{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T21:22:23Z","timestamp":1792790543991,"version":"4.5.0"},"reference-count":255,"publisher":"Springer Science and Business Media LLC","issue":"8","license":[{"start":{"date-parts":[[2024,7,8]],"date-time":"2024-07-08T00:00:00Z","timestamp":1720396800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2024,7,8]],"date-time":"2024-07-08T00:00:00Z","timestamp":1720396800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Artif Intell Rev"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Recent studies have found that deep learning models are vulnerable to adversarial examples, demonstrating that applying a certain imperceptible perturbation on clean examples can effectively deceive the well-trained and high-accuracy deep learning models. Moreover, the adversarial examples can achieve a considerable level of certainty with the attacked label. In contrast, human could barely discern the difference between clean and adversarial examples, which raised tremendous concern about robust and trustworthy deep learning techniques. In this survey, we reviewed the existence, generation, and countermeasures of adversarial examples in Computer Vision, to provide comprehensive coverage of the field with an intuitive understanding of the mechanisms and summarized the strengths, weaknesses, and major challenges. We hope this effort will ignite further interest in the community to solve current challenges and explore this fundamental area.<\/jats:p>","DOI":"10.1007\/s10462-024-10841-z","type":"journal-article","created":{"date-parts":[[2024,7,8]],"date-time":"2024-07-08T09:02:00Z","timestamp":1720429320000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":14,"title":["Generation and Countermeasures of adversarial examples on vision: a survey"],"prefix":"10.1007","volume":"57","author":[{"given":"Jiangfan","family":"Liu","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yishan","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yanming","family":"Guo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yu","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jun","family":"Tang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ying","family":"Nie","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2024,7,8]]},"reference":[{"key":"10841_CR1","doi-asserted-by":"crossref","unstructured":"Addepalli S, Vivek BS, Baburaj A, Sriramanan G, Babu RV (2020) Towards achieving adversarial robustness by enforcing feature consistency across bit planes. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR42600.2020.00110"},{"key":"10841_CR2","doi-asserted-by":"crossref","unstructured":"Akhtar N, Mian A (2018) Threat of adversarial attacks on deep learning in computer vision: a survey. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/ACCESS.2018.2807385"},{"key":"10841_CR3","doi-asserted-by":"crossref","unstructured":"Aldahdooh A, Hamidouche W, Deforges O (2022) Revisiting model\u2019s uncertainty and confidences for adversarial example detection. Applied Intelligence, 1\u201323","DOI":"10.1007\/s10489-022-03373-y"},{"issue":"7","key":"10841_CR4","doi-asserted-by":"publisher","first-page":"1889","DOI":"10.1109\/TMM.2020.2969784","volume":"22","author":"S Amini","year":"2020","unstructured":"Amini S, Ghaemmaghami S (2020) Towards improving robustness of deep neural networks to adversarial perturbations. IEEE Trans Multimedia 22(7):1889\u20131903","journal-title":"IEEE Trans Multimedia"},{"key":"10841_CR5","unstructured":"Anil C, Lucas J, Grosse R (2019) Sorting out lipschitz function approximation. In: International Conference on Machine Learning (ICML). PMLR"},{"key":"10841_CR6","doi-asserted-by":"publisher","DOI":"10.1016\/j.engappai.2023.107360","volume":"127","author":"S Amini","year":"2024","unstructured":"Amini S, Heshmati A, Ghaemmaghami S (2024) Fast adversarial attacks to deep neural networks through gradual sparsification. Eng Appl Artif Intell 127:107360","journal-title":"Eng Appl Artif Intell"},{"key":"10841_CR7","unstructured":"Anish A, Logan E, Andrew I, Kevin K (2018) Synthesizing robust adversarial examples. In: International conference on machine learning (ICML). PMLR"},{"key":"10841_CR8","unstructured":"Arjovsky M, Chintala S, Bottou L (2017) Wasserstein generative adversarial networks. In: International Conference on Machine Learning (ICML). PMLR"},{"key":"10841_CR9","doi-asserted-by":"crossref","unstructured":"Bai T, Luo J, Zhao J, Wen B, Wang Q (2021) Recent advances in adversarial training for adversarial robustness. In: International joint conference on artificial intelligence (IJCAI)","DOI":"10.24963\/ijcai.2021\/591"},{"key":"10841_CR10","unstructured":"Baluja S, Fischer I (2017) Adversarial transformation networks: Learning to generate adversarial examples. arXiv preprint arXiv: 1703.09387"},{"key":"10841_CR11","unstructured":"Balunovic M, Vechev M (2020) Adversarial training and provable defenses: Bridging the gap. In: 8th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR12","first-page":"211","volume":"21","author":"A Blum","year":"2020","unstructured":"Blum A, Dick T, Manoj NS, Zhang H (2020) Random smoothing might be unable to certify l\u221e robustness for high-dimensional images. J Mach Learn Res 21:211\u2013121121","journal-title":"J Mach Learn Res"},{"key":"10841_CR13","unstructured":"Bodria F, Giannotti F, Guidotti R, Naretto F, Pedreschi D, Rinzivillo S (2021) Benchmarking and survey of explanation methods for black box models. arXiv:2102.13076"},{"key":"10841_CR14","unstructured":"Bojarski M, Testa DD, Dworakowski D, Firner B, Flepp B, Goyal P, Jackel LD, Monfort M, Muller U, Zhang J, Zhang X, Zhao J, Zieba K (2016) End to end learning for self-driving cars. arXiv:1604.07316"},{"key":"10841_CR15","doi-asserted-by":"crossref","unstructured":"Bose AJ, Aarabi P (2018) Adversarial attacks on face detectors using neural net based constrained optimization. In: 2018 IEEE 20th International Workshop on Multimedia Signal Processing (MMSP), pp. 1\u20136 . IEEE","DOI":"10.1109\/MMSP.2018.8547128"},{"key":"10841_CR16","unstructured":"Brendel W, Rauber J, K\u00fcmmerer M, Ustyuzhaninov I, Bethge M (2019) Accurate, reliable and fast robustness evaluation. In: Advances in neural information processing systems (NeurIPS), vol 32"},{"key":"10841_CR17","unstructured":"Brown T, Man\u00e9 D, Roy A, Abadi M, Gilmer J (2017) Adversarial patch.\u00a0\u00a0arXiv:1712.09665"},{"key":"10841_CR18","unstructured":"Bunel R, Turkaslan I, Torr PHS, Kohli P, Kumar MP (2018) A unified view of piecewise linear neural network verification. In: Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"10841_CR19","unstructured":"Cao Y, Bhupathiraju SH, Naghavi P, Sugawara T, Mao ZM, Rampazzi S (2023) You can\u2019t see me: Physical removal attacks on lidar-based autonomous vehicles driving frameworks. In: 32nd USENIX Security Symposium (USENIX Security 23), pp. 2993\u20133010"},{"key":"10841_CR20","doi-asserted-by":"crossref","unstructured":"Carlini N, Wagner D (2017) Towards evaluating the robustness of neural networks. In: IEEE symposium on security and privacy","DOI":"10.1109\/SP.2017.49"},{"key":"10841_CR21","unstructured":"Carlini N, Katz G, Barrett C, Dill DL (2017) Provably minimally-distorted adversarial examples. arXiv:1709.10207"},{"key":"10841_CR22","doi-asserted-by":"crossref","unstructured":"Carrara F, Becarelli R, Caldelli R, Falchi F, Amato G (2018) Adversarial examples detection in features distance spaces. In: Proceedings of the European Conference on Computer Vision Workshops (ECCVW)","DOI":"10.1007\/978-3-030-11012-3_26"},{"key":"10841_CR23","doi-asserted-by":"crossref","unstructured":"Cazenavette G, Murdock C, Lucey S (2021) Architectural adversarial robustness: The case for deep pursuit. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR46437.2021.00707"},{"key":"10841_CR24","unstructured":"Chan A, Tay Y, Ong Y-S, Fu J (2020) Jacobian adversarially regularized networks for robustness. In: 8th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR25","doi-asserted-by":"crossref","unstructured":"Chatila R, Dignum V, Fisher M, Giannotti F, Morik K, Russell S, Yeung K (2021) Trustworthy AI. Reflections on artificial intelligence for humanity, pp 13\u201339","DOI":"10.1007\/978-3-030-69128-8_2"},{"key":"10841_CR26","doi-asserted-by":"publisher","first-page":"3405","DOI":"10.1609\/aaai.v34i04.5743","volume":"34","author":"Z Che","year":"2020","unstructured":"Che Z, Borji A, Zhai G, Ling S, Li J, Callet PL (2020) A new ensemble adversarial attack powered by long-term gradient memories. Proceedings of the AAAI Conference on Artificial Intelligence (AAAI) 34:3405\u20133413","journal-title":"Proceedings of the AAAI Conference on Artificial Intelligence (AAAI)"},{"key":"10841_CR27","doi-asserted-by":"crossref","unstructured":"Chen P-Y, Zhang H, Sharma Y, Yi J, Hsieh C-J (2017) Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In: Proceedings of the 10th ACM workshop on artificial intelligence and security","DOI":"10.1145\/3128572.3140448"},{"key":"10841_CR28","doi-asserted-by":"crossref","unstructured":"Chen P-Y, Sharma Y, Zhang H, Yi J, Hsieh C-J (2018) Ead: elastic-net attacks to deep neural networks via adversarial examples. In: Proceedings of the AAAI conference on artificial intelligence (AAAI)","DOI":"10.1609\/aaai.v32i1.11302"},{"key":"10841_CR29","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102220","volume":"104","author":"J Chen","year":"2021","unstructured":"Chen J, Zheng H, Xiong H, Ruoxi C, Du T, Hong Z, Ji S (2021) Finefool: a novel DNN object contour attack on image recognition based on the attention perturbation adversarial technique. Comput Secur 104:102220","journal-title":"Comput Secur"},{"key":"10841_CR30","doi-asserted-by":"crossref","unstructured":"Cheng C-H, N\u00fchrenberg G, Ruess H (2017) Maximum resilience of artificial neural networks. In: International Symposium on Automated Technology for Verification and Analysis","DOI":"10.1007\/978-3-319-68167-2_18"},{"key":"10841_CR31","unstructured":"Cheng S, Dong Y, Pang T, Su H, Zhu J (2019) Improving black-box adversarial attacks with a transfer-based prior. In: Advances in neural information processing systems (NeurIPS)"},{"key":"10841_CR32","unstructured":"Cheng M, Singh S, Chen PH, Chen P-Y, Liu S, Hsieh C-J (2020) Sign-opt: a query-efficient hard-label adversarial attack. In: 8th international conference on learning representations (ICLR)"},{"key":"10841_CR33","doi-asserted-by":"crossref","unstructured":"Chen R, Li J, Yan J, Li P, Sheng B (2022) Input-specific robustness certification for randomized smoothing. In: Proceedings of the AAAI Conference on Artificial Intelligence (AAAI)","DOI":"10.1609\/aaai.v36i6.20579"},{"key":"10841_CR34","doi-asserted-by":"crossref","unstructured":"Chen X, Gao X, Zhao J, Ye K, Xu C-Z (2023) Advdiffuser: Natural adversarial example synthesis with diffusion models. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision, pp. 4562\u20134572","DOI":"10.1109\/ICCV51070.2023.00421"},{"key":"10841_CR35","unstructured":"Chen Z, Li B, Wu S, Jiang K, Ding S, Zhang W (2024) Content-based unrestricted adversarial attack. Advances in Neural Information Processing Systems 36"},{"key":"10841_CR36","unstructured":"Cisse M, Bojanowski P, Grave E, Dauphin YN, Usunier N (2017) Parseval networks: Improving robustness to adversarial examples. In: International Conference on Machine Learning (ICML). PMLR"},{"key":"10841_CR37","unstructured":"Cohen J, Rosenfeld E, Kolter JZ (2019) Certified adversarial robustness via randomized smoothing. In: International Conference on Machine Learning (ICML). PMLR"},{"key":"10841_CR38","doi-asserted-by":"crossref","unstructured":"Dabouei A, Soleymani S, Taherkhani F, Dawson J, Nasrabadi NM (2020) Exploiting joint robustness to adversarial perturbations. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR42600.2020.00120"},{"key":"10841_CR39","doi-asserted-by":"crossref","unstructured":"Deb D, Zhang J, Jain AK (2020) Advfaces: Adversarial face synthesis. In: 2020 IEEE International Joint Conference on Biometrics (IJCB), pp. 1\u201310. IEEE","DOI":"10.1109\/IJCB48548.2020.9304898"},{"key":"10841_CR40","doi-asserted-by":"crossref","unstructured":"Deng J, Dong W, Socher R, Li L-J, Li K, Fei-Fei L (2009) Imagenet: a large-scale hierarchical image database. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"10841_CR41","doi-asserted-by":"crossref","unstructured":"Deng Z, Yang X, Xu S, Su H, Zhu J (2021) Libre: A practical bayesian approach to adversarial detection. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR46437.2021.00103"},{"key":"10841_CR42","unstructured":"Ding GW, Lui KYC, Jin X, Wang L, Huang R (2019) On the sensitivity of adversarial robustness to input data distributions. In: 7th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR43","doi-asserted-by":"crossref","unstructured":"Dong Y, Liao F, Pang T, Su H, Zhu J, Hu X, Li J (2018) Boosting adversarial attacks with momentum. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR.2018.00957"},{"key":"10841_CR44","doi-asserted-by":"crossref","unstructured":"Dong Y, Pang T, Su H, Zhu J (2019) Evading defenses to transferable adversarial examples by translation-invariant attacks. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR.2019.00444"},{"key":"10841_CR45","unstructured":"Dosovitskiy A, Beyer L, Kolesnikov A, Weissenborn D, Zhai X, Unterthiner T, Dehghani M, Minderer M, Heigold G, Gelly S, et al (2020) An image is worth 16x16 words: transformers for image recognition at scale. In: 8th international conference on learning representations (ICLR)"},{"key":"10841_CR46","unstructured":"Du J, Zhang H, Zhou JT, Yang Y, Feng J (2020) Query-efficient meta attack to deep neural networks. In: 8th international conference on learning representations (ICLR)"},{"key":"10841_CR47","doi-asserted-by":"crossref","unstructured":"Dutta S, Jha S, Sankaranarayanan S, Tiwari A (2018) Output range analysis for deep feedforward neural networks. In: NASA Formal Methods Symposium","DOI":"10.1007\/978-3-319-77935-5_9"},{"key":"10841_CR48","doi-asserted-by":"crossref","unstructured":"Duan R, Chen Y, Niu D, Yang Y, Qin AK, He Y (2021) Advdrop: adversarial attack to DNNs by dropping information. In: Proceedings of the IEEE\/CVF international conference on computer vision (ICCV), pp 7506\u20137515","DOI":"10.1109\/ICCV48922.2021.00741"},{"key":"10841_CR49","doi-asserted-by":"crossref","unstructured":"Duan R, Mao X, Qin AK, Chen Y, Ye S, He Y, Yang Y (2021) Adversarial laser beam: Effective physical-world attack to dnns in a blink. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR46437.2021.01580"},{"key":"10841_CR50","unstructured":"Dvijotham K, Gowal S, Stanforth R, Arandjelovic R, O\u2019Donoghue B, Uesato J, Kohli P (2018) Training verified learners with learned verifiers. arXiv:1805.10265"},{"key":"10841_CR51","unstructured":"Dvijotham K, Hayes J, Balle B, Kolter Z, Qin C, Gy\u00f6rgy A, Xiao K, Gowal S, Kohli P (2020) A framework for robustness certification of smoothed classifiers using f-divergences. In: 8th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR52","doi-asserted-by":"crossref","unstructured":"Ehlers R (2017) Formal verification of piece-wise linear feed-forward neural networks. In: International Symposium on Automated Technology for Verification and Analysis","DOI":"10.1007\/978-3-319-68167-2_19"},{"key":"10841_CR53","doi-asserted-by":"crossref","unstructured":"Fan Y, Wu B, Li T, Zhang Y, Li M, Li Z, Yang Y (2020) Sparse adversarial attack via perturbation factorization. In: Proceedings of the European conference on computer vision (ECCV)","DOI":"10.1007\/978-3-030-58542-6_3"},{"key":"10841_CR54","unstructured":"Farnia F, Zhang JM, Tse D (2018) Generalizable adversarial training via spectral normalization. In: 6th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR55","unstructured":"Feinman R, RCurtin R, Shintre S, BGardner A (2017) Detecting adversarial samples from artifacts. arXiv:1703.00410"},{"key":"10841_CR56","doi-asserted-by":"crossref","unstructured":"Finlay C, Pooladian A-A, Oberman AM (2019) The logbarrier adversarial attack: making effective use of decision boundary information. In: Proceedings of the IEEE\/CVF international conference on computer vision (ICCV)","DOI":"10.1109\/ICCV.2019.00496"},{"issue":"3","key":"10841_CR57","doi-asserted-by":"publisher","first-page":"296","DOI":"10.1007\/s10601-018-9285-6","volume":"23","author":"M Fischetti","year":"2018","unstructured":"Fischetti M, Jo J (2018) Deep neural networks and mixed integer linear optimization. Constraints An Int. J. 23(3):296\u2013309","journal-title":"Constraints An Int. J."},{"key":"10841_CR58","doi-asserted-by":"crossref","unstructured":"Ghosh P, Losalka A, J.Black M (2019) Resisting adversarial attacks using gaussian mixture variational autoencoders. In: Proceedings of the AAAI conference on artificial intelligence (AAAI)","DOI":"10.1609\/aaai.v33i01.3301541"},{"key":"10841_CR59","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2021.108279","volume":"122","author":"A Ghosh","year":"2022","unstructured":"Ghosh A, Mullick SS, Datta S, Das S, Mallipeddi R, Das AK (2022) A black-box adversarial attack strategy with adjustable sparsity and generalizability for deep image classifiers. Pattern Recogn 122:108279","journal-title":"Pattern Recogn"},{"key":"10841_CR60","unstructured":"Gilmer J, Metz L, Faghri F, Schoenholz SS, Raghu M, Wattenberg M, Goodfellow IJ (2018) Adversarial spheres. In: 6th international conference on learning representations (ICLR)"},{"issue":"2","key":"10841_CR61","doi-asserted-by":"publisher","first-page":"661","DOI":"10.1109\/LRA.2015.2509024","volume":"1","author":"A Giusti","year":"2015","unstructured":"Giusti A, Guzzi J, Cire\u015fan DC, He F-L, Rodr\u00edguez JP, Fontana F, Faessler M, Forster C, Schmidhuber J, Di Caro G et al (2015) A machine learning approach to visual perception of forest trails for mobile robots. IEEE Robot Autom Lett 1(2):661\u2013667","journal-title":"IEEE Robot Autom Lett"},{"key":"10841_CR62","doi-asserted-by":"crossref","unstructured":"Gong C, Ren T, Ye M, Liu Q (2021) Maxup: Lightweight adversarial training with data augmentation improves neural network training. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR46437.2021.00250"},{"key":"10841_CR63","unstructured":"Goodfellow I, Pouget-Abadie J, Mirza M, Xu B, Warde-Farley D, Ozair S, Courville A, Bengio Y (2014) Generative adversarial nets. In: Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"10841_CR64","unstructured":"Goodfellow IJ, Shlens J, Szegedy C (2015) Explaining and harnessing adversarial examples. In: 3th international conference on learning representations (ICLR)"},{"issue":"2","key":"10841_CR65","doi-asserted-by":"publisher","first-page":"393","DOI":"10.1007\/s10994-020-05929-w","volume":"110","author":"H Gouk","year":"2021","unstructured":"Gouk H, Frank E, Pfahringer B, Cree MJ (2021) Regularisation of neural networks by enforcing lipschitz continuity. Mach Learn 110(2):393\u2013416","journal-title":"Mach Learn"},{"key":"10841_CR66","unstructured":"Gowal S, Dvijotham K, Stanforth R, Bunel R, Qin C, Uesato J, Mann T, Kohli P (2018) On the effectiveness of interval bound propagation for training verifiably robust models. arXiv:1810.12715"},{"key":"10841_CR67","doi-asserted-by":"crossref","unstructured":"Gowal S, Qin C, Huang P-S, Cemgil T, Dvijotham K, Mann TA, Kohli P (2020) Achieving robustness in the wild via adversarial mixing with disentangled representations. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR42600.2020.00129"},{"key":"10841_CR68","unstructured":"Gu S, Rigazio L (2015) Towards deep neural network architectures robust to adversarial examples. In: 3th international conference on learning representations workshop, ICLRW"},{"issue":"5","key":"10841_CR69","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3236009","volume":"51","author":"R Guidotti","year":"2018","unstructured":"Guidotti R, Monreale A, Ruggieri S, Turini F, Giannotti F, Pedreschi D (2018) A survey of methods for explaining black box models. ACM Comput Surv (CSUR) 51(5):1\u201342","journal-title":"ACM Comput Surv (CSUR)"},{"issue":"2","key":"10841_CR70","first-page":"44","volume":"40","author":"D Gunning","year":"2019","unstructured":"Gunning D, Aha DW (2019) Darpa\u2019s explainable artificial intelligence (xai) program. AI Mag 40(2):44\u201358","journal-title":"AI Mag"},{"key":"10841_CR71","unstructured":"Guo C, Gardner JR, You Y, Wilson AG, Weinberger KQ (2019) Simple black-box adversarial attacks. In: International conference on machine learning (ICML) PMLR"},{"key":"10841_CR72","doi-asserted-by":"crossref","unstructured":"Guo M, Yang Y, Xu R, Liu Z, Lin D (2020) When nas meets robustness: In search of robust architectures against adversarial attacks. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR42600.2020.00071"},{"key":"10841_CR73","doi-asserted-by":"crossref","unstructured":"Gupta P, Rahtu E (2019) Ciidefence: Defeating adversarial attacks by fusing class-specific image inpainting and image denoising. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision (ICCV)","DOI":"10.1109\/ICCV.2019.00681"},{"key":"10841_CR74","doi-asserted-by":"crossref","unstructured":"Han J, Dong X, Zhang R, Chen D, Zhang W, Yu N, Luo P, Wang X (2019) Once a man: Towards multi-target attack via learning multi-target adversarial network once. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision (ICCV)","DOI":"10.1109\/ICCV.2019.00526"},{"key":"10841_CR75","doi-asserted-by":"publisher","first-page":"372","DOI":"10.1016\/j.cose.2019.06.012","volume":"86","author":"AS Hashemi","year":"2019","unstructured":"Hashemi AS, Mozaffari S (2019) Secure deep neural networks using adversarial image generation and training with noise-gan. Computers & Security 86:372\u2013387","journal-title":"Computers & Security"},{"key":"10841_CR76","doi-asserted-by":"publisher","first-page":"22077","DOI":"10.1007\/s11042-020-10379-6","volume":"80","author":"AS Hashemi","year":"2021","unstructured":"Hashemi AS, Mozaffari S (2021) Cnn adversarial attack mitigation using perturbed samples training. Multimedia Tools and Applications 80:22077\u201322095","journal-title":"Multimedia Tools and Applications"},{"key":"10841_CR77","unstructured":"Hashemi AS, B\u00e4r A, Mozaffari S, Fingscheidt T (2020) Transferable universal adversarial perturbations using generative models. arXiv:2010.14919"},{"key":"10841_CR78","doi-asserted-by":"crossref","unstructured":"He K, Zhang X, Ren S, Sun J (2016) Deep residual learning for image recognition. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR.2016.90"},{"key":"10841_CR79","first-page":"6840","volume":"33","author":"J Ho","year":"2020","unstructured":"Ho J, Jain A, Abbeel P (2020) Denoising diffusion probabilistic models. Adv Neural Inf Process Syst 33:6840\u20136851","journal-title":"Adv Neural Inf Process Syst"},{"key":"10841_CR80","doi-asserted-by":"crossref","unstructured":"Hosseini R, Yang X, Xie P (2021) Dsrna: Differentiable search of robust neural architectures. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR46437.2021.00613"},{"key":"10841_CR81","doi-asserted-by":"crossref","unstructured":"Hu Z, Huang S, Zhu X, Hu X, Sun F, Zhang B (2022) Adversarial texture for fooling person detectors in the physical world. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR52688.2022.01295"},{"key":"10841_CR82","doi-asserted-by":"crossref","unstructured":"Huang X, Kwiatkowska M, Wang S, Wu M (2017) Safety verification of deep neural networks. In: International Conference on Computer Aided Verification","DOI":"10.1007\/978-3-319-63387-9_1"},{"key":"10841_CR83","doi-asserted-by":"crossref","unstructured":"Huang G, Liu Z, Van Der\u00a0Maaten L, Weinberger KQ (2017) Densely connected convolutional networks. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR.2017.243"},{"key":"10841_CR84","doi-asserted-by":"crossref","unstructured":"Huang Q, Katsman I, Gu Z, He H, Belongie S, Lim S-N (2019) Enhancing adversarial example transferability with an intermediate level attack. In: Proceedings of the IEEE\/CVF international conference on computer vision (ICCV)","DOI":"10.1109\/ICCV.2019.00483"},{"key":"10841_CR85","doi-asserted-by":"crossref","unstructured":"Huang H, Wang Y, Chen Z, Tang Z, Zhang W, Ma K-K (2021) Rpattack: Refined patch attack on general object detectors. In: 2021 IEEE International Conference on Multimedia and Expo (ICME)","DOI":"10.1109\/ICME51207.2021.9428443"},{"key":"10841_CR86","unstructured":"Ilyas A, Santurkar S, Tsipras D, Engstrom, L, Tran B, Madry A (2019) Adversarial examples are not bugs, they are features. In: Advances in neural information processing systems (NeurIPS)"},{"key":"10841_CR87","unstructured":"Ioffe S, Szegedy C (2015) Batch normalization: Accelerating deep network training by reducing internal covariate shift. In: International Conference on Machine Learning (ICML). PMLR"},{"key":"10841_CR88","unstructured":"Javanmard A, Soltanolkotabi M, Hassani H (2020) Precise tradeoffs in adversarial training for linear regression. In: Conference on Learning Theory, pp. 2034\u20132078. PMLR"},{"key":"10841_CR89","doi-asserted-by":"crossref","unstructured":"Jeddi A, Shafiee MJ, Karg M, Scharfenberger C, Wong A (2020) Learn2perturb: an end-to-end feature perturbation learning to improve adversarial robustness. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR42600.2020.00132"},{"key":"10841_CR90","unstructured":"Jetley S, Lord NA, Torr PHS. (2018) With friends like these and who needs adversaries? In: Advances in neural information processing systems (NeurIPS)"},{"key":"10841_CR91","doi-asserted-by":"crossref","unstructured":"Jia X, Wei X, Cao X, Foroosh H (2019) Comdefend: An efficient image compression model to defend adversarial examples. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR.2019.00624"},{"key":"10841_CR92","doi-asserted-by":"crossref","unstructured":"Jia J, Cao X, Wang B, Gong NZ (2020) Certified robustness for top-k predictions against adversarial perturbations via randomized smoothing. In: 8th International Conference on Learning Representations (ICLR)","DOI":"10.1145\/3366423.3380029"},{"key":"10841_CR93","doi-asserted-by":"publisher","first-page":"3608173","DOI":"10.1155\/2020\/3608173","volume":"2020","author":"L Jiang","year":"2020","unstructured":"Jiang L, Qiao K, Qin R, Wang L, Yu W, Chen J, Bu H, Yan B (2020) Cycle-consistent adversarial gan: The integration of adversarial attack and defense. Security and Communication Networks 2020:3608173\u2013136081739","journal-title":"Security and Communication Networks"},{"key":"10841_CR94","doi-asserted-by":"crossref","unstructured":"Jin G, Yi X, Wu D, Mu R, Huang X (2023) Randomized adversarial training via taylor expansion. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR52729.2023.01578"},{"key":"10841_CR95","doi-asserted-by":"crossref","unstructured":"Kang M, Tran TQ, Cho S, Kim D (2021) Cap-gan: Towards adversarial robustness with cycle-consistent attentional purification. In: 2021 International Joint Conference on Neural Networks (IJCNN), pp. 1\u20138","DOI":"10.1109\/IJCNN52387.2021.9533322"},{"key":"10841_CR96","unstructured":"Kang M, Song D, Li B (2024) Diffattack: Evasion attacks against diffusion-based adversarial purification. Advances in Neural Information Processing Systems 36"},{"key":"10841_CR97","unstructured":"Karmon D, Zoran D, Goldberg Y (2018) Lavan: Localized and visible adversarial noise. In: International Conference on Machine Learning (ICML). PMLR"},{"key":"10841_CR98","doi-asserted-by":"crossref","unstructured":"Karras T, Laine S, Aila T (2019) A style-based generator architecture for generative adversarial networks. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR.2019.00453"},{"key":"10841_CR99","doi-asserted-by":"crossref","unstructured":"Katz G, Barrett C, Dill DL, Julian KD, Kochenderfer MJ (2017) Reluplex: An efficient smt solver for verifying deep neural networks. In: International Conference on Computer Aided Verification","DOI":"10.1007\/978-3-319-63387-9_5"},{"key":"10841_CR100","doi-asserted-by":"crossref","unstructured":"Kherchouche A, Fezza SA, Hamidouche W, Deforges O (2020) Natural scene statistics for detecting adversarial examples in deep neural networks. In: Multimedia Signal Processing. IEEE","DOI":"10.1109\/IJCNN48605.2020.9206959"},{"key":"10841_CR101","doi-asserted-by":"crossref","unstructured":"Kim J, Lee B-K, Ro YM (2023) Demystifying causal features on adversarial examples and causal inoculation for robust network by adversarial instrumental variable regression. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR52729.2023.01184"},{"key":"10841_CR102","unstructured":"Kingma DP, Welling M (2013) Auto-encoding variational bayes. arXiv:1312.6114"},{"key":"10841_CR103","unstructured":"Krizhevsky A, Sutskever I, Hinton GE (2012) Imagenet classification with deep convolutional neural networks. In: Advances in neural information processing systems (NeurIPS)"},{"key":"10841_CR104","unstructured":"Krotov D, Hopfield JJ (2016) Dense associative memory for pattern recognition. In: Advances in neural information processing systems (NeurIPS)"},{"issue":"12","key":"10841_CR105","doi-asserted-by":"publisher","first-page":"3151","DOI":"10.1162\/neco_a_01143","volume":"30","author":"D Krotov","year":"2018","unstructured":"Krotov D, Hopfield J (2018) Dense associative memory is robust to adversarial inputs. Neural Comput 30(12):3151\u20133167","journal-title":"Neural Comput"},{"key":"10841_CR106","unstructured":"Kumar A, Levine A, Goldstein T, Feizi S (2020) Curse of dimensionality on randomized smoothing for certifiable robustness. In: International Conference on Machine Learning (ICML). PMLR"},{"key":"10841_CR107","unstructured":"Kurakin A, Goodfellow IJ, Bengio S (2016) Adversarial machine learning at scale. In: 4th International conference on learning representations (ICLR)"},{"key":"10841_CR108","doi-asserted-by":"crossref","unstructured":"Kurakin A, Goodfellow IJ, Bengio S (2018) Adversarial examples in the physical world. In: Artificial intelligence safety and security, pp 99\u2013112","DOI":"10.1201\/9781351251389-8"},{"key":"10841_CR109","doi-asserted-by":"crossref","unstructured":"Lee M, Kim D (2023) Robust evaluation of diffusion-based adversarial purification. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision, pp. 134\u2013144","DOI":"10.1109\/ICCV51070.2023.00019"},{"key":"10841_CR110","unstructured":"Lee H, Han S, Lee J (2017) Generative adversarial trainer: defense to adversarial perturbations with GAN. arXiv:1705.03387"},{"key":"10841_CR111","unstructured":"Lee G-H, Yuan Y, Chang S, Jaakkola TS (2019) Tight certificates of adversarial robustness for randomly smoothed classifiers. In: Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"10841_CR112","unstructured":"Lee M, Kolter Z (2019) On physical adversarial patches for object detection. arXiv:1906.11897"},{"key":"10841_CR113","doi-asserted-by":"crossref","unstructured":"Lee S, Lee H, Yoon S (2020) Adversarial vertex mixup: Toward better adversarially robust generalization. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR42600.2020.00035"},{"key":"10841_CR114","doi-asserted-by":"crossref","unstructured":"Li Y, Bai S, Zhou Y, Xie C, Zhang Z, Yuille AL (2020) Learning transferable adversarial examples via ghost networks. Proceedings of the AAAI conference on artificial intelligence (AAAI) 34:11458\u201311465","DOI":"10.1609\/aaai.v34i07.6810"},{"key":"10841_CR115","unstructured":"Li Y, Fang EX, Xu H, Zhao T (2020) Implicit bias of gradient descent based adversarial training on separable data. In: 8th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR116","doi-asserted-by":"crossref","unstructured":"Li J, Ji R, Liu H, Liu J, Zhong B, Deng C, Tian Q (2020) Projection & probability-driven black-box attack. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR42600.2020.00044"},{"key":"10841_CR117","doi-asserted-by":"crossref","unstructured":"Li X, Li J, Chen Y, Ye S, He Y, Wang S, Su H, Xue H (2021) Qair: Practical query-efficient black-box attacks for image retrieval. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR46437.2021.00334"},{"issue":"4","key":"10841_CR118","doi-asserted-by":"publisher","first-page":"329","DOI":"10.1080\/00031305.2021.2006781","volume":"76","author":"Y Li","year":"2022","unstructured":"Li Y, Cheng M, Hsieh C-J, Lee TC (2022) A review of adversarial attack and defense for classification methods. Am Stat 76(4):329\u2013345","journal-title":"Am Stat"},{"key":"10841_CR119","doi-asserted-by":"crossref","unstructured":"Li T, Wu Y, Chen S, Fang K, Huang X (2022) Subspace adversarial training. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR52688.2022.01305"},{"key":"10841_CR120","doi-asserted-by":"crossref","unstructured":"Li Y, Xu C (2023) Trade-off between robustness and accuracy of vision transformers. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR52729.2023.00730"},{"issue":"1","key":"10841_CR121","doi-asserted-by":"publisher","first-page":"72","DOI":"10.1109\/TDSC.2018.2874243","volume":"18","author":"B Liang","year":"2018","unstructured":"Liang B, Li H, Su M, Li X, Shi W, Wang X (2018) Detecting adversarial image examples in deep neural networks with adaptive noise reduction. IEEE Trans Dependable Secure Comput 18(1):72\u201385","journal-title":"IEEE Trans Dependable Secure Comput"},{"key":"10841_CR122","doi-asserted-by":"crossref","unstructured":"Liao F, Liang M, Dong Y, Pang T, Hu X, Zhu J (2018) Defense against adversarial attacks using high-level representation guided denoiser. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR.2018.00191"},{"key":"10841_CR123","unstructured":"Lin J, Song C, He K, Wang L, Hopcroft JE (2020) Nesterov accelerated gradient and scale invariance for adversarial attacks. In: 8th International conference on learning representations (ICLR)"},{"key":"10841_CR124","doi-asserted-by":"crossref","unstructured":"Liu X, Hsieh C-J (2019) Rob-gan: Generator, discriminator, and adversarial attacker. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR.2019.01149"},{"key":"10841_CR125","unstructured":"Liu Y, Chen X, Liu C, Song D (2016) Delving into transferable adversarial examples and black-box attacks. arXiv:1611.02770"},{"key":"10841_CR126","doi-asserted-by":"crossref","unstructured":"Liu A, Liu X, Fan J, Ma Y, Zhang A, Xie H, Tao D (2019) Perceptual-sensitive gan for generating adversarial patches. In: Proceedings of the AAAI Conference on Artificial Intelligence (AAAI)","DOI":"10.1609\/aaai.v33i01.33011028"},{"key":"10841_CR127","unstructured":"Liu X, Yang H, Liu Z, Song L, Li H, Chen Y (2018) Dpatch: An adversarial patch attack on object detectors. In: Proceedings of the AAAI Conference on Artificial Intelligence Workshop on SafeAI"},{"key":"10841_CR128","doi-asserted-by":"crossref","unstructured":"Liu Z, Liu Q, Liu T, Xu N, Lin X, Wang Y, Wen W (2019) Feature distillation: Dnn-oriented jpeg compression against adversarial examples. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR.2019.00095"},{"key":"10841_CR129","doi-asserted-by":"publisher","first-page":"5769","DOI":"10.1109\/TIP.2021.3082317","volume":"30","author":"A Liu","year":"2021","unstructured":"Liu A, Liu X, Yu H, Zhang C, Liu Q, Tao D (2021) Training robust deep neural networks via adversarial noise propagation. IEEE Trans Image Process 30:5769\u20135781","journal-title":"IEEE Trans Image Process"},{"key":"10841_CR130","unstructured":"Liu J, Lu B, Xiong M, Zhang T, Xiong H (2023) Adversarial attack with raindrops. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)"},{"issue":"1\u20133","key":"10841_CR131","first-page":"503","volume":"45","author":"C LiuDong","year":"1989","unstructured":"LiuDong C (1989) NocedalJorge: on the limited memory BFGS method for large scale optimization. Math Program 45(1\u20133):503\u2013528","journal-title":"Math Program"},{"key":"10841_CR132","unstructured":"Lomuscio A, Maganti L (2017) An approach to reachability analysis for feed-forward relu neural networks. arXiv:1706.07351"},{"key":"10841_CR133","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102847","volume":"121","author":"T Long","year":"2022","unstructured":"Long T, Gao Q, Xu L, Zhou Z (2022) A survey on adversarial attacks in computer vision: taxonomy, visualization and future directions. Comput Secur 121:102847","journal-title":"Comput Secur"},{"key":"10841_CR134","unstructured":"Luo Y, Boix X, Roig G, Poggio T, Zhao Q (2015) Foveation-based mechanisms alleviate adversarial examples. arXiv:1511.06292"},{"key":"10841_CR135","unstructured":"Luo Y, Pfister H (2018) Adversarial defense of image classification using a variational auto-encoder. arXiv:1812.02891"},{"key":"10841_CR136","doi-asserted-by":"crossref","unstructured":"Luo C, Lin Q, Xie W, Wu B, Xie J, Shen L (2022) Frequency-driven imperceptible adversarial attack on semantic similarity. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR52688.2022.01488"},{"key":"10841_CR137","unstructured":"Ma X, Li B, Wang Y, Erfani SM, Wijewickrema S, Schoenebeck G, Song D, Houle ME, Bailey J (2018) Characterizing adversarial subspaces using local intrinsic dimensionality. arXiv:1801.02613"},{"key":"10841_CR138","doi-asserted-by":"crossref","unstructured":"Ma S, Liu Y, Tao G, Lee W-C, Zhang X (2019) Nic: Detecting adversarial samples with neural network invariant checking. In: Proceedings of The Network and Distributed System Security Symposium (NDSS)","DOI":"10.14722\/ndss.2019.23415"},{"key":"10841_CR139","doi-asserted-by":"crossref","unstructured":"Ma C, Chen L, Yong J-H (2021) Simulating unknown target models for query-efficient black-box attacks. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR46437.2021.01166"},{"key":"10841_CR140","unstructured":"Madry A, Makelov A, Schmidt L, Tsipras D, Vladu A (2018) Towards deep learning models resistant to adversarial attacks. In: 6th international conference on learning representations (ICLR)"},{"key":"10841_CR141","unstructured":"Maini P, Wong E, Kolter JZ (2020) Adversarial robustness against the union of multiple perturbation models. In: International Conference on Machine Learning (ICML). PMLR"},{"key":"10841_CR142","doi-asserted-by":"crossref","unstructured":"Mangla P, Jandial S, Varshney S, Balasubramanian VN (2019) Advgan++ : Harnessing latent layers for adversary generation. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision Workshops (ICCVW)","DOI":"10.1109\/ICCVW.2019.00257"},{"key":"10841_CR143","doi-asserted-by":"crossref","unstructured":"Meng D, Chen H (2017) Magnet: A two-pronged defense against adversarial examples. In: 2017 ACM SIGSAC conference on computer and communications security, CCS, pp 135\u2013147","DOI":"10.1145\/3133956.3134057"},{"key":"10841_CR144","unstructured":"Meng MH, Bai G, Teo SG, Hou Z, Xiao Y, Lin Y, Dong JS (2022) Adversarial robustness of deep neural networks: A survey from a formal verification perspective. IEEE Trans Depend Secure Comput"},{"key":"10841_CR145","unstructured":"Metzen JH, Genewein T, Fischer V, Bischoff B (2017) On detecting adersarial perturbations. In: 5th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR146","unstructured":"Mirman M, Gehr T, Vechev M (2018) Differentiable abstract interpretation for provably robust neural networks. In: International Conference on Machine Learning (ICML). PMLR"},{"key":"10841_CR147","unstructured":"Miyato T, Kataoka T, Koyama M, Yoshida Y (2018) Spectral normalization for generative adversarial networks. In: 6th International Conference on Learning Representations (ICLR)"},{"issue":"8","key":"10841_CR148","doi-asserted-by":"publisher","first-page":"1979","DOI":"10.1109\/TPAMI.2018.2858821","volume":"41","author":"T Miyato","year":"2019","unstructured":"Miyato T, Maeda S, Koyama M, Ishii S (2019) Virtual adversarial training: a regularization method for supervised and semi-supervised learning. IEEE Trans Pattern Anal Mach Intell 41(8):1979\u20131993","journal-title":"IEEE Trans Pattern Anal Mach Intell"},{"issue":"7540","key":"10841_CR149","doi-asserted-by":"publisher","first-page":"529","DOI":"10.1038\/nature14236","volume":"518","author":"V Mnih","year":"2015","unstructured":"Mnih V, Kavukcuoglu K, Silver D, Rusu AA, Veness J, Bellemare MG, Graves A, Riedmiller M, Fidjeland AK, Ostrovski G, Petersen S, Beattie C, Sadik A, Antonoglou I, King H, Kumaran D, Wierstra D, Legg S, Hassabis D (2015) Human-level control through deep reinforcement learning. Nature 518(7540):529\u2013533","journal-title":"Nature"},{"key":"10841_CR150","doi-asserted-by":"crossref","unstructured":"Mok J, Na B, Choe H, Yoon S (2021) Advrush: Searching for adversarially robust neural architectures. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision (ICCV)","DOI":"10.1109\/ICCV48922.2021.01210"},{"key":"10841_CR151","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli S-M, Fawzi A, Frossard P (2016) Deepfool: A simple and accurate method to fool deep neural networks. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR.2016.282"},{"key":"10841_CR152","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli S-M, Fawzi A, Fawzi O, Frossard P (2017) Universal adversarial perturbations. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR.2017.17"},{"key":"10841_CR153","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli S-M, Fawzi A, Fawzi O, Frossard P, Soatto S (2018) Robustness of classifiers to universal perturbations: a geometric perspective. In: 6th international conference on learning representations (ICLR)","DOI":"10.1109\/CVPR.2017.17"},{"issue":"9","key":"10841_CR154","doi-asserted-by":"publisher","first-page":"3154","DOI":"10.1109\/TPAMI.2020.2978474","volume":"43","author":"A Mustafa","year":"2020","unstructured":"Mustafa A, Khan SH, Hayat M, Goecke R, Shen J, Shao L (2020) Deeply supervised discriminative learning for adversarial defense. IEEE Trans Pattern Anal Mach Intell 43(9):3154\u20133166","journal-title":"IEEE Trans Pattern Anal Mach Intell"},{"key":"10841_CR155","unstructured":"Nakkiran P (2019) Adversarial robustness may be at odds with simplicity. arXiv:1901.00532"},{"key":"10841_CR156","unstructured":"Nathan I, Wei W, Helen LH, Yiran C (2019) Feature space perturbations yield more transferable adversarial examples. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)"},{"key":"10841_CR157","doi-asserted-by":"crossref","unstructured":"Nguyen D-L, Arora SS, Wu Y, Yang H (2020) Adversarial light projection attacks on face recognition systems: A feasibility study. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp. 814\u2013815","DOI":"10.1109\/CVPRW50498.2020.00415"},{"key":"10841_CR158","unstructured":"Nie W, Guo B, Huang Y, Xiao C, Vahdat A, Anandkumar A (2022) Diffusion models for adversarial purification. arXiv:2205.07460"},{"key":"10841_CR159","unstructured":"Odena A, Olah C, Shlens J (2017) Conditional image synthesis with auxiliary classifier gans. In: 5th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR160","unstructured":"Pang T, Du C, Zhu J (2017) Robust deep learning via reverse cross-entropy training and thresholding test. arXiv:1706.00633"},{"key":"10841_CR161","unstructured":"Pang T, Xu K, Dong Y, Du C, Chen N, Zhu J (2020) Rethinking softmax cross-entropy loss for adversarial robustness. In: 8th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR162","unstructured":"Pang T, Lin M, Yang X, Zhu J, Yan S (2022) Robustness and accuracy could be reconcilable by (proper) definition. In: International Conference on Machine Learning (ICML). PMLR"},{"key":"10841_CR163","unstructured":"Papernot N, McDaniel P, Goodfellow I (2016) Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv:1605.07277"},{"key":"10841_CR164","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Jha S, Fredrikson M, Celik ZB, Swami A (2016) The limitations of deep learning in adversarial settings. In: IEEE European symposium on security and privacy","DOI":"10.1109\/EuroSP.2016.36"},{"key":"10841_CR165","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Wu X, Jha S, Swami A (2016) Distillation as a defense to adversarial perturbations against deep neural networks. In: 2016 IEEE symposium on security and privacy (SP), IEEE. pp 582\u2013597","DOI":"10.1109\/SP.2016.41"},{"key":"10841_CR166","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Wu X, Jha S, Swami A (2016) Distillation as a defense to adversarial perturbations against deep neural networks. In: IEEE symposium on security and privacy","DOI":"10.1109\/SP.2016.41"},{"key":"10841_CR167","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Goodfellow IJ, Jha S, Celik ZB, Swami A (2017) Practical black-box attacks against machine learning. In: 2017 ACM on Asia conference on computer and communications security, AsiaCCS. pp 506\u2013519","DOI":"10.1145\/3052973.3053009"},{"key":"10841_CR168","unstructured":"Pintor M, Roli F, Brendel W, Biggio B (2021) Fast minimum-norm adversarial attacks through adaptive norm constraints. In: Advances in neural information processing systems (NeurIPS)"},{"key":"10841_CR169","doi-asserted-by":"crossref","unstructured":"Poursaeed O, Katsman I, Gao B, Belongie S (2018) Generative adversarial perturbations. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 4422\u20134431","DOI":"10.1109\/CVPR.2018.00465"},{"key":"10841_CR170","doi-asserted-by":"crossref","unstructured":"Raff E, Sylvester J, Forsyth SS, McLean M (2019) Barrage of random transforms for adversarially robust defense. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR.2019.00669"},{"key":"10841_CR171","unstructured":"Raghunathan A, Steinhardt J, Liang P (2018) Certified defenses against adversarial examples. In: 6th International Conference on Learning Representations (ICLR)"},{"issue":"3","key":"10841_CR172","doi-asserted-by":"publisher","first-page":"346","DOI":"10.1016\/j.eng.2019.12.012","volume":"6","author":"K Ren","year":"2020","unstructured":"Ren K, Zheng T, Qin Z, Liu X (2020) Adversarial attacks and defenses in deep learning. Engineering 6(3):346\u2013360","journal-title":"Engineering"},{"key":"10841_CR173","doi-asserted-by":"crossref","unstructured":"Rony J, Hafemann LG, Oliveira LS, Ayed IB, Sabourin R, Granger E (2019) Decoupling direction and norm for efficient gradient-based l2 adversarial attacks and defenses In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR.2019.00445"},{"key":"10841_CR174","unstructured":"Ru B, Cobb AD, Blaas A, Gal Y (2020) Bayesopt adversarial attack. In: 8th international conference on learning representations (ICLR)"},{"issue":"3","key":"10841_CR175","doi-asserted-by":"publisher","first-page":"211","DOI":"10.1007\/s11263-015-0816-y","volume":"115","author":"O Russakovsky","year":"2015","unstructured":"Russakovsky O, Deng J, Su H, Krause J, Satheesh S, Ma S, Huang Z, Karpathy A, Khosla A, Bernstein MS, Berg AC, Fei-Fei L (2015) Imagenet large scale visual recognition challenge. Int J Comput Vis 115(3):211\u2013252","journal-title":"Int J Comput Vis"},{"key":"10841_CR176","unstructured":"Salman H, Li J, Razenshteyn I, Zhang P, Zhang H, Bubeck S, Yang G (2019) Provably robust deep learning via adversarially trained smoothed classifiers. In: Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"10841_CR177","unstructured":"Samangouei P, Kabkab M, Chellappa R (2018) Defense-gan: Protecting classifiers against adversarial attacks using generative models. In: 6th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR178","unstructured":"Schmidt L, Santurkar S, Tsipras D, Talwar K, Madry A (2018) Adversarially robust generalization requires more data. In: Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"10841_CR179","doi-asserted-by":"crossref","unstructured":"Schwinn L, Nguyen A, Raab R, Zanca D, Eskofier BM, Tenbrinck D, Burger M (2021) Dynamically sampled nonlocal gradients for stronger adversarial attacks. In: 2021 International joint conference on neural networks (IJCNN), IEEE. pp 1\u20138","DOI":"10.1109\/IJCNN52387.2021.9534190"},{"key":"10841_CR180","unstructured":"Sehwag V, Wang S, Mittal P, Jana S (2020) Hydra: Pruning adversarially robust neural networks. In: Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"10841_CR181","unstructured":"Sen S, Ravindran B, Raghunathan A (2020) Empir: Ensembles of mixed precision deep networks for increased robustness against adversarial attacks. In: 8th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR182","doi-asserted-by":"crossref","unstructured":"Shi Y, Wang S, Han Y (2019) Curls & whey: boosting black-box adversarial attacks. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR.2019.00668"},{"key":"10841_CR183","unstructured":"Simonyan K, Zisserman A (2014) Very deep convolutional networks for large-scale image recognition. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)"},{"key":"10841_CR184","unstructured":"Singh G, Gehr T, Mirman M, P\u00fcschel M, Vechev M (2018) Fast and effective robustness certification. In: Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"10841_CR185","unstructured":"Song C, He K, Lin J, Wang L, Hopcroft JE (2020) Robust local features for improving the generalization of adversarial training. In: 8th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR186","unstructured":"Song C, He K, Wang L, Hopcroft JE (2018) Improving the generalization of adversarial training with domain adaptation. In: 6th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR187","unstructured":"Song Y, Kim T, Nowozin S, Ermon S, Kushman N (2018) Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. In: 6th international conference on learning representations (ICLR)"},{"key":"10841_CR188","unstructured":"Song J, Meng C, Ermon S (2020) Denoising diffusion implicit models. In: International Conference on Learning Representations"},{"issue":"1","key":"10841_CR189","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s13635-020-0101-7","volume":"2020","author":"A Sotgiu","year":"2020","unstructured":"Sotgiu A, Demontis A, Melis M, Biggio B, Fumera G, Feng X, Roli F (2020) Deep neural rejection against adversarial examples. EURASIP J Inf Secur 2020(1):1\u201310","journal-title":"EURASIP J Inf Secur"},{"key":"10841_CR190","unstructured":"Sriramanan G, Addepalli S, Baburaj A, Babu RV (2020) Guided adversarial attack for evaluating and enhancing adversarial defenses. In: Advances in neural information processing systems (NeurIPS)"},{"issue":"4","key":"10841_CR191","doi-asserted-by":"publisher","first-page":"341","DOI":"10.1023\/A:1008202821328","volume":"11","author":"R Storn","year":"1997","unstructured":"Storn R, Price K (1997) Differential evolution-a simple and efficient heuristic for global optimization over continuous spaces. J Global Optim 11(4):341\u2013359","journal-title":"J Global Optim"},{"issue":"5","key":"10841_CR192","doi-asserted-by":"publisher","first-page":"828","DOI":"10.1109\/TEVC.2019.2890858","volume":"23","author":"J Su","year":"2019","unstructured":"Su J, Vargas DV, Kouichi S (2019) One pixel attack for fooling deep neural networks. IEEE Trans Evol Comput 23(5):828\u2013841","journal-title":"IEEE Trans Evol Comput"},{"key":"10841_CR193","doi-asserted-by":"crossref","unstructured":"Su D, Zhang H, Chen H, Yi J, Chen P-Y, Gao Y (2018) Is robustness the cost of accuracy?\u2013a comprehensive study on the robustness of 18 deep image classification models. In: Proceedings of the European Conference on Computer Vision (ECCV)","DOI":"10.1007\/978-3-030-01258-8_39"},{"key":"10841_CR194","doi-asserted-by":"crossref","unstructured":"Szegedy C, Liu W, Jia Y, Sermanet P, Reed S, Anguelov D, Erhan D, Vanhoucke V, Rabinovich A. (2015) Going deeper with convolutions. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR.2015.7298594"},{"key":"10841_CR195","unstructured":"Szegedy C, Zaremba W, Sutskever I, Bruna J, Erhan D, Goodfellow IJ, Fergus R (2014) Intriguing properties of neural networks. In: 2th international conference on learning representations (ICLR)"},{"key":"10841_CR196","doi-asserted-by":"crossref","unstructured":"Taghanaki SA, Abhishek K, Azizi S, Hamarneh G (2019) A kernelized manifold mapping to diminish the effect of adversarial perturbations. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR.2019.01160"},{"key":"10841_CR197","unstructured":"Tanay T, Griffin L (2016) A boundary tilting persepective on the phenomenon of adversarial examples. arXiv:1608.07690"},{"key":"10841_CR198","doi-asserted-by":"crossref","unstructured":"Taran O, Rezaeifar S, Holotyak T, Voloshynovskiy S (2019) Defending against adversarial attacks by randomized diversification. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR.2019.01148"},{"key":"10841_CR199","unstructured":"Teng J, Lee G-H, Yuan Y (2020) $$l_1$$ adversarial robustness certificates: a randomized smoothing approach. In: 8th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR200","doi-asserted-by":"crossref","unstructured":"Theagarajan R, Chen M, Bhanu B, Zhang J (2019) Shieldnets: Defending against adversarial attacks using probabilistic adversarial robustness. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR.2019.00715"},{"key":"10841_CR201","unstructured":"Tjeng V, Xiao K, Tedrake R (2019) Evaluating robustness of neural networks with mixed integer programming. In: 7th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR202","unstructured":"Tram\u00e8r F, Kurakin A, Papernot N, Goodfellow IJ, Boneh D, McDaniel P (2018) Ensemble adversarial training: attacks and defenses. In: 6th International conference on learning representations (ICLR)"},{"key":"10841_CR203","unstructured":"Tram\u00e8r F, Papernot N, Goodfellow IJ, Boneh D, McDaniel PD (2017) The space of transferable adversarial examples. arXiv:1704.03453"},{"key":"10841_CR204","unstructured":"Tsipras D, Santurkar S, Engstrom L, Turner A, Madry A (2018) Robustness may be at odds with accuracy. In: 6th international conference on learning representations (ICLR)"},{"key":"10841_CR205","unstructured":"Tsipras D, Santurkar S, Engstrom L, Turner A, Madry A (2019) Robustness may be at odds with accuracy. In: 7th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR206","unstructured":"Tsuzuku Y, Sato I, Sugiyama M (2018) Lipschitz-margin training: Scalable certification of perturbation invariance for deep neural networks. In: Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"10841_CR207","doi-asserted-by":"crossref","unstructured":"Tu C-C, Ting P, Chen P-Y, Liu S, Zhang H, Yi J, Hsieh C-J, Cheng S-M (2019) Autozoom: Autoencoder-based zeroth order optimization method for attacking black-box neural networks. In: Proceedings of the AAAI conference on artificial intelligence (AAAI)","DOI":"10.1609\/aaai.v33i01.3301742"},{"key":"10841_CR208","doi-asserted-by":"crossref","unstructured":"Vivek BS, Babu RV (2020) Single-step adversarial training with dropout scheduling. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR42600.2020.00103"},{"key":"10841_CR209","doi-asserted-by":"crossref","unstructured":"Wang X, He K (2021) Enhancing the transferability of adversarial attacks through variance tuning. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR46437.2021.00196"},{"key":"10841_CR210","unstructured":"Wang X, He K, Song C, Wang L, Hopcroft JE (2019) At-gan: An adversarial generator model for non-constrained adversarial examples. arXiv preprint arXiv:1904.07793"},{"key":"10841_CR211","doi-asserted-by":"crossref","unstructured":"Wang X, He X, Wang J, He K (2021) Admix: enhancing the transferability of adversarial attacks. In: Proceedings of the IEEE\/CVF international conference on computer vision (ICCV)","DOI":"10.1109\/ICCV48922.2021.01585"},{"key":"10841_CR212","unstructured":"Wang J, Lyu Z, Lin D, Dai B, Fu H (2022) Guided diffusion model for adversarial purification. arXiv:2205.14969"},{"key":"10841_CR213","unstructured":"Wang S, Pei K, Whitehouse J, Yang J, Jana S (2018) Efficient formal safety analysis of neural networks. In: Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"10841_CR214","doi-asserted-by":"crossref","unstructured":"Wang H, Wang S, Jin Z, Wang Y, Chen C, Tistarelli M (2021) Similarity-based gray-box adversarial attack against deep face recognition. In: 2021 16th IEEE international conference on automatic face and gesture recognition (FG 2021), IEEE. pp 1\u20138","DOI":"10.1109\/FG52635.2021.9667076"},{"key":"10841_CR215","unstructured":"Wang H, Yu C-N (2019) A direct approach to robust deep learning using adversarial networks. In: 7th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR216","unstructured":"Wang Y, Zou D, Yi J, Bailey J, Ma X, Gu Q (2020) Improving adversarial robustness requires revisiting misclassified examples. In: 8th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR217","unstructured":"Weng T-W, Zhang H, Chen H, Song Z, Hsieh C-J, Boning DS, Dhillon IS, Daniel L (2018) Towards fast computation of certified robustness for relu networks. In: International Conference on Machine Learning (ICML). PMLR"},{"key":"10841_CR218","unstructured":"Wiyatno RR, Xu A, Dia OA, Berker AO (2019) Adversarial examples in modern machine learning: a review. arXiv:1911.05268"},{"key":"10841_CR219","unstructured":"Wong E, Kolter Z (2018) Provable defenses against adversarial examples via the convex outer adversarial polytope. In: International Conference on Machine Learning (ICML). PMLR"},{"key":"10841_CR220","unstructured":"Wong E, Schmidt FR, Metzen JH, Kolter JZ (2018) Scaling provable adversarial defenses. In: Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"10841_CR221","doi-asserted-by":"crossref","unstructured":"Wu W, Su Y, Lyu MR, King I (2021) Improving the transferability of adversarial samples with adversarial transformations. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR46437.2021.00891"},{"key":"10841_CR222","unstructured":"Wu D, Wang Y, Xia S-T, Bailey J, Ma X (2020) Skip connections matter: On the transferability of adversarial examples generated with resnets. In: 8th International conference on learning representations (ICLR)"},{"key":"10841_CR223","doi-asserted-by":"crossref","unstructured":"Xiao C, Li B, Zhu J-Y, He W, Liu M, Song D (2018) Generating adversarial examples with adversarial networks. In: International Joint Conference on Artificial Intelligence (IJCAI)","DOI":"10.24963\/ijcai.2018\/543"},{"key":"10841_CR224","doi-asserted-by":"crossref","unstructured":"Xiao C, Zheng C (2020) One man\u2019s trash is another man\u2019s treasure: Resisting adversarial examples by adversarial examples. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR42600.2020.00049"},{"key":"10841_CR225","unstructured":"Xiao C, Zhong P, Zheng C (2020) Enhancing adversarial defense by k-winners-take-all. In: 8th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR226","doi-asserted-by":"crossref","unstructured":"Xie C, Wu Y, Maaten L, Yuille AL, He K (2019) Feature denoising for improving adversarial robustness. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR.2019.00059"},{"key":"10841_CR227","unstructured":"Xie C, Yuille AL (2020) Intriguing properties of adversarial training at scale. In: 8th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR228","doi-asserted-by":"crossref","unstructured":"Xie C, Zhang Z, Zhou Y, Bai S, Wang J, Ren Z, Yuille AL (2019) Improving transferability of adversarial examples with input diversity. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR.2019.00284"},{"key":"10841_CR229","doi-asserted-by":"crossref","unstructured":"Xiong Y, Lin J, Zhang M, Hopcroft JE, He K (2022) Stochastic variance reduced ensemble adversarial attack for boosting the adversarial transferability. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR52688.2022.01456"},{"key":"10841_CR230","doi-asserted-by":"crossref","unstructured":"Xu W, Evans D, Qi Y (2018) Feature squeezing: Detecting adversarial examples in deep neural networks. In: Network and Distributed System Security Symposium","DOI":"10.14722\/ndss.2018.23198"},{"key":"10841_CR231","unstructured":"Yang G, Duan T, Hu JE, Salman H, Razenshteyn I, Li J (2020) Randomized smoothing of all shapes and sizes. In: International Conference on Machine Learning (ICML). PMLR"},{"key":"10841_CR232","unstructured":"Yang J, Jiang Y, Huang X, Ni B, Zhao C (2020) Learning black-box attackers with transferable priors and query feedback. In: Advances in neural information processing systems (NeurIPS)"},{"key":"10841_CR233","unstructured":"Yao C, Bielik P, Tsankov P, Vechev M (2021) Automated discovery of adaptive attacks on adversarial defenses. In: Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"10841_CR234","doi-asserted-by":"crossref","unstructured":"Yuan Z, Zhang J, Jia Y, Tan C, Xue T, Shan S (2021) Meta gradient adversarial attack. In: Proceedings of the IEEE\/CVF international conference on computer vision (ICCV)","DOI":"10.1109\/ICCV48922.2021.00765"},{"key":"10841_CR235","doi-asserted-by":"crossref","unstructured":"Yu Y, Gao X, Xu C-Z (2021) Lafeat: piercing through adversarial defenses with latent features. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR46437.2021.00568"},{"key":"10841_CR236","doi-asserted-by":"crossref","unstructured":"Zantedeschi V, Nicolae M-I, Rawat A (2017) Efficient defenses against adversarial attacks. In: Proceedings of the 10th ACM workshop on artificial intelligence and security, pp 39\u201349","DOI":"10.1145\/3128572.3140449"},{"issue":"7","key":"10841_CR237","first-page":"2578","volume":"31","author":"J Zhang","year":"2019","unstructured":"Zhang J, Li C (2019) Adversarial examples: opportunities and challenges. IEEE Trans Neural Netw Learn Syst 31(7):2578\u20132593","journal-title":"IEEE Trans Neural Netw Learn Syst"},{"key":"10841_CR238","doi-asserted-by":"publisher","first-page":"1291","DOI":"10.1109\/TIP.2020.3042083","volume":"30","author":"C Zhang","year":"2020","unstructured":"Zhang C, Liu A, Liu X, Xu Y, Yu H, Ma Y, Li T (2020) Interpreting and improving adversarial robustness of deep neural networks with neuron sensitivity. IEEE Trans Image Process 30:1291\u20131304","journal-title":"IEEE Trans Image Process"},{"key":"10841_CR239","doi-asserted-by":"publisher","first-page":"4804","DOI":"10.1109\/TIP.2020.2975918","volume":"29","author":"Y Zhang","year":"2020","unstructured":"Zhang Y, Tian X, Li Y, Wang X, Tao D (2020) Principal component adversarial example. IEEE Trans Image Process 29:4804\u20134815","journal-title":"IEEE Trans Image Process"},{"key":"10841_CR240","unstructured":"Zhang H, Chen H, Song Z, Boning DS, Dhillon IS, Hsieh C-J (2019) The limitations of adversarial training and the blind-spot attack. In: 7th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR241","doi-asserted-by":"crossref","unstructured":"Zhang J, Huang J-t, Wang W, Li Y, Wu W, Wang X, Su Y, Lyu MR (2023) Improving the transferability of adversarial samples by path-augmented method. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR52729.2023.00790"},{"key":"10841_CR242","doi-asserted-by":"crossref","unstructured":"Zhang J, Huang Y, Wu W, Lyu MR (2023) Transferable adversarial attacks on vision transformers with token gradient regularization. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR52729.2023.01575"},{"key":"10841_CR243","unstructured":"Zhang H, Weng T-W, Chen P-Y, Hsieh C-J, Daniel L (2018) Efficient neural network robustness certification with general activation functions. In: Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"10841_CR244","doi-asserted-by":"crossref","unstructured":"Zhang J, Wu W, Huang J-t, Huang Y, Wang W, Su Y, Lyu MR (2022) Improving adversarial transferability via neuron attribution-based attacks. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR52688.2022.01457"},{"key":"10841_CR245","doi-asserted-by":"crossref","unstructured":"Zhang R, Xia H, Hu C, Zhang C, Liu C, Xiao F (2022) Generating adversarial examples with shadow model. IEEE Trans Ind Inf","DOI":"10.1109\/TII.2021.3139902"},{"key":"10841_CR246","unstructured":"Zhang D, Ye M, Gong C, Zhu Z, Liu Q (2020) Black-box certification with randomized smoothing: A functional optimization based framework. In: Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"10841_CR247","unstructured":"Zhang H, Yu Y, Jiao J, Xing EP, Ghaoui LE, Jordan MI (2019) Theoretically principled trade-off between robustness and accuracy. In: International Conference on Machine Learning (ICML). PMLR"},{"key":"10841_CR248","unstructured":"Zhao Z, Dua D, Singh S (2017) Generating natural adversarial examples. In: 5th International Conference on Learning Representations (ICLR)"},{"key":"10841_CR249","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2022.109009","volume":"133","author":"X Zheng","year":"2023","unstructured":"Zheng X, Fan Y, Wu B, Zhang Y, Wang J, Pan S (2023) Robust physical-world attacks on face recognition. Pattern Recogn 133:109009","journal-title":"Pattern Recogn"},{"key":"10841_CR250","doi-asserted-by":"crossref","unstructured":"Zheng T, Chen C, Ren K (2019) Distributionally adversarial attack. In: Proceedings of the AAAI Conference on Artificial Intelligence (AAAI)","DOI":"10.1609\/aaai.v33i01.33012253"},{"key":"10841_CR251","unstructured":"Zheng Z, Hong P (2018) Robust detection of adversarial attacks by modeling the intrinsic properties of deep neural networks. In: Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"10841_CR252","doi-asserted-by":"crossref","unstructured":"Zheng H, Zhang Z, Gu J, Lee H, Prakash A (2020) Efficient adversarial training with transferable adversarial examples. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR42600.2020.00126"},{"key":"10841_CR253","doi-asserted-by":"crossref","unstructured":"Zhong Y, Liu X, Zhai D, Jiang J, Ji X (2022) Shadows can be dangerous: Stealthy and effective physical-world adversarial attack by natural phenomenon. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR52688.2022.01491"},{"key":"10841_CR254","doi-asserted-by":"crossref","unstructured":"Zhou D, Wang N, Peng C, Gao X, Wang X, Yu J, Liu T (2021) Removing adversarial noise in class activation feature space. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision (ICCV)","DOI":"10.1109\/ICCV48922.2021.00778"},{"key":"10841_CR255","doi-asserted-by":"crossref","unstructured":"Zi B, Zhao S, Ma X, Jiang Y-G (2021) Revisiting adversarial robustness distillation: Robust soft labels make student better. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision (ICCV)","DOI":"10.1109\/ICCV48922.2021.01613"}],"container-title":["Artificial Intelligence Review"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10462-024-10841-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10462-024-10841-z\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10462-024-10841-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,8,17]],"date-time":"2024-08-17T05:11:46Z","timestamp":1723871506000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10462-024-10841-z"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,7,8]]},"references-count":255,"journal-issue":{"issue":"8","published-online":{"date-parts":[[2024,8]]}},"alternative-id":["10841"],"URL":"https:\/\/doi.org\/10.1007\/s10462-024-10841-z","relation":{},"ISSN":["1573-7462"],"issn-type":[{"value":"1573-7462","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,7,8]]},"assertion":[{"value":"24 June 2024","order":1,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"8 July 2024","order":2,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}],"article-number":"199"}}