int. Conf. Learn. Represent., 2014, pp. 1-10."},{"issue":"9","key":"e_1_2_1_13_1","doi-asserted-by":"crossref","first-page":"2805","DOI":"10.1109\/TNNLS.2018.2886017","article-title":"Attacks and defenses for deep learning","volume":"30","author":"Yuan X.","year":"2019","unstructured":"X. Yuan, P. He, Q. Zhu, and X. Li, ''Adversarial examples: Attacks and defenses for deep learning,'' IEEE Trans. Neural Netw. Learn. Syst., vol. 30, no. 9, pp. 2805-2824, Sep. 2019.","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.3039691"},{"key":"e_1_2_1_15_1","first-page":"1","volume-title":"IEEE Symp. Comput. Commun. (ISCC)","author":"Hou C.","year":"2020","unstructured":"C. Hou, G. Gou, J. Shi, P. Fu, and G. Xiong, ''Wf-gan: Fighting back against website fingerprinting attack using adversarial learning,'' in Proc. IEEE Symp. Comput. Commun. (ISCC), Jul. 2020, pp. 1-7."},{"key":"e_1_2_1_16_1","first-page":"2705","volume-title":"30th USENIX Secur. Symp.hskip 1em plus 0.5em minus 0.4emrelax USENIX Association","author":"Nasr M.","year":"2021","unstructured":"M. Nasr, A. Bahramali, and A. Houmansadr, ''Defeating dnn-based traffic analysis systems in real-time with blind adversarial perturbations,'' in Proc. 30th USENIX Secur. Symp.hskip 1em plus 0.5em minus 0.4emrelax USENIX Association, 2021, pp. 2705-2722."},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3186743"},{"key":"e_1_2_1_18_1","first-page":"27","volume-title":"Toward an efficient website fingerprinting defense,'' in European Symposium on Research in Computer Security","author":"Ju\u00e1rez M.","year":"2016","unstructured":"M. Ju\u00e1rez, M. Imani, M. Perry, C. D\u00edaz, and M. Wright, ''Toward an efficient website fingerprinting defense,'' in European Symposium on Research in Computer Security, vol. 9878.hskip 1em plus 0.5em minus 0.4emrelax Springer, 2016, pp. 27-46."},{"key":"e_1_2_1_19_1","first-page":"1375","article-title":"Walkie-talkie: An efficient defense against passive website fingerprinting attacks","author":"Wang T.","year":"2017","unstructured":"T. Wang and I. Goldberg, ''Walkie-talkie: An efficient defense against passive website fingerprinting attacks,'' in Proceedings of the 26th USENIX Security Symposium. hskip 1em plus 0.5em minus 0.4emrelax USENIX Association, 2017, pp. 1375-1390.","journal-title":"Proceedings of the 26th USENIX Security Symposium. hskip 1em plus 0.5em minus 0.4emrelax USENIX Association"},{"key":"e_1_2_1_20_1","doi-asserted-by":"crossref","unstructured":"X. Cai R. Nithyanand T. Wang R. Johnson and I. Goldberg ''A systematic approach to developing and evaluating website fingerprinting defenses '' in Proceedings of the 21st ACM SIGSAC Conference on Computer and Communications Security. hskip 1em plus 0.5em minus 0.4emrelax ACM 2014 pp. 227-238.","DOI":"10.1145\/2660267.2660362"},{"key":"e_1_2_1_21_1","doi-asserted-by":"crossref","first-page":"344","DOI":"10.2478\/popets-2022-0049","article-title":"Regulator: A straightforward website fingerprinting defense","volume":"2","author":"Holland J. K.","year":"2022","unstructured":"J. K. Holland and N. Hopper, ''Regulator: A straightforward website fingerprinting defense,'' Proceedings on Privacy Enhancing Technologies, vol. 2, pp. 344-362, 2022.","journal-title":"Proceedings on Privacy Enhancing Technologies"},{"key":"e_1_2_1_22_1","first-page":"717","article-title":"Zero-delay lightweight defenses against website fingerprinting","author":"Gong J.","year":"2020","unstructured":"J. Gong and T. Wang, ''Zero-delay lightweight defenses against website fingerprinting,'' in 29th USENIX Security Symposium (USENIX Security 20), 2020, pp. 717-734.","journal-title":"29th USENIX Security Symposium (USENIX Security 20)"},{"key":"e_1_2_1_23_1","first-page":"163","article-title":"Aco algorithms for the traveling salesman problem","volume":"4","author":"St\u00fctzle T.","year":"1999","unstructured":"T. St\u00fctzle and M. Dorigo, ''Aco algorithms for the traveling salesman problem,'' Evolutionary Algorithms in Engineering and Computer Science, vol. 4, pp. 163-183, 1999.","journal-title":"Evolutionary Algorithms in Engineering and Computer Science"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1126\/science.220.4598.671"},{"key":"e_1_2_1_25_1","first-page":"1357","volume-title":"26th USENIX Secur. Symp.hskip 1em plus 0.5em minus 0.4emrelax Berkeley, CA, USA: USENIX Association","author":"Schuster R.","year":"2017","unstructured":"R. Schuster, V. Shmatikov, and E. Tromer, ''Beauty and the burst: Remote identification of encrypted video streams,'' in Proc. 26th USENIX Secur. Symp.hskip 1em plus 0.5em minus 0.4emrelax Berkeley, CA, USA: USENIX Association, 2017, pp. 1357-1374."},{"key":"e_1_2_1_26_1","volume-title":"Machine learning algorithms - a review,'' International Journal of Science and Research (IJSR)","author":"M.","unstructured":"M. B, ''Machine learning algorithms - a review,'' International Journal of Science and Research (IJSR), vol. 9, no. 1, pp. 381-386, 2020, internet."},{"issue":"6245","key":"e_1_2_1_27_1","doi-asserted-by":"crossref","first-page":"255","DOI":"10.1126\/science.aaa8415","article-title":"Trends, perspectives, and prospects","volume":"349","author":"J. M. I","year":"2015","unstructured":"J. M. I and M. T. M, ''Machine learning: Trends, perspectives, and prospects,'' Science, vol. 349, no. 6245, pp. 255-260, 2015.","journal-title":"Science"},{"key":"e_1_2_1_28_1","first-page":"171","volume-title":"Machine learning and law: An overview","author":"S.","year":"2021","unstructured":"S. H, Machine learning and law: An overview, 2021, pp. 171-184."},{"key":"e_1_2_1_29_1","first-page":"2459","volume-title":"Dfd: Adversarial learning-based approach to defend against website fingerprinting,'' in IEEE INFOCOM 2020-IEEE Conference on Computer Communications. hskip 1em plus 0.5em minus 0.4emrelax IEEE","author":"Abusnaina A.","year":"2020","unstructured":"A. Abusnaina, R. Jang, A. Khormali, and A. Mohaisen, ''Dfd: Adversarial learning-based approach to defend against website fingerprinting,'' in IEEE INFOCOM 2020-IEEE Conference on Computer Communications. hskip 1em plus 0.5em minus 0.4emrelax IEEE, 2020, pp. 2459-2468."},{"key":"e_1_2_1_30_1","first-page":"332","volume-title":"CA","author":"Dyer K. P.","year":"2012","unstructured":"K. P. Dyer, S. E. Coull, T. Ristenpart, and T. Shrimpton, ''Peek-a-boo, i still see you: Why efficient traffic analysis countermeasures fail,'' in 2012 IEEE Symposium on Security and Privacy. hskip 1em plus 0.5em minus 0.4emrelax San Francisco, CA, USA: IEEE, 2012, pp. 332-346."},{"key":"e_1_2_1_31_1","volume-title":"Galvez et al., ''Inside job: Applying traffic analysis to measure tor from within,'' in NDSS","author":"Jansen R.","year":"2018","unstructured":"R. Jansen, M. Juarez, R. Galvez et al., ''Inside job: Applying traffic analysis to measure tor from within,'' in NDSS, 2018."},{"key":"e_1_2_1_32_1","doi-asserted-by":"crossref","unstructured":"Z. Ling G. Xiao L. Luo et al. ''Wfguard: an effective fuzzing - testing - based traffic morphing defense against website fingerprinting '' in IEEE INFOCOM 2024 - IEEE Conference on Computer Communications. hskip 1em plus 0.5em minus 0.4emrelax IEEE 2024 pp. 441-450.","DOI":"10.1109\/INFOCOM52122.2024.10621121"},{"key":"e_1_2_1_33_1","first-page":"5084","volume-title":"Liangmin et al., ''An end - to - end anonymous traffic analysis system,'' in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","author":"Xianglan H.","year":"2024","unstructured":"H. Xianglan, Z. Qiang, W. Liangmin et al., ''An end - to - end anonymous traffic analysis system,'' in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 5084-5086."},{"key":"e_1_2_1_34_1","doi-asserted-by":"crossref","first-page":"103582","DOI":"10.1016\/j.jnca.2023.103582","article-title":"The rise of website fingerprinting on tor: Analysis on techniques and assumptions","volume":"212","author":"Aminuddin M. A. I. M.","year":"2023","unstructured":"M. A. I. M. Aminuddin, Z. F. Zaaba, A. Samsudin et al., ''The rise of website fingerprinting on tor: Analysis on techniques and assumptions,'' Journal of Network and Computer Applications, vol. 212, p. 103582, 2023.","journal-title":"Journal of Network and Computer Applications"},{"key":"e_1_2_1_35_1","first-page":"2025","article-title":"Kernelsnitch: Side-channel attacks on kernel data structures","volume":"2025","author":"M. L., J. J., S. T.","year":"2025","unstructured":"M. L., J. J., S. T., and et al., ''Kernelsnitch: Side-channel attacks on kernel data structures,'' in Network and Distributed System Security Symposium 2025: NDSS 2025, 2025, 2025.","journal-title":"Network and Distributed System Security Symposium"},{"key":"e_1_2_1_36_1","volume-title":"Tor: The second - generation onion router,'' in 13th USENIX Security Symposium (USENIX Security 04). hskip 1em plus 0.5em minus 0.4emrelax San Diego","author":"Dingledine R.","year":"2004","unstructured":"R. Dingledine, N. Mathewson, and P. F. Syverson, ''Tor: The second - generation onion router,'' in 13th USENIX Security Symposium (USENIX Security 04). hskip 1em plus 0.5em minus 0.4emrelax San Diego, CA: USENIX Association, Aug. 2004."},{"key":"e_1_2_1_37_1","doi-asserted-by":"crossref","unstructured":"J. Hiller J. Pennekamp M. Dahlmanns M. Henze A. Panchenko and K. Wehrle ''Tailoring onion routing to the internet of things: Security and privacy in untrusted environments '' in 2019 IEEE 27th International Conference on Network Protocols (ICNP). hskip 1em plus 0.5em minus 0.4emrelax IEEE 2019 pp. 1-12.","DOI":"10.1109\/ICNP.2019.8888033"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2019.1800819"},{"key":"e_1_2_1_39_1","doi-asserted-by":"crossref","unstructured":"X. Cai X. C. Zhang B. Joshi R. Nithyanand I. Goldberg and E. Shi ''Touching from a distance: Website fingerprinting attacks and defenses '' in Proceedings of the 2012 ACM conference on Computer and communications security. hskip 1em plus 0.5em minus 0.4emrelax New York NY USA: ACM 2012 pp. 605-616.","DOI":"10.1145\/2382196.2382260"},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1515\/popets-2016-0027"},{"key":"e_1_2_1_41_1","first-page":"717","volume-title":"Zero-delay lightweight defenses against website fingerprinting,'' in 29th USENIX Security Symposium (USENIX Security 20). hskip 1em plus 0.5em minus 0.4emrelax USENIX Association","author":"Gong J.","year":"2020","unstructured":"BIBentryALTinterwordspacing J. Gong and T. Wang, ''Zero-delay lightweight defenses against website fingerprinting,'' in 29th USENIX Security Symposium (USENIX Security 20). hskip 1em plus 0.5em minus 0.4emrelax USENIX Association, 2020, pp. 717-734. [Online]. Available: https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/gong BIBentrySTDinterwordspacing"},{"key":"e_1_2_1_42_1","unstructured":"torproject.org ''Tor pluggable transport '' https:\/\/tb-manual.torproject.org\/circumvention\/."},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3304528"},{"key":"e_1_2_1_44_1","doi-asserted-by":"crossref","first-page":"30","DOI":"10.1109\/TIFS.2023.3318966","article-title":"Wf-transformer: Learning temporal features for accurate anonymous traffic identification by using transformer networks","volume":"19","author":"Zhou Q.","year":"2023","unstructured":"Q. Zhou, L. Wang, H. Zhu et al., ''Wf-transformer: Learning temporal features for accurate anonymous traffic identification by using transformer networks,'' IEEE Transactions on Information Forensics and Security, vol. 19, pp. 30-43, 2023.","journal-title":"IEEE Transactions on Information Forensics and Security"},{"issue":"1","key":"e_1_2_1_45_1","doi-asserted-by":"crossref","first-page":"632","DOI":"10.1109\/TDSC.2024.3411014","article-title":"Few-shot website fingerprinting with distribution calibration","volume":"22","author":"Luo C.","year":"2024","unstructured":"C. Luo, W. Tang, Q. Wang et al., ''Few-shot website fingerprinting with distribution calibration,'' IEEE Transactions on Dependable and Secure Computing, vol. 22, no. 1, pp. 632-648, 2024.","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"key":"e_1_2_1_46_1","volume-title":"Delving into transferable adversarial examples and black-box attacks,'' arXiv preprint arXiv:1611.02770","author":"Liu Y.","year":"2017","unstructured":"Y. Liu, X. Chen, C. Liu, and D. Song, ''Delving into transferable adversarial examples and black-box attacks,'' arXiv preprint arXiv:1611.02770, 2017."},{"key":"e_1_2_1_47_1","volume-title":"Ensemble adversarial training: Attacks and defenses,'' arXiv preprint arXiv:1705.07204","author":"Tram\u00e8r F.","year":"2018","unstructured":"F. Tram\u00e8r, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel, ''Ensemble adversarial training: Attacks and defenses,'' arXiv preprint arXiv:1705.07204, 2018."}],"container-title":["Proceedings of the ACM on Networking"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3786288","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,25]],"date-time":"2026-03-25T20:03:09Z","timestamp":1774468989000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3786288"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3,25]]},"references-count":47,"journal-issue":{"issue":"CoNEXT1","published-print":{"date-parts":[[2026,3,25]]}},"alternative-id":["10.1145\/3786288"],"URL":"https:\/\/doi.org\/10.1145\/3786288","relation":{},"ISSN":["2834-5509"],"issn-type":[{"value":"2834-5509","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3,25]]},"assertion":[{"value":"2026-03-25","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}