{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T22:40:59Z","timestamp":1784328059514,"version":"3.55.0"},"reference-count":38,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2017,8,25]],"date-time":"2017-08-25T00:00:00Z","timestamp":1503619200000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Mach Learn"],"published-print":{"date-parts":[[2018,3]]},"DOI":"10.1007\/s10994-017-5663-3","type":"journal-article","created":{"date-parts":[[2017,8,25]],"date-time":"2017-08-25T18:59:11Z","timestamp":1503687551000},"page":"481-508","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":152,"title":["Analysis of classifiers\u2019 robustness to adversarial perturbations"],"prefix":"10.1007","volume":"107","author":[{"given":"Alhussein","family":"Fawzi","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Omar","family":"Fawzi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Pascal","family":"Frossard","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2017,8,25]]},"reference":[{"key":"5663_CR1","unstructured":"Barreno, M., Nelson, B., Sears, R., Joseph, A., & Tygar, D. (2006). Can machine learning be secure? In ACM symposium on information, computer and communications security (pp. 16\u201325)."},{"key":"5663_CR2","doi-asserted-by":"crossref","unstructured":"Bendale, A., & Boult, T. E. (2016). Towards open set deep networks. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 1563\u20131572).","DOI":"10.1109\/CVPR.2016.173"},{"key":"5663_CR3","volume-title":"Matrix analysis","author":"R Bhatia","year":"2013","unstructured":"Bhatia, R. (2013). Matrix analysis (Vol. 169). Berlin: Springer."},{"key":"5663_CR4","unstructured":"Biggio, B., Corona, I., Maiorca, D., Nelson, B., \u0160rndi\u0107, N., Laskov, P., et al. (2013). Evasion attacks against machine learning at test time. In Joint European conference on machine learning and knowledge discovery in databases (pp. 387\u2013402). Berlin: Springer."},{"key":"5663_CR5","unstructured":"Biggio, B., Nelson, B., & Laskov, P. (2012). Poisoning attacks against support vector machines. In International conference on machine learning (ICML)."},{"key":"5663_CR6","first-page":"499","volume":"2","author":"O Bousquet","year":"2002","unstructured":"Bousquet, O., & Elisseeff, A. (2002). Stability and generalization. The Journal of Machine Learning Research, 2, 499\u2013526.","journal-title":"The Journal of Machine Learning Research"},{"key":"5663_CR7","volume-title":"Optimization for machine learning","author":"C Caramanis","year":"2012","unstructured":"Caramanis, C., Mannor, S., & Xu, H. (2012). Robust optimization in machine learning. In S. Sra, S. Nowozin, & S. J. Wright (Eds.), Optimization for machine learning. Cambridge: MIT Press. chap\u00a014."},{"key":"5663_CR8","unstructured":"Carlini, N., & Wagner, D. (2016). Towards evaluating the robustness of neural networks. arXiv preprint arXiv:1608.04644 ."},{"key":"5663_CR9","unstructured":"Chalupka, K., Perona, P., & Eberhardt, F. (2014). Visual causal feature learning. arXiv preprint arXiv:1412.2309 ."},{"key":"5663_CR10","doi-asserted-by":"publisher","first-page":"27:1","DOI":"10.1145\/1961189.1961199","volume":"2","author":"CC Chang","year":"2011","unstructured":"Chang, C. C., & Lin, C. J. (2011). LIBSVM: A library for support vector machines. ACM Transactions on Intelligent Systems and Technology, 2, 27:1\u201327:27.","journal-title":"ACM Transactions on Intelligent Systems and Technology"},{"key":"5663_CR11","first-page":"1471","volume":"11","author":"YW Chang","year":"2010","unstructured":"Chang, Y. W., Hsieh, C. J., Chang, K. W., Ringgaard, M., & Lin, C. J. (2010). Training and testing low-degree polynomial data mappings via linear SVM. The Journal of Machine Learning Research, 11, 1471\u20131490.","journal-title":"The Journal of Machine Learning Research"},{"key":"5663_CR12","doi-asserted-by":"crossref","unstructured":"Dalvi, N., Domingos, P., Sanghai, S., & Verma, D. (2004). Adversarial classification. In ACM SIGKDD (pp. 99\u2013108).","DOI":"10.1145\/1014052.1014066"},{"issue":"2","key":"5663_CR13","doi-asserted-by":"publisher","first-page":"149","DOI":"10.1007\/s10994-009-5124-8","volume":"81","author":"O Dekel","year":"2010","unstructured":"Dekel, O., Shamir, O., & Xiao, L. (2010). Learning to classify with missing and corrupted features. Machine Learning, 81(2), 149\u2013178.","journal-title":"Machine Learning"},{"key":"5663_CR14","first-page":"1871","volume":"9","author":"RW Fan","year":"2008","unstructured":"Fan, R. W., Chang, K. W., Hsieh, C. J., Wang, X. R., & Lin, C. J. (2008). Liblinear: A library for large linear classification. The Journal of Machine Learning Research, 9, 1871\u20131874.","journal-title":"The Journal of Machine Learning Research"},{"key":"5663_CR15","doi-asserted-by":"crossref","unstructured":"Fawzi, A., & Frossard, P. (2015) Manitest: Are classifiers really invariant? In British machine vision conference (BMVC) (pp. 106.1\u2013106.13).","DOI":"10.5244\/C.29.106"},{"key":"5663_CR16","unstructured":"Goldberg, Y., & Elhadad, M. (2008). splitsvm: Fast, space-efficient, non-heuristic, polynomial kernel computation for nlp applications. In 46th Annual meeting of the association for computational linguistics on human language technologies: Short papers (pp. 237\u2013240)."},{"key":"5663_CR17","unstructured":"Goodfellow, I. (2015). Adversarial examples. http:\/\/www.iro.umontreal.ca\/~memisevr\/dlss2015\/goodfellow_adv.pdf , presentation at the Deep Learning Summer School, Montreal."},{"key":"5663_CR18","unstructured":"Goodfellow, I., Shlens, J., & Szegedy, C. (2015). Explaining and harnessing adversarial examples. In International conference on learning representations."},{"key":"5663_CR19","unstructured":"Gu, S., & Rigazio, L. (2014). Towards deep neural network architectures robust to adversarial examples. arXiv preprint arXiv:1412.5068 ."},{"key":"5663_CR20","unstructured":"Krizhevsky, A., & Hinton, G. (2009). Learning multiple layers of features from tiny images. Master\u2019s thesis, Department of Computer Science, University of Toronto."},{"key":"5663_CR21","first-page":"555","volume":"3","author":"G Lanckriet","year":"2003","unstructured":"Lanckriet, G., Ghaoui, L., Bhattacharyya, C., & Jordan, M. (2003). A robust minimax approach to classification. The Journal of Machine Learning Research, 3, 555\u2013582.","journal-title":"The Journal of Machine Learning Research"},{"issue":"11","key":"5663_CR22","doi-asserted-by":"publisher","first-page":"2278","DOI":"10.1109\/5.726791","volume":"86","author":"Y LeCun","year":"1998","unstructured":"LeCun, Y., Bottou, L., Bengio, Y., & Haffner, P. (1998). Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11), 2278\u20132324.","journal-title":"Proceedings of the IEEE"},{"key":"5663_CR23","unstructured":"Lewis, A., & Pang, J. (1998). Error bounds for convex inequality systems. In J.-P. Crouzeix, J.-E. Martinez-Legaz, & M. Volle (Eds.), Generalized convexity, generalized monotonicity: Recent results (pp. 75\u2013110). Berlin: Springer."},{"key":"5663_CR24","doi-asserted-by":"crossref","unstructured":"Li, G., Mordukhovich, B. S., & Pham, T. S. (2015). New fractional error bounds for polynomial systems with applications to H\u00f6lderian stability in optimization and spectral theory of tensors. Mathematical Programming, 153(2), 333\u2013362.","DOI":"10.1007\/s10107-014-0806-9"},{"key":"5663_CR25","unstructured":"\u0141ojasiewicz, S. (1961). Sur le probleme de la division (to complete)."},{"issue":"2","key":"5663_CR26","doi-asserted-by":"publisher","first-page":"91","DOI":"10.1023\/B:VISI.0000029664.99615.94","volume":"60","author":"D Lowe","year":"2004","unstructured":"Lowe, D. (2004). Distinctive image features from scale-invariant keypoints. International Journal of Computer Vision, 60(2), 91\u2013110.","journal-title":"International Journal of Computer Vision"},{"issue":"2","key":"5663_CR27","doi-asserted-by":"publisher","first-page":"475","DOI":"10.1109\/18.312167","volume":"40","author":"G Lugosi","year":"1994","unstructured":"Lugosi, G., & Pawlak, M. (1994). On the posterior-probability estimate of the error rate of nonparametric classification rules. IEEE Transactions on Information Theory, 40(2), 475\u2013481.","journal-title":"IEEE Transactions on Information Theory"},{"issue":"2","key":"5663_CR28","doi-asserted-by":"publisher","first-page":"383","DOI":"10.1137\/0804021","volume":"4","author":"X Luo","year":"1994","unstructured":"Luo, X., & Luo, Z. (1994). Extension of Hoffman\u2019s error bound to polynomial systems. SIAM Journal on Optimization, 4(2), 383\u2013392.","journal-title":"SIAM Journal on Optimization"},{"issue":"1\u20133","key":"5663_CR29","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/BF01582210","volume":"67","author":"ZQ Luo","year":"1994","unstructured":"Luo, Z. Q., & Pang, J. S. (1994). Error bounds for analytic systems and their applications. Mathematical Programming, 67(1\u20133), 1\u201328.","journal-title":"Mathematical Programming"},{"key":"5663_CR30","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4613-0039-7","volume-title":"Lectures on discrete geometry","author":"J Matou\u0161ek","year":"2002","unstructured":"Matou\u0161ek, J. (2002). Lectures on discrete geometry (Vol. 108). New York: Springer."},{"key":"5663_CR31","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S. M., Fawzi, A., & Frossard, P. (2016). Deepfool: A simple and accurate method to fool deep neural networks. In IEEE conference on computer vision and pattern recognition (CVPR).","DOI":"10.1109\/CVPR.2016.282"},{"issue":"3","key":"5663_CR32","doi-asserted-by":"publisher","first-page":"601","DOI":"10.1023\/B:JOTA.0000004873.30548.ca","volume":"118","author":"K Ng","year":"2003","unstructured":"Ng, K., & Zheng, X. (2003). Error bounds of constrained quadratic functions and piecewise affine inequality systems. Journal of Optimization Theory and Applications, 118(3), 601\u2013618.","journal-title":"Journal of Optimization Theory and Applications"},{"key":"5663_CR33","unstructured":"Nguyen, A., Yosinski, J., & Clune, J. (2014). Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. arXiv preprint arXiv:1412.1897 ."},{"issue":"1\u20133","key":"5663_CR34","first-page":"299","volume":"79","author":"J Pang","year":"1997","unstructured":"Pang, J. (1997). Error bounds in mathematical programming. Mathematical Programming, 79(1\u20133), 299\u2013332.","journal-title":"Mathematical Programming"},{"key":"5663_CR35","unstructured":"Simonyan, K., & Zisserman, A. (2014). Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 ."},{"key":"5663_CR36","doi-asserted-by":"crossref","unstructured":"Srndic, N., & Laskov, P. (2014). Practical evasion of a learning-based classifier: A case study. In IEEE symposium on security and privacy (pp. 197\u2013211). IEEE.","DOI":"10.1109\/SP.2014.20"},{"key":"5663_CR37","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., et al. (2014). Intriguing properties of neural networks. In International conference on learning representations (ICLR)."},{"key":"5663_CR38","first-page":"1485","volume":"10","author":"H Xu","year":"2009","unstructured":"Xu, H., Caramanis, C., & Mannor, S. (2009). Robustness and regularization of support vector machines. The Journal of Machine Learning Research, 10, 1485\u20131510.","journal-title":"The Journal of Machine Learning Research"}],"container-title":["Machine Learning"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s10994-017-5663-3\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10994-017-5663-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10994-017-5663-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,8,1]],"date-time":"2022-08-01T20:06:35Z","timestamp":1659384395000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s10994-017-5663-3"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,8,25]]},"references-count":38,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2018,3]]}},"alternative-id":["5663"],"URL":"https:\/\/doi.org\/10.1007\/s10994-017-5663-3","relation":{},"ISSN":["0885-6125","1573-0565"],"issn-type":[{"value":"0885-6125","type":"print"},{"value":"1573-0565","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,8,25]]}}}