{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,14]],"date-time":"2026-10-14T22:17:44Z","timestamp":1792016264451,"version":"4.4.0"},"reference-count":45,"publisher":"Springer Science and Business Media LLC","issue":"5","license":[{"start":{"date-parts":[[2024,4,15]],"date-time":"2024-04-15T00:00:00Z","timestamp":1713139200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2024,4,15]],"date-time":"2024-04-15T00:00:00Z","timestamp":1713139200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Artif Intell Rev"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Adversarial attacks pose significant challenges to the reliability and performance of neural networks. Despite the development of several defense mechanisms targeting various types of adversarial perturbations, only a few manage to strike a balance between theoretical soundness and practical efficacy. <jats:italic>nmODE<\/jats:italic> (neural memory ordinary differential equation) is a recently proposed model with several intriguing properties. By delving into the rare attribute of global attractors inherent in <jats:italic>nmODE<\/jats:italic>, this paper unveils its stable mapping, thereby conferring certified defense capabilities upon it. Moreover, a novel quantitative approach is proposed, establishing a mathematical link between perturbations and <jats:italic>nmODE<\/jats:italic>\u2019s defense proficiency. Additionally, a training technique termed as <jats:italic>nmODE<\/jats:italic><jats:sup>+<\/jats:sup> is put forward, enhancing the defense capability of <jats:italic>nmODE<\/jats:italic> without imposing additional training burdens. Extensive experiments demonstrate <jats:italic>nmODE<\/jats:italic>\u2019s resilience to various perturbations, showcasing its seamless integration with neural networks and existing defense mechanisms. These findings offer valuable insights into leveraging differential equations for robust neural network security.<\/jats:p>","DOI":"10.1007\/s10462-024-10749-8","type":"journal-article","created":{"date-parts":[[2024,4,15]],"date-time":"2024-04-15T20:22:41Z","timestamp":1713212561000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":9,"title":["A stable mapping of nmODE"],"prefix":"10.1007","volume":"57","author":[{"given":"Haiying","family":"Luo","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tao","family":"He","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhang","family":"Yi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2024,4,15]]},"reference":[{"key":"10749_CR1","doi-asserted-by":"crossref","unstructured":"Andriushchenko M, Croce F, Flammarion N, Hein M (2020) Square attack: a query-efficient black-box adversarial attack via random search. In: European conference on computer vision. Springer, Cham, pp 484\u2013501","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"10749_CR2","unstructured":"Arvinte M, Cornelius C, Martin J, Himayat N (2023) Investigating the adversarial robustness of density estimation using the probability flow ode. arXiv preprint. arXiv:2310.07084"},{"key":"10749_CR3","doi-asserted-by":"crossref","unstructured":"Carlini N, Wagner D (2017) Towards evaluating the robustness of neural networks. In: 2017 IEEE symposium on security and privacy (SP), pp 39\u201357","DOI":"10.1109\/SP.2017.49"},{"key":"10749_CR4","unstructured":"Chang B, Chen M, Haber E, Chi EH (2019) Antisymmetricrnn: a dynamical system view on recurrent neural networks. arXiv preprint. arXiv:1902.09689"},{"key":"10749_CR5","first-page":"6571","volume":"31","author":"RT Chen","year":"2018","unstructured":"Chen RT, Rubanova Y, Bettencourt J, Duvenaud DK (2018) Neural ordinary differential equations. Adv Neural Inf Process Syst 31:6571\u20136583","journal-title":"Adv Neural Inf Process Syst"},{"key":"10749_CR6","first-page":"27146","volume":"34","author":"T Chen","year":"2021","unstructured":"Chen T, Lasserre JB, Magron V, Pauwels E (2021) Semialgebraic representation of monotone deep equilibrium models and applications to certification. Adv Neural Inf Process Syst 34:27146\u201327159","journal-title":"Adv Neural Inf Process Syst"},{"key":"10749_CR7","unstructured":"Chiang P, Ni R, Abdelkader A, Zhu C, Studer C, Goldstein T (2020) Certified defenses for adversarial patches. arXiv preprint. arXiv:2003.06693"},{"key":"10749_CR8","doi-asserted-by":"crossref","unstructured":"Chollet F (2017) Xception: deep learning with depthwise separable convolutions. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 1251\u20131258","DOI":"10.1109\/CVPR.2017.195"},{"key":"10749_CR9","unstructured":"Croce F, Hein M (2020) Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In: International conference on machine learning, pp 2206\u20132216"},{"key":"10749_CR10","first-page":"19099","volume":"35","author":"A Cullen","year":"2022","unstructured":"Cullen A, Montague P, Liu S, Erfani S, Rubinstein B (2022) Double bubble, toil and trouble: enhancing certified robustness through transitivity. Adv Neural Inf Process Syst 35:19099\u201319112","journal-title":"Adv Neural Inf Process Syst"},{"key":"10749_CR11","first-page":"608","volume":"32","author":"E Dupont","year":"2019","unstructured":"Dupont E, Doucet A, Teh YW (2019) Augmented neural ODEs. Adv Neural Inf Process Syst 32:608","journal-title":"Adv Neural Inf Process Syst"},{"key":"10749_CR12","unstructured":"Engstrom L, Tran B, Tsipras D, Schmidt L, Madry A (2017) A rotation and a translation suffice: Fooling CNNs with simple transformations. In: Proceedings of the 2019 international conference on learning representations"},{"key":"10749_CR13","unstructured":"Goodfellow IJ, Shlens J, Szegedy C (2014) Explaining and harnessing adversarial examples. arXiv preprint. arXiv:1412.6572"},{"key":"10749_CR14","unstructured":"Gu S, Rigazio L (2014) Towards deep neural network architectures robust to adversarial examples. arXiv preprint. arXiv:1412.5068"},{"key":"10749_CR15","doi-asserted-by":"crossref","unstructured":"Haber E, Ruthotto L, Holtham E, Jun S-H (2018) Learning across scales\u2014multiscale methods for convolution neural networks. In: Proceedings of the AAAI conference on artificial intelligence, vol 32, pp 2811\u20132818","DOI":"10.1609\/aaai.v32i1.11680"},{"key":"10749_CR16","doi-asserted-by":"crossref","unstructured":"He K, Zhang X, Ren S, Sun J Deep residual learning for image recognition. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 770\u2013778 (2016)","DOI":"10.1109\/CVPR.2016.90"},{"key":"10749_CR17","unstructured":"Huang Y, Rodriguez IDJ, Zhang H, Shi Y, Yue Y (2022) FI-ODE: certified and robust forward invariance in neural ODEs. arXiv preprint. arXiv:2210.16940"},{"key":"10749_CR18","first-page":"14925","volume":"34","author":"Q Kang","year":"2021","unstructured":"Kang Q, Song Y, Ding Q, Tay WP (2021) Stable neural ode with Lyapunov-stable equilibrium points for defending against adversarial attacks. Adv Neural Inf Process Syst 34:14925\u201314937","journal-title":"Adv Neural Inf Process Syst"},{"key":"10749_CR19","unstructured":"Kidger P (2022) On neural differential equations. arXiv preprint. arXiv:2202.02435"},{"key":"10749_CR20","unstructured":"Krizhevsky A (2009) Learning multiple layers of features from tiny images. https:\/\/api.semanticscholar.org\/CorpusID:18268744"},{"key":"10749_CR21","unstructured":"LeCun Y (1998) The MNIST database of handwritten digits. http:\/\/yann.lecun.com\/exdb\/mnist\/"},{"key":"10749_CR22","doi-asserted-by":"crossref","unstructured":"Lecuyer M, Atlidakis V, Geambasu R, Hsu D, Jana S (2019) Certified robustness to adversarial examples with differential privacy. In: 2019 IEEE symposium on security and privacy (SP), pp 656\u2013672","DOI":"10.1109\/SP.2019.00044"},{"key":"10749_CR23","unstructured":"Levine A, Feizi S (2020) Wasserstein smoothing: Certified robustness against Wasserstein adversarial attacks. In: International conference on artificial intelligence and statistics, pp 3938\u20133947. PMLR"},{"key":"10749_CR24","first-page":"6372","volume":"35","author":"X Li","year":"2022","unstructured":"Li X, Xin Z, Liu W (2022) Defending against adversarial attacks via neural dynamic system. Adv Neural Inf Process Syst 35:6372\u20136383","journal-title":"Adv Neural Inf Process Syst"},{"key":"10749_CR25","doi-asserted-by":"crossref","unstructured":"Liu X, Xiao T, Si S, Cao Q, Kumar S, Hsieh C-J (2020) How does noise help robustness? explanation and exploration under the neural SDE framework. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 282\u2013290","DOI":"10.1109\/CVPR42600.2020.00036"},{"key":"10749_CR26","unstructured":"Madry A, Makelov A, Schmidt L, Tsipras D, Vladu A (2017) Towards deep learning models resistant to adversarial attacks. arXiv preprint. arXiv:1706.06083"},{"key":"10749_CR27","first-page":"5911","volume":"33","author":"A Norcliffe","year":"2020","unstructured":"Norcliffe A, Bodnar C, Day B, Simidjievski N, Li\u00f2 P (2020) On second order behaviour in augmented neural odes. Adv Neural Inf Process Syst 33:5911\u20135921","journal-title":"Adv Neural Inf Process Syst"},{"key":"10749_CR28","unstructured":"Pabbaraju C, Winston E, Kolter JZ (2020) Estimating Lipschitz constants of monotone deep equilibrium models. In: International conference on learning representations"},{"key":"10749_CR29","unstructured":"Pang T, Yang X, Dong Y, Su H, Zhu J (2020) Bag of tricks for adversarial training. arXiv preprint. arXiv:2010.00467"},{"key":"10749_CR30","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Wu X, Jha S, Swami A (2016) Distillation as a defense to adversarial perturbations against deep neural networks. In: 2016 IEEE symposium on security and privacy (SP), pp 582\u2013597","DOI":"10.1109\/SP.2016.41"},{"key":"10749_CR31","unstructured":"Raghunathan A, Steinhardt J, Liang P (2018) Certified defenses against adversarial examples. arXiv preprint. arXiv:1801.09344"},{"key":"10749_CR32","unstructured":"Rodriguez IDJ, Ames A, Yue Y (2022) Lyanet: a Lyapunov framework for training neural ODEs. In: International conference on machine learning, pp 18687\u201318703. PMLR"},{"key":"10749_CR33","unstructured":"Szegedy C, Zaremba W, Sutskever I, Bruna J, Erhan D, Goodfellow I, Fergus R (2013) Intriguing properties of neural networks. arXiv preprint. arXiv:1312.6199"},{"key":"10749_CR34","unstructured":"Tan M, Le Q (2019) Efficientnet: Rethinking model scaling for convolutional neural networks. In: International conference on machine learning, pp 6105\u20136114"},{"issue":"5","key":"10749_CR35","first-page":"1","volume":"1","author":"E Weinan","year":"2017","unstructured":"Weinan E (2017) A proposal on machine learning via dynamical systems. Commun Math Stat 1(5):1\u201311","journal-title":"Commun Math Stat"},{"key":"10749_CR36","unstructured":"Weng L, Zhang H, Chen H, Song Z, Hsieh C-J, Daniel L, Boning D, Dhillon I (2018) Towards fast computation of certified robustness for ReLu networks. In: International conference on machine learning, pp 5276\u20135285"},{"key":"10749_CR37","unstructured":"Wong E, Kolter Z (2018) Provable defenses against adversarial examples via the convex outer adversarial polytope. In: International conference on machine learning, pp 5286\u20135295"},{"key":"10749_CR38","unstructured":"Xiao H, Rasul K, Vollgraf R (2017) Fashion-MNIST: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint. arXiv:1708.07747"},{"key":"10749_CR39","unstructured":"Yan H, Du J, Tan VY, Feng J (2019) On robustness of neural ordinary differential equations. arXiv preprint. arXiv:1910.05513"},{"key":"10749_CR40","doi-asserted-by":"publisher","first-page":"1634","DOI":"10.1109\/LCSYS.2023.3265397","volume":"7","author":"R Yang","year":"2023","unstructured":"Yang R, Jia R, Zhang X, Jin M (2023) Certifiably robust neural ode with learning-based barrier function. IEEE Control Syst Lett 7:1634\u20131639","journal-title":"IEEE Control Syst Lett"},{"key":"10749_CR41","doi-asserted-by":"publisher","first-page":"14403","DOI":"10.1007\/s10462-023-10496-2","volume":"56","author":"Z Yi","year":"2023","unstructured":"Yi Z (2023) nmODE: neural memory ordinary differential equation. Artif Intell Rev 56:14403\u201314438","journal-title":"Artif Intell Rev"},{"key":"10749_CR42","unstructured":"Zhai R, Dan C, He D, Zhang H, Gong B, Ravikumar P, Hsieh C-J, Wang L (2020) Macer: attack-free and scalable robust training via maximizing certified radius. arXiv preprint. arXiv:2001.02378"},{"key":"10749_CR43","unstructured":"Zhang H, Yu Y, Jiao J, Xing E, El\u00a0Ghaoui L, Jordan M (2019) Theoretically principled trade-off between robustness and accuracy. In: International conference on machine learning, pp 7472\u20137482. PMLR"},{"key":"10749_CR44","doi-asserted-by":"crossref","unstructured":"Zheng S, Song Y, Leung T, Goodfellow I (2016) Improving the robustness of deep neural networks via stability training. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 4480\u20134488","DOI":"10.1109\/CVPR.2016.485"},{"key":"10749_CR45","unstructured":"Zizzo G, Rawat A, Sinn M, Maffeis S, Hankin C (2021) Certified federated adversarial training. arXiv preprint. arXiv:2112.10525"}],"container-title":["Artificial Intelligence Review"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10462-024-10749-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10462-024-10749-8\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10462-024-10749-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,5,17]],"date-time":"2024-05-17T06:12:37Z","timestamp":1715926357000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10462-024-10749-8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,4,15]]},"references-count":45,"journal-issue":{"issue":"5","published-online":{"date-parts":[[2024,5]]}},"alternative-id":["10749"],"URL":"https:\/\/doi.org\/10.1007\/s10462-024-10749-8","relation":{},"ISSN":["1573-7462"],"issn-type":[{"value":"1573-7462","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,4,15]]},"assertion":[{"value":"14 March 2024","order":1,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"15 April 2024","order":2,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"All authors disclosed no potential Conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}],"article-number":"120"}}