{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,20]],"date-time":"2026-06-20T10:34:05Z","timestamp":1781951645164,"version":"3.54.5"},"reference-count":104,"publisher":"Springer Science and Business Media LLC","issue":"2","license":[{"start":{"date-parts":[[2024,3,5]],"date-time":"2024-03-05T00:00:00Z","timestamp":1709596800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2024,3,5]],"date-time":"2024-03-05T00:00:00Z","timestamp":1709596800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62172434"],"award-info":[{"award-number":["62172434"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62172434"],"award-info":[{"award-number":["62172434"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62172434"],"award-info":[{"award-number":["62172434"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62172434"],"award-info":[{"award-number":["62172434"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62172434"],"award-info":[{"award-number":["62172434"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62172434"],"award-info":[{"award-number":["62172434"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Neural Process Lett"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Deep neural networks, particularly convolutional neural networks, are vulnerable to adversarial examples, undermining their reliability in visual recognition tasks. Adversarial example detection is a crucial defense mechanism against such attacks but often relies on empirical observations and specialized metrics, posing challenges in terms of data efficiency, generalization to unknown attacks, and scalability to high-resolution datasets like ImageNet. To address these issues, we propose a prototypical network-based method using a deep residual network as the backbone architecture. This approach is capable of extracting discriminative features of adversarial and normal examples from various known adversarial examples by constructing few-shot adversarial detection tasks. Then the optimal mapping matrix is computed using the Sinkhorn algorithm from optimal transport theory, and the class centers are iteratively updated, enabling the detection of unknown adversarial examples across scenarios. Experimental results show that the proposed approach outperforms existing methods in the cross-adversary benchmark and achieves enhanced generalization on a subset of ImageNet in detecting both new adversarial attacks and adaptive white-box attacks. The proposed approach offers a promising solution for improving the safety of deep neural networks in practical applications.<\/jats:p>","DOI":"10.1007\/s11063-024-11572-6","type":"journal-article","created":{"date-parts":[[2024,3,5]],"date-time":"2024-03-05T19:02:12Z","timestamp":1709665332000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["Enhancing Generalization in Few-Shot Learning for Detecting Unknown Adversarial Examples"],"prefix":"10.1007","volume":"56","author":[{"given":"Wenzhao","family":"Liu","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wanli","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kuiwu","family":"Yang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yue","family":"Chen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kaiwei","family":"Guo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jianghong","family":"Wei","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2024,3,5]]},"reference":[{"key":"11572_CR1","doi-asserted-by":"publisher","first-page":"14410","DOI":"10.1109\/ACCESS.2018.2807385","volume":"6","author":"N Akhtar","year":"2018","unstructured":"Akhtar N, Mian A (2018) Threat of adversarial attacks on deep learning in computer vision: a survey. IEEE Access 6:14410\u201314430","journal-title":"IEEE Access"},{"issue":"6","key":"11572_CR2","doi-asserted-by":"publisher","first-page":"4403","DOI":"10.1007\/s10462-021-10125-w","volume":"55","author":"A Aldahdooh","year":"2022","unstructured":"Aldahdooh A, Hamidouche W, Fezza SA et al (2022) Adversarial example detection for DNN models: a review and experimental comparison. Artif Intell Rev 55(6):4403\u20134462","journal-title":"Artif Intell Rev"},{"issue":"1","key":"11572_CR3","doi-asserted-by":"publisher","first-page":"509","DOI":"10.1007\/s10489-022-03373-y","volume":"53","author":"A Aldahdooh","year":"2023","unstructured":"Aldahdooh A, Hamidouche W, D\u00e9forges O (2023) Revisiting model\u2019s uncertainty and confidences for adversarial example detection. Appl Intell 53(1):509\u2013531","journal-title":"Appl Intell"},{"key":"11572_CR4","doi-asserted-by":"crossref","unstructured":"Andriushchenko M, Croce F, Flammarion N, et\u00a0al (2020) Square attack: a query-efficient black-box adversarial attack via random search. In: Computer vision\u2013ECCV 2020: 16th European conference, Glasgow, UK, August 23\u201328, 2020, Proceedings, Part XXIII. Springer, pp 484\u2013501","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"11572_CR5","unstructured":"Antoniou A, Edwards H, Storkey A (2018) How to train your MAML. arXiv:1810.09502"},{"key":"11572_CR6","unstructured":"Athalye A, Carlini N, Wagner D (2018) Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In: International conference on machine learning, PMLR, pp 274\u2013283"},{"key":"11572_CR7","unstructured":"Bhattad A, Chong MJ, Liang K, et\u00a0al (2019) Unrestricted adversarial examples via semantic manipulation. arXiv:1904.06347"},{"key":"11572_CR8","unstructured":"Bojarski M, Del\u00a0Testa D, Dworakowski D, et\u00a0al (2016) End to end learning for self-driving cars. arXiv:1604.07316"},{"key":"11572_CR9","unstructured":"Brown TB, Carlini N, Zhang C, et\u00a0al (2018) Unrestricted adversarial examples. arXiv:1809.08352"},{"key":"11572_CR10","unstructured":"Buckman J, Roy A, Raffel C, et\u00a0al (2018) Thermometer encoding: one hot way to resist adversarial examples. In: International conference on learning representations"},{"key":"11572_CR11","doi-asserted-by":"crossref","unstructured":"Carlini N, Wagner D (2017) Adversarial examples are not easily detected: bypassing ten detection methods. In: Proceedings of the 10th ACM workshop on artificial intelligence and security, pp 3\u201314","DOI":"10.1145\/3128572.3140444"},{"key":"11572_CR12","doi-asserted-by":"crossref","unstructured":"Carlini N, Wagner D (2017) Towards evaluating the robustness of neural networks. In: 2017 IEEE symposium on security and privacy (SP). IEEE, pp 39\u201357","DOI":"10.1109\/SP.2017.49"},{"key":"11572_CR13","doi-asserted-by":"crossref","unstructured":"Carrara F, Becarelli R, Caldelli R, et\u00a0al (2018) Adversarial examples detection in features distance spaces. In: Proceedings of the European conference on computer vision (ECCV) workshops, pp 313\u2013327","DOI":"10.1007\/978-3-030-11012-3_26"},{"key":"11572_CR14","doi-asserted-by":"crossref","unstructured":"Chen K, Chen Y, Zhou H et al (2021) Adversarial examples detection beyond image space. In: ICASSP 2021\u20132021 IEEE international conference on acoustics, speech and signal processing (ICASSP). IEEE, pp 3850\u20133854","DOI":"10.1109\/ICASSP39728.2021.9414008"},{"key":"11572_CR15","doi-asserted-by":"crossref","unstructured":"Chen PY, Sharma Y, Zhang H, et\u00a0al (2018) EAD: Elastic-net attacks to deep neural networks via adversarial examples. In: Proceedings of the AAAI conference on artificial intelligence","DOI":"10.1609\/aaai.v32i1.11302"},{"key":"11572_CR16","unstructured":"Chen WY, Liu YC, Kira Z, et\u00a0al (2019) A closer look at few-shot classification. arXiv:1904.04232"},{"key":"11572_CR17","doi-asserted-by":"crossref","unstructured":"Cohen G, Sapiro G, Giryes R (2020) Detecting adversarial samples using influence functions and nearest neighbors. In: Proceedings of the IEEE\/CVF Conference on computer vision and pattern recognition, pp 14453\u201314462","DOI":"10.1109\/CVPR42600.2020.01446"},{"key":"11572_CR18","unstructured":"Croce F, Hein M (2020) Minimally distorted adversarial examples with a fast adaptive boundary attack. In: International conference on machine learning, PMLR, pp 2196\u20132205"},{"key":"11572_CR19","unstructured":"Croce F, Hein M (2020) Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In: International conference on machine learning, PMLR, pp 2206\u20132216"},{"key":"11572_CR20","unstructured":"Cuturi M (2013) Sinkhorn distances: lightspeed computation of optimal transport. In: Advances in neural information processing systems, vol 26"},{"key":"11572_CR21","doi-asserted-by":"crossref","unstructured":"Deng J, Dong W, Socher R, et\u00a0al (2009) Imagenet: a large-scale hierarchical image database. In: 2009 IEEE conference on computer vision and pattern recognition. IEEE, pp 248\u2013255","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"11572_CR22","doi-asserted-by":"crossref","unstructured":"Ding X, Zhang X, Han J, et\u00a0al (2022) Scaling up your kernels to 31x31: revisiting large kernel design in CNNS. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 11963\u201311975","DOI":"10.1109\/CVPR52688.2022.01166"},{"key":"11572_CR23","doi-asserted-by":"crossref","unstructured":"Dong Y, Liao F, Pang T, et\u00a0al (2018) Boosting adversarial attacks with momentum. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 9185\u20139193","DOI":"10.1109\/CVPR.2018.00957"},{"key":"11572_CR24","unstructured":"Engstrom L, Tran B, Tsipras D, et\u00a0al (2019) Exploring the landscape of spatial robustness. In: International conference on machine learning, PMLR, pp 1802\u20131811"},{"key":"11572_CR25","unstructured":"Eniser HF, Christakis M, W\u00fcstholz V (2020) Raid: randomized adversarial-input detection for neural networks. arXiv:2002.02776"},{"key":"11572_CR26","unstructured":"Feinman R, Curtin RR, Shintre S, et\u00a0al (2017) Detecting adversarial samples from artifacts. arXiv:1703.00410"},{"key":"11572_CR27","doi-asserted-by":"crossref","unstructured":"Fidel G, Bitton R, Shabtai A (2020) When explainability meets adversarial learning: detecting adversarial examples using shap signatures. In: 2020 International joint conference on neural networks (IJCNN). IEEE, pp 1\u20138","DOI":"10.1109\/IJCNN48605.2020.9207637"},{"key":"11572_CR28","unstructured":"Finn C, Abbeel P, Levine S (2017) Model-agnostic meta-learning for fast adaptation of deep networks. In: Proceedings of the 34th international conference on machine learning, PMLR, pp 1126\u20131135"},{"key":"11572_CR29","doi-asserted-by":"crossref","unstructured":"Freitas S, Chen ST, Wang ZJ, et\u00a0al (2020) Unmask: Adversarial detection and defense through robust feature alignment. In: 2020 IEEE international conference on big data (big data). IEEE, pp 1081\u20131088","DOI":"10.1109\/BigData50022.2020.9378303"},{"key":"11572_CR30","unstructured":"Goodfellow I, Qin Y, Berthelot D (2019) Evaluation methodology for attacks against confidence thresholding models. https:\/\/openreview.net\/forum\/id=H1g0piA9tQ"},{"key":"11572_CR31","unstructured":"Goodfellow IJ, Shlens J, Szegedy C (2014) Explaining and harnessing adversarial examples. arXiv:1412.6572"},{"key":"11572_CR32","unstructured":"Grosse K, Manoharan P, Papernot N, et\u00a0al (2017) On the (statistical) detection of adversarial examples. arXiv:1702.06280"},{"issue":"5","key":"11572_CR33","doi-asserted-by":"publisher","first-page":"1743","DOI":"10.1109\/TSE.2020.3034721","volume":"48","author":"Y He","year":"2020","unstructured":"He Y, Meng G, Chen K et al (2020) Towards security threats of deep learning systems: a survey. IEEE Trans Softw Eng 48(5):1743\u20131770","journal-title":"IEEE Trans Softw Eng"},{"key":"11572_CR34","unstructured":"Hendrycks D, Gimpel K (2016) A baseline for detecting misclassified and out-of-distribution examples in neural networks. arXiv:1610.02136"},{"key":"11572_CR35","unstructured":"Hendrycks D, Gimpel K (2016) Early methods for detecting adversarial images. arXiv:1608.00530"},{"key":"11572_CR36","doi-asserted-by":"crossref","unstructured":"Hosseini H, Poovendran R (2018) Semantic adversarial examples. In: 2018 IEEE\/CVF conference on computer vision and pattern recognition workshops (CVPRW), pp 1614\u20131619","DOI":"10.1109\/CVPRW.2018.00212"},{"key":"11572_CR37","doi-asserted-by":"crossref","unstructured":"Hosseini H, Xiao B, Jaiswal M, et\u00a0al (2017) On the limitation of convolutional neural networks in recognizing negative images. In: 2017 16th IEEE international conference on machine learning and applications (ICMLA). IEEE, pp 352\u2013358","DOI":"10.1109\/ICMLA.2017.0-136"},{"key":"11572_CR38","unstructured":"Howard J (2020) A smaller subset of 10 easily classified classes from imagenet, and a little more French. https:\/\/github.com\/fastai\/imagenette\/"},{"key":"11572_CR39","doi-asserted-by":"crossref","unstructured":"Hu Y, Gripon V, Pateux S (2021) Leveraging the feature distribution in transfer-based few-shot learning. In: Artificial neural networks and machine learning\u2013ICANN 2021: 30th international conference on artificial neural networks, Bratislava, Slovakia, September 14\u201317, 2021, Proceedings, Part II 30. Springer, pp 487\u2013499","DOI":"10.1007\/978-3-030-86340-1_39"},{"key":"11572_CR40","unstructured":"Huang G, Larochelle H, Lacoste-Julien S (2019) Are few-shot learning benchmarks too simple? arXiv:1902.08605"},{"key":"11572_CR41","unstructured":"Ilyas A, Santurkar S, Tsipras D, et\u00a0al (2019) Adversarial examples are not bugs, they are features. In: Advances in neural information processing systems 32"},{"key":"11572_CR42","doi-asserted-by":"crossref","unstructured":"Jang U, Wu X, Jha S (2017) Objective metrics and gradient descent algorithms for adversarial examples in machine learning. In: Proceedings of the 33rd annual computer security applications conference, pp 262\u2013277","DOI":"10.1145\/3134600.3134635"},{"key":"11572_CR43","doi-asserted-by":"crossref","unstructured":"Joshi A, Mukherjee A, Sarkar S, et\u00a0al (2019) Semantic adversarial attacks: parametric transformations that fool deep classifiers. In: 2019 IEEE\/CVF international conference on computer vision (ICCV), pp 4772\u20134782","DOI":"10.1109\/ICCV.2019.00487"},{"key":"11572_CR44","doi-asserted-by":"crossref","unstructured":"Kherchouche A, Fezza SA, Hamidouche W, et\u00a0al (2020) Natural scene statistics for detecting adversarial examples in deep neural networks. In: 2020 IEEE 22nd international workshop on multimedia signal processing (MMSP). IEEE, pp 1\u20136","DOI":"10.1109\/MMSP48831.2020.9287056"},{"key":"11572_CR45","doi-asserted-by":"crossref","unstructured":"Kong Z, Guo J, Li A, et\u00a0al (2020) Physgan: generating physical-world-resilient adversarial examples for autonomous driving. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 14254\u201314263","DOI":"10.1109\/CVPR42600.2020.01426"},{"key":"11572_CR46","volume-title":"Learning multiple layers of features from tiny images","author":"A Krizhevsky","year":"2009","unstructured":"Krizhevsky A (2009) Learning multiple layers of features from tiny images. University of Toronto, Toronto"},{"key":"11572_CR47","doi-asserted-by":"crossref","unstructured":"Kurakin A, Goodfellow IJ, Bengio S (2018) Adversarial examples in the physical world. In: Artificial intelligence safety and security. Chapman and Hall, Boca Raton, pp 99\u2013112","DOI":"10.1201\/9781351251389-8"},{"issue":"11","key":"11572_CR48","doi-asserted-by":"publisher","first-page":"2278","DOI":"10.1109\/5.726791","volume":"86","author":"Y LeCun","year":"1998","unstructured":"LeCun Y, Bottou L, Bengio Y et al (1998) Gradient-based learning applied to document recognition. Proc IEEE 86(11):2278\u20132324","journal-title":"Proc IEEE"},{"key":"11572_CR49","unstructured":"Lee K, Lee K, Lee H, et\u00a0al (2018) A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In: Advances in neural information processing systems 31"},{"key":"11572_CR50","doi-asserted-by":"crossref","unstructured":"Li X, Li F (2017) Adversarial examples detection in deep networks with convolutional filter statistics. In: Proceedings of the IEEE international conference on computer vision, pp 5764\u20135772","DOI":"10.1109\/ICCV.2017.615"},{"key":"11572_CR51","doi-asserted-by":"crossref","unstructured":"Li Y, Li Y, Xiao B (2022) A physical-world adversarial attack against 3D face recognition. arXiv:2205.13412","DOI":"10.1109\/CVPR52729.2023.02366"},{"issue":"1","key":"11572_CR52","doi-asserted-by":"publisher","first-page":"72","DOI":"10.1109\/TDSC.2018.2874243","volume":"18","author":"B Liang","year":"2018","unstructured":"Liang B, Li H, Su M et al (2018) Detecting adversarial image examples in deep neural networks with adaptive noise reduction. IEEE Trans Dependable Secure Comput 18(1):72\u201385","journal-title":"IEEE Trans Dependable Secure Comput"},{"key":"11572_CR53","first-page":"3487","volume":"33","author":"WA Lin","year":"2020","unstructured":"Lin WA, Lau CP, Levine A et al (2020) Dual manifold adversarial robustness: defense against lp and non-lp adversarial attacks. Adv Neural Inf Process Syst 33:3487\u20133498","journal-title":"Adv Neural Inf Process Syst"},{"key":"11572_CR54","doi-asserted-by":"crossref","unstructured":"Liu J, Song L, Qin Y (2020) Prototype rectification for few-shot learning. In: Computer vision\u2014ECCV 2020: 16th European conference, Glasgow, UK, August 23\u201328, 2020, Proceedings, Part I 16. Springer, pp 741\u2013756","DOI":"10.1007\/978-3-030-58452-8_43"},{"key":"11572_CR55","doi-asserted-by":"crossref","unstructured":"Liu Z, Mao H, Wu CY, et\u00a0al (2022) A convnet for the 2020s. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 11976\u201311986","DOI":"10.1109\/CVPR52688.2022.01167"},{"key":"11572_CR56","doi-asserted-by":"crossref","unstructured":"Lu J, Issaranon T, Forsyth D (2017) Safetynet: detecting and rejecting adversarial examples robustly. In: 2017 IEEE international conference on computer vision (ICCV), pp 446\u2013454","DOI":"10.1109\/ICCV.2017.56"},{"key":"11572_CR57","doi-asserted-by":"crossref","unstructured":"Ma C, Zhao C, Shi H, et\u00a0al (2019) MetaAdvDet: towards robust detection of evolving adversarial attacks. In: Proceedings of the 27th ACM international conference on multimedia, pp 692\u2013701","DOI":"10.1145\/3343031.3350887"},{"key":"11572_CR58","doi-asserted-by":"crossref","unstructured":"Ma S, Liu Y, Tao G, et\u00a0al (2019) Nic: detecting adversarial samples with neural network invariant checking. In: 26th annual network and distributed system security symposium (NDSS 2019), Internet Soc","DOI":"10.14722\/ndss.2019.23415"},{"key":"11572_CR59","unstructured":"Ma X, Li B, Wang Y, et\u00a0al (2018) Characterizing adversarial subspaces using local intrinsic dimensionality. arXiv:1801.02613"},{"key":"11572_CR60","unstructured":"Madry A, Makelov A, Schmidt L, et\u00a0al (2017) Towards deep learning models resistant to adversarial attacks. arXiv:1706.06083"},{"key":"11572_CR61","doi-asserted-by":"crossref","unstructured":"Mao X, Chen Y, Li Y et al (2020) Learning to characterize adversarial subspaces. Ib: ICASSP 2020\u20132020 IEEE international conference on acoustics, speech and signal processing (ICASSP). IEEE, pp 2438\u20132442","DOI":"10.1109\/ICASSP40776.2020.9052933"},{"key":"11572_CR62","doi-asserted-by":"crossref","unstructured":"Mao X, Chen Y, Wang S, et\u00a0al (2021) Composite adversarial attacks. In: Proceedings of the AAAI conference on artificial intelligence, pp 8884\u20138892","DOI":"10.1609\/aaai.v35i10.17075"},{"key":"11572_CR63","doi-asserted-by":"crossref","unstructured":"Meng D, Chen H (2017) Magnet: a two-pronged defense against adversarial examples. In: Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pp 135\u2013147","DOI":"10.1145\/3133956.3134057"},{"key":"11572_CR64","unstructured":"Metzen JH, Genewein T, Fischer V, et\u00a0al (2017) On detecting adversarial perturbations. arXiv:1702.04267"},{"key":"11572_CR65","unstructured":"Miyato T, Maeda S, Koyama M, et\u00a0al (2015) Distributional smoothing with virtual adversarial training. arXiv:1507.00677"},{"key":"11572_CR66","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli SM, Fawzi A, Frossard P (2016) Deepfool: a simple and accurate method to fool deep neural networks. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 2574\u20132582","DOI":"10.1109\/CVPR.2016.282"},{"key":"11572_CR67","unstructured":"Nicolae MI, Sinn M, Tran MN, et\u00a0al (2018) Adversarial robustness toolbox v1. 0.0. arXiv:1807.01069"},{"key":"11572_CR68","unstructured":"Pang T, Du C, Dong Y, et\u00a0al (2018) Towards robust detection of adversarial examples. In: Advances in neural information processing systems 31"},{"key":"11572_CR69","unstructured":"Papernot N, Faghri F, Carlini N, et\u00a0al (2016) Technical report on the cleverhans v2. 1.0 adversarial examples library. arXiv:1610.00768"},{"key":"11572_CR70","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Jha S, et\u00a0al (2016) The limitations of deep learning in adversarial settings. In: 2016 IEEE European symposium on security and privacy (EuroS &P). IEEE, pp 372\u2013387","DOI":"10.1109\/EuroSP.2016.36"},{"key":"11572_CR71","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Wu X, et\u00a0al (2016) Distillation as a defense to adversarial perturbations against deep neural networks. In: 2016 IEEE symposium on security and privacy (SP). IEEE, pp 582\u2013597","DOI":"10.1109\/SP.2016.41"},{"key":"11572_CR72","unstructured":"Pertigkiozoglou S, Maragos P (2018) Detecting adversarial examples in convolutional neural networks. arXiv:1812.03303"},{"key":"11572_CR73","doi-asserted-by":"crossref","unstructured":"Qiu H, Xiao C, Yang L, et\u00a0al (2020) Semanticadv: generating adversarial examples via attribute-conditioned image editing. In: Computer vision\u2013ECCV 2020: 16th European vonference, Glasgow, UK, August 23\u201328, 2020, Proceedings, Part XIV 16. Springer, pp 19\u201337","DOI":"10.1007\/978-3-030-58568-6_2"},{"key":"11572_CR74","unstructured":"Raghu A, Raghu M, Bengio S, et\u00a0al (2019) Rapid learning or feature reuse? Towards understanding the effectiveness of MAML. arXiv:1909.09157"},{"key":"11572_CR75","unstructured":"Ren M, Triantafillou E, Ravi S, et\u00a0al (2018) Meta-learning for semi-supervised few-shot classification. In: International conference on learning representations"},{"key":"11572_CR76","doi-asserted-by":"crossref","unstructured":"Schroff F, Kalenichenko D, Philbin J (2015) Facenet: A unified embedding for face recognition and clustering. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 815\u2013823","DOI":"10.1109\/CVPR.2015.7298682"},{"key":"11572_CR77","unstructured":"Shalam D, Korman S (2022) The self-optimal-transport feature transform. arXiv:2204.03065"},{"key":"11572_CR78","doi-asserted-by":"crossref","unstructured":"Shamsabadi AS, Sanchez-Matilla R, Cavallaro A (2020) Colorfool: semantic adversarial colorization. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 1151\u20131160","DOI":"10.1109\/CVPR42600.2020.00123"},{"key":"11572_CR79","unstructured":"Shao R, Shi Z, Yi J, et\u00a0al (2022) On the adversarial robustness of vision transformers. Trans Mach Learn Res"},{"key":"11572_CR80","doi-asserted-by":"crossref","unstructured":"Sharif M, Bauer L, Reiter MK (2018) On the suitability of lp-norms for creating and preventing adversarial examples. In: Proceedings of the IEEE conference on computer vision and pattern recognition workshops, pp 1605\u20131613","DOI":"10.1109\/CVPRW.2018.00211"},{"issue":"3","key":"11572_CR81","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3317611","volume":"22","author":"M Sharif","year":"2019","unstructured":"Sharif M, Bhagavatula S, Bauer L et al (2019) A general framework for adversarial examples with objectives. ACM Trans Priv Secur (TOPS) 22(3):1\u201330","journal-title":"ACM Trans Priv Secur (TOPS)"},{"key":"11572_CR82","unstructured":"Smith L, Gal Y (2018) Understanding measures of uncertainty for adversarial example detection. arXiv:1803.08533"},{"key":"11572_CR83","unstructured":"Snell J, Swersky K, Zemel R (2017) Prototypical networks for few-shot learning. In: Advances in neural information processing systems 30"},{"key":"11572_CR84","unstructured":"Song Y, Kim T, Nowozin S, et\u00a0al (2017) Pixeldefend: leveraging generative models to understand and defend against adversarial examples. arXiv:1710.10766"},{"key":"11572_CR85","unstructured":"Song Y, Shu R, Kushman N, et\u00a0al (2018) Constructing unrestricted adversarial examples with generative models. In: Advances in neural information processing systems 31"},{"key":"11572_CR86","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s13635-020-0101-7","volume":"2020","author":"A Sotgiu","year":"2020","unstructured":"Sotgiu A, Demontis A, Melis M et al (2020) Deep neural rejection against adversarial examples. EURASIP J Inf Secur 2020:1\u201310","journal-title":"EURASIP J Inf Secur"},{"key":"11572_CR87","unstructured":"Szegedy C, Zaremba W, Sutskever I, et\u00a0al (2013) Intriguing properties of neural networks. arXiv:1312.6199"},{"key":"11572_CR88","doi-asserted-by":"crossref","unstructured":"Taigman Y, Yang M, Ranzato M, et\u00a0al (2014) Deepface: closing the gap to human-level performance in face verification. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 1701\u20131708","DOI":"10.1109\/CVPR.2014.220"},{"key":"11572_CR89","unstructured":"Tramer F, Boneh D (2019) Adversarial training and robustness for multiple perturbations. In: Advances in neural information processing systems 32"},{"key":"11572_CR90","unstructured":"Tsipras D, Santurkar S, Engstrom L, et\u00a0al (2018) Robustness may be at odds with accuracy. arXiv:1805.12152"},{"key":"11572_CR91","unstructured":"Uesato J, O\u2019donoghue B, Kohli P, et\u00a0al (2018) Adversarial risk and the dangers of evaluating against weak attacks. In: International conference on machine learning, PMLR, pp 5025\u20135034"},{"key":"11572_CR92","doi-asserted-by":"publisher","first-page":"230","DOI":"10.1109\/TMM.2021.3050057","volume":"24","author":"J Wang","year":"2021","unstructured":"Wang J, Zhao J, Yin Q et al (2021) Smsnet: a new deep convolutional neural network model for adversarial example detection. IEEE Trans Multim 24:230\u2013244","journal-title":"IEEE Trans Multim"},{"key":"11572_CR93","unstructured":"Wang Y, Chao WL, Weinberger KQ, et\u00a0al (2019) Simpleshot: revisiting nearest-neighbor classification for few-shot learning. arXiv:1911.04623"},{"key":"11572_CR94","unstructured":"Xiao C, Zhu JY, Li B, et\u00a0al (2018) Spatially transformed adversarial examples. arXiv:1801.02612"},{"key":"11572_CR95","doi-asserted-by":"crossref","unstructured":"Xiao Z, Gao X, Fu C, et\u00a0al (2021) Improving transferability of adversarial patches on face recognition with generative models. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 11845\u201311854","DOI":"10.1109\/CVPR46437.2021.01167"},{"key":"11572_CR96","unstructured":"Xie C, Wang J, Zhang Z, et\u00a0al (2017) Mitigating adversarial effects through randomization. arXiv:1711.01991"},{"key":"11572_CR97","doi-asserted-by":"crossref","unstructured":"Xu W, Evans D, Qi Y (2017) Feature squeezing: detecting adversarial examples in deep neural networks. arXiv:1704.01155","DOI":"10.14722\/ndss.2018.23198"},{"issue":"9","key":"11572_CR98","doi-asserted-by":"publisher","first-page":"2805","DOI":"10.1109\/TNNLS.2018.2886017","volume":"30","author":"X Yuan","year":"2019","unstructured":"Yuan X, He P, Zhu Q et al (2019) Adversarial examples: attacks and defenses for deep learning. IEEE Trans Neural Netw Learn Syst 30(9):2805\u20132824","journal-title":"IEEE Trans Neural Netw Learn Syst"},{"key":"11572_CR99","unstructured":"Zhang H, Yu Y, Jiao J, et\u00a0al (2019) Theoretically principled trade-off between robustness and accuracy. In: International conference on machine learning, PMLR, pp 7472\u20137482"},{"key":"11572_CR100","unstructured":"Zhang H, Cao Z, Yan Z, et\u00a0al (2021) Sill-net: feature augmentation with separated illumination representation. arXiv:2102.03539"},{"issue":"5","key":"11572_CR101","doi-asserted-by":"publisher","first-page":"3443","DOI":"10.1109\/JIOT.2021.3099164","volume":"9","author":"J Zhang","year":"2021","unstructured":"Zhang J, Lou Y, Wang J et al (2021) Evaluating adversarial attacks on driving safety in vision-based autonomous vehicles. IEEE Internet Things J 9(5):3443\u20133456","journal-title":"IEEE Internet Things J"},{"key":"11572_CR102","unstructured":"Zheng Z, Hong P (2018) Robust detection of adversarial attacks by modeling the intrinsic properties of deep neural networks. In: Advances in neural information processing systems 31"},{"key":"11572_CR103","doi-asserted-by":"crossref","unstructured":"Zhu H, Koniusz P (2023) Transductive few-shot learning with prototype-based label propagation by iterative graph refinement. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 23996\u201324006","DOI":"10.1109\/CVPR52729.2023.02298"},{"key":"11572_CR104","doi-asserted-by":"crossref","unstructured":"Zuo F, Zeng Q (2021) Exploiting the sensitivity of l2 adversarial examples to erase-and-restore. In: Proceedings of the 2021 ACM Asia conference on computer and communications security, pp 40\u201351","DOI":"10.1145\/3433210.3437529"}],"container-title":["Neural Processing Letters"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11063-024-11572-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11063-024-11572-6\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11063-024-11572-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,5,16]],"date-time":"2024-05-16T20:32:04Z","timestamp":1715891524000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11063-024-11572-6"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,3,5]]},"references-count":104,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2024,4]]}},"alternative-id":["11572"],"URL":"https:\/\/doi.org\/10.1007\/s11063-024-11572-6","relation":{},"ISSN":["1573-773X"],"issn-type":[{"value":"1573-773X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,3,5]]},"assertion":[{"value":"12 February 2024","order":1,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"5 March 2024","order":2,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"All individual participants in this study provided informed consent to participate voluntarily.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent to participate"}},{"value":"The authors confirm that participants have granted informed consent for the publication of this manuscript.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent for publication"}},{"value":"This article does not involve studies with human participants or animals conducted by any of the authors, and therefore, ethical considerations and informed consent for data usage are not applicable.","order":5,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethical approval"}}],"article-number":"85"}}