{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T19:58:41Z","timestamp":1784231921055,"version":"3.55.0"},"reference-count":455,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"},{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"am","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/100000185","name":"Defense Advanced Research Projects Agency","doi-asserted-by":"publisher","award":["HR00112090095"],"award-info":[{"award-number":["HR00112090095"]}],"id":[{"id":"10.13039\/100000185","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000923","name":"Australian Research Council Discovery","doi-asserted-by":"publisher","award":["DP190102443"],"award-info":[{"award-number":["DP190102443"]}],"id":[{"id":"10.13039\/501100000923","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Office of National Intelligence National Intelligence Postdoctoral Grant"},{"DOI":"10.13039\/100015539","name":"Australian Government","doi-asserted-by":"publisher","award":["NIPG-2021-001"],"award-info":[{"award-number":["NIPG-2021-001"]}],"id":[{"id":"10.13039\/100015539","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2021]]},"DOI":"10.1109\/access.2021.3127960","type":"journal-article","created":{"date-parts":[[2021,11,13]],"date-time":"2021-11-13T00:23:28Z","timestamp":1636763008000},"page":"155161-155196","source":"Crossref","is-referenced-by-count":293,"title":["Advances in Adversarial Attacks and Defenses in Computer Vision: A Survey"],"prefix":"10.1109","volume":"9","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3406-673X","authenticated-orcid":false,"given":"Naveed","family":"Akhtar","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5206-3842","authenticated-orcid":false,"given":"Ajmal","family":"Mian","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Navid","family":"Kardan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8216-1128","authenticated-orcid":false,"given":"Mubarak","family":"Shah","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref275","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58558-7_39"},{"key":"ref274","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58601-0_24"},{"key":"ref277","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01443"},{"key":"ref276","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58589-1_3"},{"key":"ref271","first-page":"9229","article-title":"Catastrophic child’s play: Easy to perform, hard to defend adversarial attacks","author":"ho","year":"2019","journal-title":"Proc IEEE\/CVF Conf Comput Vis Pattern Recognit (CVPR)"},{"key":"ref270","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01426"},{"key":"ref170","first-page":"1","article-title":"A new defense against adversarial images: Turning a weakness into a strength","author":"yu","year":"2019","journal-title":"Proc NIPS"},{"key":"ref273","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2019.2921336"},{"key":"ref272","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00108"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58568-6_46"},{"key":"ref171","first-page":"1","article-title":"Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates","author":"ghiasi","year":"2020","journal-title":"Proc ICLR"},{"key":"ref174","first-page":"497","article-title":"Terminal brain damage: Exposing the graceless degradation in deep neural networks under hardware fault attacks","author":"hong","year":"2019","journal-title":"Proc 28th USENIX Secur Symp (USENIX)"},{"key":"ref173","first-page":"1","article-title":"Flip Feng Shui: Hammering a needle in the software stack","author":"razavi","year":"2016","journal-title":"Proc 25th USENIX Secur Symp (USENIX)"},{"key":"ref176","first-page":"1","article-title":"A target-agnostic attack on deep models: Exploiting security vulnerabilities of transfer learning","author":"rezaei","year":"2020","journal-title":"Proc ICLR"},{"key":"ref175","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00130"},{"key":"ref178","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00816"},{"key":"ref177","first-page":"1","article-title":"Optimal strategies against generative attacks","author":"mor","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref168","first-page":"1","article-title":"Me-Net: Towards effective adversarial robustness with matrix estimation","author":"yang","year":"2019","journal-title":"Proc ICLR"},{"key":"ref169","first-page":"1","article-title":"Adversarial example detection and classification with asymmetrical adversarial training","author":"yin","year":"2020","journal-title":"Proc ICLR"},{"key":"ref267","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3339815"},{"key":"ref268","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00846"},{"key":"ref269","first-page":"1","article-title":"CAMOU: Learning physical vehicle camouflages to adversarially attack detectors in the wild","author":"zhang","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref288","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00956"},{"key":"ref287","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00406"},{"key":"ref286","article-title":"Large-scale adversarial training for vision- and-language representation learning","author":"gan","year":"2020","journal-title":"arXiv 2006 06195"},{"key":"ref285","article-title":"Do adversarially robust ImageNet models transfer better?","author":"salman","year":"2020","journal-title":"arXiv 2007 08489"},{"key":"ref181","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58610-2_15"},{"key":"ref284","first-page":"1","article-title":"Contrastive learning with adversarial examples","author":"ho","year":"2020","journal-title":"Proc NIPS"},{"key":"ref180","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00128"},{"key":"ref283","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01267-0_9"},{"key":"ref282","article-title":"Inductive bias of gradient descent based adversarial training on separable data","author":"li","year":"2019","journal-title":"arXiv 1906 02931"},{"key":"ref281","article-title":"Adversarial training can hurt generalization","author":"raghunathan","year":"2019","journal-title":"arXiv 1906 06032"},{"key":"ref185","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00443"},{"key":"ref280","article-title":"EfficientNet: Rethinking model scaling for convolutional neural networks","author":"tan","year":"2019","journal-title":"arXiv 1905 11946"},{"key":"ref184","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00935"},{"key":"ref183","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.01204"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00205"},{"key":"ref189","first-page":"7597","article-title":"BASAR: Black-box attack on skeletal action recognition","author":"diao","year":"2021","journal-title":"Proc IEEE\/CVF Conf Comput Vis Pattern Recognit (CVPR)"},{"key":"ref188","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2020.3043002"},{"key":"ref187","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58520-4_8"},{"key":"ref186","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58565-5_15"},{"key":"ref179","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01037"},{"key":"ref278","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01580"},{"key":"ref279","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00090"},{"key":"ref293","article-title":"Adversarial reprogramming of neural networks","author":"elsayed","year":"2018","journal-title":"arXiv 1806 11146"},{"key":"ref292","article-title":"Structured adversarial attack: Towards general implementation and better interpretability","author":"xu","year":"2019","journal-title":"Proc ICLR"},{"key":"ref295","first-page":"1078","article-title":"Adversarial filters of dataset biases","author":"le bras","year":"2020","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref294","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i05.6399"},{"key":"ref297","doi-asserted-by":"publisher","DOI":"10.1162\/neco_a_01143"},{"key":"ref296","article-title":"A boundary tilting persepective on the phenomenon of adversarial examples","author":"tanay","year":"2016","journal-title":"arXiv 1608 07690"},{"key":"ref299","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.01160"},{"key":"ref298","first-page":"1172","article-title":"Dense associative memory for pattern recognition","volume":"29","author":"krotov","year":"2016","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref154","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2021.3083769"},{"key":"ref153","first-page":"3387","article-title":"Synthesizing the preferred inputs for neurons in neural networks via deep generator networks","volume":"29","author":"nguyen","year":"2016","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref156","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","author":"athalye","year":"2018","journal-title":"Proc ICML"},{"key":"ref155","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00033"},{"key":"ref150","first-page":"17","article-title":"Privacy in pharmacogenetics: An end-to-end case study of personalized warfarin dosing","author":"fredrikson","year":"2014","journal-title":"Proc 23rd USENIX Secur Symp"},{"key":"ref152","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2018.00027"},{"key":"ref291","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01055"},{"key":"ref151","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2016.32"},{"key":"ref290","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58574-7_14"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01321"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01445"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00038"},{"key":"ref149","article-title":"Attack of the tails: Yes, you really can backdoor federated learning","author":"wang","year":"2020","journal-title":"arXiv 2007 05084"},{"key":"ref289","first-page":"1262","article-title":"Image synthesis with a single (robust) classifier","author":"santurkar","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref167","first-page":"1","article-title":"Mixup inference: Better exploiting mixup to defend adversarial attacks","author":"pang","year":"2020","journal-title":"Proc ICLR"},{"key":"ref166","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2020\/438"},{"key":"ref165","first-page":"1","article-title":"Empir: Ensembles of mixed precision deep networks for increased robustness against adversarial attacks","author":"sen","year":"2020","journal-title":"Proc ICLR"},{"key":"ref164","first-page":"4970","article-title":"Improving adversarial robustness via promoting ensemble diversity","author":"pang","year":"2019","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref163","first-page":"8646","article-title":"Error correcting output codes improve probability estimation and adversarial robustness of deep neural networks","volume":"32","author":"verma","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref162","first-page":"1","article-title":"Rethinking softmax cross-entropy loss for adversarial robustness","author":"pang","year":"2020","journal-title":"Proc ICLR"},{"key":"ref161","article-title":"Thwarting adversarial examples: An L?-robustsparse Fourier transform","author":"bafna","year":"2018","journal-title":"Proc NIPS"},{"key":"ref160","first-page":"3804","article-title":"Are generative classifiers more robust to adversarial attacks?","author":"li","year":"2019","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref159","first-page":"5498","article-title":"The odds are odd: A statistical test for detecting adversarial examples","author":"roth","year":"2019","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref157","first-page":"1","article-title":"On adaptive attacks to adversarial example defenses","author":"tramer","year":"2020","journal-title":"Proc NIPS"},{"key":"ref158","article-title":"Enhancing adversarial defense by K-winners-take-all","author":"xiao","year":"2019","journal-title":"arXiv 1905 10510"},{"key":"ref197","article-title":"ADef: An iterative algorithm to construct adversarial deformations","author":"alaifari","year":"2018","journal-title":"arXiv 1804 07729"},{"key":"ref198","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58542-6_3"},{"key":"ref199","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00303"},{"key":"ref193","first-page":"1","article-title":"Adversarial attacks on graph neural networks via meta learning","author":"z\u00fcgner","year":"2019","journal-title":"Proc ICLR"},{"key":"ref194","first-page":"1","article-title":"Certified robustness of graph convolution networks for graph classification under topological attacks","volume":"33","author":"jin","year":"2020","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref195","article-title":"Combinatorial attacks on binarized neural networks","author":"khalil","year":"2018","journal-title":"arXiv 1810 03538"},{"key":"ref196","article-title":"Defensive quantization: When efficiency meets robustness","author":"lin","year":"2019","journal-title":"arXiv 1904 08444"},{"key":"ref190","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01442"},{"key":"ref191","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00058"},{"key":"ref192","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00407"},{"key":"ref200","doi-asserted-by":"publisher","DOI":"10.1016\/j.patrec.2020.04.025"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00124"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01166"},{"key":"ref209","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00080"},{"key":"ref409","first-page":"1","article-title":"Certified defenses against adversarial examples","author":"raghunathan","year":"2018","journal-title":"Proc ICLR"},{"key":"ref407","first-page":"1","article-title":"Evaluating robustness of neural networks with mixed integer programming","author":"tjeng","year":"2019","journal-title":"Proc ICLR"},{"key":"ref408","first-page":"2266","article-title":"Formal guarantees on the robustness of a classifier against adversarial manipulation","author":"hein","year":"2017","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref405","first-page":"1","article-title":"Scaling up the randomized gradient-free adversarial attack reveals overestimation of robustness using established attacks","volume":"128","author":"croce","year":"2019","journal-title":"Int J Comput Vis"},{"key":"ref203","first-page":"104","article-title":"Deep affinity network for multiple object tracking","volume":"43","author":"sun","year":"2021","journal-title":"IEEE Trans Pattern Anal Mach Intell"},{"key":"ref406","first-page":"97","article-title":"Reluplex: An efficient SMT solver for verifying deep neural networks","volume":"10426","author":"katz","year":"2017","journal-title":"Proc Int Conf Comput Aided Verification"},{"key":"ref204","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01028"},{"key":"ref403","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00066"},{"key":"ref201","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00323"},{"key":"ref404","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01446"},{"key":"ref202","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.690"},{"key":"ref401","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00681"},{"key":"ref207","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58574-7_3"},{"key":"ref402","first-page":"1","article-title":"Enhancing transformation-based defenses against adversarial attacks with a distribution classifier","author":"kou","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref208","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00492"},{"key":"ref205","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00107"},{"key":"ref400","first-page":"1","article-title":"Defense-GAN: Protecting classifiers against adversarial attacks using generative models","author":"samangouei","year":"2018","journal-title":"Proc ICLR"},{"key":"ref206","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00441"},{"key":"ref211","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01498"},{"key":"ref210","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58548-8_1"},{"key":"ref418","first-page":"1","article-title":"Certified defense to image transformations via randomized smoothing","author":"fischer","year":"2020","journal-title":"Proc NIPS"},{"key":"ref419","article-title":"(De)Randomized smoothing for certifiable defense against patch attacks","author":"levine","year":"2020","journal-title":"arXiv 2002 10733"},{"key":"ref414","first-page":"5866","article-title":"Adversarial training and robustness for multiple perturbations","author":"tramer","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref212","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58595-2_13"},{"key":"ref415","first-page":"1","article-title":"Certified robustness for top-K predictions against adversarial perturbations via randomized smoothing","author":"jia","year":"2020","journal-title":"Proc ICLR"},{"key":"ref213","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00664"},{"key":"ref416","doi-asserted-by":"publisher","DOI":"10.1145\/3134600.3134606"},{"key":"ref214","article-title":"Adversarial attacks on neural network policies","author":"huang","year":"2017","journal-title":"arXiv 1702 02284"},{"key":"ref417","first-page":"1","article-title":"MACER: Attack-free and scalable robust training via maximizing certified radius","author":"zhai","year":"2020","journal-title":"Proc ICLR"},{"key":"ref215","doi-asserted-by":"publisher","DOI":"10.1109\/DSC.2018.00125"},{"key":"ref410","first-page":"5286","article-title":"Provable defenses against adversarial examples via the convex outer adversarial polytope","author":"wong","year":"2018","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref216","doi-asserted-by":"publisher","DOI":"10.1109\/DSC.2018.00126"},{"key":"ref411","first-page":"3578","article-title":"Differentiable abstract interpretation for provably robust neural networks","author":"mirman","year":"2018","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref217","article-title":"Playing atari with deep reinforcement learning","author":"mnih","year":"2013","journal-title":"arXiv 1312 5602"},{"key":"ref412","first-page":"1","article-title":"Training for faster adversarial robustness verification via inducing relu stability","author":"xiao","year":"2019","journal-title":"Proc ICLR"},{"key":"ref218","article-title":"Gradient band-based adversarial training for generalized attack immunity of A3C path finding","author":"chen","year":"2018","journal-title":"arXiv 1807 06752"},{"key":"ref413","first-page":"1","article-title":"Provable robustness against all adversarial l?-perturbations for p?1","author":"croce","year":"2020","journal-title":"Proc ICLR"},{"key":"ref219","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-62416-7_19"},{"key":"ref420","first-page":"1","article-title":"Certified defenses for adversarial patches","author":"chiang","year":"2020","journal-title":"Proc ICLR"},{"key":"ref220","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2017\/525"},{"key":"ref222","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-019-0027-x"},{"key":"ref221","first-page":"374","article-title":"A method to effectively detect vulnerabilities on path planning of VIN","volume":"10631","author":"liu","year":"2017","journal-title":"Proc Int Conf Inf Commun Secur"},{"key":"ref229","article-title":"Attacking visual language grounding with adversarial examples: A case study on neural image captioning","author":"chen","year":"2017","journal-title":"arXiv 1712 02051"},{"key":"ref228","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00520"},{"key":"ref227","doi-asserted-by":"publisher","DOI":"10.1145\/3355390"},{"key":"ref226","first-page":"1","article-title":"Robust deep reinforcement learning against adversarial perturbations on state observations","author":"zhang","year":"2020","journal-title":"Proc NIPS"},{"key":"ref225","first-page":"11225","article-title":"Adaptive reward-poisoning attacks against reinforcement learning","author":"zhang","year":"2020","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref224","first-page":"7974","article-title":"Policy teaching via environment poisoning: Training-time adversarial attacks against reinforcement learning","author":"rakhsha","year":"2020","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref223","first-page":"1","article-title":"Adversarial policies: Attacking deep reinforcement learning","author":"gleave","year":"2020","journal-title":"Proc ICLR"},{"key":"ref127","article-title":"Wasserstein adversarial examples via projected sinkhorn iterations","author":"wong","year":"2019","journal-title":"arXiv 1902 07906"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00482"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1145\/3317611"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00487"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00123"},{"key":"ref128","first-page":"1","article-title":"Unrestricted adversarial examples via semantic manipulation","author":"bhattad","year":"2020","journal-title":"Proc ICLR"},{"key":"ref130","doi-asserted-by":"publisher","DOI":"10.1364\/JOSAA.15.002036"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58568-6_2"},{"key":"ref134","article-title":"DeepFakes: A new threat to face recognition? Assessment and detection","author":"korshunov","year":"2018","journal-title":"arXiv 1812 08685"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00112"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1002\/col.1049"},{"key":"ref232","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01232"},{"key":"ref233","first-page":"1","article-title":"Freelb: Enhanced adversarial training for natural language understanding","author":"zhu","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref230","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298935"},{"key":"ref231","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00426"},{"key":"ref239","doi-asserted-by":"publisher","DOI":"10.1162\/106365601750190398"},{"key":"ref238","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00790"},{"key":"ref235","first-page":"1","article-title":"Unravelling robustness of deep learning based face recognition against adversarial attacks","volume":"32","author":"goswami","year":"2018","journal-title":"Proc AAAI Conf Artif Intell"},{"key":"ref234","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00482"},{"key":"ref237","doi-asserted-by":"publisher","DOI":"10.5244\/C.29.41"},{"key":"ref236","article-title":"Openface: A general-purpose face recognition library with mobile applications","author":"amos","year":"2016"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01501"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00890"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1109\/ISQED48828.2020.9137011"},{"key":"ref137","article-title":"Backdoor learning: A survey","author":"li","year":"2020","journal-title":"arXiv 2007 08745"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58607-2_11"},{"key":"ref140","article-title":"Input-aware dynamic backdoor attack","author":"nguyen","year":"2020","journal-title":"arXiv 2010 08138"},{"key":"ref141","first-page":"1","article-title":"Dba: Distributed backdoor attacks against federated learning","author":"xie","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref142","first-page":"4424","article-title":"Federated multi-task learning","author":"smith","year":"2017","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref143","first-page":"634","article-title":"Analyzing federated learning through an adversarial lens","author":"bhagoji","year":"2019","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref144","first-page":"2938","article-title":"How to backdoor federated learning","author":"bagdasaryan","year":"2020","journal-title":"Proc Int Conf Artif Intell Statist"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1126\/science.1254806"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58583-9_9"},{"key":"ref1","doi-asserted-by":"crossref","first-page":"436","DOI":"10.1038\/nature14539","article-title":"Deep learning","volume":"521","author":"lecun","year":"2015","journal-title":"Nature"},{"key":"ref241","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP.2019.8803803"},{"key":"ref242","doi-asserted-by":"publisher","DOI":"10.1109\/ICUFN.2019.8806124"},{"key":"ref243","doi-asserted-by":"publisher","DOI":"10.1109\/WACV.2019.00215"},{"key":"ref244","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01167"},{"key":"ref240","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.3036801"},{"key":"ref248","doi-asserted-by":"publisher","DOI":"10.1016\/j.inffus.2020.06.014"},{"key":"ref247","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00573"},{"key":"ref246","first-page":"1","article-title":"AdvFaces: Adversarial face synthesis","author":"deb","year":"2019","journal-title":"Proc IEEE Int Joint Conf Biometrics (IJCB)"},{"key":"ref245","doi-asserted-by":"publisher","DOI":"10.1007\/s11042-019-07896-4"},{"key":"ref249","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978392"},{"key":"ref109","first-page":"543","article-title":"A method for unconstrained convex minimization problem with the rate of convergence o (1\/k^ 2)","volume":"269","author":"nesterov","year":"1983","journal-title":"Doklady an USSR"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00072"},{"key":"ref107","first-page":"1","article-title":"Nesterov accelerated gradient and scale invariance for adversarial attacks","author":"lin","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref106","first-page":"1","article-title":"Practical no-box adversarial attacks against DNNs","author":"li","year":"2020","journal-title":"Proc NIPS"},{"key":"ref105","article-title":"Adversarial example games","author":"bose","year":"2020","journal-title":"arXiv 2007 00720"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00483"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58517-4_15"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.74"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00723"},{"key":"ref112","first-page":"1","article-title":"Transferable perturbations of deep feature distributions","author":"inkawhich","year":"2020","journal-title":"Proc ICLR"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00102"},{"key":"ref250","article-title":"Invisible mask: Practical attacks on face recognition with infrared","author":"zhou","year":"2018","journal-title":"arXiv 1803 04683"},{"key":"ref251","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW50498.2020.00415"},{"key":"ref254","doi-asserted-by":"publisher","DOI":"10.1109\/SIBIRCON48586.2019.8958134"},{"key":"ref255","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.01026"},{"key":"ref252","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298682"},{"key":"ref253","article-title":"AdvHat: Real-world adversarial attack on ArcFace face ID system","author":"komkov","year":"2019","journal-title":"arXiv 1908 08705"},{"key":"ref257","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_31"},{"key":"ref256","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58558-7_36"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref259","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01304"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.243"},{"key":"ref258","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00039"},{"key":"ref12","article-title":"Inception-v4, inception-ResNet and the impact of residual connections on learning","author":"szegedy","year":"2016","journal-title":"arXiv 1602 07261"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1038\/nature24270"},{"key":"ref14","year":"2020","journal-title":"Driving the Future"},{"key":"ref15","author":"middlehurst","year":"2020","journal-title":"China Unveils World’s First Facial Recognition ATM"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00668"},{"key":"ref16","year":"2020","journal-title":"About Face ID Advanced Technology"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1002\/rob.21918"},{"key":"ref18","first-page":"1896","article-title":"Learning from millions of 3D scans for large-scale 3D face recognition","author":"gilani","year":"2018","journal-title":"Proc IEEE Conf Comput Vis and Pattern Recog"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00196"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/SIBGRAPI.2018.00067"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58621-8_46"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00042"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58542-6_34"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00031"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00891"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2018.00211"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2018.00212"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref260","article-title":"Targeted adversarial perturbations for monocular depth prediction","author":"wong","year":"2020","journal-title":"arXiv 2006 08602"},{"key":"ref261","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58452-8_36"},{"key":"ref262","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00500"},{"key":"ref263","first-page":"1","article-title":"Adversarial attacks on deep graph matching","volume":"33","author":"zhang","year":"2020","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref264","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58574-7_41"},{"key":"ref265","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58520-4_11"},{"key":"ref266","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00249"},{"key":"ref365","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P19-1425"},{"key":"ref364","first-page":"1","article-title":"Defending against physically realizable attacks on image classification","author":"wu","year":"2020","journal-title":"Proc ICLR"},{"key":"ref363","article-title":"Boosting adversarial training with hypersphere embedding","author":"pang","year":"2020","journal-title":"arXiv 2002 08619"},{"key":"ref362","article-title":"Over-parameterized adversarial training: An analysis overcoming the curse of dimensionality","author":"zhang","year":"2020","journal-title":"arXiv 2002 06668"},{"key":"ref361","first-page":"13029","article-title":"Convergence of adversarial training in overparametrized neural networks","volume":"32","author":"gao","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref360","first-page":"1","article-title":"Adversarial weight perturbation helps robust generalization","volume":"33","author":"wu","year":"2020","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/MASSW.2019.00012"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2018.10.315"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01264-9_28"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00126"},{"key":"ref359","first-page":"1","article-title":"Bridging mode connectivity in loss landscapes and adversarial robustness","author":"zhao","year":"2020","journal-title":"Proc ICLR"},{"key":"ref30","article-title":"Explaining and harnessing adversarial examples","author":"goodfellow","year":"2014","journal-title":"arXiv 1412 6572"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1007\/s11633-019-1211-x"},{"key":"ref357","first-page":"1","article-title":"Fast is better than free: Revisiting adversarial training","author":"wong","year":"2020","journal-title":"Proc ICLR"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2018.2886017"},{"key":"ref358","first-page":"1","article-title":"Understanding and improving fast adversarial training","author":"andriushchenko","year":"2020","journal-title":"Proc NIPS"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1038\/s41586-019-1724-z"},{"key":"ref355","article-title":"Adversarially robust transfer learning","author":"shafahi","year":"2019","journal-title":"arXiv 1905 08232"},{"key":"ref34","article-title":"Label universal targeted attack","author":"akhtar","year":"2019","journal-title":"arXiv 1905 11544"},{"key":"ref356","first-page":"1","article-title":"Hydra: Pruning adversarially robust neural networks","volume":"7","author":"sehwag","year":"2020","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref352","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00035"},{"key":"ref351","first-page":"6438","article-title":"Manifold mixup: Better representations by interpolating hidden states","volume":"97","author":"verma","year":"2019","journal-title":"Proc 36th Int Conf Mach Learn"},{"key":"ref354","first-page":"1","article-title":"Implicit bias of gradient descent based adversarial training on separable data","author":"li","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref353","first-page":"1","article-title":"Intriguing properties of adversarial training at scale","author":"xie","year":"2020","journal-title":"Proc ICLR"},{"key":"ref350","article-title":"Mixup: Beyond empirical risk minimization","author":"zhang","year":"2017","journal-title":"arXiv 1710 09412"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01019"},{"key":"ref27","article-title":"Fooling detection alone is not enough: Adversarial attack against multiple object tracking","author":"jia","year":"2019","journal-title":"Proc Int Conf Learn Representations"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2807385"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1177\/0278364918770733"},{"key":"ref348","first-page":"6575","article-title":"Adversarial neural pruning with latent vulnerability suppression","author":"madaan","year":"2020","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref349","first-page":"6640","article-title":"Adversarial robustness against the union of multiple perturbation models","author":"maini","year":"2020","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref22","article-title":"Intriguing properties of neural networks","author":"szegedy","year":"2013","journal-title":"arXiv 1312 6199"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1186\/s40537-014-0007-7"},{"key":"ref24","article-title":"Segmentations-leak: Membership inference attacks and defenses in semantic image segmentation","author":"he","year":"2019","journal-title":"arXiv 1912 09685"},{"key":"ref344","article-title":"Dual manifold adversarial robustness: Defense against lp and non-lp adversarial attacks","author":"lin","year":"2020","journal-title":"arXiv 2009 02470"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00099"},{"key":"ref345","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00673"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00051"},{"key":"ref346","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00020"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01373"},{"key":"ref347","first-page":"1","article-title":"Adversarial distributional training for robust deep learning","author":"dong","year":"2020","journal-title":"Proc NIPS"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref383","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00110"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref382","first-page":"1","article-title":"Biologically inspired sleep algorithm for increased generalization and adversarial robustness in deep neural networks","author":"tadros","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref381","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00120"},{"key":"ref380","first-page":"1","article-title":"Jacobian adversarially regularized networks for robustness","author":"chan","year":"2020","journal-title":"Proc ICLR"},{"key":"ref387","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_24"},{"key":"ref386","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00103"},{"key":"ref385","first-page":"3856","article-title":"Dynamic routing between capsules","author":"sabour","year":"2017","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref384","first-page":"1","article-title":"Detecting and diagnosing adversarial images with class-conditional capsule reconstructions","author":"qin","year":"2020","journal-title":"Proc ICLR"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref379","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00707"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2010.2059031"},{"key":"ref57","article-title":"Deep inside convolutional networks: Visualising image classification models and saliency maps","author":"simonyan","year":"2013","journal-title":"arXiv 1312 6034"},{"key":"ref377","first-page":"1","article-title":"Peernets: Exploiting peer wisdom against adversarial attacks","author":"svoboda","year":"2019","journal-title":"Proc ICLR"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"ref378","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00613"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref54","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"2017","journal-title":"arXiv 1706 06083"},{"key":"ref53","article-title":"Adversarial machine learning at scale","author":"kurakin","year":"2016","journal-title":"arXiv 1611 01236"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref370","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00088"},{"key":"ref372","article-title":"A direct approach to robust deep learning using adversarial networks","author":"wang","year":"2019","journal-title":"arXiv 1905 09591"},{"key":"ref40","article-title":"Adversarial attacks against face recognition: A comprehensive study","author":"vakhshiteh","year":"2020","journal-title":"arXiv 2007 11709"},{"key":"ref371","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00079"},{"key":"ref374","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00044"},{"key":"ref373","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00059"},{"key":"ref376","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00068"},{"key":"ref375","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01234-2_23"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1038\/s41592-019-0576-7"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1038\/nature12346"},{"key":"ref6","author":"manning","year":"1999","journal-title":"Foundations of Statistical Natural Language Processing"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1038\/nrn2113"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref49","article-title":"Adversarial examples in the physical world","author":"kurakin","year":"2016","journal-title":"arXiv 1607 02533"},{"key":"ref7","first-page":"1097","article-title":"ImageNet classification with deep convolutional neural networks","author":"krizhevsky","year":"2012","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1989.1.4.541"},{"key":"ref46","author":"fletcher","year":"2013","journal-title":"Practical Methods of Optimization"},{"key":"ref366","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00071"},{"key":"ref45","article-title":"Adversarial patch","author":"brown","year":"2017","journal-title":"arXiv 1712 09665"},{"key":"ref367","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58583-9_13"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2018.2858821"},{"key":"ref368","first-page":"1","article-title":"ADV-BNN: Improved adversarial defense through robust Bayesian neural network","author":"liu","year":"2019","journal-title":"Proc ICLR"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2016.58"},{"key":"ref369","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00132"},{"key":"ref42","author":"carlini","year":"2020","journal-title":"A Complete List of All Adversarial Example Papers"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298594"},{"key":"ref44","first-page":"8312","article-title":"Constructing unrestricted adversarial examples with generative models","author":"song","year":"2018","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref43","article-title":"Unrestricted adversarial examples","author":"brown","year":"2018","journal-title":"arXiv 1809 08352"},{"key":"ref320","first-page":"10749","article-title":"With friends like these, who needs adversaries?","author":"jetley","year":"2018","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref321","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01453"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00847"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01579"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1137\/1.9780898719857"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.01161"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00499"},{"key":"ref318","article-title":"Robustness of classifiers to universal perturbations: A geometric perspective","author":"moosavi-dezfooli","year":"2017","journal-title":"arXiv 1705 09554"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00111"},{"key":"ref317","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_39"},{"key":"ref74","first-page":"1","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","author":"brendel","year":"2018","journal-title":"Proc ICLR"},{"key":"ref316","first-page":"1","article-title":"Robustness may be at odds with accuracy","author":"tsipras","year":"2019","journal-title":"Proc ICLR"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00045"},{"key":"ref315","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00714"},{"key":"ref314","article-title":"Constructing unrestricted adversarial examples with generative models","author":"song","year":"2018","journal-title":"arXiv 1805 07894"},{"key":"ref313","article-title":"Adversarial spheres","author":"gilmer","year":"2018","journal-title":"arXiv 1801 02774"},{"key":"ref78","first-page":"1","article-title":"Query-efficient meta attack to deep neural networks","author":"du","year":"2020","journal-title":"Proc ICLR"},{"key":"ref312","article-title":"Are adversarial examples inevitable?","author":"shafahi","year":"2018","journal-title":"arXiv 1809 02104"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00044"},{"key":"ref311","first-page":"6629","article-title":"Most ReLU networks suffer from ?² adversarial perturbations","author":"daniely","year":"2020","journal-title":"Proc NIPS"},{"key":"ref455","article-title":"Trojaning attack on neural networks","author":"liu","year":"2017"},{"key":"ref454","article-title":"Transformers in vision: A survey","author":"khan","year":"2021","journal-title":"arXiv 2101 01169"},{"key":"ref319","first-page":"1","article-title":"Robustness of classifiers to universal perturbations: A geometric perspective","author":"moosavi-dezfooli","year":"2018","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref450","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58601-0_5"},{"key":"ref451","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00855"},{"key":"ref452","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01606"},{"key":"ref453","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00568"},{"key":"ref310","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.36.1.48"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref61","article-title":"Distilling the knowledge in a neural network","author":"hinton","year":"2015","journal-title":"ArXiv 1503 02531"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"ref305","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58604-1_45"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01291"},{"key":"ref304","article-title":"The space of transferable adversarial examples","author":"tram\u00e8r","year":"2017","journal-title":"arXiv 1704 03453"},{"key":"ref65","article-title":"Backpropagating linearly improves transferability of adversarial examples","author":"guo","year":"2020","journal-title":"NeurIPS"},{"key":"ref307","article-title":"Biologically inspired mechanisms for adversarial robustness","author":"reddy","year":"2020","journal-title":"arXiv 2006 16427"},{"key":"ref66","article-title":"GreedyFool: Distortion-aware sparse adversarial attack","author":"dong","year":"2020","journal-title":"arXiv 2010 13773"},{"key":"ref306","first-page":"1","article-title":"Excessive invariance causes adversarial vulnerability","author":"jacobsen","year":"2019","journal-title":"Proc ICLR"},{"key":"ref67","first-page":"1","article-title":"Guided adversarial attack for evaluating and enhancing adversarial defenses","author":"sriramanan","year":"2020","journal-title":"Proc NIPS"},{"key":"ref301","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2016.0045"},{"key":"ref68","first-page":"1","article-title":"Diversity can be transferred: Output diversification for white-and black-box attacks","volume":"33","author":"tashiro","year":"2020","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref300","first-page":"1","article-title":"Intriguing properties of adversarial examples","author":"cubuk","year":"2018","journal-title":"Proc ICLR"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00445"},{"key":"ref303","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2016.7727230"},{"key":"ref302","doi-asserted-by":"publisher","DOI":"10.1109\/WACV.2018.00093"},{"key":"ref444","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00085"},{"key":"ref443","first-page":"1","article-title":"Prediction poisoning: Towards defenses against DNN model stealing attacks","author":"orekondy","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref446","first-page":"158","article-title":"Multitask learning strengthens adversarial robustness","volume":"12347","author":"yang","year":"2020","journal-title":"Proc Eur Conf Comput Vis"},{"key":"ref445","article-title":"Adversarial robustness of supervised sparse coding","author":"sulam","year":"2020","journal-title":"arXiv 2010 12088"},{"key":"ref448","first-page":"7449","article-title":"Calibratable adversarial training: In-situ tradeoff between robustness and accuracy for free","author":"wang","year":"2020","journal-title":"Proc NIPS"},{"key":"ref309","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","author":"cohen","year":"2019","journal-title":"Proc ICML"},{"key":"ref447","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00472"},{"key":"ref308","first-page":"1","article-title":"A game theoretic analysis of additive adversarial attacks and defenses","author":"pal","year":"2020","journal-title":"Proc NIPS"},{"key":"ref449","first-page":"1","article-title":"On the trade-off between adversarial and backdoor robustness","volume":"33","author":"weng","year":"2020","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref441","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58577-8_18"},{"key":"ref442","first-page":"1","article-title":"Adversarially robust few-shot learning: A meta-learning approach","volume":"33","author":"goldblum","year":"2020","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref440","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58520-4_40"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00514"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00506"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00473"},{"key":"ref92","article-title":"Improving query efficiency of black-box adversarial attack","volume":"12370","author":"xia","year":"2020","journal-title":"Proc Eur Conf Comput Vis"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58555-6_17"},{"key":"ref342","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00078"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"ref343","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00283"},{"key":"ref340","first-page":"412","article-title":"One man’s trash is another man’s treasure: Resisting adversarial examples by adversarial examples","author":"xiao","year":"2020","journal-title":"Proc IEEE\/CVF Conf Comput Vis Pattern Recognit (CVPR)"},{"key":"ref341","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00034"},{"key":"ref336","first-page":"1","article-title":"Adversarial training and provable defenses: Bridging the gap","author":"balunovic","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref335","first-page":"1","article-title":"MMA training: Direct input space margin maximization through adversarial training","author":"ding","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref334","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00453"},{"key":"ref333","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00129"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00334"},{"key":"ref99","first-page":"1","article-title":"Learning black-box attackers with transferable priors and query feedback","volume":"33","author":"yang","year":"2020","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref339","first-page":"1","article-title":"Generalizable adversarial training via spectral normalization","author":"farnia","year":"2019","journal-title":"Proc ICLR"},{"key":"ref96","first-page":"1","article-title":"AdvFlow: Inconspicuous black-box adversarial attacks using normalizing flows","author":"dolatabadi","year":"2020","journal-title":"Proc NIPS"},{"key":"ref338","first-page":"1","article-title":"Robust local features for improving the generalization of adversarial training","author":"song","year":"2020","journal-title":"Proc ICLR"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01029"},{"key":"ref337","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00103"},{"key":"ref439","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58529-7_5"},{"key":"ref438","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00498"},{"key":"ref437","article-title":"Cost-sensitive robustness against adversarial examples","author":"zhang","year":"2018","journal-title":"arXiv 1810 09225"},{"key":"ref436","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00357"},{"key":"ref435","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00503"},{"key":"ref434","first-page":"1","article-title":"Robust anomaly detection and backdoor attack detection via differential privacy","author":"du","year":"2020","journal-title":"Proc ICLR"},{"key":"ref433","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP40776.2020.9054325"},{"key":"ref432","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58526-6_24"},{"key":"ref430","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01410"},{"key":"ref431","article-title":"Robustness of Bayesian neural networks to gradient-based attacks","author":"carbone","year":"2020","journal-title":"arXiv 2002 04359"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2018.2873729"},{"key":"ref81","first-page":"1","article-title":"Bayesopt adversarial attack","author":"ru","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref84","first-page":"1","article-title":"Query-efficient hard-label black-box attack: An optimization-based approach","author":"cheng","year":"2019","journal-title":"Proc ICLR"},{"key":"ref83","first-page":"1","article-title":"Sign-opt: A query-efficient hard-label adversarial attack","author":"cheng","year":"2020","journal-title":"Proc ICLR"},{"key":"ref330","first-page":"7502","article-title":"Interpreting adversarially trained convolutional neural networks","author":"zhang","year":"2019","journal-title":"Proc ICML"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00130"},{"key":"ref331","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00250"},{"key":"ref332","first-page":"1","article-title":"Improving adversarial robustness requires revisiting misclassified examples","author":"wang","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00021"},{"key":"ref323","first-page":"831","article-title":"Adversarial examples from computational constraints","author":"bubeck","year":"2019","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref322","first-page":"125","article-title":"Adversarial examples are not bugs, they are features","author":"ilyas","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref325","first-page":"1","article-title":"The limitations of adversarial training and the blind-spot attack","author":"zhang","year":"2020","journal-title":"Proc ICLR"},{"key":"ref324","article-title":"Skip connections matter: On the transferability of adversarial examples generated with ResNets","author":"wu","year":"2020","journal-title":"arXiv 2002 05990"},{"key":"ref85","article-title":"Improving black-box adversarial attacks with a transfer-based prior","author":"cheng","year":"2019","journal-title":"arXiv 1906 06919"},{"key":"ref327","first-page":"1","article-title":"On the sensitivity of adversarial robustness to input data distributions","author":"ding","year":"2019","journal-title":"Proc ICLR"},{"key":"ref429","first-page":"1","article-title":"Adversarially robust representations with smooth encoders","author":"cemgil","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref86","first-page":"1","article-title":"Black-box adversarial attack with transferable model-based embedding","author":"huang","year":"2020","journal-title":"Proc ICLR"},{"key":"ref326","first-page":"1","article-title":"Towards the first adversarially robust neural network model on MNIST","author":"schott","year":"2019","journal-title":"Proc ICLR"},{"key":"ref87","first-page":"1","article-title":"Sign bits are all you need for black-box attacks","author":"al-dujaili","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref329","first-page":"1","article-title":"ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness","author":"geirhos","year":"2019","journal-title":"Proc ICLR"},{"key":"ref88","first-page":"1","article-title":"Prior convictions: Black-box adversarial attacks with bandits and priors","author":"ilyas","year":"2019","journal-title":"Proc ICLR"},{"key":"ref328","article-title":"Improving the generalization of adversarial training with domain adaptation","author":"song","year":"2018","journal-title":"arXiv 1810 00740"},{"key":"ref426","first-page":"15859","article-title":"Beyond perturbations: Learning guarantees with arbitrary adversarial test examples","volume":"33","author":"goldwasser","year":"2020","journal-title":"Advances in neural information processing systems"},{"key":"ref425","article-title":"On the tightness of semidefinite relaxations for certifying robustness to adversarial examples","author":"zhang","year":"2020","journal-title":"arXiv 2006 06759"},{"key":"ref428","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00752"},{"key":"ref427","first-page":"1","article-title":"Denoised smoothing: A provable defense for pretrained classifiers","volume":"33","author":"salman","year":"2020","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref422","article-title":"Black-box certification with randomized smoothing: A functional optimization based framework","author":"zhang","year":"2020","journal-title":"arXiv 2002 09169"},{"key":"ref421","first-page":"1","article-title":"Adversarial robustness via robust low rank representations","author":"awasthi","year":"2020","journal-title":"Proc NIPS"},{"key":"ref424","first-page":"1","article-title":"Fast adversarial robustness certification of nearest prototype classifiers for arbitrary seminorms","volume":"33","author":"saralajew","year":"2020","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref423","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00820"},{"key":"ref399","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.01171"},{"key":"ref389","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00491"},{"key":"ref388","article-title":"Attacks meet interpretability: Attribute-steered detection of adversarial samples","author":"tao","year":"2018","journal-title":"arXiv 1810 11580"},{"key":"ref390","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00496"},{"key":"ref397","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00624"},{"key":"ref398","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00715"},{"key":"ref395","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00669"},{"key":"ref396","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.01148"},{"key":"ref393","article-title":"Keeping the bad guys out: Protecting and vaccinating deep learning with JPEG compression","author":"das","year":"2017","journal-title":"arXiv 1705 02900"},{"key":"ref394","first-page":"1","article-title":"Countering adversarial images using input transformations","author":"guo","year":"2018","journal-title":"Proc ICLR"},{"key":"ref391","first-page":"1","article-title":"GAT: Generative adversarial training for adversarial example detection and robust classification","author":"yin","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref392","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00095"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6287639\/9312710\/09614158.pdf?arnumber=9614158","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,3,8]],"date-time":"2022-03-08T21:53:48Z","timestamp":1646776428000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9614158\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021]]},"references-count":455,"URL":"https:\/\/doi.org\/10.1109\/access.2021.3127960","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021]]}}}