{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,27]],"date-time":"2026-10-27T19:32:14Z","timestamp":1793129534346,"version":"4.5.0"},"publisher-location":"Cham","reference-count":85,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783030682378","type":"print"},{"value":"9783030682385","type":"electronic"}],"license":[{"start":{"date-parts":[[2020,1,1]],"date-time":"2020-01-01T00:00:00Z","timestamp":1577836800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2020,1,1]],"date-time":"2020-01-01T00:00:00Z","timestamp":1577836800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2020]]},"DOI":"10.1007\/978-3-030-68238-5_32","type":"book-chapter","created":{"date-parts":[[2021,1,30]],"date-time":"2021-01-30T02:02:43Z","timestamp":1611972163000},"page":"429-448","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":69,"title":["Adversarial Training Against Location-Optimized Adversarial Patches"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8896-7619","authenticated-orcid":false,"given":"Sukrut","family":"Rao","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6286-1805","authenticated-orcid":false,"given":"David","family":"Stutz","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9683-5237","authenticated-orcid":false,"given":"Bernt","family":"Schiele","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2021,1,31]]},"reference":[{"key":"32_CR1","doi-asserted-by":"publisher","first-page":"14410","DOI":"10.1109\/ACCESS.2018.2807385","volume":"6","author":"N Akhtar","year":"2018","unstructured":"Akhtar, N., Mian, A.: Threat of adversarial attacks on deep learning in computer vision: a survey. IEEE Access 6, 14410\u201314430 (2018)","journal-title":"IEEE Access"},{"key":"32_CR2","unstructured":"Alaifari, R., Alberti, G.S., Gauksson, T.: ADef: an iterative algorithm to construct adversarial deformations. In: International Conference on Learning Representations (2019). https:\/\/openreview.net\/forum?id=Hk4dFjR5K7"},{"key":"32_CR3","unstructured":"Alayrac, J.B., Uesato, J., Huang, P.S., Fawzi, A., Stanforth, R., Kohli, P.: Are labels required for improving adversarial robustness? In: Wallach, H., Larochelle, H., Beygelzimer, A., d\u2019 Alch\u00e9-Buc, F., Fox, E., Garnett, R. (eds.) Advances in Neural Information Processing Systems, vol. 32, pp. 12214\u201312223. Curran Associates, Inc. (2019). http:\/\/papers.nips.cc\/paper\/9388-are-labels-required-for-improving-adversarial-robustness.pdf"},{"key":"32_CR4","doi-asserted-by":"crossref","unstructured":"Andriushchenko, M., Croce, F., Flammarion, N., Hein, M.: Square attack: a query-efficient black-box adversarial attack via random search. arXiv: 1912.00049 (2019)","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"32_CR5","unstructured":"Athalye, A., Carlini, N.: On the robustness of the CVPR 2018 white-box adversarial example defenses. arXiv: 1804.03286 (2018)"},{"key":"32_CR6","unstructured":"Athalye, A., Carlini, N., Wagner, D.: Obfuscated gradients give a false sense of security: circumventing defenses to adversarial examples. In: Proceedings of Machine Learning Research, vol. 80, pp. 274\u2013283. PMLR, Stockholmsm\u00e4ssan, Stockholm Sweden, 10\u201315 July 2018. http:\/\/proceedings.mlr.press\/v80\/athalye18a.html"},{"key":"32_CR7","unstructured":"Bafna, M., Murtagh, J., Vyas, N.: Thwarting adversarial examples: an L\\_0-robust sparse fourier transform. In: Bengio, S., Wallach, H., Larochelle, H., Grauman, K., Cesa-Bianchi, N., Garnett, R. (eds.) Advances in Neural Information Processing Systems, vol. 31, pp. 10075\u201310085. Curran Associates, Inc. (2018). http:\/\/papers.nips.cc\/paper\/8211-thwarting-adversarial-examples-an-l_0-robust-sparse-fourier-transform.pdf"},{"key":"32_CR8","unstructured":"Balaji, Y., Goldstein, T., Hoffman, J.: Instance adaptive adversarial training: improved accuracy tradeoffs in neural nets. arXiv:1910.08051 (2019)"},{"key":"32_CR9","unstructured":"Bhagoji, A.N., He, W., Li, B., Song, D.: Exploring the space of black-box attacks on deep neural networks. arXiv: 1712.09491 (2017)"},{"key":"32_CR10","doi-asserted-by":"publisher","unstructured":"Biggio, B., Roli, F.: Wild patterns: ten years after the rise of adversarial machine learning. Pattern Recogn. 84, 317\u2013331 (2018). https:\/\/doi.org\/10.1016\/j.patcog.2018.07.023, http:\/\/www.sciencedirect.com\/science\/article\/pii\/S0031320318302565","DOI":"10.1016\/j.patcog.2018.07.023"},{"key":"32_CR11","unstructured":"Brendel, W., Bethge, M.: Comment on \u201cbiologically inspired protection of deep networks from adversarial attacks\u201d. arXiv: 1704.01547 (2017)"},{"key":"32_CR12","unstructured":"Brown, T.B., Carlini, N., Zhang, C., Olsson, C., Christiano, P., Goodfellow, I.: Unrestricted adversarial examples. arXiv: 1809.08352 (2017)"},{"key":"32_CR13","unstructured":"Brown, T.B., Man\u00e9, D., Roy, A., Abadi, M., Gilmer, J.: Adversarial patch. arXiv: 1712.09665 (2017)"},{"key":"32_CR14","unstructured":"Brunner, T., Diehl, F., Knoll, A.: Copy and paste: a simple but effective initialization method for black-box adversarial attacks. arXiv: 1906.06086 (2019)"},{"key":"32_CR15","doi-asserted-by":"crossref","unstructured":"Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 IEEE Symposium on Security and Privacy (SP), pp. 39\u201357 (2017)","DOI":"10.1109\/SP.2017.49"},{"key":"32_CR16","unstructured":"Carlini, N.: Is ami (attacks meet interpretability) robust to adversarial examples? arXiv: 1902.02322 (2019)"},{"key":"32_CR17","doi-asserted-by":"publisher","unstructured":"Carlini, N., Wagner, D.: Adversarial examples are not easily detected: Bypassing ten detection methods. In: Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, AISec 2017, pp. 3\u201314. Association for Computing Machinery, New York (2017). https:\/\/doi.org\/10.1145\/3128572.3140444","DOI":"10.1145\/3128572.3140444"},{"key":"32_CR18","unstructured":"Carlini, N., Wagner, D.A.: Defensive distillation is not robust to adversarial examples. arXiv: 1607.04311 (2016)"},{"key":"32_CR19","unstructured":"Carlini, N., Wagner, D.A.: Magnet and \u201cefficient defenses against adversarial attacks\u201d are not robust to adversarial examples. arXiv: 1711.08478 (2017)"},{"key":"32_CR20","unstructured":"Carmon, Y., Raghunathan, A., Schmidt, L., Duchi, J.C., Liang, P.S.: Unlabeled data improves adversarial robustness. In: Wallach, H., Larochelle, H., Beygelzimer, A., d\u2019 Alch\u00e9-Buc, F., Fox, E., Garnett, R. (eds.) Advances in Neural Information Processing Systems, vol. 32, pp. 11192\u201311203. Curran Associates, Inc. (2019). http:\/\/papers.nips.cc\/paper\/9298-unlabeled-data-improves-adversarial-robustness.pdf"},{"key":"32_CR21","unstructured":"Chen, J., Jordan, M.I.: Boundary Attack++: Query-efficient decision-based adversarial attack. arXiv: 1904.02144 (2019)"},{"key":"32_CR22","doi-asserted-by":"crossref","unstructured":"Chen, P.Y., Zhang, H., Sharma, Y., Yi, J., Hsieh, C.J.: Zoo: zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In: Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, AISec 2017 pp. 15\u201326. Association for Computing Machinery, New York (2017). https:\/\/doi.org\/10.1145\/3128572.3140448","DOI":"10.1145\/3128572.3140448"},{"key":"32_CR23","doi-asserted-by":"crossref","unstructured":"Chiang, P., Geiping, J., Goldblum, M., Goldstein, T., Ni, R., Reich, S., Shafahi, A.: Witchcraft: efficient PGD attacks with random step size. In: ICASSP 2020\u20132020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 3747\u20133751 (2020)","DOI":"10.1109\/ICASSP40776.2020.9052930"},{"key":"32_CR24","unstructured":"Chiang, P., Ni, R., Abdelkader, A., Zhu, C., Studor, C., Goldstein, T.: Certified defenses for adversarial patches. In: International Conference on Learning Representations (2020). https:\/\/openreview.net\/forum?id=HyeaSkrYPH"},{"key":"32_CR25","doi-asserted-by":"crossref","unstructured":"Croce, F., Hein, M.: Sparse and imperceivable adversarial attacks. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision (ICCV), October 2019","DOI":"10.1109\/ICCV.2019.00482"},{"key":"32_CR26","unstructured":"Croce, F., Hein, M.: Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In: Proceedings of the International Conference on Machine Learning, vol. 1, pp. 11571\u201311582 (2020). http:\/\/proceedings.mlr.press\/v119\/croce20b.html"},{"key":"32_CR27","unstructured":"Dhaliwal, J., Hambrook, K.: Recovery guarantees for compressible signals with adversarial noise. arXiv: 1907.06565 (2019)"},{"key":"32_CR28","doi-asserted-by":"crossref","unstructured":"Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., Li, J.: Boosting adversarial attacks with momentum. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2018","DOI":"10.1109\/CVPR.2018.00957"},{"key":"32_CR29","unstructured":"Dumont, B., Maggio, S., Montalvo, P.: Robustness of rotation-equivariant networks to adversarial perturbations. arXiv: 1802.06627 (2018)"},{"key":"32_CR30","unstructured":"Engstrom, L., Ilyas, A., Athalye, A.: Evaluating and understanding the robustness of adversarial logit pairing. arXiv: 1807.10272 (2018)"},{"key":"32_CR31","unstructured":"Engstrom, L., Tsipras, D., Schmidt, L., Madry, A.: A rotation and a translation suffice: Fooling CNNs with simple transformations. arXiv: 1712.02779 (2017)"},{"key":"32_CR32","doi-asserted-by":"crossref","unstructured":"Eykholt, K., et al.: Robust physical-world attacks on deep learning visual classification. In: IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 1625\u20131634 (2018)","DOI":"10.1109\/CVPR.2018.00175"},{"key":"32_CR33","unstructured":"Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv: 1412.6572 (2014)"},{"key":"32_CR34","unstructured":"Gowal, S., et al.: On the effectiveness of interval bound propagation for training verifiably robust models. arXiv: 1810.12715 (2018)"},{"key":"32_CR35","unstructured":"Guo, C., Gardner, J., You, Y., Wilson, A.G., Weinberger, K.: Simple black-box adversarial attacks. In: International Conference on Machine Learning, pp. 2484\u20132493 (2019)"},{"key":"32_CR36","doi-asserted-by":"crossref","unstructured":"Hayes, J.: On visible adversarial perturbations & digital watermarking. In: IEEE\/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp. 1597\u20131604 (2018)","DOI":"10.1109\/CVPRW.2018.00210"},{"key":"32_CR37","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 770\u2013778 (2016)","DOI":"10.1109\/CVPR.2016.90"},{"key":"32_CR38","doi-asserted-by":"crossref","unstructured":"Hosseini, H., Poovendran, R.: Semantic adversarial examples. In: IEEE\/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp. 1614\u20131619 (2018)","DOI":"10.1109\/CVPRW.2018.00212"},{"key":"32_CR39","unstructured":"Huang, R., Xu, B., Schuurmans, D., Szepesv\u00e1ri, C.: Learning with a strong adversary. arXiv: 1511.03034 (2015)"},{"key":"32_CR40","unstructured":"Ilyas, A., Engstrom, L., Athalye, A., Lin, J.: Black-box adversarial attacks with limited queries and information. In: Proceedings of the 35th International Conference on Machine Learning, ICML 2018, July 2018"},{"key":"32_CR41","doi-asserted-by":"crossref","unstructured":"Kanbak, C., Moosavi-Dezfooli, S.M., Frossard, P.: Geometric robustness of deep networks: Analysis and improvement. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2018","DOI":"10.1109\/CVPR.2018.00467"},{"key":"32_CR42","unstructured":"Karmon, D., Zoran, D., Goldberg, Y.: LaVAN: localized and visible adversarial noise. In: Proceeding of the International Conference on Machine Learning (ICML), pp. 2512\u20132520 (2018)"},{"key":"32_CR43","unstructured":"Krizhevsky, A.: Learning multiple layers of features from tiny images. Technical Report (2009)"},{"key":"32_CR44","doi-asserted-by":"crossref","unstructured":"Lamb, A., Verma, V., Kannala, J., Bengio, Y.: Interpolated adversarial training: achieving robust neural networks without sacrificing too much accuracy. In: Proceedings of the ACM Workshop on Artificial Intelligence and Security, pp. 95\u2013103 (2019)","DOI":"10.1145\/3338501.3357369"},{"key":"32_CR45","unstructured":"Lee, H., Han, S., Lee, J.: Generative adversarial trainer: defense to adversarial perturbations with GAN. arXiv: 1705.03387 (2017)"},{"key":"32_CR46","unstructured":"Lee, M., Kolter, Z.: On physical adversarial patches for object detection. arXiv: 1906.11897 (2019)"},{"key":"32_CR47","unstructured":"Liu, X., Yang, H., Song, L., Li, H., Chen, Y.: DPatch: Attacking object detectors with adversarial patches. arXiv: 1806.02299 (2018)"},{"key":"32_CR48","unstructured":"Liu, Y., Zhang, W., Li, S., Yu, N.: Enhanced attacks on defensively distilled deep neural networks. arXiv: 1711.05934 (2017)"},{"key":"32_CR49","unstructured":"Luo, B., Liu, Y., Wei, L., Xu, Q.: Towards imperceptible and robust adversarial example attacks against neural networks. In: McIlraith, S.A., Weinberger, K.Q. (eds.) Proceedings of the Thirty-Second AAAI Conference on Artificial Intelligence, (AAAI-18), the 30th innovative Applications of Artificial Intelligence (IAAI-18), and the 8th AAAI Symposium on Educational Advances in Artificial Intelligence (EAAI-18), New Orleans, Louisiana, USA, 2\u20137 February 2018, pp. 1652\u20131659. AAAI Press (2018). https:\/\/www.aaai.org\/ocs\/index.php\/AAAI\/AAAI18\/paper\/view\/16217"},{"key":"32_CR50","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. In: International Conference on Learning Representations (2018). https:\/\/openreview.net\/forum?id=rJzIBfZAb"},{"key":"32_CR51","unstructured":"Maini, P., Wong, E., Kolter, J.Z.: Adversarial robustness against the union of multiple perturbation models. In: Proceedings of the International Conference on Machine Learning (ICML) (2020)"},{"key":"32_CR52","unstructured":"Mirman, M., Gehr, T., Vechev, M.T.: Differentiable abstract interpretation for provably robust neural networks. In: Proceedings of the International Conference on Machine Learning (ICML), pp. 3575\u20133583 (2018)"},{"key":"32_CR53","unstructured":"Miyato, T., Maeda, S.i., Koyama, M., Nakae, K., Ishii, S.: Distributional smoothing with virtual adversarial training. arXiv: 1507.00677 (2015)"},{"key":"32_CR54","unstructured":"Mosbach, M., Andriushchenko, M., Trost, T.A., Hein, M., Klakow, D.: Logit pairing methods can fool gradient-based attacks. arXiv: 1810.12042 (2018)"},{"key":"32_CR55","doi-asserted-by":"crossref","unstructured":"Naseer, M., Khan, S., Porikli, F.: Local gradients smoothing: defense against localized adversarial attacks. In: Proceedings of the IEEE Winter Conference on Applications of Computer Vision (WACV), pp. 1300\u20131307 (2019)","DOI":"10.1109\/WACV.2019.00143"},{"key":"32_CR56","unstructured":"Raghunathan, A., Xie, S.M., Yang, F., Duchi, J.C., Liang, P.: Adversarial training can hurt generalization. arXiv: 1906.06032 (2019)"},{"key":"32_CR57","doi-asserted-by":"crossref","unstructured":"Ranjan, A., Janai, J., Geiger, A., Black, M.J.: Attacking optical flow. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision (ICCV), October 2019","DOI":"10.1109\/ICCV.2019.00249"},{"key":"32_CR58","unstructured":"Schott, L., Rauber, J., Brendel, W., Bethge, M.: Robust perception through analysis by synthesis. arXiv: 1805.09190 (2018)"},{"key":"32_CR59","unstructured":"Shafahi, A., et al.: Adversarial training for free! In: Wallach, H.M., Larochelle, H., Beygelzimer, A., d\u2019Alch\u00e9-Buc, F., Fox, E.B., Garnett, R. (eds.) Advances in Neural Information Processing Systems (NIPS), pp. 3353\u20133364 (2019)"},{"key":"32_CR60","doi-asserted-by":"crossref","unstructured":"Shafahi, A., Najibi, M., Xu, Z., Dickerson, J.P., Davis, L.S., Goldstein, T.: Universal adversarial training. In: The Thirty-Fourth AAAI Conference on Artificial Intelligence, AAAI 2020, The Thirty-Second Innovative Applications of Artificial Intelligence Conference, IAAI 2020, The Tenth AAAI Symposium on Educational Advances in Artificial Intelligence, EAAI 2020, New York, NY, USA, 7\u201312 February 2020, pp. 5636\u20135643. AAAI Press (2020). https:\/\/aaai.org\/ojs\/index.php\/AAAI\/article\/view\/6017","DOI":"10.1609\/aaai.v34i04.6017"},{"key":"32_CR61","unstructured":"Shaham, U., Yamada, Y., Negahban, S.: Understanding adversarial training: increasing local stability of neural nets through robust optimization. arXiv: 1511.05432 (2015)"},{"key":"32_CR62","unstructured":"Sharma, Y., Chen, P.Y.: Attacking the madry defense model with l1-based adversarial examples. arXiv: 1710.10733 (2017)"},{"key":"32_CR63","unstructured":"Sinha, A., Namkoong, H., Duchi, J.: Certifiable distributional robustness with principled adversarial training. In: International Conference on Learning Representations (2018). https:\/\/openreview.net\/forum?id=Hk6kPgZA-"},{"key":"32_CR64","unstructured":"Song, Y., Shu, R., Kushman, N., Ermon, S.: Generative adversarial examples. arXiv: 1805.07894 (2018)"},{"key":"32_CR65","doi-asserted-by":"publisher","unstructured":"Stallkamp, J., Schlipsing, M., Salmen, J., Igel, C.: Man vs. computer: benchmarking machine learning algorithms for traffic sign recognition. Neural Netw. 32, 323\u2013332 (2012). https:\/\/doi.org\/10.1016\/j.neunet.2012.02.016, http:\/\/www.sciencedirect.com\/science\/article\/pii\/S0893608012000457","DOI":"10.1016\/j.neunet.2012.02.016"},{"key":"32_CR66","doi-asserted-by":"crossref","unstructured":"Stutz, D., Hein, M., Schiele, B.: Disentangling adversarial robustness and generalization. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2019","DOI":"10.1109\/CVPR.2019.00714"},{"key":"32_CR67","unstructured":"Stutz, D., Hein, M., Schiele, B.: Confidence-calibrated adversarial training: generalizing to unseen attacks. In: Proceedings of the International Conference on Machine Learning ICML (2020)"},{"key":"32_CR68","unstructured":"Szegedy, C., et al.: Intriguing properties of neural networks. In: Proceedings of the International Conference on Learning Representations (ICLR) (2014)"},{"key":"32_CR69","unstructured":"Tram\u00e9r, F., Boneh, D.: Adversarial training and robustness for multiple perturbations. In: Wallach, H., Larochelle, H., Beygelzimer, A., d\u2019 Alch\u00e9-Buc, F., Fox, E., Garnett, R. (eds.) Advances in Neural Information Processing Systems, vol. 32, pp. 5866\u20135876. Curran Associates, Inc. (2019). http:\/\/papers.nips.cc\/paper\/8821-adversarial-training-and-robustness-for-multiple-perturbations.pdf"},{"key":"32_CR70","unstructured":"Tram\u00e8r, F., Carlini, N., Brendel, W., Madry, A.: On adaptive attacks to adversarial example defenses. arXiv: 2002.08347 (2020)"},{"key":"32_CR71","unstructured":"Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., Madry, A.: Robustness may be at odds with accuracy. In: International Conference on Learning Representations (2019). https:\/\/openreview.net\/forum?id=SyxAb30cY7"},{"key":"32_CR72","doi-asserted-by":"crossref","unstructured":"Wang, J., Zhang, H.: Bilateral adversarial training: towards fast training of more robust models against adversarial attacks. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision (ICCV), October 2019","DOI":"10.1109\/ICCV.2019.00673"},{"key":"32_CR73","doi-asserted-by":"crossref","unstructured":"Wiyatno, R., Xu, A.: Physical adversarial textures that fool visual object tracking. In: 2019 IEEE\/CVF International Conference on Computer Vision (ICCV), pp. 4821\u20134830 (2019)","DOI":"10.1109\/ICCV.2019.00492"},{"key":"32_CR74","unstructured":"Wong, E., Rice, L., Kolter, J.Z.: Fast is better than free: revisiting adversarial training. In: International Conference on Learning Representations (2020). https:\/\/openreview.net\/forum?id=BJx040EFvH"},{"key":"32_CR75","unstructured":"Wu, T., Tong, L., Vorobeychik, Y.: Defending against physically realizable attacks on image classification. In: International Conference on Learning Representations (2020). https:\/\/openreview.net\/forum?id=H1xscnEKDr"},{"key":"32_CR76","unstructured":"Xiao, C., Zhu, J.Y., Li, B., He, W., Liu, M., Song, D.: Spatially transformed adversarial examples. In: International Conference on Learning Representations (2018). https:\/\/openreview.net\/forum?id=HyydRMZC-"},{"key":"32_CR77","doi-asserted-by":"publisher","first-page":"151","DOI":"10.1007\/s11633-019-1211-x","volume":"17","author":"H Xu","year":"2020","unstructured":"Xu, H., et al.: Adversarial attacks and defenses in images, graphs and text: a review. Int. J. Autom. Comput. 17, 151\u2013178 (2020)","journal-title":"Int. J. Autom. Comput."},{"key":"32_CR78","unstructured":"Xu, K., et al.: Structured adversarial attack: towards general implementation and better interpretability. In: International Conference on Learning Representations (2019). https:\/\/openreview.net\/forum?id=BkgzniCqY7"},{"issue":"9","key":"32_CR79","doi-asserted-by":"publisher","first-page":"2805","DOI":"10.1109\/TNNLS.2018.2886017","volume":"30","author":"X Yuan","year":"2019","unstructured":"Yuan, X., He, P., Zhu, Q., Li, X.: Adversarial examples: attacks and defenses for deep learning. IEEE Trans. Neural Netw. Learn. Syst. 30(9), 2805\u20132824 (2019)","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"32_CR80","doi-asserted-by":"crossref","unstructured":"Zajac, M., Zo\u0142na, K., Rostamzadeh, N., Pinheiro, P.O.: Adversarial framing for image and video classification. In: Proceedings of the AAAI Conference on Artificial Intelligence, vol. 33, pp. 10077\u201310078 (2019)","DOI":"10.1609\/aaai.v33i01.330110077"},{"key":"32_CR81","unstructured":"Zhang, H., Yu, Y., Jiao, J., Xing, E.P., Ghaoui, L.E., Jordan, M.I.: Theoretically principled trade-off between robustness and accuracy. In: Proceedings of the International Conference on Machine Learning (ICML), pp. 7472\u20137482 (2019)"},{"key":"32_CR82","unstructured":"Zhang, H., Chen, H., Song, Z., Boning, D.S., Dhillon, I.S., Hsieh, C.: The limitations of adversarial training and the blind-spot attack. In: 7th International Conference on Learning Representations, ICLR 2019, New Orleans, LA, USA, 6\u20139 May 2019. OpenReview.net (2019). https:\/\/openreview.net\/forum?id=HylTBhA5tQ"},{"key":"32_CR83","unstructured":"Zhang, S., Huang, K., Zhu, J., Liu, Y.: Manifold adversarial learning. arXiv: 1807.05832v1 (2018)"},{"key":"32_CR84","unstructured":"Zhao, Z., Dua, D., Singh, S.: Generating natural adversarial examples. In: International Conference on Learning Representations (2018). https:\/\/openreview.net\/forum?id=H1BLjgZCb"},{"key":"32_CR85","unstructured":"Zhao, Z., Liu, Z., Larson, M.A.: A differentiable color filter for generating unrestricted adversarial images. arXiv: 2002.01008 (2020)"}],"container-title":["Lecture Notes in Computer Science","Computer Vision \u2013 ECCV 2020 Workshops"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-68238-5_32","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,1,29]],"date-time":"2025-01-29T18:06:54Z","timestamp":1738174014000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-030-68238-5_32"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020]]},"ISBN":["9783030682378","9783030682385"],"references-count":85,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-68238-5_32","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020]]},"assertion":[{"value":"31 January 2021","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ECCV","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"European Conference on Computer Vision","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Glasgow","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"United Kingdom","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2020","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"23 August 2020","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"28 August 2020","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"16","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"eccv2020","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/eccv2020.eu\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Double-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"OpenReview","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"5025","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"1360","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"0","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"27% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"7","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"The conference was held virtually due to the COVID-19 pandemic. From the ECCV Workshops 249 full papers, 18 short papers, and 21 further contributions were published out of a total of 467 submissions.","order":10,"name":"additional_info_on_review_process","label":"Additional Info on Review Process","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}}]}}