{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,28]],"date-time":"2026-01-28T14:28:12Z","timestamp":1769610492291,"version":"3.49.0"},"reference-count":297,"publisher":"Springer Science and Business Media LLC","issue":"5","license":[{"start":{"date-parts":[[2024,10,12]],"date-time":"2024-10-12T00:00:00Z","timestamp":1728691200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2024,10,12]],"date-time":"2024-10-12T00:00:00Z","timestamp":1728691200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["New Gener. Comput."],"published-print":{"date-parts":[[2024,12]]},"DOI":"10.1007\/s00354-024-00283-0","type":"journal-article","created":{"date-parts":[[2024,10,12]],"date-time":"2024-10-12T02:01:52Z","timestamp":1728698512000},"page":"1165-1235","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["How to Defend and Secure Deep Learning Models Against Adversarial Attacks in Computer Vision: A Systematic Review"],"prefix":"10.1007","volume":"42","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6428-1997","authenticated-orcid":false,"given":"Lovi","family":"Dhamija","sequence":"first","affiliation":[]},{"given":"Urvashi","family":"Bansal","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2024,10,12]]},"reference":[{"key":"283_CR1","doi-asserted-by":"publisher","unstructured":"He, K., Zhang, X, Ren, S., Sun, J.; Deep residual learning for image recognition. In: Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, IEEE Computer Society, Dec. 2016, pp. 770\u2013778. https:\/\/doi.org\/10.1109\/CVPR.2016.90","DOI":"10.1109\/CVPR.2016.90"},{"key":"283_CR2","doi-asserted-by":"crossref","unstructured":"Jia, X., Li, S., Zhao, H., Kim, S., Kumar, V.: Towards robust and discriminative sequential data learning\u202f: when and how to perform adversarial training\u202f? \u2217,\u201d pp. 1665\u20131673, (2019)","DOI":"10.1145\/3292500.3330957"},{"key":"283_CR3","unstructured":"Eykholt, K., et al.: Physical adversarial examples for object detectors. In: 12th USENIX Workshop on Offensive Technologies, WOOT 2018, co-located with USENIX Security 2018. 2018. https:\/\/arxiv.org\/abs\/1807.07769v2. Accessed 26 Jun 2023"},{"key":"283_CR4","doi-asserted-by":"crossref","unstructured":"Metzen, J.H., Brox, T.: Universal adversarial perturbations against semantic image segmentation. 2017.","DOI":"10.1109\/ICCV.2017.300"},{"key":"283_CR5","unstructured":"Bojarski, M., et al.: End to end learning for self-driving cars. 2016. http:\/\/arxiv.org\/abs\/1604.07316. Accessed 6 May 2021"},{"key":"283_CR6","doi-asserted-by":"publisher","first-page":"317","DOI":"10.1016\/j.patcog.2018.07.023","volume":"84","author":"B Biggio","year":"2018","unstructured":"Biggio, B., Roli, F.: Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recognit 84, 317\u2013331 (2018). https:\/\/doi.org\/10.1016\/j.patcog.2018.07.023","journal-title":"Pattern Recognit"},{"key":"283_CR7","first-page":"1","volume":"2014","author":"J Gao","year":"2017","unstructured":"Gao, J., Wang, B., Lin, Z., Xu, W., Qi, Y.: Deepcloak: masking deep neural network models for robustness against adversarial samples. ArXiv 2014, 1\u20138 (2017)","journal-title":"ArXiv"},{"key":"283_CR8","unstructured":"Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. In: 3rd International Conference on Learning Representations, ICLR 2015-Conference Track Proceedings, pp. 1\u201311, (2015)"},{"key":"283_CR9","doi-asserted-by":"publisher","unstructured":"Cheng, S., Dong, Y., Pang, T., Su, H., Zhu, J.: Improving black-box adversarial attacks with a transfer-based prior. https:\/\/doi.org\/10.5555\/3454287.3455268.","DOI":"10.5555\/3454287.3455268"},{"key":"283_CR10","unstructured":"Kurakin, A., Goodfellow, I., Bengio, S.: Adversarial examples in the physical world. 2016. http:\/\/arxiv.org\/abs\/1607.02533"},{"key":"283_CR11","unstructured":"Szegedy, C., et al.: Intriguing properties of neural networks. In: 2nd International Conference on Learning Representations, ICLR 2014 - Conference Track Proceedings, pp. 1\u201310, (2014)"},{"key":"283_CR12","unstructured":"Adry, A.M., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. https:\/\/github.com\/MadryLab\/mnist_challenge. Accessed 6 May 2021"},{"key":"283_CR13","unstructured":"Tram\u00e8r, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., McDaniel, P.: Ensemble adversarial training: attacks and defenses. ArXiv, May 2017.  [Online]. Available: http:\/\/arxiv.org\/abs\/1705.07204. Accessed 6 May 2021"},{"key":"283_CR14","unstructured":"Potdevin, Y., Nowotka, D., Ganesh, V.: An empirical investigation of randomized defenses against adversarial attacks. ArXiv, pp. 1\u201321, (2019)"},{"key":"283_CR15","first-page":"1","volume":"1","author":"C Guo","year":"2017","unstructured":"Guo, C., Rana, M., Ciss\u00e9, M., Van Der Maaten, L.: Countering adversarial images using input transformations. ArXiv 1, 1\u201312 (2017)","journal-title":"ArXiv"},{"key":"283_CR16","doi-asserted-by":"crossref","unstructured":"Li, X., Li, F.: Adversarial examples detection in deep networks with convolutional filter statistics. In: Proceedings of the IEEE International Conference on Computer Vision, vol. 2017-October, pp. 5775\u20135783, Dec. 2016.  [Online]. Available: http:\/\/arxiv.org\/abs\/1612.07767. Accessed 6 May 2021","DOI":"10.1109\/ICCV.2017.615"},{"issue":"3","key":"283_CR17","doi-asserted-by":"publisher","first-page":"346","DOI":"10.1016\/j.eng.2019.12.012","volume":"6","author":"K Ren","year":"2020","unstructured":"Ren, K., Zheng, T., Qin, Z., Liu, X.: Adversarial attacks and defenses in deep learning. Engineering 6(3), 346\u2013360 (2020). https:\/\/doi.org\/10.1016\/j.eng.2019.12.012","journal-title":"Engineering"},{"key":"283_CR18","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2018.10.315","author":"M Ozdag","year":"2018","unstructured":"Ozdag, M.: Adversarial attacks and defenses against deep neural networks: a survey. Proc. Comput. Sci. (2018). https:\/\/doi.org\/10.1016\/j.procs.2018.10.315","journal-title":"Proc. Comput. Sci."},{"key":"283_CR19","unstructured":"Li, G., Zhu, P., Li, J., Yang, Z., Cao, N., Chen, Z.: Security matters: a survey on adversarial machine learning. ArXiv. 2018. http:\/\/arxiv.org\/abs\/1810.07339. Accessed 6 May 2021"},{"key":"283_CR20","doi-asserted-by":"crossref","unstructured":"Akhtar, N., Mian, A.: Threat of adversarial attacks on deep learning in computer vision: a survey. IEEE Access, vol. 6, pp. 14410\u201314430, Jan. 2018. http:\/\/arxiv.org\/abs\/1801.00553. Accessed 6 May 2021","DOI":"10.1109\/ACCESS.2018.2807385"},{"key":"283_CR21","doi-asserted-by":"publisher","first-page":"12","DOI":"10.1016\/j.jpdc.2019.03.003","volume":"130","author":"X Wang","year":"2019","unstructured":"Wang, X., Li, J., Kuang, X., an Tan, Y., Li, J.: The security of machine learning in an adversarial setting: a survey. J. Parallel Distrib. Comput. 130, 12\u201323 (2019). https:\/\/doi.org\/10.1016\/j.jpdc.2019.03.003","journal-title":"J. Parallel Distrib. Comput."},{"issue":"2","key":"283_CR22","doi-asserted-by":"publisher","first-page":"151","DOI":"10.1007\/s11633-019-1211-x","volume":"17","author":"H Xu","year":"2020","unstructured":"Xu, H., et al.: Adversarial attacks and defenses in images, graphs and text: a review. Int. J. Autom. Comput. 17(2), 151\u2013178 (2020). https:\/\/doi.org\/10.1007\/s11633-019-1211-x","journal-title":"Int. J. Autom. Comput."},{"key":"283_CR23","doi-asserted-by":"publisher","unstructured":"Qiu, M., Qiu, H.: Review on image processing based adversarial example defenses in computer vision. In: Proceedings\u20142020 IEEE 6th Intl Conference on Big Data Security on Cloud, BigDataSecurity 2020, 2020 IEEE Intl Conference on High Performance and Smart Computing, HPSC 2020 and 2020 IEEE Intl Conference on Intelligent Data and Security, IDS 2020, Institute of Electrical and Electronics Engineers Inc., May 2020, pp. 94\u201399. https:\/\/doi.org\/10.1109\/BigDataSecurity-HPSC-IDS49724.2020.00027","DOI":"10.1109\/BigDataSecurity-HPSC-IDS49724.2020.00027"},{"key":"283_CR24","doi-asserted-by":"publisher","first-page":"155161","DOI":"10.1109\/ACCESS.2021.3127960","volume":"9","author":"N Akhtar","year":"2021","unstructured":"Akhtar, N., Mian, A., Kardan, N., Shah, M.: Advances in adversarial attacks and defenses in computer vision: A survey. IEEE Access, 9, 155161\u2013155196 (2021)","journal-title":"IEEE Access"},{"key":"283_CR25","doi-asserted-by":"publisher","first-page":"162","DOI":"10.1016\/j.neucom.2022.09.004","volume":"514","author":"J Wang","year":"2022","unstructured":"Wang, J., Wang, C., Lin, Q., Luo, C., Wu, C., Li, J.: Adversarial attacks and defenses in deep learning for image recognition: a survey. Neurocomputing 514, 162\u2013181 (2022). https:\/\/doi.org\/10.1016\/j.neucom.2022.09.004","journal-title":"Neurocomputing"},{"issue":"9","key":"283_CR26","doi-asserted-by":"publisher","first-page":"2805","DOI":"10.1109\/TNNLS.2018.2886017","volume":"30","author":"X Yuan","year":"2019","unstructured":"Yuan, X., He, P., Zhu, Q., Li, X.: Adversarial examples: attacks and defenses for deep learning. IEEE Trans. Neural Netw. Learn. Syst. 30(9), 2805\u20132824 (2019). https:\/\/doi.org\/10.1109\/TNNLS.2018.2886017","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"issue":"1","key":"283_CR27","doi-asserted-by":"publisher","first-page":"25","DOI":"10.1049\/CIT2.12028","volume":"6","author":"A Chakraborty","year":"2021","unstructured":"Chakraborty, A., Alam, M., Dey, V., Chattopadhyay, A., Mukhopadhyay, D.: A survey on adversarial attacks and defences. CAAI Trans. Intell. Technol. 6(1), 25\u201345 (2021). https:\/\/doi.org\/10.1049\/CIT2.12028","journal-title":"CAAI Trans. Intell. Technol."},{"key":"283_CR28","doi-asserted-by":"publisher","DOI":"10.1016\/J.COSE.2022.102847","volume":"121","author":"T Long","year":"2022","unstructured":"Long, T., Gao, Q., Xu, L., Zhou, Z.: A survey on adversarial attacks in computer vision: Taxonomy, visualization and future directions. Comput. Secur. 121, 102847 (2022). https:\/\/doi.org\/10.1016\/J.COSE.2022.102847","journal-title":"Comput. Secur."},{"key":"283_CR29","unstructured":"Kurakin, A., Goodfellow, I.J., Bengio, S.: Adversarial examples in the physical world. In: 5th International Conference on Learning Representations, ICLR 2017 - Workshop Track Proceedings, no. c, pp. 1\u201314, 2019."},{"key":"283_CR30","unstructured":"Athalye, A., Carlini, N., Wagner, D.: Obfuscated gradients give a false sense of security: circumventing defenses to adversarial examples. In: 35th International Conference on Machine Learning, ICML 2018, vol. 1, pp. 436\u2013448, Feb. 2018. https:\/\/arxiv.org\/abs\/1802.00420v4. Accessed 19 Jul 2023"},{"key":"283_CR31","doi-asserted-by":"publisher","unstructured":"Eykholt, K., et al.: Robust physical-world attacks on deep learning visual classification. In: Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, IEEE Computer Society, Dec. 2018, pp. 1625\u20131634. https:\/\/doi.org\/10.1109\/CVPR.2018.00175.","DOI":"10.1109\/CVPR.2018.00175"},{"key":"283_CR32","doi-asserted-by":"publisher","unstructured":"Moosavi-Dezfooli, S.M., Fawzi, A, Frossard, P.: DeepFool: a simple and accurate method to fool deep neural networks. In: Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, vol. 2016-Decem, pp. 2574\u20132582, 2016, https:\/\/doi.org\/10.1109\/CVPR.2016.282","DOI":"10.1109\/CVPR.2016.282"},{"key":"283_CR33","doi-asserted-by":"publisher","unstructured":"Papernot, N., Mcdaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., Swami, S.: The limitations of deep learning in adversarial settings. In: Proceedings-2016 IEEE European Symposium on Security and Privacy, EURO S and P 2016, pp. 372\u2013387, 2016, https:\/\/doi.org\/10.1109\/EuroSP.2016.36","DOI":"10.1109\/EuroSP.2016.36"},{"key":"283_CR34","doi-asserted-by":"publisher","unstructured":"Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: Proc IEEE Symp Secur Priv, pp. 39\u201357, Jun. 2017, https:\/\/doi.org\/10.1109\/SP.2017.49.","DOI":"10.1109\/SP.2017.49"},{"key":"283_CR35","doi-asserted-by":"publisher","unstructured":"Eykholt, K., et al.: Robust physical-world attacks on deep learning models. 2017. https:\/\/doi.org\/10.48550\/arxiv.1707.08945","DOI":"10.48550\/arxiv.1707.08945"},{"issue":"01","key":"283_CR36","doi-asserted-by":"publisher","first-page":"1088","DOI":"10.1609\/AAAI.V34I01.5459","volume":"34","author":"K Yang","year":"2020","unstructured":"Yang, K., Tsai, T., Yu, H., Ho, T.Y., Jin, Y.: Beyond digital domain: fooling deep learning based recognition system in physical world. Proc. AAAI Conf. Artif. Intell. 34(01), 1088\u20131095 (2020). https:\/\/doi.org\/10.1609\/AAAI.V34I01.5459","journal-title":"Proc. AAAI Conf. Artif. Intell."},{"key":"283_CR37","unstructured":"Liu, Y., Chen, X., Liu, C., Song, D.: Delving into transferable adversarial examples and Black-box Attacks. (2016). http:\/\/arxiv.org\/abs\/1611.02770"},{"key":"283_CR38","unstructured":"Xie, C., et al.: Improving transferability of adversarial examples with input diversity"},{"key":"283_CR39","doi-asserted-by":"publisher","unstructured":"Dong, Y., Pang, T., Su, H., Zhu, J.: Evading defenses to transferable adversarial examples by translation-invariant attacks. In: Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, vol. 2019-June, pp. 4307\u20134316, Apr. 2019, https:\/\/doi.org\/10.48550\/arxiv.1904.02884","DOI":"10.48550\/arxiv.1904.02884"},{"key":"283_CR40","doi-asserted-by":"publisher","unstructured":"Dong, Y., et al.: Boosting adversarial attacks with momentum. In: Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, pp. 9185\u20139193, 2018, https:\/\/doi.org\/10.1109\/CVPR.2018.00957","DOI":"10.1109\/CVPR.2018.00957"},{"key":"283_CR41","doi-asserted-by":"publisher","unstructured":"Liu, Y., Chen, X., Liu, C., Song, D.: Delving into transferable adversarial examples and black-box Attacks. In: 5th International Conference on Learning Representations, ICLR 2017 - Conference Track Proceedings, Nov. 2016, https:\/\/doi.org\/10.48550\/arxiv.1611.02770","DOI":"10.48550\/arxiv.1611.02770"},{"key":"283_CR42","doi-asserted-by":"publisher","unstructured":"Xiong, Y., Lin, J., Zhang, M., Hopcroft, J.E., He, K.: Stochastic variance reduced ensemble adversarial attack for boosting the adversarial transferability,\u201d pp. 14963\u201314972, (2022), https:\/\/doi.org\/10.1109\/CVPR52688.2022.01456.","DOI":"10.1109\/CVPR52688.2022.01456"},{"key":"283_CR43","doi-asserted-by":"publisher","DOI":"10.1145\/3317611","author":"M Sharif","year":"2019","unstructured":"Sharif, M., Bhagavatula, S., Bauer, L., Reiter, M.K.: A General Framework for Adversarial Examples with Objectives. ACM Trans. Privacy Secur. (TOPS) (2019). https:\/\/doi.org\/10.1145\/3317611","journal-title":"ACM Trans. Privacy Secur. (TOPS)"},{"key":"283_CR44","doi-asserted-by":"publisher","unstructured":"Chen, P.Y., Zhang, H., Sharma, Y., Yi, J., Hsieh, C.J.: ZOO: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In: AISec 2017-Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, co-located with CCS 2017, pp. 15\u201326, 2017, https:\/\/doi.org\/10.1145\/3128572.3140448.","DOI":"10.1145\/3128572.3140448"},{"key":"283_CR45","unstructured":"Eyas, A., Engstrom, L., Athalye, A., Lin, J.: Black-box adversarial attacks with limited queries and information. In: 35th International Conference on Machine Learning, ICML 2018, vol. 5, pp. 3392\u20133401, Apr. 2018. https:\/\/arxiv.org\/abs\/1804.08598v3. Accessed 12 Feb 2024"},{"key":"283_CR46","unstructured":"Tu, C.-C. et al.: AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networks"},{"key":"283_CR47","unstructured":"Li, Y., Li, L., Wang, L., Zhang, T., Gong, B.: NATTACK: learning the distributions of adversarial examples for an improved black-box attack on deep neural networks. In: 36th International Conference on Machine Learning, ICML 2019, vol. 2019-June, pp. 6860\u20136870, May 2019.  [Online]. Available: https:\/\/arxiv.org\/abs\/1905.00441v3, Accessed 12 Feb 2024"},{"key":"283_CR48","doi-asserted-by":"publisher","unstructured":"Sharif, M., Bhagavatula, S., Bauer, L., Reiter, M.K.: Accessorize to a Crime, pp. 1528\u20131540, (2016), https:\/\/doi.org\/10.1145\/2976749.2978392","DOI":"10.1145\/2976749.2978392"},{"key":"283_CR49","doi-asserted-by":"publisher","unstructured":"Nina, N., Kasiviswanathan, S.P.: Simple black-box adversarial attacks on deep neural networks.  In: 2017 IEEE Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp. 1310\u20131318 (2017). https:\/\/doi.org\/10.1109\/CVPRW.2017.172","DOI":"10.1109\/CVPRW.2017.172"},{"key":"283_CR50","doi-asserted-by":"publisher","unstructured":"Pengcheng, L., Yi, J., Zhang, L.: Query-efficient black-box attack by active learning. In: Proceedings-IEEE International Conference on Data Mining, ICDM, vol. 2018-November, pp. 1200\u20131205, Sep. 2018, https:\/\/doi.org\/10.1109\/ICDM.2018.00159","DOI":"10.1109\/ICDM.2018.00159"},{"key":"283_CR51","doi-asserted-by":"publisher","unstructured":"Bhagoji, A.N., He, W., Li, B., Song, D.: Practical black-box attacks on deep neural networks using efficient query mechanisms. In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 11216 LNCS, pp. 158\u2013174 (2018). https:\/\/doi.org\/10.1007\/978-3-030-01258-8_10\/TABLES\/3","DOI":"10.1007\/978-3-030-01258-8_10\/TABLES\/3"},{"key":"283_CR52","doi-asserted-by":"publisher","unstructured":"Liu, Y., Moosavi-Dezfooli, S.M., Frossard, P.: A geometry-inspired decision-based attack. In: Proceedings of the IEEE International Conference on Computer Vision, vol. 2019-October, pp. 4889\u20134897, Mar. 2019, https:\/\/doi.org\/10.48550\/arxiv.1903.10826","DOI":"10.48550\/arxiv.1903.10826"},{"key":"283_CR53","doi-asserted-by":"crossref","unstructured":"Kos, J., Fischer, I., Song, D.: Adversarial examples for generative models. In: 2018 IEEE Security and Privacy Workshops (spw), pp. 36\u201342. IEEE (2018)","DOI":"10.1109\/SPW.2018.00014"},{"key":"283_CR54","doi-asserted-by":"publisher","unstructured":"Odena, A., Olah, C., Shlens, J.: Conditional image synthesis with auxiliary classifier GANs. In: 34th International Conference on Machine Learning, ICML 2017, vol. 6, pp. 4043\u20134055 (2016) https:\/\/doi.org\/10.48550\/arxiv.1610.09585","DOI":"10.48550\/arxiv.1610.09585"},{"key":"283_CR55","unstructured":"Eykholt, K., et al.: Robust physical-world attacks on deep learning models. 2017. http:\/\/arxiv.org\/abs\/1707.08945"},{"key":"283_CR56","unstructured":"Jan, S.T.K., Messou, J., Lin, Y.-C., Huang, J.-B., Wang, G.: Connecting the digital and physical world: improving the robustness of adversarial attacks. www.aaai.org. Accessed 8 Jan 2023"},{"key":"283_CR57","doi-asserted-by":"publisher","unstructured":"Guo, Y., Wei, X., Wang, G., Zhang, B.: Adversarial sticker: a stealthy attack method in the physical world. 2021, https:\/\/doi.org\/10.48550\/arxiv.2104.06728","DOI":"10.48550\/arxiv.2104.06728"},{"key":"283_CR58","doi-asserted-by":"publisher","unstructured":"Zolfi, A., Avidan, S., Elovici, Y., Shabtai, A.: Adversarial mask: real-world universal adversarial attack on face recognition model. 2021. https:\/\/doi.org\/10.48550\/arxiv.2111.10759","DOI":"10.48550\/arxiv.2111.10759"},{"key":"283_CR59","doi-asserted-by":"publisher","unstructured":"Lin, C.S., Hsu, C.Y., Chen, P.Y., Yu, C.M.: real-World adversarial examples via makeup. In: ICASSP, IEEE International Conference on Acoustics, Speech and Signal Processing - Proceedings, vol. 2022-May, pp. 2854\u20132858, (2022), https:\/\/doi.org\/10.1109\/ICASSP43922.2022.9747469.","DOI":"10.1109\/ICASSP43922.2022.9747469"},{"key":"283_CR60","doi-asserted-by":"crossref","unstructured":"Xu, K., Zhang, G., Liu, S., Fan, Q., Sun, M., Chen, H., et al.: Adversarial t-shirt! evading person detectors in a physical world. In: Computer Vision\u2013ECCV 2020: 16th European Conference, Glasgow, UK, August 23\u201328, 2020, Proceedings, Part V 16, pp. 665\u2013681. Springer International Publishing (2020)","DOI":"10.1007\/978-3-030-58558-7_39"},{"key":"283_CR61","unstructured":"Keele, S. (2007). Guidelines for performing systematic literature reviews in software engineering (Vol. 5). Technical report, ver. 2.3 ebse technical report. ebse."},{"key":"283_CR62","unstructured":"Singh, N. D., Croce, F., Hein, M.: Revisiting adversarial training for imagenet: Architectures, training and generalization across threat models. Adv. Neural Inf. Process.  Syst. 36 (2024)"},{"key":"283_CR63","unstructured":"GitHub - jason71995\/adversarial_attack: Adversarial Attack on Keras and Tensorflow 2.0. https:\/\/github.com\/jason71995\/adversarial_attack. Accessed 27 Feb 2024"},{"key":"283_CR64","unstructured":"Kim H. Torchattacks: A PyTorch repository for adversarial attacks. 2020. https:\/\/github.com\/Harry24k\/adversarial-attacks-pytorch. Accessed 27 Feb 2024"},{"key":"283_CR65","doi-asserted-by":"publisher","unstructured":"Papernot, N., et al.: Technical Report on the CleverHans v2.1.0 Adversarial Examples Library. 2016. https:\/\/doi.org\/10.48550\/arxiv.1610.00768","DOI":"10.48550\/arxiv.1610.00768"},{"key":"283_CR66","unstructured":"GitHub - bethgelab\/foolbox: A Python toolbox to create adversarial examples that fool neural networks in PyTorch, TensorFlow, and JAX. https:\/\/github.com\/bethgelab\/foolbox. Accessed 24 Feb 2024"},{"key":"283_CR67","unstructured":"Automatic Differentiation in PyTorch | by ODSC - Open Data Science | Medium. https:\/\/medium.com\/@ODSC\/automatic-differentiation-in-pytorch-6131b4581cdf. Accessed 6 May 2021"},{"key":"283_CR68","unstructured":"The Theano Development Team et al.: Theano: a Python framework for fast computation of mathematical expressions. 2016, http:\/\/arxiv.org\/abs\/1605.02688. Accessed 6 May 2021"},{"key":"283_CR69","unstructured":"Chen T., et al.: MXNet: a flexible and efficient machine learning library for heterogeneous distributed systems"},{"key":"283_CR70","doi-asserted-by":"publisher","first-page":"94","DOI":"10.1016\/j.neucom.2019.12.002","volume":"384","author":"H Nguyen","year":"2020","unstructured":"Nguyen, H., Zhuang, D., Wu, P.Y., Chang, M.: AutoGAN-based dimension reduction for privacy preservation. Neurocomputing 384, 94\u2013103 (2020). https:\/\/doi.org\/10.1016\/j.neucom.2019.12.002","journal-title":"Neurocomputing"},{"key":"283_CR71","unstructured":"GitHub - Trusted-AI\/adversarial-robustness-toolbox: Adversarial Robustness Toolbox (ART)-Python Library for Machine Learning Security-Evasion, Poisoning, Extraction, Inference-Red and Blue Teams. https:\/\/github.com\/Trusted-AI\/adversarial-robustness-toolbox. Accessed 25 Feb 2024"},{"key":"283_CR72","doi-asserted-by":"publisher","unstructured":"Ling, X., et al.: DEEPSEC: a uniform platform for security analysis of deep learning model. In: Proc IEEE Symp Secur Priv, vol. 2019-May, pp. 673\u2013690, (2019), https:\/\/doi.org\/10.1109\/SP.2019.00023","DOI":"10.1109\/SP.2019.00023"},{"key":"283_CR73","doi-asserted-by":"publisher","unstructured":"Sun, B., Tsai, N.H., Liu, F., Yu, R., Su, H.: Adversarial defense by stratified convolutional sparse coding. In: Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, vol. 2019-June, pp. 11439\u201311448, (2019), https:\/\/doi.org\/10.1109\/CVPR.2019.01171","DOI":"10.1109\/CVPR.2019.01171"},{"key":"283_CR74","doi-asserted-by":"crossref","unstructured":"Grosse, K., Papernot, N., Manoharan, P., Backes, M., McDaniel, P.: Adversarial perturbations against deep neural networks for malware classification. (2016). arXiv preprint arXiv:1606.04435","DOI":"10.1109\/SP.2016.41"},{"key":"283_CR75","doi-asserted-by":"publisher","first-page":"177932","DOI":"10.1109\/ACCESS.2019.2958358","volume":"7","author":"M Aprilpyone","year":"2019","unstructured":"Aprilpyone, M., Kinoshita, Y., Kiya, H.: Adversarial robustness by one bit double quantization for visual classification. IEEE Access 7, 177932\u2013177943 (2019). https:\/\/doi.org\/10.1109\/ACCESS.2019.2958358","journal-title":"IEEE Access"},{"key":"283_CR76","doi-asserted-by":"publisher","DOI":"10.1016\/j.imavis.2020.103926","author":"X Hou","year":"2020","unstructured":"Hou, X., Liu, J., Xu, B., Wang, X., Liu, B., Qiu, G.: Class-aware domain adaptation for improving adversarial robustness. Image Vis. Comput. (2020). https:\/\/doi.org\/10.1016\/j.imavis.2020.103926","journal-title":"Image Vis. Comput."},{"key":"283_CR77","doi-asserted-by":"publisher","unstructured":"Hua, Y., Ge, S., Gao, X., Jin, X., Zeng, D.: Logit correction. In: MM 2019-Proceedings of the 27th ACM International Conference on Multimedia, pp. 2106\u20132114, (2019), https:\/\/doi.org\/10.1145\/3343031.3351012","DOI":"10.1145\/3343031.3351012"},{"key":"283_CR78","doi-asserted-by":"publisher","unstructured":"Wang, S., Wang, X., Ye, S., Zhao, P., Lin, X.: Defending DNN adversarial attacks with pruning and logits augmentation. In: 2018 IEEE Global Conference on Signal and Information Processing, GlobalSIP 2018 - Proceedings, pp. 1144\u20131148 (2019). https:\/\/doi.org\/10.1109\/GlobalSIP.2018.8646578","DOI":"10.1109\/GlobalSIP.2018.8646578"},{"key":"283_CR79","doi-asserted-by":"publisher","unstructured":"Li, C., Weng, H., Ji, S., Dong, J., He, Q.: DeT: defending against adversarial examples via decreasing transferability. In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Springer, Dec. 2019, pp. 307\u2013322. https:\/\/doi.org\/10.1007\/978-3-030-37337-5_25","DOI":"10.1007\/978-3-030-37337-5_25"},{"key":"283_CR80","doi-asserted-by":"publisher","first-page":"182","DOI":"10.1016\/j.ins.2019.05.084","volume":"501","author":"F Guo","year":"2019","unstructured":"Guo, F., et al.: Detecting adversarial examples via prediction difference for deep neural networks. Inf Sci (N Y) 501, 182\u2013192 (2019). https:\/\/doi.org\/10.1016\/j.ins.2019.05.084","journal-title":"Inf Sci (N Y)"},{"key":"283_CR81","doi-asserted-by":"publisher","unstructured":"Cui, L., Xi, R., Hao, Z., Yu, X., Zhang, L.: DunDi: improving robustness of neural networks using distance metric learning. In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 11537 LNCS, pp. 145\u2013159, 2019, https:\/\/doi.org\/10.1007\/978-3-030-22741-8_11","DOI":"10.1007\/978-3-030-22741-8_11"},{"key":"283_CR82","doi-asserted-by":"publisher","unstructured":"Soll, M., Hinz, T., Magg, S., Wermter, S.: Evaluating defensive distillation for defending text processing neural networks against adversarial examples. In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 11729 LNCS, pp. 685\u2013696, (2019), https:\/\/doi.org\/10.1007\/978-3-030-30508-6_54","DOI":"10.1007\/978-3-030-30508-6_54"},{"key":"283_CR83","doi-asserted-by":"publisher","unstructured":"Agarwal, C., Nguyen, A., Schonfeld, D.: Improving robustness to adversarial examples by encouraging discriminative features. In: Proceedings-International Conference on Image Processing, ICIP, vol. 2019-Septe, pp. 3801\u20133805, 2019, https:\/\/doi.org\/10.1109\/ICIP.2019.8803601.","DOI":"10.1109\/ICIP.2019.8803601"},{"key":"283_CR84","doi-asserted-by":"publisher","unstructured":"Naseer, M., Khan, S.H., Porikli, F.: Local gradients smoothing: Defense against localized adversarial attacks. In: Proceedings-2019 IEEE Winter Conference on Applications of Computer Vision, WACV 2019, pp. 1300\u20131307, 2019, https:\/\/doi.org\/10.1109\/WACV.2019.00143","DOI":"10.1109\/WACV.2019.00143"},{"key":"283_CR85","doi-asserted-by":"publisher","unstructured":"Kawashima, T., Takagi, T.: Sentence simplification from non-parallel corpus with adversarial learning. In: Proceedings-2019 IEEE\/WIC\/ACM International Conference on Web Intelligence, WI 2019, pp. 43\u201350, 2019, https:\/\/doi.org\/10.1145\/3350546.3352499","DOI":"10.1145\/3350546.3352499"},{"key":"283_CR86","doi-asserted-by":"publisher","unstructured":"Liu, K., Dolan-Gavitt, B., Garg, S.: Fine-pruning: Defending against backdooring attacks on deep neural networks. In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 11050 LNCS, pp. 273\u2013294, 2018, https:\/\/doi.org\/10.1007\/978-3-030-00470-5_13","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"283_CR87","unstructured":"Luo, Y., Pfister, H.: Adversarial defense of image classification using a variational auto-encoder. ArXiv (2018)"},{"key":"283_CR88","unstructured":"Song, S., Chen, Y., Cheung, N.M., Jay Kuo, C.C.: Defense against adversarial attacks with saak transform. ArXiv (2018)"},{"key":"283_CR89","doi-asserted-by":"publisher","first-page":"83","DOI":"10.1016\/j.ins.2018.04.092","volume":"460\u2013461","author":"JY Kim","year":"2018","unstructured":"Kim, J.Y., Bu, S.J., Cho, S.B.: Zero-day malware detection using transferred generative adversarial networks based on deep autoencoders. Inf Sci (N Y) 460\u2013461, 83\u2013102 (2018). https:\/\/doi.org\/10.1016\/j.ins.2018.04.092","journal-title":"Inf Sci (N Y)"},{"key":"283_CR90","doi-asserted-by":"publisher","unstructured":"Wang, J., Dong, G., Sun, J., Wang, X., Zhang, P.: Adversarial sample detection for deep neural network through model mutation testing. In: Proceedings-International Conference on Software Engineering, vol. 2019-May, pp. 1245\u20131256 (2019). https:\/\/doi.org\/10.1109\/ICSE.2019.00126.","DOI":"10.1109\/ICSE.2019.00126"},{"key":"283_CR91","doi-asserted-by":"publisher","DOI":"10.1186\/s40537-019-0213-4","author":"AE Abdel-Hakim","year":"2019","unstructured":"Abdel-Hakim, A.E.: Ally patches for spoliation of adversarial patches. J. Big Data (2019). https:\/\/doi.org\/10.1186\/s40537-019-0213-4","journal-title":"J. Big Data"},{"key":"283_CR92","first-page":"2","volume":"1","author":"X Wang","year":"2020","unstructured":"Wang, X., Wang, S., Chen, P.Y., Lin, X., Chin, P.: Block switching: a stochastic approach for deep learning security. ArXiv 1, 2\u20136 (2020)","journal-title":"ArXiv"},{"key":"283_CR93","doi-asserted-by":"publisher","unstructured":"Mummadi, C.K., Brox, T., Metzen, J.H.: Defending against universal perturbations with shared adversarial training. In: Proceedings of the IEEE International Conference on Computer Vision, vol. 2019-Octob, pp. 4927\u20134936 (2019). https:\/\/doi.org\/10.1109\/ICCV.2019.00503","DOI":"10.1109\/ICCV.2019.00503"},{"key":"283_CR94","doi-asserted-by":"publisher","unstructured":"Zhang, M., Li, H., Kuang, X., Pang, L., Wu, Z.: Neuron selecting: defending against adversarial examples in deep neural\u00a0networks. In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 11999 LNCS, pp. 613\u2013629 (2020). https:\/\/doi.org\/10.1007\/978-3-030-41579-2_36.","DOI":"10.1007\/978-3-030-41579-2_36"},{"key":"283_CR95","unstructured":"Ratzlaff, N., Fuxin, L.: Unifying bilateral filtering and adversarial training for robust neural networks. ArXiv. 2018. http:\/\/arxiv.org\/abs\/1804.01635. Accessed 6 May 2021"},{"key":"283_CR96","unstructured":"Maini, P., Wong, E., Zico Kolter, J.: Adversarial robustness against the union of multiple perturbation models. ArXiv (2019)"},{"key":"283_CR97","doi-asserted-by":"crossref","unstructured":"De Silva, S., Kim, J., Raich, R.: COST AWARE ADVERSARIAL LEARNING Shashini De Silva , Jinsub Kim , and Raviv Raich School of EECS , Oregon State University , Corvallis , Oregon , US 97331. In: ICASSP 2020\u20142020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 3587\u20133591 (2020)","DOI":"10.1109\/ICASSP40776.2020.9053631"},{"key":"283_CR98","doi-asserted-by":"publisher","first-page":"18","DOI":"10.1016\/j.eswa.2017.12.022","volume":"97","author":"TS Sethi","year":"2018","unstructured":"Sethi, T.S., Kantardzic, M.: Handling adversarial concept drift in streaming data. Expert Syst. Appl. 97, 18\u201340 (2018). https:\/\/doi.org\/10.1016\/j.eswa.2017.12.022","journal-title":"Expert Syst. Appl."},{"key":"283_CR99","unstructured":"Meng, D., Chen, H.:\u201cMagNet: a two-pronged defense against adversarial examples. In: Proceedings of the ACM Conference on Computer and Communications Security, pp. 135\u2013147, May 2017. http:\/\/arxiv.org\/abs\/1705.09064. Accessed 6 May 2021"},{"key":"283_CR100","unstructured":"Song, S., Chen, Y., Cheung, N.-M., Kuo, C.-C.J.:\u201cDefense against adversarial attacks with Saak transform. ArXiv. 2018. http:\/\/arxiv.org\/abs\/1808.01785. Accessed 6 May 2021"},{"key":"283_CR101","unstructured":"Kurakin, A., Goodfellow, I.J., Bengio, S.: Adversarial machine learning at scale. In: 5th International Conference on Learning Representations, ICLR 2017-Conference Track Proceedings, pp. 1\u201317, (2017)"},{"key":"283_CR102","unstructured":"Qin C., et al.: Adversarial robustness through local linearization. ArXiv, no. NeurIPS, pp. 1\u201317, (2019)"},{"key":"283_CR103","doi-asserted-by":"publisher","first-page":"195","DOI":"10.1016\/j.neucom.2018.04.027","volume":"307","author":"U Shaham","year":"2015","unstructured":"Shaham, U., Yamada, Y., Negahban, S.: Understanding adversarial training: increasing local stability of neural nets through robust optimization. Neurocomputing 307, 195\u2013204 (2015). https:\/\/doi.org\/10.1016\/j.neucom.2018.04.027","journal-title":"Neurocomputing"},{"key":"283_CR104","doi-asserted-by":"crossref","unstructured":"Miyato, T., Maeda, S., Koyama, M., Ishii, S.: Virtual adversarial training: a regularization method for supervised and semi-supervised learning. In: IEEE Trans Pattern Anal Mach Intell, vol. 41, no. 8, pp. 1979\u20131993, 2017.  [Online]. Available: http:\/\/arxiv.org\/abs\/1704.03976. Accessed 6 May 2021","DOI":"10.1109\/TPAMI.2018.2858821"},{"key":"283_CR105","unstructured":"Cheng, M., Lei, Q., Chen, P.Y., Dhillon, I., Hsieh, C.J.: CAT: customized adversarial training for improved robustness. ArXiv. 2020."},{"key":"283_CR106","doi-asserted-by":"crossref","unstructured":"Jin, G., Yi, X., Wu, D., Mu, R., Huang, X.: Randomized adversarial training via taylor expansion. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 16447\u201316457 (2023)","DOI":"10.1109\/CVPR52729.2023.01578"},{"key":"283_CR107","doi-asserted-by":"publisher","unstructured":"Goodwin, J., Brown, O., Helus, V.: Fast training of deep neural networks robust to adversarial perturbations. In: 2020 IEEE High Performance Extreme Computing Conference, HPEC 2020, 2020, https:\/\/doi.org\/10.1109\/HPEC43674.2020.9286256","DOI":"10.1109\/HPEC43674.2020.9286256"},{"key":"283_CR108","doi-asserted-by":"crossref","unstructured":"Jia, X., Zhang, Y., Wei, X., Wu, B., Ma, K., Wang, J., Cao, X.: Improving fast adversarial training with prior-guided knowledge. In: IEEE Transactions on Pattern Analysis and Machine Intelligence (2024)","DOI":"10.1109\/TPAMI.2024.3381180"},{"key":"283_CR109","unstructured":"Zhu, J.-J., Bento, J.: Generative adversarial active learning. ArXiv. 2017. http:\/\/arxiv.org\/abs\/1702.07956. Accessed 8 May 2021"},{"key":"283_CR110","unstructured":"Ducoffe, M., Precioso, F.: Adversarial active learning for deep networks: a margin based approach. ArXiv (2018)"},{"key":"283_CR111","doi-asserted-by":"publisher","unstructured":"Xie, C., Wu, Y., Van Der Maaten, L., Yuille, A.L., He, K.: Feature denoising for improving adversarial robustness. In: Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, vol. 2019-June, pp. 501\u2013509, 2019, https:\/\/doi.org\/10.1109\/CVPR.2019.00059","DOI":"10.1109\/CVPR.2019.00059"},{"key":"283_CR112","unstructured":"Joe, B., Hwang, S.J., Shin, I.: Learning to disentangle robust and vulnerable features for adversarial detection. ArXiv (2019)"},{"key":"283_CR113","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.05.014","author":"F Menet","year":"2020","unstructured":"Menet, F., Berthier, P., Gagnon, M., Fernandez, J.M.: Spartan Networks: Self-feature-squeezing neural networks for increased robustness in adversarial settings. Comput. Secur. (2020). https:\/\/doi.org\/10.1016\/j.cose.2019.05.014","journal-title":"Comput. Secur."},{"key":"283_CR114","unstructured":"Dhillon, G.S. et al.: Stochastic activation pruning for robust adversarial defense. ArXiv (2018). http:\/\/arxiv.org\/abs\/1803.01442. Accessed 7 May 2021"},{"key":"283_CR115","doi-asserted-by":"publisher","unstructured":"Lindqvist, B., Izmailov, R.: Minimax defense against gradient-based adversarial attacks (2020). https:\/\/doi.org\/10.48550\/arxiv.2002.01256","DOI":"10.48550\/arxiv.2002.01256"},{"key":"283_CR116","doi-asserted-by":"publisher","unstructured":"Roy, A., Chhabra, A., Kamhoua, C.A., Mohapatra, P.: A moving target defense against adversarial machine learning. In: Proceedings of the 4th ACM\/IEEE Symposium on Edge Computing, SEC 2019, pp. 383\u2013388 (2019). https:\/\/doi.org\/10.1145\/3318216.3363338","DOI":"10.1145\/3318216.3363338"},{"key":"283_CR117","doi-asserted-by":"publisher","unstructured":"Papernot, N., McDaniel, P., Wu, X., Jha, S., Swami, A.: Distillation as a defense to adversarial perturbations against deep neural networks. In: Proceedings-2016 IEEE Symposium on Security and Privacy, SP 2016, pp. 582\u2013597 (2016). https:\/\/doi.org\/10.1109\/SP.2016.41.","DOI":"10.1109\/SP.2016.41"},{"issue":"1","key":"283_CR118","doi-asserted-by":"publisher","first-page":"128","DOI":"10.1109\/TNNLS.2020.2977142","volume":"32","author":"Z Katzir","year":"2021","unstructured":"Katzir, Z., Elovici, Y.: Gradients cannot be tamed: behind the impossible paradox of blocking targeted adversarial attacks. IEEE Trans Neural Netw Learn Syst 32(1), 128\u2013138 (2021). https:\/\/doi.org\/10.1109\/TNNLS.2020.2977142","journal-title":"IEEE Trans Neural Netw Learn Syst"},{"key":"283_CR119","doi-asserted-by":"crossref","unstructured":"Ross, A.S., Doshi-Velez, F.: Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients. In: 32nd AAAI Conference on Artificial Intelligence, AAAI 2018, pp. 1660\u20131669, Nov. 2017. http:\/\/arxiv.org\/abs\/1711.09404. Accessed 6 May 2021","DOI":"10.1609\/aaai.v32i1.11504"},{"key":"283_CR120","first-page":"1","volume":"2","author":"C Sun","year":"2020","unstructured":"Sun, C., Chen, S., Huang, X.: Double backpropagation for training autoencoders against adversarial attack. ArXiv 2, 1\u20138 (2020)","journal-title":"ArXiv"},{"key":"283_CR121","doi-asserted-by":"publisher","unstructured":"Folz, J., Palacio, S., Hees, J., Dengel, A.: Adversarial defense based on structure-to-signal autoencoders. In: Proceedings-2020 IEEE Winter Conference on Applications of Computer Vision, WACV 2020, pp. 3568\u20133577 (2020). https:\/\/doi.org\/10.1109\/WACV45572.2020.9093310.","DOI":"10.1109\/WACV45572.2020.9093310"},{"key":"283_CR122","doi-asserted-by":"publisher","unstructured":"Zhong, Y., Deng, W.: Adversarial learning with margin-based triplet embedding regularization. In: Proceedings of the IEEE International Conference on Computer Vision, vol. 2019-October, pp. 6548\u20136557, Sep. 2019, https:\/\/doi.org\/10.48550\/arxiv.1909.09481","DOI":"10.48550\/arxiv.1909.09481"},{"key":"283_CR123","doi-asserted-by":"publisher","unstructured":"Santos, F.A.O., de Souza, M.D., Zanchettin, C.: Towards background and\u00a0foreground color robustness with\u00a0adversarial right for\u00a0the\u00a0right reasons. In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 14258 LNCS, pp. 169\u2013180, 2023, https:\/\/doi.org\/10.1007\/978-3-031-44192-9_14.","DOI":"10.1007\/978-3-031-44192-9_14"},{"key":"283_CR124","doi-asserted-by":"publisher","unstructured":"Hua, Y., Ge, S., Gao, X., Jin, X., Zeng, D.: Defending against adversarial examples via soft decision trees embedding. In: MM 2019 - Proceedings of the 27th ACM International Conference on Multimedia, pp. 2106\u20132114 (2019). https:\/\/doi.org\/10.1145\/3343031.3351012","DOI":"10.1145\/3343031.3351012"},{"key":"283_CR125","doi-asserted-by":"publisher","unstructured":"Carrara, F., Becarelli, R., Caldelli, R., Falchi, F., Amato, G.: Adversarial examples detection in features distance spaces. In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 11130 LNCS, pp. 313\u2013327, 2019, https:\/\/doi.org\/10.1007\/978-3-030-11012-3_26","DOI":"10.1007\/978-3-030-11012-3_26"},{"key":"283_CR126","unstructured":"Li, Y., Xie, L., Zhang, Y., Zhang, R., Wang, Y., Tian, Q.: Defending adversarial attacks by correcting logits. ArXiv, pp. 1\u201312 (2019)"},{"key":"283_CR127","unstructured":"Kannan, H., Kurakin, A., Goodfellow, I.: Adversarial logit pairing. (2018). arXiv preprint arXiv:1803.06373"},{"key":"283_CR128","doi-asserted-by":"publisher","unstructured":"Brendel, W., Bethge, M.: Approximating CNNs with Bag-of-local-Features models works surprisingly well on ImageNet. In: 7th International Conference on Learning Representations, ICLR 2019, Mar. 2019, https:\/\/doi.org\/10.48550\/arxiv.1904.00760","DOI":"10.48550\/arxiv.1904.00760"},{"key":"283_CR129","doi-asserted-by":"publisher","unstructured":"Zhang, Z., Yuan, B., Mccoyd, M., Wagner, D.: Clipped BagNet: defending against sticker attacks with clipped Bag-of-features. (2020) https:\/\/doi.org\/10.1109\/SPW50608.2020.00026","DOI":"10.1109\/SPW50608.2020.00026"},{"key":"283_CR130","unstructured":"Xiang, C., Bhagoji, A.N., Sehwag, V., Mittal, P.: PatchGuard: A provably robust defense against adversarial patches via small receptive fields and masking. In: Proceedings of the 30th USENIX Security Symposium, pp. 2237\u20132254, May 2020. https:\/\/arxiv.org\/abs\/2005.10884v5. Accessed 25 Jul 2023"},{"key":"283_CR131","doi-asserted-by":"publisher","first-page":"962","DOI":"10.48550\/arxiv.2009.05244","volume":"31","author":"S-Y Lo","year":"2020","unstructured":"Lo, S.-Y., Member, S., Patel, V.M., Member, S.: Defending against multiple and unforeseen adversarial videos. IEEE Trans. Image Process. 31, 962\u2013973 (2020). https:\/\/doi.org\/10.48550\/arxiv.2009.05244","journal-title":"IEEE Trans. Image Process."},{"key":"283_CR132","unstructured":"Han, H., et al.: ScaleCert: scalable certified defense against adversarial patches with sparse superficial layers."},{"key":"283_CR133","unstructured":"Metzen, J. H., Yatsura, M.: Efficient certified defenses against patch attacks on image classifiers. (2021). arXiv preprint arXiv:2102.04154."},{"key":"283_CR134","unstructured":"Zhao, P., Fu, Z., Wu, O., Hu, Q., Wang, J.: Detecting adversarial examples via key-based network. ArXiv pp. 1\u20136 (2018)"},{"key":"283_CR135","doi-asserted-by":"publisher","first-page":"148","DOI":"10.1016\/J.FUTURE.2020.04.013","volume":"110","author":"M Pawlicki","year":"2020","unstructured":"Pawlicki, M., Chora\u015b, M., Kozik, R.: Defending network intrusion detection systems against adversarial evasion attacks. Futur. Gener. Comput. Syst. 110, 148\u2013154 (2020). https:\/\/doi.org\/10.1016\/J.FUTURE.2020.04.013","journal-title":"Futur. Gener. Comput. Syst."},{"key":"283_CR136","unstructured":"Lu, J., Issaranon, T., Forsyth, D.: SafetyNet: detecting and rejecting adversarial examples robustly"},{"key":"283_CR137","unstructured":"Samangouei, P., Kabkab, M., Chellappa, R.: Defense-gan: protecting classifiers against adversarial attacks using generative models. arXiv. arXiv, May 17, 2018. https:\/\/github.com\/kabkabm\/defensegan. Accessed 6 May 2021"},{"issue":"NeurIPS","key":"283_CR138","first-page":"7913","volume":"2018-Decem","author":"Z Zheng","year":"2018","unstructured":"Zheng, Z., Hong, P.: Robust detection of adversarial attacks by modeling the intrinsic properties of deep neural networks. Adv. Neural. Inf. Process. Syst. 2018-Decem(NeurIPS), 7913\u20137922 (2018)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"283_CR139","unstructured":"Gupte, A., Banburski, A., Poggio, T.: PCA as a defense against some adversaries. (2022)"},{"key":"283_CR140","doi-asserted-by":"publisher","unstructured":"Yang, J., Wu, M., Liu, X.Z.: Defense against adversarial attack using PCA. In: Communications in Computer and Information Science, vol. 1253 CCIS, pp. 627\u2013636 (2020) https:\/\/doi.org\/10.1007\/978-981-15-8086-4_59\/COVER","DOI":"10.1007\/978-981-15-8086-4_59\/COVER"},{"key":"283_CR141","unstructured":"Feinman, R., Curtin, R.R., Shintre, S., Gardner, A.B.: Detecting adversarial samples from artifacts. ArXiv (2017)"},{"key":"283_CR142","unstructured":"Li, Y., Tang, T., Hsieh, C.-J., Lee, T.C.M.: Detecting adversarial examples with Bayesian neural network"},{"key":"283_CR143","doi-asserted-by":"publisher","unstructured":"Saha, S., Kumar, A., Sahay, P., Jose, G., Kruthiventi, S., Muralidhara, H.: Attack agnostic statistical method for adversarial detection. In: Proceedings-2019 International Conference on Computer Vision Workshop, ICCVW 2019, pp. 798\u2013802, 2019, https:\/\/doi.org\/10.1109\/ICCVW.2019.00107","DOI":"10.1109\/ICCVW.2019.00107"},{"key":"283_CR144","doi-asserted-by":"publisher","unstructured":"Liu, H., Li, W., Li, Z., Wang, Y., Gui, G.: Deep learning based adversarial images detection. In: Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST, vol. 301 LNICST, pp. 279\u2013286, 2019, https:\/\/doi.org\/10.1007\/978-3-030-36402-1_30","DOI":"10.1007\/978-3-030-36402-1_30"},{"key":"283_CR145","doi-asserted-by":"publisher","first-page":"160397","DOI":"10.1109\/ACCESS.2019.2951526","volume":"7","author":"Y Bakhti","year":"2019","unstructured":"Bakhti, Y., Fezza, S.A., Hamidouche, W., Deforges, O.: DDSA: a defense against adversarial attacks using deep denoising sparse autoencoder. IEEE Access 7, 160397\u2013160407 (2019). https:\/\/doi.org\/10.1109\/ACCESS.2019.2951526","journal-title":"IEEE Access"},{"key":"283_CR146","unstructured":"Bao, R., Liang, S., Wang, Q.: Featurized bidirectional GAN: Adversarial defense via adversarially learned semantic inference. (2018). arXiv preprint arXiv:1805.07862"},{"issue":"11","key":"283_CR147","doi-asserted-by":"publisher","first-page":"139","DOI":"10.1145\/3422622","volume":"63","author":"I Goodfellow","year":"2020","unstructured":"Goodfellow, I., et al.: Generative adversarial networks. Commun. ACM 63(11), 139\u2013144 (2020). https:\/\/doi.org\/10.1145\/3422622","journal-title":"Commun. ACM"},{"key":"283_CR148","doi-asserted-by":"publisher","unstructured":"Bouniot, Q., Audigier, R., Loesch, A.: Optimal transport as a defense against adversarial attacks. 2021, https:\/\/doi.org\/10.1109\/ICPR48806.2021.9413327","DOI":"10.1109\/ICPR48806.2021.9413327"},{"key":"283_CR149","doi-asserted-by":"publisher","DOI":"10.1080\/19393555.2022.2088429","author":"L Dhamija","year":"2022","unstructured":"Dhamija, L., Garg, U.: An adaptive randomized and secured approach against adversarial attacks. Inform. Secur. J. (2022). https:\/\/doi.org\/10.1080\/19393555.2022.2088429","journal-title":"Inform. Secur. J."},{"key":"283_CR150","doi-asserted-by":"publisher","unstructured":"Behnia, F., et al.: Code-Bridged Classifier (CBC): a low or negative overhead defense for making a CNN classifier robust against adversarial attacks. In: Proceedings-International Symposium on Quality Electronic Design, ISQED, vol. 2020-March, no. 1, pp. 27\u201332 (2020). https:\/\/doi.org\/10.1109\/ISQED48828.2020.9136987","DOI":"10.1109\/ISQED48828.2020.9136987"},{"key":"283_CR151","doi-asserted-by":"publisher","unstructured":"Wei, W., et al.: Cross-layer strategic ensemble defense against adversarial examples. In: 2020 International Conference on Computing, Networking and Communications, ICNC 2020, pp. 456\u2013460, 2020. https:\/\/doi.org\/10.1109\/ICNC47757.2020.9049702.","DOI":"10.1109\/ICNC47757.2020.9049702"},{"key":"283_CR152","unstructured":"Song, Y., Kim, T., Nowozin, S., Ermon, S., Kushman, N.: PixelDefend: leveraging generative models to understand and defend against adversarial examples. ArXiv. 2017. http:\/\/arxiv.org\/abs\/1710.10766. Accessed 6 May 2021"},{"key":"283_CR153","doi-asserted-by":"publisher","unstructured":"Prakash, A., Moran, N., Garber, S., Dilillo, A., Storer, J.: Deflecting adversarial attacks with pixel deflection. In: Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, pp. 8571\u20138580, (2018). https:\/\/doi.org\/10.48550\/arxiv.1801.08926.","DOI":"10.48550\/arxiv.1801.08926"},{"key":"283_CR154","unstructured":"Guo, C., Rana, M., Cisse, M., van der Maaten, L.: Countering adversarial images using input transformations. ArXiv. 2017. http:\/\/arxiv.org\/abs\/1711.00117. Accessed 6 May 2021"},{"key":"283_CR155","doi-asserted-by":"publisher","unstructured":"Gupta, P., Rahtu, E.: CIIdefence: defeating adversarial attacks by fusing class-specific image inpainting and image denoising. In: Proceedings of the IEEE International Conference on Computer Vision, vol. 2019-Octob, pp. 6707\u20136716 (2019). https:\/\/doi.org\/10.1109\/ICCV.2019.00681","DOI":"10.1109\/ICCV.2019.00681"},{"key":"283_CR156","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2024.106176","author":"H Wang","year":"2024","unstructured":"Wang, H., Wu, C., Zheng, K.: Defense against adversarial attacks based on color space transformation. Neural Netw. (2024). https:\/\/doi.org\/10.1016\/j.neunet.2024.106176","journal-title":"Neural Netw."},{"key":"283_CR157","unstructured":"Aydemir, A. E., Temizel, A., Temizel, T. T.: The effects of JPEG and JPEG2000 compression on attacks using adversarial examples. (2018). arXiv preprint arXiv:1803.10418"},{"key":"283_CR158","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198","author":"W Xu","year":"2017","unstructured":"Xu, W., Evans, D., Qi, Y.: Feature squeezing: detecting adversarial examples in deep neural networks. ArXiv (2017). https:\/\/doi.org\/10.14722\/ndss.2018.23198","journal-title":"ArXiv"},{"key":"283_CR159","doi-asserted-by":"publisher","unstructured":"Borkar, T., Heide, F., Karam, L.: Defending against universal attacks through selective feature regeneration. In: Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, pp. 706\u2013716, (2020), https:\/\/doi.org\/10.1109\/CVPR42600.2020.00079","DOI":"10.1109\/CVPR42600.2020.00079"},{"key":"283_CR160","doi-asserted-by":"publisher","unstructured":"Cao, X., Gong, N.Z.: Mitigating evasion attacks to deep neural networks via region-based classification. In: ACM International Conference Proceeding Series, vol. Part F1325, pp. 278\u2013287, 2017, https:\/\/doi.org\/10.1145\/3134600.3134606","DOI":"10.1145\/3134600.3134606"},{"key":"283_CR161","doi-asserted-by":"publisher","unstructured":"Yu, H., Towards adversarial robustness via feature matching. 2020. https:\/\/doi.org\/10.1109\/ACCESS.2020.2993304","DOI":"10.1109\/ACCESS.2020.2993304"},{"key":"283_CR162","doi-asserted-by":"publisher","unstructured":"Qiu, P., Wang, Q., Wang, D., Lyu, Y., Lu, Z., Qu, G.: Mitigating adversarial attacks for deep neural networks by input deformation and augmentation. In: Proceedings of the Asia and South Pacific Design Automation Conference, ASP-DAC, vol. 2020-Janua, pp. 157\u2013162, 2020, https:\/\/doi.org\/10.1109\/ASP-DAC47756.2020.9045107","DOI":"10.1109\/ASP-DAC47756.2020.9045107"},{"key":"283_CR163","doi-asserted-by":"publisher","first-page":"244","DOI":"10.1016\/j.patrec.2021.01.032","volume":"146","author":"A Agarwal","year":"2021","unstructured":"Agarwal, A., Vatsa, M., Singh, R., Ratha, N.: Cognitive data augmentation for adversarial defense via pixel masking. Pattern Recognit Lett 146, 244\u2013251 (2021). https:\/\/doi.org\/10.1016\/j.patrec.2021.01.032","journal-title":"Pattern Recognit Lett"},{"key":"283_CR164","unstructured":"Wang, Z., Pang, T., Du, C., Lin, M., Liu, W., Yan, S.: Better diffusion models further improve adversarial training. In: International Conference on Machine Learning, pp. 36246\u201336263,  PMLR (2023)"},{"key":"283_CR165","doi-asserted-by":"publisher","unstructured":"Zhang, Y., Liang, J., Bai, K., Yang, Q., Song, Y.: Two sides of the same coin: white-box and black-box attacks for transfer learning. Virtual Event, vol. 20, https:\/\/doi.org\/10.1145\/3394486","DOI":"10.1145\/3394486"},{"key":"283_CR166","doi-asserted-by":"publisher","unstructured":"Jang, Y., Zhao, T., Hong, S., Lee, H.: Adversarial defense via learning to generate diverse attacks. In: Proceedings of the IEEE International Conference on Computer Vision, vol. 2019-Octob, pp. 2740\u20132749 (2019). https:\/\/doi.org\/10.1109\/ICCV.2019.00283","DOI":"10.1109\/ICCV.2019.00283"},{"key":"283_CR167","doi-asserted-by":"crossref","unstructured":"Tram\u00e8r, F., Boneh, D.: Adversarial training and robustness for multiple perturbations. ArXiv (2019)","DOI":"10.1145\/3319535.3354222"},{"key":"283_CR168","unstructured":"Shafahi, A., et al.: Adversarial Training for Free!,\u201d ArXiv, no. NeurIPS (2019)"},{"key":"283_CR169","doi-asserted-by":"crossref","unstructured":"Bagheri, A., Simeone, O., Rajendran, B.: Adversarial training for probabilistic spiking neural networks. ArXiv (2018)","DOI":"10.1109\/ICASSP.2018.8462410"},{"key":"283_CR170","doi-asserted-by":"publisher","unstructured":"Liu, Y.L., Lomuscio, A.: An MCTS-based adversarial training method for image recognition. In: Proceedings of the International Joint Conference on Neural Networks, vol. 2019-July, no. July, pp. 1\u20138 (2019). https:\/\/doi.org\/10.1109\/IJCNN.2019.8852337","DOI":"10.1109\/IJCNN.2019.8852337"},{"key":"283_CR171","unstructured":"Nguyen, P.H., Mahmood, K., Nguyen, L.M., Nguyen, T., van Dijk, M.: BUZZ: buffer zones for defending adversarial examples in image classification. ArXiv, pp. 1\u201326, (2019)"},{"issue":"NeurIPS","key":"283_CR172","first-page":"419","volume":"2018-Decem","author":"Z Yan","year":"2018","unstructured":"Yan, Z., Guo, Y., Zhang, C.: Deep defense: Training DnNs with improved adversarial robustness. Adv. Neural. Inf. Process. Syst. 2018-Decem(NeurIPS), 419\u2013428 (2018)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"issue":"8","key":"283_CR173","first-page":"1","volume":"14","author":"X Zhou","year":"2019","unstructured":"Zhou, X., Tsang, I.W., Yin, J.: Latent adversarial defence with boundary-guided generation. ArXiv 14(8), 1\u201311 (2019)","journal-title":"ArXiv"},{"key":"283_CR174","doi-asserted-by":"publisher","unstructured":"Lateralized learning for robustness against adversarial attacks in a visual classification system. In: Proceedings of the 2020 Genetic and Evolutionary Computation Conference. https:\/\/doi.org\/10.1145\/3377930.3390164","DOI":"10.1145\/3377930.3390164"},{"key":"283_CR175","doi-asserted-by":"publisher","unstructured":"Meng, D., Chen, H.: MagNet: a two-pronged defense against adversarial examples. (2017). https:\/\/doi.org\/10.1145\/3133956.3134057","DOI":"10.1145\/3133956.3134057"},{"key":"283_CR176","unstructured":"Li, H., Xiao, Q., Tian, S., Tian, J.: Purifying adversarial perturbation with adversarially trained auto-encoders. ArXiv, (2019)"},{"key":"283_CR177","unstructured":"Transferable Adversarial Robustness using Adversarially Trained Autoencoders | Pratik Vaishnavi. https:\/\/www3.cs.stonybrook.edu\/~pvaishnavi\/publication\/vaishnavi-2019-transferable\/. Accessed 17 June 2022"},{"key":"283_CR178","doi-asserted-by":"publisher","first-page":"195","DOI":"10.1016\/j.neucom.2018.04.027","volume":"307","author":"U Shaham","year":"2018","unstructured":"Shaham, U., Yamada, Y., Negahban, S.: Understanding adversarial training: Increasing local stability of supervised models through robust optimization. Neurocomputing 307, 195\u2013204 (2018). https:\/\/doi.org\/10.1016\/j.neucom.2018.04.027","journal-title":"Neurocomputing"},{"key":"283_CR179","doi-asserted-by":"publisher","unstructured":"Raju, R.S., Lipasti, M.: BlurNet: defense by filtering the feature maps. In: Proceedings-50th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks, DSN-W 2020, pp. 38\u201346, 2020, https:\/\/doi.org\/10.1109\/DSN-W50199.2020.00016","DOI":"10.1109\/DSN-W50199.2020.00016"},{"key":"283_CR180","doi-asserted-by":"publisher","unstructured":"Sahay, R., Mahfuz, R., El Gamal, A.: Combatting adversarial attacks through denoising and dimensionality reduction: a cascaded autoencoder approach. In: 2019 53rd Annual Conference on Information Sciences and Systems, CISS 2019, Dec. 2018, https:\/\/doi.org\/10.48550\/arxiv.1812.03087","DOI":"10.48550\/arxiv.1812.03087"},{"issue":"3","key":"283_CR181","doi-asserted-by":"publisher","first-page":"c","DOI":"10.1109\/tpami.2020.2978474","volume":"8828","author":"A Mustafa","year":"2020","unstructured":"Mustafa, A., Khan, S.H., Hayat, M., Goecke, R., Shen, J., Shao, L.: Deeply supervised discriminative learning for adversarial defense. IEEE Trans. Pattern Anal. Mach. Intell. 8828(3), c\u20131 (2020). https:\/\/doi.org\/10.1109\/tpami.2020.2978474","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"283_CR182","unstructured":"Haichao, Z., Wang, J.: Defense against adversarial attacks using feature scattering-based adversarial training. ArXiv, no. NeurIPS (2019)"},{"key":"283_CR183","unstructured":"Gao, Y., Pan, Y.: Improved detection of adversarial images using deep neural networks. ArXiv (2020)"},{"key":"283_CR184","doi-asserted-by":"publisher","DOI":"10.1145\/3351917.3351987","author":"L Jiang","year":"2019","unstructured":"Jiang, L., Qiao, K., Qin, R., Chen, J., Bu, H., Yan, B.: Unsupervised adversarial perturbation eliminating via disentangled representations. ACM Int.Conf. Proc. Ser. (2019). https:\/\/doi.org\/10.1145\/3351917.3351987","journal-title":"ACM Int.Conf. Proc. Ser."},{"key":"283_CR185","unstructured":"Adam, G. A., Smirnov, P., Duvenaud, D., Haibe-Kains, B., Goldenberg, A.: Stochastic combinatorial ensembles for defending against adversarial examples. (2018). arXiv preprint arXiv:1808.06645."},{"key":"283_CR186","unstructured":"Rakin, A.S., Yi, J., Gong, B., Fan, D.: Defend deep neural networks against adversarial examples via fixed and dynamic quantized activation functions. ArXiv, no. i, pp. 1\u201315, (2018)"},{"key":"283_CR187","doi-asserted-by":"publisher","unstructured":"Wang, S., et al.: Defensive dropout for hardening deep neural networks under adversarial attacks. In: IEEE\/ACM International Conference on Computer-Aided Design, Digest of Technical Papers, ICCAD, no. i, 2018, https:\/\/doi.org\/10.1145\/3240765.3264699","DOI":"10.1145\/3240765.3264699"},{"key":"283_CR188","unstructured":"D. Li, R. Baral, T. Li, H. Wang, Q. Li, and S. Xu.: HashTran-DNN: A framework for enhancing robustness of deep neural networks against adversarial malware samples. ArXiv, pp. 1\u201313, 2018."},{"key":"283_CR189","doi-asserted-by":"publisher","unstructured":"Jakubovitz, D., Giryes, R.: Improving DNN robustness to adversarial attacks using Jacobian regularization. In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 11216 LNCS, pp. 525\u2013541, 2018, https:\/\/doi.org\/10.1007\/978-3-030-01258-8_32","DOI":"10.1007\/978-3-030-01258-8_32"},{"key":"283_CR190","doi-asserted-by":"publisher","first-page":"2020","DOI":"10.1186\/s13635-020-00106-x","volume":"1","author":"O Taran","year":"2020","unstructured":"Taran, O., Rezaeifar, S., Holotyak, T., Voloshynovskiy, S.: Machine learning through cryptographic glasses: combating adversarial attacks by key-based diversified aggregation. EURASIP J. Inf. Secur. 1, 2020 (2020). https:\/\/doi.org\/10.1186\/s13635-020-00106-x","journal-title":"EURASIP J. Inf. Secur."},{"issue":"8","key":"283_CR191","doi-asserted-by":"publisher","first-page":"119744","DOI":"10.1109\/ACCESS.2020.3005961","volume":"8","author":"MAAK Jalwana","year":"2020","unstructured":"Jalwana, M.A.A.K., Akhtar, N., Bennamoun, M., Mian, A.: orthogonal deep models as defense against black-box attacks. IEEE Access 8(8), 119744\u2013119757 (2020). https:\/\/doi.org\/10.1109\/ACCESS.2020.3005961","journal-title":"IEEE Access"},{"key":"283_CR192","doi-asserted-by":"publisher","unstructured":"He, Z., Rakin, A.S., Fan, D.: Parametric noise injection: Trainable randomness to improve deep neural network robustness against adversarial attack. In: Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, vol. 2019-June, pp. 588\u2013597, 2019, https:\/\/doi.org\/10.1109\/CVPR.2019.00068","DOI":"10.1109\/CVPR.2019.00068"},{"key":"283_CR193","unstructured":"Tadros, T., Krishnan, G., Ramyaa, R., Bazhenov, M.: Biologically inspired sleep algorithm for increased generalization and adversarial robustness in deep neural networks. In: International Conference on Learning Representations (2019)"},{"key":"283_CR194","unstructured":"Shanbhogue, M., et al.: Compression to the rescue: defending from adversarial attacks across modalities. 2022. https:\/\/youtu.be\/z4d0PMl3UVM. Accessed 17 Jun 2022"},{"key":"283_CR195","doi-asserted-by":"publisher","unstructured":"Khalid, F., et al.: QuSecNets: quantization-based defense mechanism for securing deep neural network against adversarial attacks. In: 2019 IEEE 25th International Symposium on On-Line Testing and Robust System Design, IOLTS 2019, no. 10, pp. 182\u2013187, 2019, https:\/\/doi.org\/10.1109\/IOLTS.2019.8854377","DOI":"10.1109\/IOLTS.2019.8854377"},{"key":"283_CR196","doi-asserted-by":"crossref","unstructured":"Cennamo, A., Freeman, I., Kummert, A.: A statistical defense approach for detecting adversarial examples. ArXiv (2019)","DOI":"10.1145\/3415048.3416103"},{"key":"283_CR197","doi-asserted-by":"publisher","DOI":"10.1155\/2020\/8319249","author":"G Sun","year":"2020","unstructured":"Sun, G., Su, Y., Qin, C., Xu, W., Lu, X., Ceglowski, A.: Complete defense framework to protect deep neural networks against adversarial examples. Math. Probl. Eng. (2020). https:\/\/doi.org\/10.1155\/2020\/8319249","journal-title":"Math. Probl. Eng."},{"issue":"3","key":"283_CR198","doi-asserted-by":"publisher","first-page":"1365","DOI":"10.32604\/cmc.2020.07421","volume":"62","author":"C Liu","year":"2020","unstructured":"Liu, C., et al.: Defend against adversarial samples by using perceptual hash. Comput. Mater. Continua 62(3), 1365\u20131386 (2020). https:\/\/doi.org\/10.32604\/cmc.2020.07421","journal-title":"Comput. Mater. Continua"},{"key":"283_CR199","unstructured":"Dhaliwal, J., Shintre, S.: Gradient similarity: an explainable approach to detect adversarial attacks against deep learning. ArXiv, (2018)"},{"key":"283_CR200","doi-asserted-by":"publisher","first-page":"103","DOI":"10.1016\/j.neucom.2019.01.083","volume":"345","author":"XY Zhang","year":"2019","unstructured":"Zhang, X.Y., Shi, H., Zhu, X., Li, P.: Active semi-supervised learning based on self-expressive correlation with generative adversarial networks. Neurocomputing 345, 103\u2013113 (2019). https:\/\/doi.org\/10.1016\/j.neucom.2019.01.083","journal-title":"Neurocomputing"},{"key":"283_CR201","doi-asserted-by":"publisher","first-page":"10989","DOI":"10.1109\/ACCESS.2020.2965184","volume":"8","author":"X Zhang","year":"2020","unstructured":"Zhang, X., Zhou, Y., Pei, S., Zhuge, J., Chen, J.: Adversarial examples detection for XSS attacks based on generative adversarial networks. IEEE Access 8, 10989\u201310996 (2020). https:\/\/doi.org\/10.1109\/ACCESS.2020.2965184","journal-title":"IEEE Access"},{"key":"283_CR202","unstructured":"Lindqvist, B., Sugrim, S., Izmailov, R.: AutoGAN: robust classifier against adversarial attacks. ArXiv, (2018)"},{"key":"283_CR203","doi-asserted-by":"publisher","unstructured":"Yi, Z., Yu, J., Li, S., Tan, Y., Wu, Q.: Incremental learning of GAN for detecting multiple adversarial attacks. In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Springer Verlag, Sep. 2019, pp. 673\u2013684. https:\/\/doi.org\/10.1007\/978-3-030-30508-6_53.","DOI":"10.1007\/978-3-030-30508-6_53"},{"issue":"March","key":"283_CR204","doi-asserted-by":"publisher","first-page":"105378","DOI":"10.1016\/j.compag.2020.105378","volume":"173","author":"R Barth","year":"2020","unstructured":"Barth, R., Hemming, J., Van Henten, E.J.: Optimising realism of synthetic images using cycle generative adversarial networks for improved part segmentation. Comput. Electron. Agric. 173(March), 105378 (2020). https:\/\/doi.org\/10.1016\/j.compag.2020.105378","journal-title":"Comput. Electron. Agric."},{"key":"283_CR205","doi-asserted-by":"publisher","unstructured":"Ghosh, P., Losalka, A., Black, M\/.J.: Resisting adversarial attacks using Gaussian mixture variational autoencoders. In: 33rd AAAI Conference on Artificial Intelligence, AAAI 2019, 31st Innovative Applications of Artificial Intelligence Conference, IAAI 2019 and the 9th AAAI Symposium on Educational Advances in Artificial Intelligence, EAAI 2019, no. 2014, pp. 541\u2013548, 2019, https:\/\/doi.org\/10.1609\/aaai.v33i01.3301541","DOI":"10.1609\/aaai.v33i01.3301541"},{"key":"283_CR206","doi-asserted-by":"publisher","unstructured":"Liu, G., Khalil, I., Khreishah, A.: ZK-GanDef: a GAN based zero knowledge adversarial training defense for neural networks. In: Proceedings-49th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks, DSN 2019, pp. 64\u201375, 2019, https:\/\/doi.org\/10.1109\/DSN.2019.00021","DOI":"10.1109\/DSN.2019.00021"},{"key":"283_CR207","doi-asserted-by":"publisher","unstructured":"Ling, T., Jianming, L.: A defense against adversarial examples via image squeezing. In: Proceedings-2019 12th International Conference on Intelligent Computation Technology and Automation, ICICTA 2019, pp. 170\u2013174, 2019, https:\/\/doi.org\/10.1109\/ICICTA49267.2019.00044","DOI":"10.1109\/ICICTA49267.2019.00044"},{"key":"283_CR208","unstructured":"Wang, H., Wang, J. , Yin, Z.: An efficient pre-processing method to eliminate adversarial effects. pp. 1\u20137, 2019,  [Online]. Available: http:\/\/arxiv.org\/abs\/1905.08614"},{"key":"283_CR209","unstructured":"Rakin, A. S., He, Z., Gong, B., Fan, D.: Blind pre-processing: A robust defense method against adversarial examples. (2018). arXiv preprint arXiv:1802.01549"},{"issue":"8","key":"283_CR210","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1109\/tnse.2020.3008394","volume":"14","author":"S-H Choi","year":"2020","unstructured":"Choi, S.-H., Shin, J., Liu, P., Choi, Y.: EEJE: two-step input transformation for robust DNN against adversarial examples. IEEE Trans Netw Sci Eng 14(8), 1\u20131 (2020). https:\/\/doi.org\/10.1109\/tnse.2020.3008394","journal-title":"IEEE Trans Netw Sci Eng"},{"key":"283_CR211","doi-asserted-by":"publisher","unstructured":"Bhagoji, A.N., Cullina, D., Sitawarin, C., Mittal, P: Enhancing robustness of machine learning systems via data transformations. In: 2018 52nd Annual Conference on Information Sciences and Systems, CISS 2018, pp. 1\u20135, 2018, https:\/\/doi.org\/10.1109\/CISS.2018.8362326","DOI":"10.1109\/CISS.2018.8362326"},{"key":"283_CR212","unstructured":"Xie, C., Zhang, Z., Yuille, A.L., Wang, J., Ren, Z.: Mitigating adversarial effects through randomization. ArXiv, pp. 1\u201316, (2017)"},{"key":"283_CR213","doi-asserted-by":"publisher","unstructured":", J., et al.: Restoration as a defense against adversarial perturbations for spam image detection. In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 11729 LNCS, pp. 711\u2013723, 2019, https:\/\/doi.org\/10.1007\/978-3-030-30508-6_56.","DOI":"10.1007\/978-3-030-30508-6_56"},{"key":"283_CR214","doi-asserted-by":"publisher","unstructured":"An, S., Lee, M.J., So, J.: Improving robustness against adversarial example attacks using non-parametric models on MNIST. In: 2020 International Conference on Artificial Intelligence in Information and Communication, ICAIIC 2020, pp. 443\u2013447, 2020, https:\/\/doi.org\/10.1109\/ICAIIC48513.2020.9065264.","DOI":"10.1109\/ICAIIC48513.2020.9065264"},{"key":"283_CR215","doi-asserted-by":"publisher","first-page":"5695","DOI":"10.1109\/ACCESS.2018.2889409","volume":"7","author":"Y Zhou","year":"2019","unstructured":"Zhou, Y., Hu, X., Wang, L., Duan, S., Chen, Y.: Markov chain based efficient defense against adversarial examples in computer vision. IEEE Access 7, 5695\u20135706 (2019). https:\/\/doi.org\/10.1109\/ACCESS.2018.2889409","journal-title":"IEEE Access"},{"key":"283_CR216","doi-asserted-by":"publisher","unstructured":"Ma, S., Liu, Y., Tao, G., Lee, W.-C., Zhang, X.: NIC: detecting adversarial samples with neural network invariant checking. (2019) https:\/\/doi.org\/10.14722\/ndss.2019.23415.","DOI":"10.14722\/ndss.2019.23415"},{"key":"283_CR217","unstructured":"Kariyappa S., Qureshi, M.K.: Improving adversarial robustness of ensembles with diversity training. ArXiv, (2019)"},{"key":"283_CR218","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00767-6_75","volume-title":"Advrefactor: A resampling-based defense against adversarial attacks, vol. 11165 LNCS, no. 61601459","author":"J Jiang","year":"2018","unstructured":"Jiang, J., et al.: Advrefactor: A resampling-based defense against adversarial attacks, vol. 11165 LNCS, no. 61601459. Springer International Publishing (2018). https:\/\/doi.org\/10.1007\/978-3-030-00767-6_75"},{"key":"283_CR219","unstructured":"Staib, M., Jegelka, S.: Distributionally robust deep learning as a generalization of adversarial training. In: Nips, no. Nips, pp. 1\u20139, 2017,  [Online]. Available: https:\/\/machine-learning-and-security.github.io\/papers\/mlsec17_paper_30.pdf"},{"key":"283_CR220","doi-asserted-by":"crossref","unstructured":"Lin, J., Njilla, L. L., Xiong, K.: Robust machine learning against adversarial samples at test time. In: ICC 2020-2020 IEEE International Conference on Communications (ICC), pp. 1\u20136. IEEE, (2020)","DOI":"10.1109\/ICC40277.2020.9149002"},{"key":"283_CR221","unstructured":"Lin, Y., Kasra Ahmadi, K.A., Jiang, H.: Bandlimiting neural networks against adversarial attacks. ArXiv, no. 2017, (2019)"},{"key":"283_CR222","doi-asserted-by":"crossref","unstructured":"Rouhani, B.D., Samragh, M., Javaheripi, M., Javidi, T., Koushanfar, F.: DeepFense: online accelerated defense against adversarial deep learning. ArXiv, no. i, (2017)","DOI":"10.1145\/3240765.3240791"},{"key":"283_CR223","unstructured":"Wang, S., Chen, T., Chen, S., Nepal, S., Grobler, M., Rudolph, C.: Defending adversarial attacks via semantic Feature Manipulation. ArXiv, (2020)"},{"key":"283_CR224","doi-asserted-by":"publisher","unstructured":"Rakin, A.S., Fan, D.: Defense-Net: defend against a wide range of adversarial attacks through adversarial detector. In: Proceedings of IEEE Computer Society Annual Symposium on VLSI, ISVLSI, vol. 2019-July, pp. 332\u2013337, (2019), https:\/\/doi.org\/10.1109\/ISVLSI.2019.00067.","DOI":"10.1109\/ISVLSI.2019.00067"},{"key":"283_CR225","doi-asserted-by":"publisher","first-page":"296","DOI":"10.1016\/j.neunet.2020.01.015","volume":"124","author":"V Mygdalis","year":"2020","unstructured":"Mygdalis, V., Tefas, A., Pitas, I.: K-Anonymity inspired adversarial attack and multiple one-class classification defense. Neural Netw. 124, 296\u2013307 (2020). https:\/\/doi.org\/10.1016\/j.neunet.2020.01.015","journal-title":"Neural Netw."},{"key":"283_CR226","unstructured":"Tran, R., Patrick, D., Geyer, M., Fernandez, A.S.: Sad: Saliency-based defenses against adversarial examples. ArXiv, (2020)"},{"key":"283_CR227","doi-asserted-by":"publisher","unstructured":"Sheikholeslami, F., Jain, S., Giannakis, G.B.: Efficient randomized defense against adversarial attacks in deep convolutional neural networks. In: ICASSP, IEEE International Conference on Acoustics, Speech and Signal Processing - Proceedings, vol. 2019-May, pp. 3277\u20133281, (2019), https:\/\/doi.org\/10.1109\/ICASSP.2019.8683348","DOI":"10.1109\/ICASSP.2019.8683348"},{"key":"283_CR228","unstructured":"Hu, J., Okatani, T.: Analysis of deep networks for monocular depth estimation through adversarial attacks with proposal of a defense method. ArXiv, (2019)"},{"key":"283_CR229","doi-asserted-by":"publisher","unstructured":"Qiu, Y., et al.: Adversarial defense through network profiling based path extraction. In: Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, vol. 2019-June, pp. 4772\u20134781, (2019), https:\/\/doi.org\/10.1109\/CVPR.2019.00491","DOI":"10.1109\/CVPR.2019.00491"},{"key":"283_CR230","doi-asserted-by":"publisher","first-page":"124632","DOI":"10.1109\/ACCESS.2019.2937604","volume":"7","author":"YJ Mun","year":"2019","unstructured":"Mun, Y.J., Kang, J.W.: Ensemble of random binary output encoding for adversarial robustness. IEEE Access 7, 124632\u2013124640 (2019). https:\/\/doi.org\/10.1109\/ACCESS.2019.2937604","journal-title":"IEEE Access"},{"key":"283_CR231","doi-asserted-by":"publisher","unstructured":"Theagarajan, R., Chen, M., Bhanu, B., Zhang, J.: ShieldNets: defending against adversarial attacks using probabilistic adversarial robustness. In: Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, vol. 2019-June, no. c, pp. 6981\u20136989, 2019, https:\/\/doi.org\/10.1109\/CVPR.2019.00715","DOI":"10.1109\/CVPR.2019.00715"},{"key":"283_CR232","doi-asserted-by":"publisher","unstructured":"Jia, X., Wei, X., Cao, X., Foroosh, h.: Comdefend: an efficient image compression model to defend adversarial examples. In: Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, vol. 2019-June, pp. 6077\u20136085, (2019), https:\/\/doi.org\/10.1109\/CVPR.2019.00624","DOI":"10.1109\/CVPR.2019.00624"},{"key":"283_CR233","doi-asserted-by":"publisher","first-page":"19","DOI":"10.1007\/978-3-030-49536-7_3","volume":"899","author":"VM Kabilan","year":"2021","unstructured":"Kabilan, V.M., Morris, B., Nguyen, H.P., Nguyen, A.: VectorDefense: vectorization as a defense to adversarial examples. Stud. Comput. Intell. 899, 19\u201335 (2021). https:\/\/doi.org\/10.1007\/978-3-030-49536-7_3","journal-title":"Stud. Comput. Intell."},{"key":"283_CR234","doi-asserted-by":"crossref","unstructured":"Liu, G., Khalil, I., Khreishah, A.: Using single-step adversarial training to defend iterative adversarial examples. ArXiv, (2020)","DOI":"10.1145\/3422337.3447841"},{"key":"283_CR235","doi-asserted-by":"publisher","unstructured":"Mustafa, A., Khan, S., Hayat, M., Goecke, R., Shen, J., Shao, L.: Adversarial defense by restricting the hidden space of deep neural networks. In: Proceedings of the IEEE International Conference on Computer Vision, vol. 2019-Octob, pp. 3384\u20133393, (2019), https:\/\/doi.org\/10.1109\/ICCV.2019.00348.","DOI":"10.1109\/ICCV.2019.00348"},{"key":"283_CR236","doi-asserted-by":"publisher","unstructured":"Berg, A., Tulchinsky, E., Zaidenerg, N.J.: Deadversarial multiverse network\u2014a defense architecture against adversarial attacks. In: SYSTOR 2019-Proceedings of the 12th ACM International Systems and Storage Conference, p. 190, (2019), https:\/\/doi.org\/10.1145\/3319647.3325851","DOI":"10.1145\/3319647.3325851"},{"key":"283_CR237","unstructured":"Zhang, Y., Liang, P.: Defending against whitebox adversarial attacks via randomized discretization. ArXiv, vol. 89, (2019)"},{"key":"283_CR238","unstructured":"Ranjan, R., Sankaranarayanan, S., Castillo, C.D., Chellappa, R.: Improving network robustness against adversarial attacks with compact convolution. ArXiv, pp. 1\u201322, (2017)"},{"key":"283_CR239","unstructured":"Li, Y., Min, M.R., Yu, W., Hsieh, C.J., Lee, T.C.M., Kruus, E.: Optimal transport classifier: defending against adversarial attacks by regularized deep embedding. ArXiv, (2018)"},{"key":"283_CR240","unstructured":"Radial Basis Feature Transformation to Arm CNNs Against Adversarial Attacks | Papers With Code.  [Online]. Available: https:\/\/paperswithcode.com\/paper\/radial-basis-feature-transformation-to-arm. Accessed 8 May 2021"},{"key":"283_CR241","unstructured":"Agrawal, R., De Alfaro, L., Helmbold, D.: A new family of neural networks provably resistant to adversarial attacks. ArXiv, pp. 1\u201316, (2019_"},{"key":"283_CR242","doi-asserted-by":"publisher","unstructured":"Choi, S.H., Shin, J.M., Liu, P., Choi, Y.H.: Robustness analysis of CNN-based malware family classification methods against various adversarial attacks. In: 2019 IEEE Conference on Communications and Network Security, CNS 2019, (2019), https:\/\/doi.org\/10.1109\/CNS.2019.8802809.","DOI":"10.1109\/CNS.2019.8802809"},{"key":"283_CR243","unstructured":"Yu, T., Hu, S., Guo, C., Chao, W.L., Weinberger, K.Q.: A new defense against adversarial images: turning a weakness into a strength. ArXiv, no. NeurIPS, (2019)"},{"key":"283_CR244","doi-asserted-by":"publisher","unstructured":"Ding, Y., Wang, L., Zhang, H., Yi, J., Fan, D., Gong, B.: Defending against adversarial attacks using random forest. In: IEEE Computer Society Conference on Computer Vision and Pattern Recognition Workshops, vol. 2019-June, pp. 105\u2013114, (2019), https:\/\/doi.org\/10.1109\/CVPRW.2019.00019","DOI":"10.1109\/CVPRW.2019.00019"},{"key":"283_CR245","first-page":"1","volume":"2014","author":"S Sen","year":"2020","unstructured":"Sen, S., Raghunathan, A., Ravindran, B.: Empir: ensembles of mixed precision deep networks for increased robustness against adversarial attacks. ArXiv 2014, 1\u201312 (2020)","journal-title":"ArXiv"},{"key":"283_CR246","doi-asserted-by":"publisher","first-page":"126582","DOI":"10.1109\/ACCESS.2019.2939352","volume":"7","author":"U Hwang","year":"2019","unstructured":"Hwang, U., Park, J., Jang, H., Yoon, S., Cho, N.I.: PuVAE: a variational autoencoder to purify adversarial examples. IEEE Access 7, 126582\u2013126593 (2019). https:\/\/doi.org\/10.1109\/ACCESS.2019.2939352","journal-title":"IEEE Access"},{"key":"283_CR247","doi-asserted-by":"crossref","unstructured":"Ozbulak, U., Van Messem, A., De Neve, W.: Not all adversarial examples require a complex defense: identifying over-optimized adversarial examples with IQR-based logit thresholding. ArXiv, (2019)","DOI":"10.1109\/IJCNN.2019.8851930"},{"key":"283_CR248","doi-asserted-by":"publisher","unstructured":"Benjamin Erichson, N., Yao, Z., Mahoney, M.W.: Jumprelu: a retrofit defense strategy for adversarial attacks. In: ICPRAM 2020-Proceedings of the 9th International Conference on Pattern Recognition Applications and Methods, pp. 103\u2013114 (2020) https:\/\/doi.org\/10.5220\/0009316401030114.","DOI":"10.5220\/0009316401030114"},{"key":"283_CR249","doi-asserted-by":"publisher","unstructured":"Fan, W., Sun, G., Su, Y., Liu, Z., Lu, X.: Hybrid defense for deep neural networks: an integration of detecting and cleaning adversarial perturbations. In: Proceedings-2019 IEEE International Conference on Multimedia and Expo Workshops, ICMEW 2019, pp. 210\u2013215, 2019, https:\/\/doi.org\/10.1109\/ICMEW.2019.00-85.","DOI":"10.1109\/ICMEW.2019.00-85"},{"key":"283_CR250","doi-asserted-by":"publisher","unstructured":"Gandhi, A., Jain, S.: Adversarial perturbations fool deepfake detectors. In: Proceedings of the International Joint Conference on Neural Networks, no. Ijcnn, 2020, https:\/\/doi.org\/10.1109\/IJCNN48605.2020.9207034","DOI":"10.1109\/IJCNN48605.2020.9207034"},{"key":"283_CR251","doi-asserted-by":"publisher","unstructured":"Zhou, X., et al.: LADDER: latent boundary-guided adversarial training. In: 123AD, https:\/\/doi.org\/10.1007\/s10994-022-06203-x","DOI":"10.1007\/s10994-022-06203-x"},{"key":"283_CR252","doi-asserted-by":"publisher","unstructured":"Karim, R., Islam, M.A., Mohammed, N., Bruce, N.D.B.: On the robustness of deep learning models to universal adversarial attack. In: Proceedings-2018 15th Conference on Computer and Robot Vision, CRV 2018, pp. 55\u201362, (2018), https:\/\/doi.org\/10.1109\/CRV.2018.00018","DOI":"10.1109\/CRV.2018.00018"},{"key":"283_CR253","unstructured":"Wang, Q., Zhang, S., Cao, J., Li, J., Tan, M., Xiang, Y.: Internal wasserstein distance for adversarial attack and defense. 2021. https:\/\/arxiv.org\/abs\/2103.07598v4. Accessed 18 Jul 2023"},{"key":"283_CR254","unstructured":"Li, H., Shan, S., Wenger, E., Zhang, J., Zheng, H., Zhao, B.Y.: Blacklight: defending black-box adversarial attacks on deep neural networks. ArXiv. (2020)"},{"key":"283_CR255","doi-asserted-by":"publisher","unstructured":"Chen, S., Carlini, N., Wagner, D.: Stateful detection of black-box adversarial attacks. In: SPAI 2020-Proceedings of the 1st ACM Workshop on Security and Privacy on Artificial Intelligent, Co-located with AsiaCCS 2020, pp. 30\u201339, (2020), https:\/\/doi.org\/10.1145\/3385003.3410925","DOI":"10.1145\/3385003.3410925"},{"key":"283_CR256","doi-asserted-by":"crossref","unstructured":"Yu, Y., Yu, P., Li, W.: AuxBlocks: defense adversarial example via auxiliary blocks,\u201d ArXiv, no. xxxxxx, (2019)","DOI":"10.1109\/IJCNN.2019.8851823"},{"key":"283_CR257","doi-asserted-by":"publisher","unstructured":"Jia, J., Salem, A., Backes, M., Zhang, Y., Gong, N.Z.: \u201c=Memguard: defending against black-box membership inference attacks via adversarial examples. In: Proceedings of the ACM Conference on Computer and Communications Security, pp. 259\u2013274, (2019), https:\/\/doi.org\/10.1145\/3319535.3363201.","DOI":"10.1145\/3319535.3363201"},{"key":"283_CR258","unstructured":"Strauss, T., Hanselmann, M., Junginger, A., Ulmer, H.: Ensemble methods as a defense to adversarial perturbations against deep neural networks. ArXiv, pp. 1\u201310, (2017)"},{"key":"283_CR259","first-page":"14620","volume":"34","author":"S Cheng","year":"2021","unstructured":"Cheng, S., Wu, G., Zhu, J.: On the convergence of prior-guided zeroth-order optimization algorithms. Adv. Neural Inf. Process. Syst. 34,  14620\u201314631 (2021).","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"283_CR260","unstructured":"Shi, K., Hsu, D., Bishop, A.: A cryptographic approach to black box adversarial machine learning. (2019). arXiv preprint arXiv:1906.03231"},{"issue":"12","key":"283_CR261","doi-asserted-by":"publisher","first-page":"10193","DOI":"10.1002\/INT.22458","volume":"37","author":"D Ye","year":"2022","unstructured":"Ye, D., Chen, C., Liu, C., Wang, H., Jiang, S.: Detection defense against adversarial attacks with saliency map.\u00a0Int. J. Intell. Syst.\u00a037(12), 10193\u201310210 (2022)","journal-title":"Int. J. Intell. Syst."},{"key":"283_CR262","doi-asserted-by":"publisher","DOI":"10.1145\/3474198.3478141","author":"N Si","year":"2021","unstructured":"Si, N., Chang, H., Li, Y.: A simple and effective method to defend against saliency map attack. ACM International Conference Proceeding Series (2021). https:\/\/doi.org\/10.1145\/3474198.3478141","journal-title":"ACM International Conference Proceeding Series"},{"key":"283_CR263","doi-asserted-by":"publisher","unstructured":"Xiao, C., Zheng, C.: One man\u2019s trash is another man\u2019s treasure: Resisting adversarial examples by adversarial examples. In: Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, pp. 409\u2013418 (2020). https:\/\/doi.org\/10.1109\/CVPR42600.2020.00049.","DOI":"10.1109\/CVPR42600.2020.00049"},{"key":"283_CR264","doi-asserted-by":"publisher","DOI":"10.1016\/J.COMNET.2020.107168","volume":"173","author":"S Hosseini","year":"2020","unstructured":"Hosseini, S., Zade, B.M.H.: New hybrid method for attack detection using combination of evolutionary algorithms, SVM, and ANN. Comput. Netw. 173, 107168 (2020). https:\/\/doi.org\/10.1016\/J.COMNET.2020.107168","journal-title":"Comput. Netw."},{"key":"283_CR265","doi-asserted-by":"publisher","first-page":"49","DOI":"10.1016\/J.NEUCOM.2022.10.034","volume":"516","author":"\u0130M Bayta\u015f","year":"2023","unstructured":"Bayta\u015f, \u0130M., Deb, D.: Robustness-via-synthesis: Robust training with generative adversarial perturbations. Neurocomputing 516, 49\u201360 (2023). https:\/\/doi.org\/10.1016\/J.NEUCOM.2022.10.034","journal-title":"Neurocomputing"},{"key":"283_CR266","unstructured":"Tang, S., et al.: RobustART: benchmarking robustness on architecture design and training techniques. 2021. http:\/\/arxiv.org\/abs\/2109.05211"},{"key":"283_CR267","unstructured":"Croce, F., Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang, M., et al.: Robustbench: a standardized adversarial robustness benchmark. (2020). arXiv preprint arXiv:2010.09670"},{"key":"283_CR268","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2023.109308","volume":"137","author":"J Guo","year":"2023","unstructured":"Guo, J., Bao, W., Wang, J., Ma, Y., Gao, X., Xiao, G. et al.: A comprehensive evaluation framework for deep model robustness.\u00a0Pattern Recognit.\u00a0137, 109308 (2023)","journal-title":"Pattern Recognit"},{"key":"283_CR269","doi-asserted-by":"crossref","unstructured":"Huang, X., Kwiatkowska, M., Wang, S., Wu, M.: Safety verification of deep neural networks. In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 10426 LNCS, pp. 3\u201329, Oct. 2016.  [Online]. Available: http:\/\/arxiv.org\/abs\/1610.06940. Accessed 7 May 2021","DOI":"10.1007\/978-3-319-63387-9_1"},{"key":"283_CR270","doi-asserted-by":"publisher","unstructured":"Katz, G., Barrett, C., Dill, D.L., Julian, K., Kochenderfer, M.J.: Reluplex: An efficient smt solver for verifying deep neural networks. In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 10426 LNCS, pp. 97\u2013117, (2017), https:\/\/doi.org\/10.1007\/978-3-319-63387-9_5\/TABLES\/3","DOI":"10.1007\/978-3-319-63387-9_5\/TABLES\/3"},{"key":"283_CR271","doi-asserted-by":"publisher","unstructured":"Gopinath, D., Katz, G., P\u0103s\u0103reanu, C.S., Barrett, C.: DeepSafe: a data-driven approach for assessing robustness of neural networks. In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 11138 LNCS, pp. 3\u201319, 2018, https:\/\/doi.org\/10.1007\/978-3-030-01090-4_1\/COVER","DOI":"10.1007\/978-3-030-01090-4_1\/COVER"},{"key":"283_CR272","doi-asserted-by":"publisher","unstructured":"Elboher, Y.Y., Gottschlich, J., Katz, G.: An abstraction-based framework for neural network verification. In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 12224 LNCS, pp. 43\u201365, 2020, https:\/\/doi.org\/10.1007\/978-3-030-53288-8_3\/FIGURES\/9","DOI":"10.1007\/978-3-030-53288-8_3\/FIGURES\/9"},{"key":"283_CR273","doi-asserted-by":"publisher","unstructured":"Zantedeschi, V., Nicolae, M.I., Rawat, A.: Efficient defenses against adversarial attacks. In: AISec 2017\u2014Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, co-located with CCS 2017, pp. 39\u201349, Nov. 2017, https:\/\/doi.org\/10.1145\/3128572.3140449","DOI":"10.1145\/3128572.3140449"},{"key":"283_CR274","doi-asserted-by":"publisher","unstructured":"Weng, T.W., et al.: Towards fast computation of certified robustness for ReLU networks. In: 35th International Conference on Machine Learning, ICML 2018, vol. 12, pp. 8379\u20138404, Apr. 2018, https:\/\/doi.org\/10.48550\/arxiv.1804.09699","DOI":"10.48550\/arxiv.1804.09699"},{"key":"283_CR275","doi-asserted-by":"publisher","first-page":"4939","DOI":"10.48550\/arxiv.1811.00866","volume":"21","author":"H Zhang","year":"2018","unstructured":"Zhang, H., Weng, T.W., Chen, P.Y., Hsieh, C.J., Daniel, L.: Efficient neural network robustness certification with general activation functions. Adv. Neural. Inf. Process. Syst. 21, 4939\u20134948 (2018). https:\/\/doi.org\/10.48550\/arxiv.1811.00866","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"283_CR276","doi-asserted-by":"publisher","unstructured":"Yoshida, Y., Miyato, T.: Spectral norm regularization for improving the generalizability of deep learning. (2017). https:\/\/doi.org\/10.48550\/arxiv.1705.10941","DOI":"10.48550\/arxiv.1705.10941"},{"key":"283_CR277","doi-asserted-by":"publisher","unstructured":"Cisse, M., Bojanowski, P., Grave, E., Dauphin, Y., Usunier, N.: Parseval networks: improving robustness to adversarial examples. In: 34th International Conference on Machine Learning, ICML 2017, vol. 2, pp. 1423\u20131432, Apr. 2017, https:\/\/doi.org\/10.48550\/arxiv.1704.08847","DOI":"10.48550\/arxiv.1704.08847"},{"issue":"11","key":"283_CR278","doi-asserted-by":"publisher","first-page":"137","DOI":"10.1145\/3361566","volume":"62","author":"K Pei","year":"2019","unstructured":"Pei, K., Cao, Y., Yang, J., Jana, S.: Deepxplore: automated whitebox testing of deep learning systems. Commun. ACM 62(11), 137\u2013145 (2019). https:\/\/doi.org\/10.1145\/3361566","journal-title":"Commun. ACM"},{"key":"283_CR279","doi-asserted-by":"publisher","first-page":"216","DOI":"10.1016\/j.neucom.2020.05.062","volume":"412","author":"L Hui","year":"2020","unstructured":"Hui, L., Bo, Z., Linquan, H., Jiabao, G., Yifan, L.: FoolChecker: a platform to evaluate the robustness of images against adversarial attacks. Neurocomputing 412, 216\u2013225 (2020). https:\/\/doi.org\/10.1016\/j.neucom.2020.05.062","journal-title":"Neurocomputing"},{"key":"283_CR280","doi-asserted-by":"publisher","unstructured":"Zhong, Z., Hu, Z., Chen, X.: Quantifying DNN model robustness to the real-world threats. In: Proceedings\u201450th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks, DSN 2020, pp. 150\u2013157, (2020), https:\/\/doi.org\/10.1109\/DSN48063.2020.00033.","DOI":"10.1109\/DSN48063.2020.00033"},{"key":"283_CR281","doi-asserted-by":"publisher","unstructured":"Feng, C.: Robustness verification boosting for deep neural networks. In: Proceedings\u20142019 6th International Conference on Information Science and Control Engineering, ICISCE 2019, pp. 531\u2013535, (2019), https:\/\/doi.org\/10.1109\/ICISCE48695.2019.00112","DOI":"10.1109\/ICISCE48695.2019.00112"},{"key":"283_CR282","unstructured":"Gowal, S., et al.: On the effectiveness of interval bound propagation for training verifiably robust models. (2018). https:\/\/arxiv.org\/abs\/1810.12715v4. Accessed 18 Jul 2023"},{"key":"283_CR283","unstructured":"Mirman, M., Gehr, T., Vechev, M.: Differentiable abstract interpretation for provably robust neural networks. (2018). http:\/\/diffai.ethz.ch. Accessed 18 Jul 2023"},{"key":"283_CR284","doi-asserted-by":"publisher","unstructured":"Singh, G., Gehr, T., Mirman, M., P\u00fcschel, M., Vechev, M.: Fast and effective robustness certification. https:\/\/doi.org\/10.5555\/3327546.3327739","DOI":"10.5555\/3327546.3327739"},{"key":"283_CR285","doi-asserted-by":"crossref","unstructured":"Yang, Z., Chang, E.C., Liang, Z.: Adversarial neural network inversion via auxiliary knowledge alignment. ArXiv, pp. 225\u2013240, (2019)","DOI":"10.1145\/3319535.3354261"},{"key":"283_CR286","doi-asserted-by":"crossref","unstructured":"Juuti, M., Szyller, S., Marchal, S., Asokan, N.: PRADA: protecting against DNN model stealing attacks. In: 2019 IEEE European Symposium on Security and Privacy (EuroS&P), pp. 512\u2013527. IEEE, (2019)","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"283_CR287","doi-asserted-by":"crossref","unstructured":"Freitas, S., Chen, S.T., Wang, Z., Chau, D.H.: UnMask: adversarial detection and defense through robust feature alignment. ArXiv. (2020)","DOI":"10.1109\/BigData50022.2020.9378303"},{"key":"283_CR288","doi-asserted-by":"publisher","unstructured":"Rosenberg, I., Shabtai, A., Elovici, Y., Rokach, L.: Sequence squeezing: a defense method against adversarial examples for API call-based RNN variants. In: Proceedings of the International Joint Conference on Neural Networks, vol. 2021-July, Jul. 2021, https:\/\/doi.org\/10.1109\/IJCNN52387.2021.9534432","DOI":"10.1109\/IJCNN52387.2021.9534432"},{"key":"283_CR289","doi-asserted-by":"publisher","unstructured":"Chou, E., Tramer, F., Pellegrino, G.: SentiNet: detecting localized universal attacks against deep learning systems. In: Proceedings\u20142020 IEEE Symposium on Security and Privacy Workshops, SPW 2020, pp. 48\u201354, (2020), https:\/\/doi.org\/10.1109\/SPW50608.2020.00025","DOI":"10.1109\/SPW50608.2020.00025"},{"key":"283_CR290","doi-asserted-by":"publisher","unstructured":"Redmon, J., Divvala, S., Girshick, R., Farhadi, A.: You only look once: unified, real-time object detection. In: Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, vol. 2016-December, pp. 779\u2013788, Jun. 2015, https:\/\/doi.org\/10.1109\/CVPR.2016.91","DOI":"10.1109\/CVPR.2016.91"},{"key":"283_CR291","doi-asserted-by":"publisher","first-page":"10691","DOI":"10.1609\/AAAI.V35I12.17278","volume":"12A","author":"N Ye","year":"2019","unstructured":"Ye, N., Li, Q., Zhou, X.Y., Zhu, Z.: Amata: an annealing mechanism for adversarial training acceleration. ArXiv 12A, 10691\u201310699 (2019). https:\/\/doi.org\/10.1609\/AAAI.V35I12.17278","journal-title":"ArXiv"},{"key":"283_CR292","unstructured":"Bai, Y., Zeng, Y., Jiang, Y., Xia, S., Ma, X., Wang, Y.: Improving adversarial robustness via channel-wise activation suppressing. ArXiv. (2021)"},{"key":"283_CR293","unstructured":"Zheng, Z., Hong, P.: Robust detection of adversarial attacks by modeling the intrinsic properties of deep neural networks. Adv. Neural. Inf. Process. Syst 31 (2018)"},{"issue":"2","key":"283_CR294","doi-asserted-by":"publisher","first-page":"953","DOI":"10.1109\/TDSC.2020.3014390","volume":"19","author":"D Wang","year":"2018","unstructured":"Wang, D., Li, C., Wen, S., Nepal, S., Xiang, Y.: Defending against adversarial attacks towards deep neural networks via collaborative multi-task training. IEEE Trans. Depend. Secure Comput. 19(2), 953\u2013965 (2020)","journal-title":"IEEE Trans. Depend. Secure Comput."},{"issue":"3","key":"283_CR295","doi-asserted-by":"publisher","first-page":"2698","DOI":"10.1109\/TPAMI.2022.3174724","volume":"45","author":"M Picot","year":"2023","unstructured":"Picot, M., Messina, F., Boudiaf, M., Labeau, F., Ben Ayed, I., Piantanida, P.: Adversarial robustness via fisher-rao regularization. IEEE Trans. Pattern Anal. Mach. Intell. 45(3), 2698\u20132710 (2023). https:\/\/doi.org\/10.1109\/TPAMI.2022.3174724","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"283_CR296","doi-asserted-by":"publisher","DOI":"10.3389\/FRAI.2021.780843\/FULL","author":"G Jagatap","year":"2022","unstructured":"Jagatap, G., Joshi, A., Chowdhury, A.B., Garg, S., Hegde, C.: Adversarially robust learning via entropic regularization. Front. Artif. Intell. (2022). https:\/\/doi.org\/10.3389\/FRAI.2021.780843\/FULL","journal-title":"Front. Artif. Intell."},{"key":"283_CR297","unstructured":"Gosch, L., Geisler, S., Sturm, D., Charpentier, B., Z\u00fcgner, D., G\u00fcnnemann, S.: Adversarial training for graph neural networks: pitfalls, solutions, and new directions. (2023).  [Online]. Available: http:\/\/arxiv.org\/abs\/2306.15427"}],"container-title":["New Generation Computing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s00354-024-00283-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s00354-024-00283-0\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s00354-024-00283-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,11,4]],"date-time":"2024-11-04T09:45:33Z","timestamp":1730713533000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s00354-024-00283-0"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,10,12]]},"references-count":297,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2024,12]]}},"alternative-id":["283"],"URL":"https:\/\/doi.org\/10.1007\/s00354-024-00283-0","relation":{},"ISSN":["0288-3635","1882-7055"],"issn-type":[{"value":"0288-3635","type":"print"},{"value":"1882-7055","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,10,12]]},"assertion":[{"value":"1 August 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"1 September 2024","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"12 October 2024","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"There are no material financial or non-financial interests to disclose for the authors. There are no declared competing interests of the authors pertinent to this study's subject matter. Each author attested\u00a0that they are not connected to any group or organization with a financial or non-financial interest in the topics or materials covered in this article. The authors hold no proprietary or financial interests in any of the topics covered in this article.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of Interest"}}]}}