{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,16]],"date-time":"2026-01-16T04:10:44Z","timestamp":1768536644909,"version":"3.49.0"},"reference-count":58,"publisher":"Springer Science and Business Media LLC","issue":"6","license":[{"start":{"date-parts":[[2021,2,13]],"date-time":"2021-02-13T00:00:00Z","timestamp":1613174400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2021,2,13]],"date-time":"2021-02-13T00:00:00Z","timestamp":1613174400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61732011"],"award-info":[{"award-number":["61732011"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61976141"],"award-info":[{"award-number":["61976141"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61772344"],"award-info":[{"award-number":["61772344"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Natural Science Foundation of SZU","award":["827-000230"],"award-info":[{"award-number":["827-000230"]}]},{"name":"Interdisciplinary Innovation Team of Shenzhen University"},{"DOI":"10.13039\/501100003453","name":"Natural Science Foundation of Guangdong Province","doi-asserted-by":"crossref","award":["2020B1515310008"],"award-info":[{"award-number":["2020B1515310008"]}],"id":[{"id":"10.13039\/501100003453","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int. J. Mach. Learn. & Cyber."],"published-print":{"date-parts":[[2021,6]]},"DOI":"10.1007\/s13042-021-01278-9","type":"journal-article","created":{"date-parts":[[2021,2,18]],"date-time":"2021-02-18T00:13:40Z","timestamp":1613607220000},"page":"1853-1865","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":5,"title":["A study on the uncertainty of convolutional layers in deep neural networks"],"prefix":"10.1007","volume":"12","author":[{"given":"Haojing","family":"Shen","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sihong","family":"Chen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ran","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2021,2,13]]},"reference":[{"key":"1278_CR1","unstructured":"Abbasi M, Gagn\u00e9 C (2017) Robustness to adversarial examples through an ensemble of specialists. In: Proceedings of the 5th international conference on learning representations (ICLR), Toulon, France, April 24\u201326, 2017"},{"key":"1278_CR2","unstructured":"Athalye A, Carlini N, Wagner D (2018) Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In: Proceedings of the 35th international conference on machine learning (ICML), Stockholm, Sweden, July 10\u201315, 2018, pp 274\u2013283"},{"issue":"11","key":"1278_CR3","doi-asserted-by":"publisher","first-page":"997","DOI":"10.1016\/S0167-8655(98)00083-X","volume":"19","author":"J Basak","year":"1998","unstructured":"Basak J, De RK, Pal SK (1998) Unsupervised feature selection using a neuro-fuzzy approach. Pattern Recognit Lett 19(11):997\u20131006","journal-title":"Pattern Recognit Lett"},{"key":"1278_CR4","unstructured":"Bradshaw J, Matthews AGdG, Ghahramani Z (2017) Adversarial examples, uncertainty, and transfer testing robustness in gaussian process hybrid deep networks. arXiv preprint arXiv:1707.02476"},{"key":"1278_CR5","unstructured":"Brown TB, Man\u00e9 D, Roy A, Abadi M, Gilmer J (2017) Adversarial patch. arXiv preprint arXiv:1712.09665"},{"key":"1278_CR6","doi-asserted-by":"crossref","unstructured":"Carlini N, Wagner D (2017) Towards evaluating the robustness of neural networks. In: 2017 IEEE symposium on security and privacy (sp), pp 39\u201357. IEEE","DOI":"10.1109\/SP.2017.49"},{"key":"1278_CR7","doi-asserted-by":"crossref","unstructured":"Chen HY, Liang JH, Chang SC, Pan JY, Chen YT, Wei W, Juan DC (2019) Improving adversarial robustness via guided complement entropy. In: Proceedings of the IEEE international conference on computer vision, pp 4881\u20134889","DOI":"10.1109\/ICCV.2019.00498"},{"key":"1278_CR8","doi-asserted-by":"crossref","unstructured":"Chen PY, Zhang H, Sharma Y, Yi J, Hsieh CJ (2017) Zoo: zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In: Proceedings of the 10th ACM Workshop on artificial intelligence and security, pp 15\u201326","DOI":"10.1145\/3128572.3140448"},{"key":"1278_CR9","unstructured":"Clevert D, Unterthiner T, Hochreiter S (2016) Fast and accurate deep network learning by exponential linear units (elus). In: Bengio Y, LeCun Y (eds) 4th international conference on learning representations, ICLR 2016, San Juan, Puerto Rico, May 2\u20134, 2016, conference track proceedings. http:\/\/arxiv.org\/abs\/1511.07289"},{"issue":"6","key":"1278_CR10","doi-asserted-by":"publisher","first-page":"141","DOI":"10.1109\/MSP.2012.2211477","volume":"29","author":"L Deng","year":"2012","unstructured":"Deng L (2012) The mnist database of handwritten digit images for machine learning research [best of the web]. IEEE Signal Process Mag 29(6):141\u2013142","journal-title":"IEEE Signal Process Mag"},{"key":"1278_CR11","unstructured":"Ding GW, Wang L, Jin X (2019) AdverTorch v0.1: an adversarial robustness toolbox based on pytorch. arXiv preprint arXiv:1902.07623"},{"key":"1278_CR12","doi-asserted-by":"crossref","unstructured":"Dong Y, Liao F, Pang T, Su H, Zhu J, Hu X, Li J (2018) Boosting adversarial attacks with momentum. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 9185\u20139193","DOI":"10.1109\/CVPR.2018.00957"},{"key":"1278_CR13","doi-asserted-by":"crossref","unstructured":"Eykholt K, Evtimov I, Fernandes E, Li B, Rahmati A, Xiao C, Prakash A, Kohno T, Song D (2018) Robust physical-world attacks on deep learning visual classification. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 1625\u20131634","DOI":"10.1109\/CVPR.2018.00175"},{"key":"1278_CR14","unstructured":"Glorot X, Bordes A, Bengio Y (2011) Deep sparse rectifier neural networks. In: Proceedings of the fourteenth international conference on artificial intelligence and statistics, pp 315\u2013323"},{"key":"1278_CR15","unstructured":"Goodfellow IJ, Shlens J, Szegedy C (2015) Explaining and harnessing adversarial examples. In: Bengio Y, LeCun Y (eds) 3rd international conference on learning representations, ICLR 2015, San Diego, CA, USA, May 7\u20139, 2015, conference track proceedings. http:\/\/arxiv.org\/abs\/1412.6572"},{"key":"1278_CR16","unstructured":"Haykin S, Kosko B (2001) Gradient based learning applied to document recognition, pp 306\u2013351"},{"key":"1278_CR17","unstructured":"Hein M, Andriushchenko M (2017) Formal guarantees on the robustness of a classifier against adversarial manipulation. In: Advances in neural information processing systems, pp 2266\u20132276"},{"key":"1278_CR18","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2020.2970195","author":"Y Jia","year":"2020","unstructured":"Jia Y, Liu H, Hou J, Kwong S (2020) Pairwise constraint propagation with dual adversarial manifold regularization. IEEE Trans Neural Netw Learn Syst. https:\/\/doi.org\/10.1109\/TNNLS.2020.2970195","journal-title":"IEEE Trans Neural Netw Learn Syst"},{"key":"1278_CR19","doi-asserted-by":"publisher","DOI":"10.1109\/TCYB.2020.2969684","author":"Y Jia","year":"2020","unstructured":"Jia Y, Liu H, Hou J, Kwong S (2020) Semisupervised adaptive symmetric non-negative matrix factorization. IEEE Trans Cybern. https:\/\/doi.org\/10.1109\/TCYB.2020.2969684","journal-title":"IEEE Trans Cybern"},{"key":"1278_CR20","unstructured":"Karmon D, Zoran D, Goldberg Y (2018) Lavan: localized and visible adversarial noise. In: Dy JG, Krause A (eds) Proceedings of the 35th international conference on machine learning, ICML 2018, Stockholmsm\u00e4ssan, Stockholm, Sweden, July 10\u201315, 2018, Proceedings of Machine Learning Research, vol.\u00a080, pp 2512\u20132520. PMLR. http:\/\/proceedings.mlr.press\/v80\/karmon18a.html"},{"key":"1278_CR21","doi-asserted-by":"publisher","first-page":"189","DOI":"10.1080\/03081070902993178","volume":"38","author":"K Krippendorff","year":"2009","unstructured":"Krippendorff K (2009) Figure 12 in Klaus Krippendorff\u2019s \u2019ross Ashby\u2019s information theory: a bit of history, some solutions to problems, and what we face today. Int J Gen Syst 38:189\u2013212. https:\/\/doi.org\/10.1080\/03081070902993178(Int. J. Gen. Syst. 38(6), 667\u2013668 (2009))","journal-title":"Int J Gen Syst"},{"key":"1278_CR22","unstructured":"Krizhevsky A, Hinton G et\u00a0al (2009) Learning multiple layers of features from tiny images"},{"key":"1278_CR23","unstructured":"Kurakin A, Goodfellow IJ, Bengio S (2017) Adversarial examples in the physical world. In: Proceedings of the 5th international conference on learning representations (ICLR), Toulon, France, April 24\u201326, 2017"},{"key":"1278_CR24","unstructured":"Kurakin A, Goodfellow IJ, Bengio S (2017) Adversarial machine learning at scale. In: 5th International conference on learning representations, ICLR 2017, Toulon, France, April 24\u201326, 2017, conference track proceedings. OpenReview.net. https:\/\/openreview.net\/forum?id=HJGU3Rodl"},{"issue":"1","key":"1278_CR25","doi-asserted-by":"publisher","first-page":"145","DOI":"10.1109\/18.61115","volume":"37","author":"J Lin","year":"1991","unstructured":"Lin J (1991) Divergence measures based on the Shannon entropy. IEEE Trans Inf Theory 37(1):145\u2013151","journal-title":"IEEE Trans Inf Theory"},{"key":"1278_CR26","doi-asserted-by":"crossref","unstructured":"Liu H, Ji R, Li J, Zhang B, Gao Y, Wu Y, Huang F (2019) Universal adversarial perturbation via prior driven uncertainty approximation. In: Proceedings of the IEEE\/CVF international conference on computer vision (ICCV)","DOI":"10.1109\/ICCV.2019.00303"},{"key":"1278_CR27","doi-asserted-by":"crossref","unstructured":"Liu H, Jia Y, Hou J, Zhang Q (2019) Imbalance-aware pairwise constraint propagation. In: Proceedings of the 27th ACM international conference on multimedia, pp 1605\u20131613","DOI":"10.1145\/3343031.3350968"},{"key":"1278_CR28","unstructured":"Liu X, Yang H, Liu Z, Song L, Chen Y, Li H (2019) DPATCH: an adversarial patch attack on object detectors. In: Proceedings of the AAAI workshop on artificial intelligence safety (SafeAI), Honolulu, Hawaii, USA, January 27, 2019"},{"key":"1278_CR29","unstructured":"Liu Y, Chen X, Liu C, Song D (2016) Delving into transferable adversarial examples and black-box attacks. arXiv preprint. https:\/\/arxiv.org\/abs\/1611.02770"},{"key":"1278_CR30","unstructured":"Madry A, Makelov A, Schmidt L, Tsipras D, Vladu A (2018) Towards deep learning models resistant to adversarial attacks. In: Proceedings of the 6th international conference on learning representations (ICLR), Vancouver, BC, Canada, April 30\u2013May 3, 2018"},{"key":"1278_CR31","unstructured":"Mishkin D, Matas J (2016) All you need is a good init. In: Bengio Y, LeCun Y (eds) 4th International conference on learning representations, ICLR 2016, San Juan, Puerto Rico, May 2\u20134, 2016, conference track proceedings. http:\/\/arxiv.org\/abs\/1511.06422"},{"key":"1278_CR32","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli SM, Fawzi A, Frossard P (2016) Deepfool: a simple and accurate method to fool deep neural networks. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 2574\u20132582","DOI":"10.1109\/CVPR.2016.282"},{"key":"1278_CR33","unstructured":"Papernot N, McDaniel P, Goodfellow I (2016) Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277"},{"key":"1278_CR34","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Jha S, Fredrikson M, Celik ZB, Swami A (2016) The limitations of deep learning in adversarial settings. In: 2016 IEEE European symposium on security and privacy (EuroS&P), pp. 372\u2013387. IEEE","DOI":"10.1109\/EuroSP.2016.36"},{"key":"1278_CR35","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Wu X, Jha S, Swami A (2016) Distillation as a defense to adversarial perturbations against deep neural networks. In: 2016 IEEE symposium on security and privacy (SP), pp 582\u2013597. IEEE","DOI":"10.1109\/SP.2016.41"},{"key":"1278_CR36","unstructured":"Pinto L, Davidson J, Sukthankar R, Gupta A (2017) Robust adversarial reinforcement learning. In: Proceedings of the 34th international conference on machine learning (ICML), Sydney, NSW, Australia, August 6\u201311, 2017"},{"key":"1278_CR37","unstructured":"Pourpanah F, Abdar M, Luo Y, Zhou X, Wang R, Lim CP, Wang XZ (2020) A review of generalized zero-shot learning methods. arXiv preprint arXiv:2011.08641"},{"key":"1278_CR38","unstructured":"Qin C, Martens J, Gowal S, Krishnan D, Dvijotham K, Fawzi A, De S, Stanforth R, Kohli P (2019) Adversarial robustness through local linearization. In: Advances in neural information processing systems, pp 13847\u201313856"},{"key":"1278_CR39","unstructured":"Raghunathan A, Steinhardt J, Liang P (2018) Certified defenses against adversarial examples. In: Proceedings of the 6th international conference on learning representations (ICLR), Vancouver, BC, Canada, April 30\u2013May 3, 2018"},{"issue":"02","key":"1278_CR40","doi-asserted-by":"publisher","first-page":"69","DOI":"10.1142\/S0129065704001899","volume":"14","author":"M Seeger","year":"2004","unstructured":"Seeger M (2004) Gaussian processes for machine learning. Int J Neural Syst 14(02):69\u2013106","journal-title":"Int J Neural Syst"},{"issue":"1","key":"1278_CR41","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1145\/584091.584093","volume":"5","author":"CE Shannon","year":"2001","unstructured":"Shannon CE (2001) A mathematical theory of communication. ACM SIGMOBILE Mobile Comput Commun Rev 5(1):3\u201355","journal-title":"ACM SIGMOBILE Mobile Comput Commun Rev"},{"key":"1278_CR42","doi-asserted-by":"crossref","unstructured":"Sharif M, Bhagavatula S, Bauer L, Reiter MK (2016) Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition. In: Proceedings of the 2016 ACM sigsac conference on computer and communications security, pp 1528\u20131540","DOI":"10.1145\/2976749.2978392"},{"key":"1278_CR43","unstructured":"Shen H, Chen S, Wang R, Wang X (2020) Generalized adversarial examples: Attacks and defenses. arXiv preprint arXiv:2011.14045"},{"key":"1278_CR44","unstructured":"Sinha A, Namkoong H, Duchi JC (2018) Certifying some distributional robustness with principled adversarial training. In: Proceedings of the 6th international conference on learning representations (ICLR), Vancouver, BC, Canada, April 30\u2013May 3, 2018"},{"key":"1278_CR45","unstructured":"Smith L, Gal Y (2018) Understanding measures of uncertainty for adversarial example detection. In: Proceedings of the 34th conference on uncertainty in artificial intelligence (UAI), Monterey, California, USA, August 6\u201310, 2018, pp 560\u2013569"},{"key":"1278_CR46","unstructured":"Springenberg JT, Dosovitskiy A, Brox T, Riedmiller MA (2015) Striving for simplicity: The all convolutional net. In: Bengio Y, LeCun Y (eds) 3rd International conference on learning representations, ICLR 2015, San Diego, CA, USA, May 7\u20139, 2015, workshop track proceedings. http:\/\/auai.org\/uai2018\/proceedings\/papers\/207.pdf"},{"key":"1278_CR47","doi-asserted-by":"crossref","unstructured":"Su D, Zhang H, Chen H, Yi J, Chen PY, Gao Y (2018) Is robustness the cost of accuracy?\u2014a comprehensive study on the robustness of 18 deep image classification models. In: Proceedings of the European conference on computer vision (ECCV), pp 631\u2013648","DOI":"10.1007\/978-3-030-01258-8_39"},{"issue":"5","key":"1278_CR48","doi-asserted-by":"publisher","first-page":"828","DOI":"10.1109\/TEVC.2019.2890858","volume":"23","author":"J Su","year":"2019","unstructured":"Su J, Vargas DV, Sakurai K (2019) One pixel attack for fooling deep neural networks. IEEE Trans Evolut Comput 23(5):828\u2013841","journal-title":"IEEE Trans Evolut Comput"},{"key":"1278_CR49","doi-asserted-by":"crossref","unstructured":"Szegedy C, Vanhoucke V, Ioffe S, Shlens J, Wojna Z (2016) Rethinking the inception architecture for computer vision. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 2818\u20132826","DOI":"10.1109\/CVPR.2016.308"},{"key":"1278_CR50","unstructured":"Szegedy C, Zaremba W, Sutskever I, Bruna J, Erhan D, Goodfellow IJ, Fergus R (2014) Intriguing properties of neural networks. In: Bengio Y, LeCun Y (eds) 2nd international conference on learning representations, ICLR 2014, Banff, AB, Canada, April 14\u201316, 2014, conference track proceedings. http:\/\/arxiv.org\/abs\/1312.6199"},{"key":"1278_CR51","doi-asserted-by":"publisher","first-page":"103550","DOI":"10.1016\/j.engappai.2020.103550","volume":"91","author":"M Terzi","year":"2020","unstructured":"Terzi M, Susto GA, Chaudhari P (2020) Directional adversarial training for cost sensitive deep learning classification applications. Eng Appl Artif Intell 91:103550","journal-title":"Eng Appl Artif Intell"},{"key":"1278_CR52","unstructured":"Tram\u00e9r F, Kurakin A, Papernot N, Goodfellow IJ, Boneh D, McDaniel PD (2018) Ensemble adversarial training: Attacks and defenses. In: Proceedings of the 6th international conference on learning representations (ICLR), Vancouver, BC, Canada, April 30\u2013May 3, 2018"},{"key":"1278_CR53","unstructured":"Tsipras D, Santurkar S, Engstrom L, Turne, A, Madry A(2019) Robustness may be at odds with accuracy. In: Proceedings of the 7th international conference on learning representations (ICLR), New Orleans, LA, USA, May 6\u20139, 2019"},{"key":"1278_CR54","unstructured":"Wong E, Kolter JZ (2018) Provable defenses against adversarial examples via the convex outer adversarial polytope. In: Proceedings of the 35th international conference on machine learning (ICML), Stockholm, Sweden, July 10\u201315, 2018, pp 8405\u20138423"},{"key":"1278_CR55","unstructured":"Xiao H, Rasul K, Vollgraf R (2017) Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms"},{"issue":"4","key":"1278_CR56","doi-asserted-by":"publisher","first-page":"556","DOI":"10.1109\/34.993562","volume":"24","author":"DS Yeung","year":"2002","unstructured":"Yeung DS, Wang X (2002) Improving performance of similarity-based clustering by feature weight learning. IEEE Trans Pattern Anal Mach Intell 24(4):556\u2013561","journal-title":"IEEE Trans Pattern Anal Mach Intell"},{"key":"1278_CR57","unstructured":"Zhang H, Yu Y, Jiao J, Xing EP, Ghaoui LE, Jordan MI (2019) Theoretically principled trade-off between robustness and accuracy. In: Proceedings of the 36th international conference on machine learning (ICML), Long Beach, California, USA, June 9\u201315, 2019, pp 12907\u201312929"},{"key":"1278_CR58","unstructured":"Zhao Z, Dua D, Singh S (2018) Generating natural adversarial examples. In: Proceedings of the 6th international conference on learning representations (ICLR), Vancouver, BC, Canada, April 30\u2013May 3, 2018"}],"container-title":["International Journal of Machine Learning and Cybernetics"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s13042-021-01278-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s13042-021-01278-9\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s13042-021-01278-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,5,20]],"date-time":"2021-05-20T09:15:34Z","timestamp":1621502134000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s13042-021-01278-9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,2,13]]},"references-count":58,"journal-issue":{"issue":"6","published-print":{"date-parts":[[2021,6]]}},"alternative-id":["1278"],"URL":"https:\/\/doi.org\/10.1007\/s13042-021-01278-9","relation":{},"ISSN":["1868-8071","1868-808X"],"issn-type":[{"value":"1868-8071","type":"print"},{"value":"1868-808X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,2,13]]},"assertion":[{"value":"9 November 2020","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"7 January 2021","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"13 February 2021","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Compliance with ethical standards"}},{"value":"The authors declare that there is no conflict of interests regarding the publication of this article.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}]}}