Pith. sign in

REVIEW 4 major objections 5 minor 74 references

DP-TRAE: A Dual-Phase Merging Transferable Reversible Adversarial Example for Image Privacy Protection

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A two-phase reversible adversarial attack achieves 99.0% success against black-box classifiers while restoring original images.

desk verdict The dual-phase attack idea has merit, but the abstract's 99% ASR and 100% recovery claims are contradicted by the paper's own tables. read the letter →

arxiv 2505.06860 v1 pith:OPOMRQP3 submitted 2025-05-11 cs.CR cs.AIcs.LG

Xia Du , Jiajie Zhu , Jizhe Zhou , Chi-man Pun , Zheng Lin , Cong Wu , Zhe Chen , Jun Luo This is my paper · ORCID
classification cs.CRcs.AIcs.LG
keywords reversibleadversarialexamplesblack-boxattackimageprivacyprotectiondatahidingtransferabilityqueryefficiencyHuffmancodingcommercialAPI
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes DP-TRAE, a method for crafting reversible adversarial examples—images that are perturbed to fool classifiers but can be restored to the original—so that they work against unknown black-box classifiers. The central claim is that splitting the attack into a transferable white-box phase and a query-efficient black-box phase resolves the tension between strong attacks and the strict perturbation limits of reversible data hiding. On a ten-model ImageNet benchmark, the paper reports 99.0% black-box attack success, better transferability than prior reversible attacks, and a 100% recovery rate for restored images. It also reports a 92% success rate against a commercial cloud vision API, presented as the first reversible adversarial attack on a commercial black-box model. If the claim holds, reversible adversarial examples move from white-box demonstrations to a practical privacy tool for unknown and proprietary classifiers.

What carries the argument

The load-bearing mechanism is the two-phase perturbation pipeline together with the compression scheme that makes reversibility affordable. SA-WA's stepwise adaptive rule labels the top $(N-i)/2N$ gradient positions for extra perturbation and shrinks that set as iterations grow, which the paper argues boosts transferability while curbing overfitting. MAE-BA's memory list $H$ stores the probability ratios from each queried superpixel block and periodically expands the block that gave the largest ratio, exploiting local coherence of gradients to reduce queries. Equation (8) maps each perturbation to a thresholded magnitude in $\{0,1,2\}$ times a stage threshold $\xi$, and Huffman coding then compresses the resulting message so the side information fits into the reversible data hiding stage; this quantization is what lets the attack use larger, more effective perturbations without exceeding RDH capacity.

What would settle it

Compare the restored images with the originals pixel by pixel on the paper's 1,000-image test set: lossless recovery requires every pixel to be identical, so any nonzero difference—already implied by the reported 48.94 dB PSNR—would refute the 100% recovery claim. A direct byte-level comparison settles it.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that a reversible adversarial example can be made black-box practical by combining two complementary phases. The Stepwise Adaptive White-box Attack (SA-WA) first generates a transferable perturbation from a known surrogate model, amplifying gradient-sensitive regions early and tapering that amplification to avoid overfitting, using momentum, input diversity, and translation-invariant smoothing. The Memory-Assisted Expansion Black-box Attack (MAE-BA) then queries the unknown model on superpixel blocks—groups of neighboring pixels—and keeps a memory of which regions most changed the target probability, periodically revisiting and expanding those regions. The final perturbation is quantized to three magnitudes, compressed with Huffman coding, and embedded with reversible data hiding so the image can be restored. Across ten ImageNet classifiers of varied architecture, the paper reports 99.0% black-box attack success and 100% recovery of correct classifications from restored images.

Load-bearing premise

The load-bearing premise is that reversible data hiding recovers the original pixels losslessly; if that step is even slightly lossy, the advertised 100% recovery rate fails no matter how strong the attack is.

Editorial extensions

If this is right

  • Reversible adversarial examples can be targeted at black-box and proprietary image classifiers, not only at white-box surrogates.
  • A white-box initialization followed by black-box refinement lowers the query budget compared with starting from random perturbations.
  • Threshold quantization plus Huffman coding is a workable way to fit strong adversarial perturbations inside the storage limits of reversible data hiding.
  • The reported robustness under spatial squeezing, randomization, Gaussian blur, JPEG compression, and super-resolution suggests the approach survives common preprocessing defenses.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper's claims, the finite PSNR of 48.94 dB for restored images means exact pixel-for-pixel recovery is not demonstrated; the 100% figure appears to measure classification success, not bit-exact identity.
  • Beyond the paper's claims, the method's transferability is bounded by how well the surrogate models approximate the unknown target, so success on ImageNet-style classifiers may not carry over to very different domains.
  • Beyond the paper's claims, the 92% commercial-API result on 50 images is a small sample; a larger evaluation with equalized query budgets against other black-box attacks would sharpen the practical estimate.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The manuscript proposes DP-TRAE, a reversible adversarial example method for image privacy protection. It combines a white-box stepwise adaptive attack (SA-WA) to generate a transferable initial perturbation with a memory-assisted black-box attack (MAE-BA) that queries superpixel blocks and uses historical query results. The perturbation is quantized, Huffman-coded, and embedded via reversible data hiding (RDH), with recovery intended to restore the original image. Experiments report attack success rates across several ImageNet classifiers, robustness against preprocessing defenses, recovery quality metrics, ablations, and a commercial API attack. The central claim, stated in the abstract and introduction, is that the method achieves 99.0% attack success rate and 100% recovery rate in black-box scenarios.

Significance. If the claims were substantiated, DP-TRAE would be a practically relevant advance: it would make reversible adversarial examples viable against black-box and commercial models, combining transferable initialization with query-efficient refinement while preserving lossless recovery. The paper has genuine strengths: it evaluates against multiple black-box baselines, tests robustness defenses, includes ablation studies, and reports a real-world commercial API attack. The algorithms are presented in sufficient detail to be reimplemented. However, the headline numerical claims are contradicted by the manuscript's own tables, and the defining 'reversible' property is not established: the reported recovery quality is finite-PSNR, not lossless, and the RDH mechanism is described only as LSB embedding with no losslessness mechanism or capacity analysis. These are load-bearing issues for the paper's central contribution.

major comments (4)
  1. [Abstract and Tables II-III] The abstract claims a '99.0% attack success rate and 100% recovery rate in black-box scenarios,' but the black-box results in Table III give DP-TRAE an average ASR of 81.5%, with the 99.0% value appearing only for the query model DN-121. The values near 99.0% in Table II occur in the ensemble/white-box transfer setting, not in the black-box scenario of Table III. The headline ASR claim is therefore unsupported by the reported black-box experiments. In addition, all ASR values are point estimates on 1,000 images with no error bars or significance tests, so the claimed superiority over baselines is not statistically grounded.
  2. [Section III.E and Table V] The paper repeatedly states that the RDH step recovers the original image losslessly (Section III.A, Section III.E, Section IV.D), and the abstract claims a 100% recovery rate. Table V, however, reports the recovered image at PSNR 48.94 dB and SSIM 0.9913. An exactly recovered image would have infinite PSNR and SSIM of 1.0. These numbers are inconsistent with lossless recovery and with the claim that the restored images are 'without loss' and 'indistinguishable from the original images.' This contradiction invalidates the central 'reversible' property as currently claimed; the authors must either provide a genuinely lossless recovery pipeline with corresponding evidence or restate the contribution as approximate recovery, which would be a fundamentally different result.
  3. [Section II.B and Section III.E] The RDH component is described only as 'we employ the LSB method for data embedding' (Section II.B) with no mechanism that would make LSB embedding reversible. Standard LSB substitution overwrites the least significant bits and is not lossless unless the original bits are stored, or histogram shifting/overflow handling is used. The paper provides no such mechanism, no discussion of overflow/underflow at pixel boundaries, and no capacity analysis for embedding the Huffman-coded stage matrix into x+delta while preserving exact recovery. Without these details, Algorithm 3 cannot substantiate the claim that the perturbation information is embedded reversibly.
  4. [Algorithm 3, line 5] In Algorithm 3, line 5 sets Mse[h,w] = xi for every position, while line 6 appends the computed stage value to the Huffman tree. As written, the message matrix does not encode the perturbation stages; if this is a typo for Mse[h,w] = stage, it must be corrected. Either way, the paper never specifies the extraction and recovery algorithm that reverses this embedding, so the reader cannot verify the claimed lossless restoration.
minor comments (5)
  1. [Abstract] There is a typo in the abstract: 'Further more' should be 'Furthermore'.
  2. [Table IV caption] The caption says 'againsting'; this should be 'against'.
  3. [Table V caption] The caption contains typos: 'RECOVERD' should be 'RECOVERED' and 'CLASSFICATION' should be 'CLASSIFICATION'.
  4. [Figure 4] The subplots in Figure 4 lack axis labels and units; please state what quantity is plotted (presumably average ASR) and over which target models the average is taken.
  5. [Section IV.F] The commercial model experiment uses only 50 images and does not specify the query budget or API constraints; please provide these details so the 92% success rate can be interpreted.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's attack and recovery numbers come from direct experiments, not from a derivation that reduces to its own inputs.

full rationale

DP-TRAE is an empirical systems paper. Its headline quantities are attack success rates and recovery metrics measured on fixed models and a commercial API; none of these are derived from a fitted parameter, an assumed uniqueness theorem, or a self-citation chain. The method in Section III combines standard transferable white-box attacks (MI/DI/TI), a superpixel-based black-box search with a historical query memory, Huffman coding, and a reversible-data-hiding embedding step. Each component is described operationally, and the reported ASR tables compare against external baselines such as SimBA and SurFree. The comparison with the authors' own prior DP-RAE is a legitimate baseline, and the citation to the ACM MM preliminary version [42] does not carry any load-bearing mathematical or uniqueness claim. The tuning of expansion size and enhancement frequency on the test models is a model-selection and generalization concern, not a circular-reasoning defect. The claim of '100% recovery rate' is unsupported by the finite PSNR and SSIM in Table V, and the abstract's '99.0% attack success rate' is not the Table III average; these are consistency and support problems, but they are not cases where a prediction is forced by construction or where an output is defined as its own input. No specific reduction of a target quantity to the method's own assumptions or prior self-citations can be exhibited, so the appropriate circularity score is 0.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The method rests on several hand-set hyperparameters and heuristics rather than a first-principles derivation. The most fragile assumption is lossless RDH recovery, which is contradicted by the reported finite PSNR. No new physical entities are introduced.

free parameters (5)
  • stage threshold ξ = ξ = epsilon/2, with epsilon = 8/255 (approximately 4/255)
    Controls the quantization levels in Eq. 8-9 and the step size; set by hand in Section IV-A, not cross-validated.
  • expansion size Ep = 4
    Chosen from ablation in Section IV-E, Fig. 4(a), then used in the main results; no separate validation set is used.
  • enhance step size s = 5
    Chosen from ablation in Section IV-E, Fig. 4(b), balancing success and compute; used directly in the main experiments.
  • white-box and black-box iteration counts = 10 and 1000
    Set in Section IV-A by hand; these directly determine attack success and query cost.
  • SA amplification schedule (top fraction labeled 2) = (N-i)/2N at iteration i
    Algorithm 1 line 7 defines an ad hoc schedule for boosting gradient-sensitive regions; no analysis justifies the specific schedule.
assumptions (5)
  • domain assumption The white-box model's gradient is available and the black-box model only returns labels and probabilities (Section III.B).
    This defines the threat model; the method's design depends entirely on this access asymmetry.
  • ad hoc to paper Perturbations generated on a white-box model give a useful initial direction for attacking an unknown black-box model (Section I, Section III.A).
    This is the core heuristic of DP-TRAE and is not proven; it is only tested empirically.
  • ad hoc to paper Superpixel-level queries and memory of past queries preserve local gradient coherence and improve query efficiency (Section III.D).
    Heuristic claim about smoothness of the unknown model's decision surface; no formal or empirical validation isolates this assumption.
  • domain assumption The chosen LSB-based RDH can embed the Huffman-coded perturbation plus side information and recover the original image losslessly (Section III.E, Algorithm 3).
    Required for the reversibility claim; contradicted by the finite PSNR 48.94 dB in Table V unless additional lossy factors are present.
  • ad hoc to paper Attack examples generated against the queried black-box model transfer to the other target models reported in Table III.
    The black-box experiment appears to query one model but reports ASR on nine others; the transfer is assumed and not explained.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DP-TRAE: A Dual-Phase Merging Transferable Reversible Adversarial Example for Image Privacy Protection." pith.science (2026). https://pith.science/paper/OPOMRQP3

@misc{pith2026250506860,
  author       = {Pith},
  title        = {Pith review of: DP-TRAE: A Dual-Phase Merging Transferable Reversible Adversarial Example for Image Privacy Protection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OPOMRQP3}},
  note         = {Machine review of arXiv:2505.06860}
}
read the original abstract

In the field of digital security, Reversible Adversarial Examples (RAE) combine adversarial attacks with reversible data hiding techniques to effectively protect sensitive data and prevent unauthorized analysis by malicious Deep Neural Networks (DNNs). However, existing RAE techniques primarily focus on white-box attacks, lacking a comprehensive evaluation of their effectiveness in black-box scenarios. This limitation impedes their broader deployment in complex, dynamic environments. Further more, traditional black-box attacks are often characterized by poor transferability and high query costs, significantly limiting their practical applicability. To address these challenges, we propose the Dual-Phase Merging Transferable Reversible Attack method, which generates highly transferable initial adversarial perturbations in a white-box model and employs a memory augmented black-box strategy to effectively mislead target mod els. Experimental results demonstrate the superiority of our approach, achieving a 99.0% attack success rate and 100% recovery rate in black-box scenarios, highlighting its robustness in privacy protection. Moreover, we successfully implemented a black-box attack on a commercial model, further substantiating the potential of this approach for practical use.

Figures

Figures reproduced from arXiv: 2505.06860 by the authors.

Figure 1
Figure 1. RAEs prevent malicious DNNs from stealing privacy data and can [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. An overview of the proposed DP-TRAE. information. On the other hand, Maho et al. proposed the SurFree attack optimizes the query path using geometric con￾siderations [50], eliminating the need for a substitute model. This approach substantially reduces query complexity while maintaining high attack success rates. B. Reversible Data Hiding Image steganography involves embedding secret informa￾tion within images in an… view at source ↗
Figure 3
Figure 3. Visual results of DP-TRAE, including clean images, attacked images, and the corresponding recovery images. [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: (a) reported the impact of different expand sizes on attack performance; (b) reported the impact of different enhance step sizes on attack performance; [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Results of DP-TRAE attacks on a commercial model. [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

74 extracted references · 41 canonical work pages

  1. [1]

    Secure deep learning framework for moving object detection in compressed video

    Xianhao Tian, Peijia Zheng, and Jiwu Huang. Secure deep learning framework for moving object detection in compressed video. IEEE Transactions on Dependable and Secure Computing , 21(4):2836–2851, 2023

    work page 2023

  2. [2]

    Attribute-based encryption with reliable outsourced decryption in cloud computing using smart contract

    Chunpeng Ge, Zhe Liu, Willy Susilo, Liming Fang, and Hao Wang. Attribute-based encryption with reliable outsourced decryption in cloud computing using smart contract. IEEE Transactions on Dependable and Secure Computing, 21(2):937–948, 2023

    work page 2023

  3. [3]

    FedSN: A Federated Learning Framework over Heterogeneous LEO Satellite Networks

    Zheng Lin, Zhe Chen, Zihan Fang, Xianhao Chen, Xiong Wang, and Yue Gao. FedSN: A Federated Learning Framework over Heterogeneous LEO Satellite Networks. IEEE Trans. Mobile Comput. , 2024

    work page 2024

  4. [4]

    Automated Federated Pipeline for Parameter- efficient Fine-tuning of Large Language Models

    Zihan Fang, Zheng Lin, Zhe Chen, Xianhao Chen, Yue Gao, and Yuguang Fang. Automated Federated Pipeline for Parameter- efficient Fine-tuning of Large Language Models. arXiv preprint arXiv:2404.06448, 2024

    arXiv 2024

  5. [5]

    Lcfed: An efficient clustered federated learning framework for heterogeneous data

    Yuxin Zhang, Haoyu Chen, Zheng Lin, Zhe Chen, and Jin Zhao. Lcfed: An efficient clustered federated learning framework for heterogeneous data. arXiv preprint arXiv:2501.01850 , 2025

    arXiv 2025

  6. [6]

    AgentsCoDriver: Large Language Model Empow- ered Collaborative Driving with Lifelong Learning

    Senkang Hu, Zhengru Fang, Zihan Fang, Yiqin Deng, Xianhao Chen, and Yuguang Fang. AgentsCoDriver: Large Language Model Empow- ered Collaborative Driving with Lifelong Learning. arXiv preprint arXiv:2404.06345, 2024

    arXiv 2024

  7. [7]

    IC3M: In-Car Multimodal Multi- Object Monitoring for Abnormal Status of Both Driver and Passengers

    Zihan Fang, Zheng Lin, Senkang Hu, Hangcheng Cao, Yiqin Deng, Xianhao Chen, and Yuguang Fang. IC3M: In-Car Multimodal Multi- Object Monitoring for Abnormal Status of Both Driver and Passengers. arXiv preprint arXiv:2410.02592 , 2024

    arXiv

  8. [8]

    Hierarchical Split Federated Learning: Convergence Analysis and System Optimization

    Zheng Lin, Wei Wei, Zhe Chen, Chan-Tong Lam, Xianhao Chen, Yue Gao, and Jun Luo. Hierarchical Split Federated Learning: Convergence Analysis and System Optimization. IEEE Trans. Mobile Comput., 2025

    work page 2025

Show all 74 references
  1. [9]

    Accelerating Federated Learning with Model Segmentation for Edge Networks

    Mingda Hu, Jingjing Zhang, Xiong Wang, Shengyun Liu, and Zheng Lin. Accelerating Federated Learning with Model Segmentation for Edge Networks. IEEE Trans. Green Commun. Netw. , 2024

    2024

  2. [10]

    Graph Learning for Multi-Satellite Based Spectrum Sensing

    Haoxuan Yuan, Zhe Chen, Zheng Lin, Jinbo Peng, Zihan Fang, Yuhang Zhong, Zihang Song, Xiong Wang, and Yue Gao. Graph Learning for Multi-Satellite Based Spectrum Sensing. In Proc. IEEE ICCT , pages 1112–1116, 2023

    2023

  3. [11]

    Constructing 4D Radio Map in LEO Satellite Networks with Limited Samples

    Haoxuan Yuan, Zhe Chen, Zheng Lin, Jinbo Peng, Yuhang Zhong, Xuanjie Hu, Songyan Xue, Wei Li, and Yue Gao. Constructing 4D Radio Map in LEO Satellite Networks with Limited Samples. arXiv preprint arXiv:2501.02775, 2025

    2025 arXiv

  4. [12]

    SigChord: Sniffing Wide Non-sparse Multiband Signals for Terrestrial and Non-terrestrial Wireless Networks

    Jinbo Peng, Junwen Duan, Zheng Lin, Haoxuan Yuan, Yue Gao, and Zhe Chen. SigChord: Sniffing Wide Non-sparse Multiband Signals for Terrestrial and Non-terrestrial Wireless Networks. arXiv preprint arXiv:2504.06587, 2025

    2025 arXiv

  5. [13]

    Channel Power Gain Estimation for Terahertz Vehicle-to-Infrastructure Networks

    Zheng Lin, Lifeng Wang, Jie Ding, Bo Tan, and Shi Jin. Channel Power Gain Estimation for Terahertz Vehicle-to-Infrastructure Networks. IEEE Commun. Lett., 27(1):155–159, 2022

    2022

  6. [14]

    MERIT: Multimodal Wearable Vital Sign Waveform Monitoring

    Yongyang Tang, Zhe Chen, Ang Li, Tianyue Zheng, Zheng Lin, Jia Xu, Pin Lv, Zhe Sun, and Yue Gao. MERIT: Multimodal Wearable Vital Sign Waveform Monitoring. arXiv preprint arXiv:2410.00392 , 2024

    2024 arXiv

  7. [15]

    seeing is not always believing

    Jinshan Liu and Jung-Min Park. “seeing is not always believing”: Detecting perception error attacks against autonomous vehicles. IEEE Transactions on Dependable and Secure Computing , 18(5):2209–2223, 2021

    2021

  8. [16]

    Privacy and artificial intelligence

    James Curzon, Tracy Ann Kosa, Rajen Akalu, and Khalil El-Khatib. Privacy and artificial intelligence. IEEE Transactions on Artificial Intelligence, 2(2):96–108, 2021

    2021

  9. [17]

    Adversarial robustness of deep neural networks: A survey from a formal verification perspective

    Mark Huasong Meng, Guangdong Bai, Sin Gee Teo, Zhe Hou, Yan Xiao, Yun Lin, and Jin Song Dong. Adversarial robustness of deep neural networks: A survey from a formal verification perspective. IEEE Transactions on Dependable and Secure Computing , 2022

    2022

  10. [18]

    Machine learning in metaverse security: Current solutions and future challenges

    Yazan Otoum, Navya Gottimukkala, Neeraj Kumar, and Amiya Nayak. Machine learning in metaverse security: Current solutions and future challenges. ACM Computing Surveys , 2024

    2024

  11. [19]

    Xporter: A study of the multi-port charger security on privacy leakage and voice injection

    Tao Ni, Yongliang Chen, Weitao Xu, Lei Xue, and Qingchuan Zhao. Xporter: A study of the multi-port charger security on privacy leakage and voice injection. In Proceedings of the 29th Annual International Conference on Mobile Computing and Networking , pages 1–15, 2023

    2023

  12. [20]

    The secret sharer: Evaluating and testing unintended memoriza- tion in neural networks

    Nicholas Carlini, Chang Liu, ´Ulfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memoriza- tion in neural networks. In 28th USENIX security symposium (USENIX security 19), pages 267–284, 2019

    2019

  13. [21]

    Exploiting contactless side channels in wireless charging power banks for user privacy inference via few-shot learning

    Tao Ni, Jianfeng Li, Xiaokuan Zhang, Chaoshun Zuo, Wubing Wang, Weitao Xu, Xiapu Luo, and Qingchuan Zhao. Exploiting contactless side channels in wireless charging power banks for user privacy inference via few-shot learning. In Proceedings of the 29th Annual International Con...

    2023

  14. [22]

    Rethinking Adversarial Attacks in Reinforcement Learning from Policy Distribution Perspective

    Tianyang Duan, Zongyuan Zhang, Zheng Lin, Yue Gao, Ling Xiong, Yong Cui, Hongbin Liang, Xianhao Chen, Heming Cui, and Dong Huang. Rethinking Adversarial Attacks in Reinforcement Learning from Policy Distribution Perspective. arXiv preprint arXiv:2501.03562, 2025

    2025 arXiv

  15. [23]

    Uncovering user interactions on smartphones via contactless wireless charging side channels

    Tao Ni, Xiaokuan Zhang, Chaoshun Zuo, Jianfeng Li, Zhenyu Yan, Wub- ing Wang, Weitao Xu, Xiapu Luo, and Qingchuan Zhao. Uncovering user interactions on smartphones via contactless wireless charging side channels. In 2023 IEEE Symposium on Security and Privacy (SP), pages 3399–...

    2023

  16. [24]

    Revealed: 50 million facebook profiles harvested for cambridge analytica in major data breach

    Carole Cadwalladr and Emma Graham-Harrison. Revealed: 50 million facebook profiles harvested for cambridge analytica in major data breach. The guardian, 17(1):22, 2018

    2018

  17. [25]

    Subnetwork- lossless robust watermarking for hostile theft attacks in deep transfer learning models

    Ju Jia, Yueming Wu, Anran Li, Siqi Ma, and Yang Liu. Subnetwork- lossless robust watermarking for hostile theft attacks in deep transfer learning models. IEEE transactions on dependable and secure comput- ing, 2022

    2022

  18. [26]

    Towards transferable targeted adversarial examples

    Zhibo Wang, Hongshan Yang, Yunhe Feng, Peng Sun, Hengchang Guo, Zhifei Zhang, and Kui Ren. Towards transferable targeted adversarial examples. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 20534–20543, 2023

    2023

  19. [27]

    On generating transferable targeted pertur- bations

    Muzammal Naseer, Salman Khan, Munawar Hayat, Fahad Shahbaz Khan, and Fatih Porikli. On generating transferable targeted pertur- bations. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7708–7717, 2021

    2021

  20. [28]

    Interpreting universal adversarial example attacks on image classification models

    Yi Ding, Fuyuan Tan, Ji Geng, Zhen Qin, Mingsheng Cao, Kim- Kwang Raymond Choo, and Zhiguang Qin. Interpreting universal adversarial example attacks on image classification models. IEEE Transactions on Dependable and Secure Computing , 20(4):3392–3407, 2022

    2022

  21. [29]

    Cross-domain trans- ferability of adversarial perturbations

    Muhammad Muzammal Naseer, Salman H Khan, Muhammad Haris Khan, Fahad Shahbaz Khan, and Fatih Porikli. Cross-domain trans- ferability of adversarial perturbations. Advances in Neural Information Processing Systems, 32, 2019

    2019

  22. [30]

    Feature importance-aware transferable adversarial attacks

    Zhibo Wang, Hengchang Guo, Zhifei Zhang, Wenxin Liu, Zhan Qin, and Kui Ren. Feature importance-aware transferable adversarial attacks. In Proceedings of the IEEE/CVF international conference on computer vision, pages 7639–7648, 2021

    2021

  23. [31]

    Itpatch: An invisible and triggered physical adversarial patch against traffic sign recognition

    Shuai Yuan, Hongwei Li, Xingshuo Han, Guowen Xu, Wenbo Jiang, Tao Ni, Qingchuan Zhao, and Yuguang Fang. Itpatch: An invisible and triggered physical adversarial patch against traffic sign recognition. arXiv preprint arXiv:2409.12394 , 2024

    2024

  24. [32]

    Toward understanding and boosting adversarial transferability from a distribution perspective

    Yao Zhu, Yuefeng Chen, Xiaodan Li, Kejiang Chen, Yuan He, Xiang Tian, Bolun Zheng, Yaowu Chen, and Qingming Huang. Toward understanding and boosting adversarial transferability from a distribution perspective. IEEE Transactions on Image Processing , 31:6487–6501, 2022

    2022

  25. [33]

    Intriguing properties of neural networks

    C Szegedy. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  26. [34]

    Adversarial image perturbation for privacy protection a game theory perspective

    Seong Joon Oh, Mario Fritz, and Bernt Schiele. Adversarial image perturbation for privacy protection a game theory perspective. In 2017 IEEE International Conference on Computer Vision (ICCV), pages 1491–1500. IEEE, 2017

    2017

  27. [35]

    Diffprotect: Generate adversarial examples with diffusion models for facial privacy protection

    Jiang Liu, Chun Pong Lau, and Rama Chellappa. Diffprotect: Generate adversarial examples with diffusion models for facial privacy protection. arXiv preprint arXiv:2305.13625 , 2023

    2023

  28. [36]

    Socialguard: An adversarial example based privacy- preserving technique for social images

    Mingfu Xue, Shichang Sun, Zhiyu Wu, Can He, Jian Wang, and Weiqiang Liu. Socialguard: An adversarial example based privacy- preserving technique for social images. Journal of Information Security and Applications, 63:102993, 2021

    2021

  29. [37]

    Unauthorized ai cannot recognize me: Reversible adversarial example

    Jiayang Liu, Weiming Zhang, Kazuto Fukuchi, Youhei Akimoto, and Jun Sakuma. Unauthorized ai cannot recognize me: Reversible adversarial example. Pattern Recognition, 134:109048, 2023

    2023

  30. [38]

    A black-box reversible adversarial example for authorizable recognition to shared images

    Lizhi Xiong, Yue Wu, Peipeng Yu, and Yuhui Zheng. A black-box reversible adversarial example for authorizable recognition to shared images. Pattern Recognition, 140:109549, 2023

    2023

  31. [39]

    Self- recoverable adversarial examples: A new effective protection mechanism JOURNAL OF LATEX CLASS FILES, VOL

    Jiawei Zhang, Jinwei Wang, Hao Wang, and Xiangyang Luo. Self- recoverable adversarial examples: A new effective protection mechanism JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 12 in social networks. IEEE Transactions on Circuits and Systems for Video Technology,...

    2021

  32. [40]

    Reversible data hiding in encrypted images based on pixel prediction and bit-plane compression

    Zhaoxia Yin, Yinyin Peng, and Youzhi Xiang. Reversible data hiding in encrypted images based on pixel prediction and bit-plane compression. IEEE Transactions on Dependable and Secure Computing , 19(2):992– 1002, 2020

    2020

  33. [41]

    Separable reversible data hiding in encrypted jpeg bitstreams

    Zhenxing Qian, Hang Zhou, Xinpeng Zhang, and Weiming Zhang. Separable reversible data hiding in encrypted jpeg bitstreams. IEEE Transactions on Dependable and Secure Computing , 15(6):1055–1067, 2016

    2016

  34. [42]

    Dp-rae: A dual-phase merging reversible adversarial example for image privacy protection

    Jiajie Zhu, Xia Du, Jizhe Zhou, Chi-Man Pun, Qizhen Xu, and Xiaoyuan Liu. Dp-rae: A dual-phase merging reversible adversarial example for image privacy protection. In Proceedings of the 32nd ACM International Conference on Multimedia , pages 671–680, 2024

    2024

  35. [43]

    Reversible adversarial attack based on reversible image transformation

    Zhaoxia Yin, Hua Wang, Li Chen, Jie Wang, and Weiming Zhang. Reversible adversarial attack based on reversible image transformation. arXiv preprint arXiv:1911.02360 , 2019

    1911 arXiv

  36. [44]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014

    2014 arXiv

  37. [45]

    Adversarial examples in the physical world

    Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pages 99–112. Chapman and Hall/CRC, 2018

    2018

  38. [46]

    Boosting adversarial attacks with momentum

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 9185–9193, 2018

    2018

  39. [47]

    Improving transferability of adversarial exam- ples with input diversity

    Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferability of adversarial exam- ples with input diversity. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 2730–2739, 2019

    2019

  40. [48]

    Evading defenses to transferable adversarial examples by translation-invariant attacks

    Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invariant attacks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4312–4321, 2019

    2019

  41. [49]

    Simple black-box adversarial attacks

    Chuan Guo, Jacob Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Weinberger. Simple black-box adversarial attacks. In Interna- tional conference on machine learning, pages 2484–2493. PMLR, 2019

    2019

  42. [50]

    Surfree: a fast surrogate-free black-box attack

    Thibault Maho, Teddy Furon, and Erwan Le Merrer. Surfree: a fast surrogate-free black-box attack. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10430– 10439, 2021

    2021

  43. [51]

    Analysis of lsb based image steganography techniques

    Rajarathnam Chandramouli and Nasir Memon. Analysis of lsb based image steganography techniques. In Proceedings 2001 international conference on image processing (Cat. No. 01CH37205), volume 3, pages 1019–1022. IEEE, 2001

    2001

  44. [52]

    Digital watermarking and steganography

    Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital watermarking and steganography . Morgan kaufmann, 2007

    2007

  45. [53]

    Reversible data hiding in color image with grayscale invariance

    Dongdong Hou, Weiming Zhang, Kejiang Chen, Sian-Jheng Lin, and Nenghai Yu. Reversible data hiding in color image with grayscale invariance. IEEE Transactions on Circuits and Systems for Video Technology, 29(2):363–374, 2018

    2018

  46. [54]

    Hinet: Deep image hiding by invertible network

    Junpeng Jing, Xin Deng, Mai Xu, Jianyi Wang, and Zhenyu Guan. Hinet: Deep image hiding by invertible network. In Proceedings of the IEEE/CVF international conference on computer vision , pages 4733– 4742, 2021

    2021

  47. [55]

    Hidden: hiding data with deep networks

    J Zhu. Hidden: hiding data with deep networks. arXiv preprint arXiv:1807.09937, 2018

    2018 arXiv

  48. [56]

    Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models

    Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM workshop on artificial intelligence and security, pages 15–26, 2017

    2017

  49. [57]

    Imagenet large scale visual recognition challenge

    Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115:211–252, 2015

    2015

  50. [58]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 770–778, 2016

    2016

  51. [59]

    Densely connected convolutional networks

    Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 4700–4708, 2017

    2017

  52. [60]

    Very deep convolu- tional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convolu- tional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014

    2014 arXiv

  53. [61]

    Rethinking the inception architecture for computer vision

    Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. Rethinking the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2818–2826, 2016

    2016

  54. [62]

    Imagenet classification with deep convolutional neural networks

    Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems , 25, 2012

    2012

  55. [63]

    Mobilenetv2: Inverted residuals and linear bottlenecks

    Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang-Chieh Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 4510–4520, 2018

    2018

  56. [64]

    Searching for mobilenetv3

    Andrew Howard, Mark Sandler, Grace Chu, Liang-Chieh Chen, Bo Chen, Mingxing Tan, Weijun Wang, Yukun Zhu, Ruoming Pang, Vijay Vasudevan, et al. Searching for mobilenetv3. In Proceedings of the IEEE/CVF international conference on computer vision , pages 1314–1324, 2019

    2019

  57. [65]

    Image quality assessment: from error visibility to structural similarity

    Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing , 13(4):600–612, 2004

    2004

  58. [66]

    Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression

    Nilaksh Das, Madhuri Shanbhogue, Shang-Tse Chen, Fred Hohman, Li Chen, Michael E Kounavis, and Duen Horng Chau. Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression. arXiv preprint arXiv:1705.02900 , 2017

    2017 arXiv

  59. [67]

    Mitigating adversarial effects through randomization

    Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. arXiv preprint arXiv:1711.01991, 2017

    2017 arXiv

  60. [68]

    Heat and blur: an effective and fast defense against adversarial examples

    Haya Brama and Tal Grinshpoun. Heat and blur: an effective and fast defense against adversarial examples. arXiv preprint arXiv:2003.07573, 2020

    2003 arXiv

  61. [69]

    Image super-resolution as a defense against adversarial attacks

    Aamir Mustafa, Salman H Khan, Munawar Hayat, Jianbing Shen, and Ling Shao. Image super-resolution as a defense against adversarial attacks. IEEE Transactions on Image Processing , 29:1711–1724, 2019

    2019

  62. [70]

    AgentsCoMerge: Large Language Model Empowered Collaborative Decision Making for Ramp Merging

    Senkang Hu, Zhengru Fang, Zihan Fang, Yiqin Deng, Xianhao Chen, Yuguang Fang, and Sam Kwong. AgentsCoMerge: Large Language Model Empowered Collaborative Decision Making for Ramp Merging. arXiv preprint arXiv:2408.03624 , 2024

    2024 arXiv

  63. [71]

    HSplitLoRA: A Heterogeneous Split Parameter-Efficient Fine-Tuning Framework for Large Language Models

    Zheng Lin, Yuxin Zhang, Zhe Chen, Zihan Fang, Xianhao Chen, Praneeth Vepakomma, Wei Ni, Jun Luo, and Yue Gao. HSplitLoRA: A Heterogeneous Split Parameter-Efficient Fine-Tuning Framework for Large Language Models. arXiv preprint arXiv:2505.02795 , 2025

    2025 arXiv

  64. [72]

    FedAC: A Adaptive Clustered Federated Learning Framework for Heterogeneous Data

    Yuxin Zhang, Haoyu Chen, Zheng Lin, Zhe Chen, and Jin Zhao. FedAC: A Adaptive Clustered Federated Learning Framework for Heterogeneous Data. arXiv preprint arXiv:2403.16460 , 2024

    2024 arXiv

  65. [73]

    Leo-Split: A Semi-Supervised Split Learning Framework over LEO Satellite Networks

    Zheng Lin, Yuxin Zhang, Zhe Chen, Zihan Fang, Cong Wu, Xianhao Chen, Yue Gao, and Jun Luo. Leo-Split: A Semi-Supervised Split Learning Framework over LEO Satellite Networks. arXiv preprint arXiv:2501.01293, 2025

    2025 arXiv

  66. [74]

    SatFed: A Resource-Efficient LEO Satellite-Assisted Heterogeneous Federated Learning Framework

    Yuxin Zhang, Zheng Lin, Zhe Chen, Zihan Fang, Wenjun Zhu, Xianhao Chen, Jin Zhao, and Yue Gao. SatFed: A Resource-Efficient LEO Satellite-Assisted Heterogeneous Federated Learning Framework. arXiv preprint arXiv:2409.13503, 2024

    2024 arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.