{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,14]],"date-time":"2026-03-14T18:00:55Z","timestamp":1773511255294,"version":"3.50.1"},"reference-count":71,"publisher":"Springer Science and Business Media LLC","issue":"6","license":[{"start":{"date-parts":[[2023,9,4]],"date-time":"2023-09-04T00:00:00Z","timestamp":1693785600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2023,9,4]],"date-time":"2023-09-04T00:00:00Z","timestamp":1693785600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int J Comput Vis"],"published-print":{"date-parts":[[2024,6]]},"DOI":"10.1007\/s11263-023-01884-w","type":"journal-article","created":{"date-parts":[[2023,9,4]],"date-time":"2023-09-04T09:02:38Z","timestamp":1693818158000},"page":"1881-1898","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":22,"title":["Towards Defending Multiple $$\\ell _p$$-Norm Bounded Adversarial Perturbations via Gated Batch Normalization"],"prefix":"10.1007","volume":"132","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4224-1318","authenticated-orcid":false,"given":"Aishan","family":"Liu","sequence":"first","affiliation":[]},{"given":"Shiyu","family":"Tang","sequence":"additional","affiliation":[]},{"given":"Xinyun","family":"Chen","sequence":"additional","affiliation":[]},{"given":"Lei","family":"Huang","sequence":"additional","affiliation":[]},{"given":"Haotong","family":"Qin","sequence":"additional","affiliation":[]},{"given":"Xianglong","family":"Liu","sequence":"additional","affiliation":[]},{"given":"Dacheng","family":"Tao","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2023,9,4]]},"reference":[{"key":"1884_CR1","unstructured":"Asano, Y. M., Rupprecht, C., & Vedaldi, A. (2020). A critical analysis of self-supervision, or what we can learn from a single image."},{"key":"1884_CR2","unstructured":"Athalye, A., Carlini, N., & Wagner, D. (2018). Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International Conference on Machine Learning."},{"key":"1884_CR3","unstructured":"Ba, J. L., Kiros, J. R., & Hinton, G. E. (2016). Layer normalization. arXiv preprint arXiv:1607.06450."},{"key":"1884_CR4","unstructured":"Bahdanau, D., Cho, K., & Bengio, Y. (2014). Neural machine translation by jointly learning to align and translate. arXiv preprint arXiv:1409.0473."},{"key":"1884_CR5","doi-asserted-by":"crossref","unstructured":"Benz, P., Zhang, C., Karjauv, A., & Kweon, I.S. (2021). Revisiting batch normalization for improving corruption robustness. In WACV.","DOI":"10.1109\/WACV48630.2021.00054"},{"key":"1884_CR6","unstructured":"Brendel, W., Rauber, J., & Bethge, M. (2018). Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In International Conference on Learning Representations."},{"key":"1884_CR7","unstructured":"Brendel, W., Rauber, J., K\u00fcmmerer, M., Ustyuzhaninov, I., & Bethge, M. (2019). Accurate, reliable and fast robustness evaluation. In Advances in Neural Information Processing Systems."},{"key":"1884_CR8","unstructured":"Brown, T. B., Man\u00e9, Dandelion, R., Aurko, A., Mart\u00edn, & Gilmer, J. (2017). Adversarial patch. arXiv preprint arXiv:1712.09665."},{"key":"1884_CR9","doi-asserted-by":"crossref","unstructured":"Carlini, N., & Wagner, D. (2017). Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy.","DOI":"10.1109\/SP.2017.49"},{"key":"1884_CR10","doi-asserted-by":"crossref","unstructured":"Chang, W.-G., You, T., Seo, S., Kwak, S., & Han, B. (2019). Domain-specific batch normalization for unsupervised domain adaptation. In IEEE Conference on Computer Vision and Pattern Recognition.","DOI":"10.1109\/CVPR.2019.00753"},{"key":"1884_CR11","unstructured":"Cisse, M., Bojanowski, P., Grave, E., Dauphin, Y., & Usunier, N. (2017). Parseval networks: Improving robustness to adversarial examples. In International Conference on Machine Learning."},{"key":"1884_CR12","unstructured":"Croce, F., & Hein, M. (2020). Provable robustness against all adversarial $$l_p$$-perturbations for $$p \\ge 1$$."},{"key":"1884_CR13","unstructured":"Croce, F., & Hein, M. (2020). Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks."},{"key":"1884_CR14","doi-asserted-by":"crossref","unstructured":"Croce, F., Rauber, J., & Hein, M. (2020). Scaling up the randomized gradient-free adversarial attack reveals overestimation of robustness using established attacks. International Journal of Computer Vision.","DOI":"10.1007\/s11263-019-01213-0"},{"key":"1884_CR15","unstructured":"de Vries, H., Strub, F., Mary, J., Larochelle, H., Pietquin, O., & Courville, A. C. (2017). In Advances in Neural Information Processing Systems."},{"key":"1884_CR16","unstructured":"Deecke, L., Murray, I., & Bilen, H. (2019). Mode normalization."},{"key":"1884_CR17","doi-asserted-by":"crossref","unstructured":"Dong, Y., Liao, F., Pang, T., & Su, H. (2018). Boosting adversarial attacks with momentum. In IEEE Conference on Computer Vision and Pattern Recognition.","DOI":"10.1109\/CVPR.2018.00957"},{"key":"1884_CR18","unstructured":"Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., et al. (2020). An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations."},{"key":"1884_CR19","doi-asserted-by":"crossref","unstructured":"Duan, R., Mao, X., Kai Qin, A., Chen, Y., Ye, S., He, Y., & Yang, Y. (2021). Adversarial laser beam: Effective physical-world attack to DNNS in a blink. In CVPR.","DOI":"10.1109\/CVPR46437.2021.01580"},{"key":"1884_CR20","unstructured":"Engstrom, L., Ilyas, A., & Athalye, A. (2018). Evaluating and understanding the robustness of adversarial logit pairing. arXiv preprint arXiv:1807.10272."},{"key":"1884_CR21","unstructured":"Goodfellow, I.J., Shlens, J., & Szegedy, C. (2014). Explaining and harnessing adversarial examples (2014). arXiv preprint arXiv:1412.6572."},{"key":"1884_CR22","doi-asserted-by":"crossref","unstructured":"Goswami, G., Agarwal, A., Ratha, N., Singh, R., & Vatsa, M. (2019). Detecting and mitigating adversarial perturbations for robust face recognition. International Journal of Computer Vision.","DOI":"10.1007\/s11263-019-01160-w"},{"key":"1884_CR23","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., & Sun, J. (2016). Deep residual learning for image recognition. In IEEE Conference on Computer Vision and Pattern Recognition.","DOI":"10.1109\/CVPR.2016.90"},{"key":"1884_CR24","doi-asserted-by":"crossref","unstructured":"Hinton, G., Deng, L., Yu, D., Dahl, G.E., Mohamed, A., Jaitly, N., Senior, A., Vanhoucke, V., Nguyen, P., & Sainath, T.N. (2012). Deep neural networks for acoustic modeling in speech recognition: The shared views of four research groups. IEEE Signal Processing Magazine.","DOI":"10.1109\/MSP.2012.2205597"},{"key":"1884_CR25","doi-asserted-by":"crossref","unstructured":"Huang, X., & Belongie, S. (2017). Arbitrary style transfer in real-time with adaptive instance normalization.","DOI":"10.1109\/ICCV.2017.167"},{"key":"1884_CR26","unstructured":"Huang, L., Qin, J., Zhou, Y., Zhu, F., Liu, L., & Shao, L. (2020). Normalization techniques in training dnns: Methodology, analysis and application. arXiv preprint arXiv:2009.12836."},{"key":"1884_CR27","unstructured":"Ioffe, S., & Szegedy, C. (2015). Batch normalization: Accelerating deep network training by reducing internal covariate shift. In International Conference on Machine Learning."},{"key":"1884_CR28","unstructured":"Kang, D., Sun, Y., Hendrycks, D., Brown, T., & Steinhardt, J. (2019). Testing robustness against unforeseen adversaries. arXiv preprint arXiv:1908.08016."},{"key":"1884_CR29","unstructured":"Krizhevsky, A., & Hinton, G. (2009). Learning multiple layers of features from tiny images. Technical report, Citeseer."},{"key":"1884_CR30","unstructured":"Krizhevsky, A., Sutskever, I., & Hinton, G.E. (2012). Imagenet classification with deep convolutional neural networks."},{"key":"1884_CR31","unstructured":"Kurakin, Alexey, Goodfellow, Ian, & Bengio, Samy. (2017). Adversarial machine learning at scale."},{"key":"1884_CR32","unstructured":"Kurakin, A., Goodfellow, I., & Bengio, S. (2016). Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533."},{"key":"1884_CR33","unstructured":"Laidlaw, C., Singla, S., & Feizi, S. (2021). Perceptual adversarial robustness: Defense against unseen threat models. In International Conference on Learning Representations."},{"key":"1884_CR34","unstructured":"LeCun, Y. (1998). The mnist database of handwritten digits. http:\/\/yann.lecun.com\/exdb\/mnist\/."},{"key":"1884_CR35","doi-asserted-by":"crossref","unstructured":"LeCun, Y., Bottou, L., Bengio, Y., & Haffner, P. (1998). Gradient-based learning applied to document recognition. In Proceedings of the IEEE.","DOI":"10.1109\/5.726791"},{"key":"1884_CR36","unstructured":"Li, Y., Li, L., Wang, L., Zhang, T., & Gong, B. (2019). Nattack: Learning the distributions of adversarial examples for an improved black-box attack on deep neural networks. In International Conference on Machine Learning."},{"key":"1884_CR37","doi-asserted-by":"crossref","unstructured":"Li, Y., Wang, N., Shi, J., Liu, J., & Hou, X. (2017). Revisiting batch normalization for practical domain adaptation.","DOI":"10.1016\/j.patcog.2018.03.005"},{"key":"1884_CR38","doi-asserted-by":"crossref","unstructured":"Li, B., Wu, B., Su, J., & Wang, G. (2020). Fast sub-net evaluation for efficient neural network pruning: Eagleeye. In ECCV.","DOI":"10.1007\/978-3-030-58536-5_38"},{"key":"1884_CR39","doi-asserted-by":"crossref","unstructured":"Liao, F., Liang, M., Dong, Y., Pang, T., Hu, X., & Zhu, J. (2018). Defense against adversarial attacks using high-level representation guided denoiser. In IEEE Conference on Computer Vision and Pattern Recognition.","DOI":"10.1109\/CVPR.2018.00191"},{"key":"1884_CR40","unstructured":"Lin, W.-A., Lau, C.P., Levine, A., Chellappa, R., & Feizi, S. (2020). Dual manifold adversarial robustness: Defense against lp and non-lp adversarial attacks. In Advances in Neural Information Processing Systems."},{"key":"1884_CR41","doi-asserted-by":"crossref","unstructured":"Liu, A., Huang, T., Liu, X., Xu, Y., Ma, Y., Chen, X., Maybank, S., & Tao, D. (2020). Spatiotemporal attacks for embodied agents. In European Conference on Computer Vision.","DOI":"10.1007\/978-3-030-58520-4_8"},{"key":"1884_CR42","doi-asserted-by":"crossref","unstructured":"Liu, A., Liu, X., Fan, J., Ma, Y., Zhang, A., Xie, H., & Tao, D. (2019). Perceptual-sensitive GAN for generating adversarial patches. In 33rd AAAI Conference on Artificial Intelligence.","DOI":"10.1609\/aaai.v33i01.33011028"},{"key":"1884_CR43","doi-asserted-by":"crossref","unstructured":"Liu, A., Liu, X., Zhang, C., Yu, H., Liu, Q., & Tao, D. (2021). Training robust deep neural networks via adversarial noise propagation. IEEE Transactions on Image Processing.","DOI":"10.1109\/TIP.2021.3082317"},{"key":"1884_CR44","doi-asserted-by":"crossref","unstructured":"Liu, A., Wang, J., Liu, X., Cao, B., Zhang, C., & Yu, H. (2020). Bias-based universal adversarial patch attack for automatic check-out. In ECCV.","DOI":"10.1007\/978-3-030-58601-0_24"},{"key":"1884_CR45","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2018). Towards deep learning models resistant to adversarial attacks."},{"key":"1884_CR46","unstructured":"Maini, P., Chen, X., Li, B., Song, D. (2020). Perturbation type categorization for multiple $$\\ell _p$$ bounded adversarial robustness."},{"key":"1884_CR47","unstructured":"Maini, P., Wong, E., & Kolter, Z. J. (2020). Adversarial robustness against the union of multiple perturbation model."},{"key":"1884_CR48","unstructured":"Metzen, J. H., Fischer, V., & Bischoff, B. (2018). On detecting adversarial perturbations."},{"key":"1884_CR49","doi-asserted-by":"crossref","unstructured":"Papernot, N., Mcdaniel, P., Wu, X., Jha, S., & Swami, A. (2015). Distillation as a defense to adversarial perturbations against deep neural networks. arXiv preprint arXiv:1511.04508.","DOI":"10.1109\/SP.2016.41"},{"key":"1884_CR50","unstructured":"Rauber, J., Brendel, W., & Bethge, M. (2017). Foolbox: A python toolbox to benchmark the robustness of machine learning models."},{"key":"1884_CR51","unstructured":"Schott, L., Rauber, J., Bethge, M., & Brendel, W. (2019). Towards the first adversarially robust neural network model on MNIST."},{"key":"1884_CR52","doi-asserted-by":"crossref","unstructured":"Shao, R., Perera, P., Yuen, P. C., & Patel, V. M. (2022). Open-set adversarial defense with clean-adversarial mutual learning. International Journal of Computer Vision.","DOI":"10.1007\/s11263-022-01581-0"},{"key":"1884_CR53","unstructured":"Simonyan, K., & Zisserman, A. (2015). Very deep convolutional networks for large-scale image recognition. In International Conference on Learning Representations."},{"key":"1884_CR54","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013). Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199."},{"key":"1884_CR55","unstructured":"Tang, S., Gong, R., Wang, Y., Liu, A., Wang, J., Chen, X., Yu, F., Liu, X., Song, D., Yuille, A., Torr, P. H. S., & Tao, D. (2021). Robustart: Benchmarking robustness on architecture design and training techniques. https:\/\/arxiv.org\/pdf\/2109.05211.pdf."},{"key":"1884_CR56","doi-asserted-by":"crossref","unstructured":"Tram\u00e8r, F., & Boneh, D. (2019). Adversarial training and robustness for multiple perturbations. In Advances in Neural Information Processing Systems.","DOI":"10.1145\/3319535.3354222"},{"key":"1884_CR57","unstructured":"Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., & Madry, A. (2019). Robustness may be at odds with accuracy."},{"key":"1884_CR58","unstructured":"Uesato, J., O\u2019Donoghue, B., van den Oord, A., & Kohli, P. (2018). Adversarial risk and the dangers of evaluating against weak attacks. In International Conference on Machine Learning."},{"key":"1884_CR59","unstructured":"Ulyanov, D., Vedaldi, A., & Lempitsky, V. S. (2016). Instance normalization: The missing ingredient for fast stylization. arXiv preprint arXiv:1607.08022."},{"key":"1884_CR60","unstructured":"Van Der Laurens, M., & Hinton, G. (2008). Visualizing data using t-sne. Journal of Machine Learning Research."},{"key":"1884_CR61","doi-asserted-by":"crossref","unstructured":"Wang, J., Liu, A., Yin, Z., Liu, S., Tang, S., & Liu, X. (2021). Dual attention suppression attack: Generate adversarial camouflage in physical world. In CVPR.","DOI":"10.1109\/CVPR46437.2021.00846"},{"key":"1884_CR62","doi-asserted-by":"crossref","unstructured":"Wei, X., Yan, H., & Li, B. (2022). Sparse black-box video attack with reinforcement learning. International Journal of Computer Vision.","DOI":"10.1007\/s11263-022-01604-w"},{"key":"1884_CR63","doi-asserted-by":"crossref","unstructured":"Wu, Y., & He, K. (2018). Group normalization. In European Conference on Computer Vision.","DOI":"10.1007\/978-3-030-01261-8_1"},{"key":"1884_CR64","unstructured":"Wu, J., Zhang, Q., & Xu, G. (2017). Tiny imagenet challenge."},{"key":"1884_CR65","unstructured":"Xie, C., & Yuille, A. (2020). Intriguing properties of adversarial training at scale."},{"key":"1884_CR66","doi-asserted-by":"crossref","unstructured":"Xie, C., Tan, M., Gong, B., Wang, J., Yuille, A.L., & Le, Q. V. (2020). Adversarial examples improve image recognition. In IEEE Conference on Computer Vision and Pattern Recognition.","DOI":"10.1109\/CVPR42600.2020.00090"},{"key":"1884_CR67","unstructured":"Xie, C., Wang, J., Zhang, Z., Ren, Z., & Yuille, A. (2018). Mitigating adversarial effects through randomization."},{"key":"1884_CR68","unstructured":"Yin, D., Lopes, G. R., Shlens, J., Ekin Cubuk, D., & Gilmer, J. (2019). A fourier perspective on model robustness in computer vision. In Advances in Neural Information Processing Systems."},{"key":"1884_CR69","doi-asserted-by":"crossref","unstructured":"Zagoruyko, S., & Komodakis, N. (2016). Wide residual networks. In The British Machine Vision Conference.","DOI":"10.5244\/C.30.87"},{"key":"1884_CR70","doi-asserted-by":"crossref","unstructured":"Zhang, C., Liu, A., Liu, X., Xu, Y., Yu, H., Ma, Y., & Li, T. (2020). Interpreting and improving adversarial robustness with neuron sensitivity. IEEE Transactions on Image Processing.","DOI":"10.1109\/TIP.2020.3042083"},{"key":"1884_CR71","unstructured":"Zhang, H., Yu, Y., Jiao, J., Xing, E. P., Ghaoui, L. E., & Jordan, M. I. (2019). Theoretically principled trade-off between robustness and accuracy."}],"container-title":["International Journal of Computer Vision"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11263-023-01884-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11263-023-01884-w\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11263-023-01884-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,5,31]],"date-time":"2024-05-31T06:06:06Z","timestamp":1717135566000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11263-023-01884-w"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,9,4]]},"references-count":71,"journal-issue":{"issue":"6","published-print":{"date-parts":[[2024,6]]}},"alternative-id":["1884"],"URL":"https:\/\/doi.org\/10.1007\/s11263-023-01884-w","relation":{},"ISSN":["0920-5691","1573-1405"],"issn-type":[{"value":"0920-5691","type":"print"},{"value":"1573-1405","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,9,4]]},"assertion":[{"value":"30 September 2022","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"10 August 2023","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"4 September 2023","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}