{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,28]],"date-time":"2026-08-28T10:54:33Z","timestamp":1787914473148,"version":"build-2784847793"},"reference-count":106,"publisher":"Springer Science and Business Media LLC","issue":"7","license":[{"start":{"date-parts":[[2024,6,15]],"date-time":"2024-06-15T00:00:00Z","timestamp":1718409600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2024,6,15]],"date-time":"2024-06-15T00:00:00Z","timestamp":1718409600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Artif Intell Rev"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>In the rapidly evolving field of Deep Learning (DL), the trustworthiness of models is essential for their effective application in critical domains like healthcare and autonomous systems. Trustworthiness in DL encompasses aspects such as reliability, fairness, and transparency, which are crucial for its real-world impact and acceptance. However, the development of trustworthy DL models faces significant challenges. This is notably due to adversarial examples, a sophisticated form of evasion attack in adversarial machine learning (AML), which subtly alter inputs to deceive these models and pose a major threat to their safety and reliability. The current body of research primarily focuses on defensive measures, such as enhancing the robustness of models or implementing explainable AI techniques. However, this approach often neglects to address the fundamental vulnerabilities that adversaries exploit. As a result, the field tends to concentrate more on counteracting measures rather than gaining an in-depth understanding of the vulnerabilities and attack strategies inherent in DL systems. This gap in comprehensive understanding impedes the formulation of effective defense mechanisms. This research aims to shift the focus from predominantly defensive strategies toward a more extensive comprehension of adversarial techniques and the innate vulnerabilities of DL models. We undertake this by conducting a thorough systematic literature review, encompassing 49 diverse studies from the previous decade. Our findings reveal the key characteristics of adversarial examples that enable their success against image classification-based DL models. Building on these insights, we propose the Transferable Pretrained Adversarial Deep Learning framework (TPre-ADL). This conceptual model aims to rectify the deficiencies in current defense strategies by incorporating the analyzed traits of adversarial examples, potentially enhancing the robustness and trustworthiness of DL models.<\/jats:p>","DOI":"10.1007\/s10462-024-10777-4","type":"journal-article","created":{"date-parts":[[2024,6,15]],"date-time":"2024-06-15T05:01:42Z","timestamp":1718427702000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":10,"title":["Enhancing trustworthy deep learning for image classification against evasion attacks: a systematic literature review"],"prefix":"10.1007","volume":"57","author":[{"given":"Dua\u2019a Mkhiemir","family":"Akhtom","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Manmeet Mahinderjit","family":"Singh","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chew","family":"XinYing","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2024,6,15]]},"reference":[{"issue":"2","key":"10777_CR1","doi-asserted-by":"publisher","first-page":"56","DOI":"10.3390\/healthcare7020056","volume":"7","author":"C Agbo","year":"2019","unstructured":"Agbo C, Mahmoud Q, Eklund J (2019) Blockchain technology in healthcare: a systematic review. Healthcare 7(2):56. https:\/\/doi.org\/10.3390\/healthcare7020056","journal-title":"Healthcare"},{"key":"10777_CR2","doi-asserted-by":"publisher","first-page":"14410","DOI":"10.1109\/access.2018.2807385","volume":"6","author":"N Akhtar","year":"2018","unstructured":"Akhtar N, Mian A (2018) Threat of adversarial attacks on deep learning in computer vision: a survey. IEEE Access 6:14410\u201314430. https:\/\/doi.org\/10.1109\/access.2018.2807385","journal-title":"IEEE Access"},{"key":"10777_CR3","doi-asserted-by":"publisher","unstructured":"Alzantot M, Sharma Y, Chakraborty S et\u00a0al (2019) GenAttack. In: Proceedings of the genetic and evolutionary computation conference. ACM. https:\/\/doi.org\/10.1145\/3321707.3321749","DOI":"10.1145\/3321707.3321749"},{"key":"10777_CR4","doi-asserted-by":"publisher","first-page":"185","DOI":"10.1016\/j.neunet.2020.07.010","volume":"130","author":"P Angelov","year":"2020","unstructured":"Angelov P, Soares E (2020) Towards explainable deep neural networks (XDNN). Neural Netw 130:185\u2013194","journal-title":"Neural Netw"},{"issue":"4","key":"10777_CR5","doi-asserted-by":"publisher","first-page":"1059","DOI":"10.1111\/rssb.12377","volume":"82","author":"DW Apley","year":"2020","unstructured":"Apley DW, Zhu J (2020) Visualizing the effects of predictor variables in black box supervised learning models. J R Stat Soc Ser B Stat Methodol 82(4):1059\u20131086","journal-title":"J R Stat Soc Ser B Stat Methodol"},{"issue":"6","key":"10777_CR6","doi-asserted-by":"publisher","first-page":"e15154","DOI":"10.2196\/15154","volume":"22","author":"O Asan","year":"2020","unstructured":"Asan O, Bayrak AE, Choudhury A et al (2020) Artificial intelligence and human trust in healthcare: focus on clinicians. J Med Internet Res 22(6):e15154","journal-title":"J Med Internet Res"},{"key":"10777_CR7","doi-asserted-by":"publisher","first-page":"109037","DOI":"10.1016\/j.patcog.2022.109037","volume":"133","author":"Y Bai","year":"2023","unstructured":"Bai Y, Wang Y, Zeng Y et al (2023) Query efficient black-box adversarial attack on deep neural networks. Pattern Recogn 133:109037","journal-title":"Pattern Recogn"},{"key":"10777_CR8","doi-asserted-by":"publisher","unstructured":"Bhagoji AN, He W, Li B et\u00a0al (2018) Practical black-box attacks on deep neural networks using efficient query mechanisms. In: Computer Vision\u2014ECCV 2018. Springer International Publishing, pp 158\u2013174. https:\/\/doi.org\/10.1007\/978-3-030-01258-8_10","DOI":"10.1007\/978-3-030-01258-8_10"},{"key":"10777_CR9","unstructured":"Burnel JC, Fatras K, Courty N (2020) Generating natural adversarial hyperspectral examples with a modified Wasserstein GAN. arXiv preprint http:\/\/arxiv.org\/abs\/2001.09993 [cs.LG]"},{"key":"10777_CR10","doi-asserted-by":"crossref","unstructured":"Carlini N, Wagner D (2017) Towards evaluating the robustness of neural networks. In: 2017 IEEE symposium on security and privacy (SP). IEEE, pp 39\u201357","DOI":"10.1109\/SP.2017.49"},{"key":"10777_CR11","doi-asserted-by":"publisher","first-page":"100164","DOI":"10.1016\/j.crbiot.2023.100164","volume":"7","author":"C Chakraborty","year":"2023","unstructured":"Chakraborty C, Bhattacharya M, Pal S et al (2023) From machine learning to deep learning: an advances of the recent data-driven paradigm shift in medicine and healthcare. Curr Res Biotechnol 7:100164","journal-title":"Curr Res Biotechnol"},{"key":"10777_CR12","doi-asserted-by":"publisher","unstructured":"Chen PY, Zhang H, Sharma Y et\u00a0al (2017) ZOO: zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In: Proceedings of the 10th ACM workshop on artificial intelligence and security. ACM. https:\/\/doi.org\/10.1145\/3128572.3140448","DOI":"10.1145\/3128572.3140448"},{"key":"10777_CR13","doi-asserted-by":"publisher","first-page":"89","DOI":"10.1016\/j.cose.2019.04.014","volume":"85","author":"J Chen","year":"2019","unstructured":"Chen J, Su M, Shen S et al (2019) POBA-GA: perturbation optimized black-box adversarial attacks via genetic algorithm. Comput Secur 85:89\u2013106. https:\/\/doi.org\/10.1016\/j.cose.2019.04.014","journal-title":"Comput Secur"},{"key":"10777_CR14","doi-asserted-by":"publisher","unstructured":"Chen J, Jordan MI, Wainwright MJ (2020) HopSkipJumpAttack: a query-efficient decision-based attack. In: 2020 IEEE symposium on security and privacy (SP). IEEE. https:\/\/doi.org\/10.1109\/sp40000.2020.00045","DOI":"10.1109\/sp40000.2020.00045"},{"key":"10777_CR15","doi-asserted-by":"publisher","first-page":"109156","DOI":"10.1109\/ACCESS.2020.3001730","volume":"8","author":"Y Chu","year":"2020","unstructured":"Chu Y, Yue X, Wang Q et al (2020) SecureAS: a vulnerability assessment system for deep neural network based on adversarial examples. IEEE Access 8:109156\u2013109167","journal-title":"IEEE Access"},{"key":"10777_CR16","doi-asserted-by":"publisher","unstructured":"Coates A, Carpenter B, Case C et\u00a0al (2011) Text detection and character recognition in scene images with unsupervised feature learning. IEEE, pp 215\u2013223. https:\/\/doi.org\/10.1109\/icdar.2011.95","DOI":"10.1109\/icdar.2011.95"},{"issue":"3","key":"10777_CR17","doi-asserted-by":"publisher","first-page":"889","DOI":"10.32604\/iasc.2021.019727","volume":"30","author":"B Deng","year":"2021","unstructured":"Deng B, Ran Z, Chen J et al (2021) Adversarial examples generation algorithm through DCGAN. Intell Autom Soft Comput 30(3):889\u2013898","journal-title":"Intell Autom Soft Comput"},{"key":"10777_CR18","doi-asserted-by":"crossref","unstructured":"Dong Y, Liao F, Pang T et\u00a0al (2018) Boosting adversarial attacks with momentum. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp 9185\u20139193","DOI":"10.1109\/CVPR.2018.00957"},{"key":"10777_CR19","doi-asserted-by":"publisher","unstructured":"Eiben AE, Smith JE (2015) What is an evolutionary algorithm? In: Natural computing series. Springer, Berlin, Heidelberg, pp 25\u201348. https:\/\/doi.org\/10.1007\/978-3-662-44874-8_3","DOI":"10.1007\/978-3-662-44874-8_3"},{"issue":"8","key":"10777_CR20","doi-asserted-by":"publisher","first-page":"1037","DOI":"10.1167\/9.8.1037","volume":"9","author":"L Fei-Fei","year":"2010","unstructured":"Fei-Fei L, Deng J, Li K (2010) ImageNet: constructing a large-scale image database. J Vis 9(8):1037\u20131037. https:\/\/doi.org\/10.1167\/9.8.1037","journal-title":"J Vis"},{"key":"10777_CR21","first-page":"10","volume":"1050","author":"IJ Goodfellow","year":"2014","unstructured":"Goodfellow IJ, Pouget-Abadie J, Mirza M et al (2014a) Generative adversarial nets. Stat 1050:10","journal-title":"Stat"},{"key":"10777_CR22","unstructured":"Goodfellow IJ, Shlens J, Szegedy C (2014b) Explaining and harnessing adversarial examples. arXiv preprint http:\/\/arxiv.org\/abs\/1412.6572"},{"issue":"11","key":"10777_CR23","doi-asserted-by":"publisher","first-page":"139","DOI":"10.1145\/3422622","volume":"63","author":"I Goodfellow","year":"2020","unstructured":"Goodfellow I, Pouget-Abadie J, Mirza M et al (2020) Generative adversarial networks. Commun ACM 63(11):139\u2013144. https:\/\/doi.org\/10.1145\/3422622","journal-title":"Commun ACM"},{"key":"10777_CR24","doi-asserted-by":"publisher","first-page":"142","DOI":"10.1016\/j.patrec.2021.03.033","volume":"147","author":"D Gragnaniello","year":"2021","unstructured":"Gragnaniello D, Marra F, Verdoliva L et al (2021) Perceptual quality-preserving black-box attack against deep learning image classifiers. Pattern Recogn Lett 147:142\u2013149","journal-title":"Pattern Recogn Lett"},{"key":"10777_CR25","doi-asserted-by":"publisher","DOI":"10.1016\/j.clindermatol.2023.12.013","author":"A Grzybowski","year":"2024","unstructured":"Grzybowski A, Jin K, Wu H (2024) Challenges of artificial intelligence in medicine and dermatology. Clin Dermatol. https:\/\/doi.org\/10.1016\/j.clindermatol.2023.12.013","journal-title":"Clin Dermatol"},{"key":"10777_CR26","doi-asserted-by":"publisher","first-page":"263","DOI":"10.1016\/j.inffus.2021.10.007","volume":"79","author":"A Holzinger","year":"2022","unstructured":"Holzinger A, Dehmer M, Emmert-Streib F et al (2022) Information fusion as an integrative cross-cutting enabler to achieve robust, explainable, and trustworthy medical artificial intelligence. Inf Fusion 79:263\u2013278","journal-title":"Inf Fusion"},{"key":"10777_CR27","doi-asserted-by":"publisher","first-page":"13","DOI":"10.1016\/j.neunet.2022.09.009","volume":"156","author":"L Huang","year":"2022","unstructured":"Huang L, Gao C, Liu N (2022) Defeat: decoupled feature attack across deep neural networks. Neural Netw 156:13\u201328","journal-title":"Neural Netw"},{"issue":"2","key":"10777_CR28","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3491209","volume":"55","author":"D Kaur","year":"2022","unstructured":"Kaur D, Uslu S, Rittichier KJ et al (2022) Trustworthy artificial intelligence: a review. ACM Comput Surv (CSUR) 55(2):1\u201338","journal-title":"ACM Comput Surv (CSUR)"},{"key":"10777_CR29","doi-asserted-by":"publisher","first-page":"633","DOI":"10.1007\/s11154-023-09795-4","volume":"24","author":"R Kaur","year":"2023","unstructured":"Kaur R, Kumar R, Gupta M (2023) Deep neural network for food image classification and nutrient identification: a systematic review. Rev Endocr Metab Disord 24:633\u2013653","journal-title":"Rev Endocr Metab Disord"},{"key":"10777_CR30","doi-asserted-by":"publisher","unstructured":"Kemelmacher-Shlizerman I, Seitz S, Miller D et\u00a0al (2016) The MegaFace Benchmark: 1 million faces for recognition at scale. IEEE, pp 4873\u20134882. https:\/\/doi.org\/10.1109\/cvpr.2016.527","DOI":"10.1109\/cvpr.2016.527"},{"key":"10777_CR31","doi-asserted-by":"publisher","unstructured":"Khoshpasand M, Ghorbani A (2020) On the generation of unrestricted adversarial examples. In: 2020 50th annual IEEE\/IFIP international conference on dependable systems and networks workshops (DSN-W). IEEE. https:\/\/doi.org\/10.1109\/dsn-w50199.2020.00012","DOI":"10.1109\/dsn-w50199.2020.00012"},{"key":"10777_CR32","doi-asserted-by":"publisher","first-page":"266","DOI":"10.1016\/j.neunet.2023.08.024","volume":"167","author":"H Kim","year":"2023","unstructured":"Kim H, Lee W, Lee S et al (2023) Bridged adversarial training. Neural Netw 167:266\u2013282","journal-title":"Neural Netw"},{"issue":"8","key":"10777_CR33","doi-asserted-by":"publisher","first-page":"792","DOI":"10.1016\/j.infsof.2010.03.006","volume":"52","author":"B Kitchenham","year":"2007","unstructured":"Kitchenham B, Pretorius R, Budgen D et al (2007) Systematic literature reviews in software engineering\u2014a tertiary study. Inf Softw Technol 52(8):792\u2013805. https:\/\/doi.org\/10.1016\/j.infsof.2010.03.006","journal-title":"Inf Softw Technol"},{"key":"10777_CR34","unstructured":"Koh PW, Liang P (2017) Understanding black-box predictions via influence functions. In: Precup D, Teh YW (eds) Proceedings of the 34th international conference on machine learning, proceedings of machine learning research, vol\u00a070. PMLR, pp 1885\u20131894. https:\/\/proceedings.mlr.press\/v70\/koh17a.html"},{"key":"10777_CR35","unstructured":"Krizhevsky A (2009) Learning multiple layers of features from tiny images. Master\u2019s Thesis, University of Tront"},{"key":"10777_CR36","doi-asserted-by":"crossref","unstructured":"Kulkarni Y, Bhambani K (2021) Kryptonite: an adversarial attack using regional focus. In: Applied cryptography and network security workshops: ACNS 2021 Satellite Workshops, AIBlock, AIHWS, AIoTS, CIMSS, Cloud S &P, SCI, SecMT, and SiMLA, Kamakura, Japan, June 21\u201324, 2021, proceedings. Springer, pp 463\u2013481","DOI":"10.1007\/978-3-030-81645-2_26"},{"key":"10777_CR37","unstructured":"Kurakin A, Goodfellow I, Bengio S (2016) Adversarial machine learning at scale. arXiv preprint http:\/\/arxiv.org\/abs\/1611.01236"},{"key":"10777_CR38","doi-asserted-by":"crossref","unstructured":"Kurakin A, Goodfellow IJ, Bengio S (2018) Adversarial examples in the physical world. In: Artificial intelligence safety and security. Chapman and Hall\/CRC, Boca Raton, pp 99\u2013112","DOI":"10.1201\/9781351251389-8"},{"issue":"12","key":"10777_CR39","doi-asserted-by":"publisher","first-page":"738","DOI":"10.3390\/sym10120738","volume":"10","author":"H Kwon","year":"2018","unstructured":"Kwon H, Kim Y, Yoon H et al (2018) Random untargeted adversarial example on deep neural network. Symmetry 10(12):738","journal-title":"Symmetry"},{"key":"10777_CR40","unstructured":"LeCun Y (1998) The MNIST database of handwritten digits. https:\/\/yann.lecun.com\/exdb\/mnist\/"},{"key":"10777_CR41","unstructured":"Levin S, Wong JC (2018) Self-driving uber kills Arizona woman in first fatal crash involving pedestrian. The Guardian, 19"},{"key":"10777_CR42","unstructured":"Li G, Zhu P, Li J et\u00a0al (2018) Security matters: a survey on adversarial machine learning. arXiv preprint http:\/\/arxiv.org\/abs\/1810.07339 [cs.LG]"},{"issue":"3","key":"10777_CR43","first-page":"1087","volume":"60","author":"X Li","year":"2019","unstructured":"Li X, Zhu Q, Meng Q et al (2019) Researching the link between the geometric and R\u00e8nyi discord for special canonical initial states based on neural network method. Comput Mater Contin 60(3):1087\u20131095","journal-title":"Comput Mater Contin"},{"key":"10777_CR44","doi-asserted-by":"crossref","unstructured":"Li M, Deng C, Li T et\u00a0al (2020) Towards transferable targeted attack. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition. pp 641\u2013649","DOI":"10.1109\/CVPR42600.2020.00072"},{"issue":"9","key":"10777_CR45","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3555803","volume":"55","author":"B Li","year":"2023","unstructured":"Li B, Qi P, Liu B et al (2023) Trustworthy AI: from principles to practices. ACM Comput Surv 55(9):1\u201346","journal-title":"ACM Comput Surv"},{"key":"10777_CR46","doi-asserted-by":"publisher","first-page":"110767","DOI":"10.1016\/j.jss.2020.110767","volume":"170","author":"J Lin","year":"2020","unstructured":"Lin J, Xu L, Liu Y et al (2020) Black-box adversarial sample generation based on differential evolution. J Syst Softw 170:110767. https:\/\/doi.org\/10.1016\/j.jss.2020.110767","journal-title":"J Syst Softw"},{"key":"10777_CR47","doi-asserted-by":"publisher","first-page":"12103","DOI":"10.1109\/access.2018.2805680","volume":"6","author":"Q Liu","year":"2018","unstructured":"Liu Q, Li P, Zhao W et al (2018) A survey on security threats and defensive techniques of machine learning: a data driven view. IEEE Access 6:12103\u201312117. https:\/\/doi.org\/10.1109\/access.2018.2805680","journal-title":"IEEE Access"},{"key":"10777_CR48","doi-asserted-by":"publisher","first-page":"109902","DOI":"10.1016\/j.patcog.2023.109902","volume":"145","author":"D Liu","year":"2024","unstructured":"Liu D, Wu LY, Li B et al (2024) Jacobian norm with selective input gradient regularization for interpretable adversarial defense. Pattern Recogn 145:109902","journal-title":"Pattern Recogn"},{"key":"10777_CR49","doi-asserted-by":"publisher","first-page":"58822","DOI":"10.1109\/access.2019.2914675","volume":"7","author":"S Lo","year":"2019","unstructured":"Lo S, Liu Y, Chia S et al (2019) Analysis of blockchain solutions for IoT: a systematic literature review. IEEE Access 7:58822\u201358835. https:\/\/doi.org\/10.1109\/access.2019.2914675","journal-title":"IEEE Access"},{"key":"10777_CR50","unstructured":"Lundberg SM, Lee SI (2017) A unified approach to interpreting model predictions. In: Advances in neural information processing systems, 30"},{"issue":"1","key":"10777_CR51","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3485133","volume":"55","author":"GR Machado","year":"2021","unstructured":"Machado GR, Silva E, Goldschmidt RR (2021) Adversarial machine learning in image classification: a survey toward the defender\u2019s perspective. ACM Comput Surv 55(1):1\u201338. https:\/\/doi.org\/10.1145\/3485133","journal-title":"ACM Comput Surv"},{"key":"10777_CR52","unstructured":"Madry A, Makelov A, Schmidt L et\u00a0al (2017) Towards deep learning models resistant to adversarial attacks. arXiv preprint http:\/\/arxiv.org\/abs\/1706.06083"},{"issue":"3","key":"10777_CR53","doi-asserted-by":"publisher","first-page":"402","DOI":"10.1109\/jproc.2020.2970615","volume":"108","author":"DJ Miller","year":"2020","unstructured":"Miller DJ, Xiang Z, Kesidis G (2020) Adversarial learning targeting deep neural network classification: a comprehensive review of defenses against attacks. Proc IEEE 108(3):402\u2013433. https:\/\/doi.org\/10.1109\/jproc.2020.2970615","journal-title":"Proc IEEE"},{"key":"10777_CR54","doi-asserted-by":"publisher","unstructured":"Moosavi-Dezfooli SM, Fawzi A, Frossard P (2016) DeepFool: a simple and accurate method to fool deep neural networks. In: 2016 IEEE conference on computer vision and pattern recognition (CVPR). IEEE. https:\/\/doi.org\/10.1109\/cvpr.2016.282","DOI":"10.1109\/cvpr.2016.282"},{"key":"10777_CR55","doi-asserted-by":"crossref","unstructured":"Mothilal RK, Sharma A, Tan C (2020) Explaining machine learning classifiers through diverse counterfactual explanations. In: Proceedings of the 2020 conference on fairness, accountability, and transparency. pp 607\u2013617","DOI":"10.1145\/3351095.3372850"},{"issue":"7","key":"10777_CR56","doi-asserted-by":"publisher","first-page":"9677","DOI":"10.1007\/s12652-022-03868-z","volume":"14","author":"N Musa","year":"2023","unstructured":"Musa N, Gital AY, Aljojo N et al (2023) A systematic review and meta-data analysis on the applications of deep learning in electrocardiogram. J Ambient Intell Humaniz Comput 14(7):9677\u20139750","journal-title":"J Ambient Intell Humaniz Comput"},{"key":"10777_CR57","doi-asserted-by":"publisher","first-page":"107320","DOI":"10.1016\/j.patcog.2020.107320","volume":"103","author":"U Mutlu","year":"2020","unstructured":"Mutlu U, Alpayd\u0131n E (2020) Training bidirectional generative adversarial networks with hints. Pattern Recogn 103:107320. https:\/\/doi.org\/10.1016\/j.patcog.2020.107320","journal-title":"Pattern Recogn"},{"key":"10777_CR58","doi-asserted-by":"publisher","unstructured":"Narodytska N, Kasiviswanathan S (2017) Simple black-box adversarial attacks on deep neural networks. In: 2017 IEEE conference on computer vision and pattern recognition workshops (CVPRW). IEEE. https:\/\/doi.org\/10.1109\/cvprw.2017.172","DOI":"10.1109\/cvprw.2017.172"},{"key":"10777_CR59","unstructured":"Netzer Y, Wang T, Coates A, et al (2011) Reading digits in natural images with unsupervised feature learning. In: NIPS workshop on deep learning and unsupervised feature learning, vol 2011. p 7"},{"key":"10777_CR60","doi-asserted-by":"publisher","unstructured":"Papernot N, McDaniel P, Jha S et al (2016a) The limitations of deep learning in adversarial settings. In: IEEE European symposium on security and privacy (EuroS &P). IEEE. https:\/\/doi.org\/10.1109\/eurosp.2016.36","DOI":"10.1109\/eurosp.2016.36"},{"key":"10777_CR61","doi-asserted-by":"publisher","unstructured":"Papernot N, Mcdaniel P, Wu X et\u00a0al (2016b) Distillation as a defense to adversarial perturbations against deep neural networks. IEEE, San Jose, CA, pp 582\u2013597. https:\/\/doi.org\/10.1109\/sp.2016.41","DOI":"10.1109\/sp.2016.41"},{"key":"10777_CR62","doi-asserted-by":"publisher","unstructured":"Papernot N, McDaniel P, Goodfellow I et\u00a0al (2017) Practical black-box attacks against machine learning. In: Proceedings of the 2017 ACM on Asia conference on computer and communications security. ACM. https:\/\/doi.org\/10.1145\/3052973.3053009","DOI":"10.1145\/3052973.3053009"},{"key":"10777_CR63","doi-asserted-by":"publisher","first-page":"100199","DOI":"10.1016\/j.cosrev.2019.100199","volume":"34","author":"N Pitropakis","year":"2019","unstructured":"Pitropakis N, Panaousis E, Giannetsos T et al (2019) A taxonomy and survey of attacks against machine learning. Comput Sci Rev 34:100199. https:\/\/doi.org\/10.1016\/j.cosrev.2019.100199","journal-title":"Comput Sci Rev"},{"key":"10777_CR64","doi-asserted-by":"publisher","first-page":"203","DOI":"10.1023\/A:1007601015854","volume":"42","author":"F Provost","year":"2001","unstructured":"Provost F, Fawcett T (2001) Robust classification for imprecise environments. Mach Learn 42:203\u2013231","journal-title":"Mach Learn"},{"key":"10777_CR65","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/j.neucom.2020.01.040","volume":"394","author":"X Qiu","year":"2020","unstructured":"Qiu X, Zhou S (2020) Generating adversarial examples with input significance indicator. Neurocomputing 394:1\u201312","journal-title":"Neurocomputing"},{"issue":"5","key":"10777_CR66","doi-asserted-by":"publisher","first-page":"909","DOI":"10.3390\/app9050909","volume":"9","author":"S Qiu","year":"2019","unstructured":"Qiu S, Liu Q, Zhou S et al (2019) Review of artificial intelligence adversarial attack and defense technologies. Appl Sci 9(5):909. https:\/\/doi.org\/10.3390\/app9050909","journal-title":"Appl Sci"},{"key":"10777_CR67","doi-asserted-by":"publisher","DOI":"10.1007\/s11042-023-17776-7","author":"K Raghavan","year":"2023","unstructured":"Raghavan K et al (2023) Attention guided grad-CAM: an improved explainable artificial intelligence model for infrared breast cancer detection. Multimed Tools Appl. https:\/\/doi.org\/10.1007\/s11042-023-17776-7","journal-title":"Multimed Tools Appl"},{"issue":"17","key":"10777_CR68","doi-asserted-by":"publisher","first-page":"26731","DOI":"10.1007\/s11042-022-14305-w","volume":"82","author":"M Rana","year":"2023","unstructured":"Rana M, Bhushan M (2023) Machine learning and deep learning approach for medical image analysis: diagnosis to detection. Multimed Tools Appl 82(17):26731\u201326769","journal-title":"Multimed Tools Appl"},{"key":"10777_CR69","doi-asserted-by":"publisher","unstructured":"Ribeiro MT, Singh S, Guestrin C (2016) \u201cWhy should I trust you?\u201d. In: Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining. ACM. https:\/\/doi.org\/10.1145\/2939672.2939778","DOI":"10.1145\/2939672.2939778"},{"key":"10777_CR70","doi-asserted-by":"crossref","unstructured":"Ribeiro MT, Singh S, Guestrin C (2018) Anchors: high-precision model-agnostic explanations. In: Proceedings of the AAAI conference on artificial intelligence","DOI":"10.1609\/aaai.v32i1.11491"},{"key":"10777_CR71","doi-asserted-by":"publisher","unstructured":"Rozsa A, Rudd E, Boult T (2016) Adversarial diversity and hard positive generation. IEEE, pp 25\u201332. https:\/\/doi.org\/10.1109\/cvprw.2016.58","DOI":"10.1109\/cvprw.2016.58"},{"issue":"5","key":"10777_CR72","doi-asserted-by":"publisher","first-page":"2749","DOI":"10.1007\/s11948-020-00228-y","volume":"26","author":"M Ryan","year":"2020","unstructured":"Ryan M (2020) In ai we trust: ethics, artificial intelligence, and reliability. Sci Eng Ethics 26(5):2749\u20132767","journal-title":"Sci Eng Ethics"},{"key":"10777_CR73","doi-asserted-by":"publisher","first-page":"101940","DOI":"10.1016\/j.sysarc.2020.101940","volume":"114","author":"A Shafee","year":"2021","unstructured":"Shafee A, Awaad TA (2021) Privacy attacks against deep learning models and their countermeasures. J Syst Archit 114:101940. https:\/\/doi.org\/10.1016\/j.sysarc.2020.101940","journal-title":"J Syst Archit"},{"issue":"2","key":"10777_CR74","doi-asserted-by":"publisher","first-page":"430","DOI":"10.1109\/TIP.2005.859378","volume":"15","author":"HR Sheikh","year":"2006","unstructured":"Sheikh HR, Bovik AC (2006) Image information and visual quality. IEEE Trans Image Process 15(2):430\u2013444","journal-title":"IEEE Trans Image Process"},{"key":"10777_CR75","doi-asserted-by":"publisher","first-page":"107309","DOI":"10.1016\/j.patcog.2020.107309","volume":"105","author":"Y Shi","year":"2020","unstructured":"Shi Y, Han Y, Zhang Q et al (2020) Adaptive iterative attack towards explainable adversarial robustness. Pattern Recogn 105:107309","journal-title":"Pattern Recogn"},{"key":"10777_CR76","unstructured":"Song Y, Shu R, Kushman N et\u00a0al (2018) Constructing unrestricted adversarial examples with generative models. In: Proceedings of the 32nd international conference on neural information processing systems. pp 8322\u20138333"},{"key":"10777_CR77","doi-asserted-by":"crossref","unstructured":"Song C, Xu C, Yang S et\u00a0al (2019) A black-box approach to generate adversarial examples against deep neural networks for high dimensional input. In: 2019 IEEE fourth international conference on data science in cyberspace (DSC). IEEE, pp 473\u2013479","DOI":"10.1109\/DSC.2019.00078"},{"key":"10777_CR78","first-page":"1","volume":"2022","author":"PN Srinivasu","year":"2022","unstructured":"Srinivasu PN, Sandhya N, Jhaveri RH et al (2022) From blackbox to explainable ai in healthcare: existing tools and case studies. Mob Inf Syst 2022:1\u201320","journal-title":"Mob Inf Syst"},{"issue":"5","key":"10777_CR79","doi-asserted-by":"publisher","first-page":"828","DOI":"10.1109\/tevc.2019.2890858","volume":"23","author":"J Su","year":"2019","unstructured":"Su J, Vargas DV, Sakurai K (2019) One pixel attack for fooling deep neural networks. IEEE Trans Evol Comput 23(5):828\u2013841. https:\/\/doi.org\/10.1109\/tevc.2019.2890858","journal-title":"IEEE Trans Evol Comput"},{"key":"10777_CR80","unstructured":"Suara S, Jha A, Sinha P et\u00a0al (2023) Is grad-cam explainable in medical images? arXiv preprint http:\/\/arxiv.org\/abs\/2307.10506"},{"key":"10777_CR81","unstructured":"Szegedy C, Zaremba W, Sutskever I et\u00a0al (2013) Intriguing properties of neural networks. arXiv preprint http:\/\/arxiv.org\/abs\/1312.6199"},{"key":"10777_CR82","doi-asserted-by":"crossref","unstructured":"Tabacof P, Valle E (2016) Exploring the space of adversarial images. In: 2016 international joint conference on neural networks (IJCNN). IEEE, pp 426\u2013433","DOI":"10.1109\/IJCNN.2016.7727230"},{"key":"10777_CR83","unstructured":"Tsipras D, Santurkar S, Engstrom L et\u00a0al (2018) Robustness may be at odds with accuracy. arXiv preprint http:\/\/arxiv.org\/abs\/1805.12152"},{"issue":"4","key":"10777_CR84","doi-asserted-by":"publisher","first-page":"600","DOI":"10.1109\/tip.2003.819861","volume":"13","author":"Z Wang","year":"2004","unstructured":"Wang Z, Bovik A, Sheikh H et al (2004) Image quality assessment: from error visibility to structural similarity. IEEE Trans Image Process 13(4):600\u2013612. https:\/\/doi.org\/10.1109\/tip.2003.819861","journal-title":"IEEE Trans Image Process"},{"key":"10777_CR85","doi-asserted-by":"publisher","unstructured":"Wang S, Shi Y, Han Y (2018) Universal perturbation generation for black-box attack using evolutionary algorithms. In: 2018 24th international conference on pattern recognition (ICPR). IEEE. https:\/\/doi.org\/10.1109\/icpr.2018.8546023","DOI":"10.1109\/icpr.2018.8546023"},{"key":"10777_CR86","unstructured":"Wang X, He K, Song C et\u00a0al (2019a) AT-GAN: an adversarial generator model for non-constrained adversarial examples. arXiv preprint http:\/\/arxiv.org\/abs\/1904.07793 [cs.CV]"},{"key":"10777_CR87","doi-asserted-by":"publisher","first-page":"12","DOI":"10.1016\/j.jpdc.2019.03.003","volume":"130","author":"X Wang","year":"2019","unstructured":"Wang X, Li J, Kuang X et al (2019b) The security of machine learning in an adversarial setting: a survey. J Parallel Distrib Comput 130:12\u201323. https:\/\/doi.org\/10.1016\/j.jpdc.2019.03.003","journal-title":"J Parallel Distrib Comput"},{"key":"10777_CR88","doi-asserted-by":"crossref","unstructured":"Wang Z, Guo H, Zhang Z et\u00a0al (2021) Feature importance-aware transferable adversarial attacks. In: Proceedings of the IEEE\/CVF international conference on computer vision. pp 7639\u20137648","DOI":"10.1109\/ICCV48922.2021.00754"},{"key":"10777_CR89","first-page":"103227","volume":"68","author":"Y Wang","year":"2022","unstructured":"Wang Y, Liu J, Chang X et al (2022) AB-FGSM: AdaBelief optimizer and FGSM-based approach to generate adversarial examples. J Inf Secur Appl 68:103227","journal-title":"J Inf Secur Appl"},{"key":"10777_CR90","unstructured":"Weidt F, Silva R (2016) Systematic literature review in computer science\u2014a practical guide. Relat\u00f3rios T\u00e9cnicos Do DCC\/UFJF (8):1"},{"key":"10777_CR91","unstructured":"Wickramanayake S, Hsu W, Lee ML (2021) Explanation-based data augmentation for image classification. In: Ranzato M, Beygelzimer A, Dauphin Y et\u00a0al (eds) Advances in neural information processing systems, vol\u00a034. Curran Associates, Inc., pp 20929\u201320940. https:\/\/proceedings.neurips.cc\/paper\/2021\/file\/af3b6a54e9e9338abc54258e3406e485-Paper.pdf"},{"key":"10777_CR92","doi-asserted-by":"publisher","first-page":"110242","DOI":"10.1016\/j.patcog.2023.110242","volume":"149","author":"Y Xia","year":"2024","unstructured":"Xia Y, Chen B, Feng Y et al (2024) Multi-scale architectures matter: examining the adversarial robustness of flow-based lossless compression. Pattern Recognit 149:110242","journal-title":"Pattern Recognit"},{"key":"10777_CR93","doi-asserted-by":"publisher","first-page":"104","DOI":"10.1016\/j.ins.2021.04.033","volume":"571","author":"Y Xiao","year":"2021","unstructured":"Xiao Y, Pun CM (2021) Improving adversarial attacks on deep neural networks via constricted gradient-based perturbations. Inf Sci 571:104\u2013132","journal-title":"Inf Sci"},{"key":"10777_CR94","doi-asserted-by":"crossref","unstructured":"Xiao C, Li B, Zhu JY et\u00a0al (2018) Generating adversarial examples with adversarial networks. arXiv preprint http:\/\/arxiv.org\/abs\/1801.02610 [cs.CR]","DOI":"10.24963\/ijcai.2018\/543"},{"issue":"2","key":"10777_CR95","doi-asserted-by":"publisher","first-page":"151","DOI":"10.1007\/s11633-019-1211-x","volume":"17","author":"H Xu","year":"2020","unstructured":"Xu H, Ma Y, Liu HC et al (2020) Adversarial attacks and defenses in images, graphs and text: a review. Int J Autom Comput 17(2):151\u2013178. https:\/\/doi.org\/10.1007\/s11633-019-1211-x","journal-title":"Int J Autom Comput"},{"key":"10777_CR96","doi-asserted-by":"publisher","first-page":"e702","DOI":"10.7717\/peerj-cs.702","volume":"7","author":"G Yang","year":"2021","unstructured":"Yang G, Li M, Fang X et al (2021) Generating adversarial examples without specifying a target model. PeerJ Comput Sci 7:e702","journal-title":"PeerJ Comput Sci"},{"issue":"1","key":"10777_CR97","doi-asserted-by":"publisher","first-page":"27","DOI":"10.1017\/ilm.2020.5","volume":"59","author":"K Yeung","year":"2020","unstructured":"Yeung K (2020) Recommendation of the council on artificial intelligence (OECD). Int Leg Mater 59(1):27\u201334","journal-title":"Int Leg Mater"},{"key":"10777_CR98","first-page":"1","volume":"2021","author":"H Yin","year":"2021","unstructured":"Yin H, Zhang H, Wang J et al (2021) Boosting adversarial attacks on neural networks with better optimizer. Secur Commun Netw 2021:1\u20139","journal-title":"Secur Commun Netw"},{"key":"10777_CR99","doi-asserted-by":"publisher","unstructured":"Yu P, Song K, Lu J (2018) Generating adversarial examples with conditional generative adversarial net. In: 2018 24th international conference on pattern recognition (ICPR). IEEE. https:\/\/doi.org\/10.1109\/icpr.2018.8545152","DOI":"10.1109\/icpr.2018.8545152"},{"key":"10777_CR100","doi-asserted-by":"crossref","unstructured":"Yu L, Deng T, Zhang W et\u00a0al (2020) Stronger adversarial attack: using mini-batch gradient. In: 2020 12th international conference on advanced computational intelligence (ICACI). IEEE, pp 364\u2013370","DOI":"10.1109\/ICACI49185.2020.9177719"},{"key":"10777_CR101","doi-asserted-by":"publisher","first-page":"151103","DOI":"10.1109\/access.2019.2946461","volume":"7","author":"W Zhang","year":"2019","unstructured":"Zhang W (2019) Generating adversarial examples in one shot with image-to-image translation GAN. IEEE Access 7:151103\u2013151119. https:\/\/doi.org\/10.1109\/access.2019.2946461","journal-title":"IEEE Access"},{"key":"10777_CR102","unstructured":"Zhang H, Yu Y, Jiao J et\u00a0al (2019) Theoretically principled trade-off between robustness and accuracy. In: International conference on machine learning. PMLR, pp 7472\u20137482"},{"key":"10777_CR103","doi-asserted-by":"publisher","first-page":"128250","DOI":"10.1109\/ACCESS.2020.3008433","volume":"8","author":"S Zhang","year":"2020","unstructured":"Zhang S, Xie X, Xu Y (2020) A brute-force black-box method to attack machine learning-based systems in cybersecurity. IEEE Access 8:128250\u2013128263","journal-title":"IEEE Access"},{"key":"10777_CR104","unstructured":"Zhao Z, Dua D, Singh S (2017) Generating natural adversarial examples. arXiv preprint http:\/\/arxiv.org\/abs\/1710.11342 [cs.LG]"},{"key":"10777_CR105","doi-asserted-by":"publisher","first-page":"19","DOI":"10.1016\/j.neunet.2020.04.005","volume":"127","author":"G Zhong","year":"2020","unstructured":"Zhong G, Gao W, Liu Y et al (2020) Generative adversarial networks with decoder\u2013encoder output noises. Neural Netw 127:19\u201328. https:\/\/doi.org\/10.1016\/j.neunet.2020.04.005","journal-title":"Neural Netw"},{"key":"10777_CR106","doi-asserted-by":"publisher","DOI":"10.1038\/s41467-021-27577-x","author":"Q Zhou","year":"2021","unstructured":"Zhou Q, Zuley M, Guo Y et al (2021) A machine and human reader study on ai diagnosis model safety under attacks of adversarial images. Nat Commun. https:\/\/doi.org\/10.1038\/s41467-021-27577-x","journal-title":"Nat Commun"}],"container-title":["Artificial Intelligence Review"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10462-024-10777-4.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10462-024-10777-4\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10462-024-10777-4.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,15]],"date-time":"2024-07-15T06:18:03Z","timestamp":1721024283000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10462-024-10777-4"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,6,15]]},"references-count":106,"journal-issue":{"issue":"7","published-online":{"date-parts":[[2024,7]]}},"alternative-id":["10777"],"URL":"https:\/\/doi.org\/10.1007\/s10462-024-10777-4","relation":{"has-preprint":[{"id-type":"doi","id":"10.21203\/rs.3.rs-3421337\/v1","asserted-by":"object"}]},"ISSN":["1573-7462"],"issn-type":[{"value":"1573-7462","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,6,15]]},"assertion":[{"value":"24 April 2024","order":1,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"15 June 2024","order":2,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors have no relevant financial or non-financial interests to disclose.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"NA.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethical approval"}},{"value":"NA.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent to participate"}},{"value":"NA.","order":5,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent for publication"}}],"article-number":"174"}}