{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T18:23:29Z","timestamp":1778351009629,"version":"3.51.4"},"reference-count":77,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"Institute of Information and Communications Technology Planning and Evaluation"},{"name":"Korean Government [Ministry of Science and ICT (MSIT)]","award":["2021-0-02068"],"award-info":[{"award-number":["2021-0-02068"]}]},{"name":"IITP Grant"},{"name":"Korean Government","award":["2022-0-00759"],"award-info":[{"award-number":["2022-0-00759"]}]},{"name":"IITP Grant"},{"name":"Korean Government (MSIT), Artificial Intelligence Convergence Innovation Human Resources Development","award":["RS-2022-00155911"],"award-info":[{"award-number":["RS-2022-00155911"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2023]]},"DOI":"10.1109\/access.2023.3250661","type":"journal-article","created":{"date-parts":[[2023,3,2]],"date-time":"2023-03-02T18:25:46Z","timestamp":1677781546000},"page":"96449-96459","source":"Crossref","is-referenced-by-count":8,"title":["Adversarial Attacks and Batch Normalization: A Batch Statistics Perspective"],"prefix":"10.1109","volume":"11","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2407-7865","authenticated-orcid":false,"given":"Awais","family":"Muhammad","sequence":"first","affiliation":[{"name":"Department of Computer Science and Engineering, Kyung-Hee University, Yongin, South Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2442-0475","authenticated-orcid":false,"given":"Fahad","family":"Shamshad","sequence":"additional","affiliation":[{"name":"Computer Vision Department, Mohamed bin Zayed University of Artificial Intelligence, Abu Dhabi, United Arab Emirates"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2677-3186","authenticated-orcid":false,"given":"Sung-Ho","family":"Bae","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, Kyung-Hee University, Yongin, South Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref13","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","author":"croce","year":"2020","journal-title":"Proc ICML"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2012.6248092"},{"key":"ref12","article-title":"Recurrent batch normalization","author":"cooijmans","year":"2016","journal-title":"arXiv 1603 09025"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00195"},{"key":"ref15","first-page":"1","article-title":"On the sensitivity of adversarial robustness to input data distributions","author":"ding","year":"2019","journal-title":"Proc ICLR"},{"key":"ref59","first-page":"1","article-title":"Faster R-CNN: Towards real-time object detection with region proposal networks","volume":"28","author":"ren","year":"2015","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.91"},{"key":"ref53","article-title":"Spectral normalization for generative adversarial networks","author":"miyato","year":"2018","journal-title":"arXiv 1802 05957"},{"key":"ref52","first-page":"3523","article-title":"Image segmentation using deep learning: A survey","volume":"44","author":"minaee","year":"2022","journal-title":"IEEE Trans Pattern Anal Mach Intell"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2014.461"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/ICVGIP.2008.47"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2017.2699184"},{"key":"ref54","first-page":"427","article-title":"Deep neural networks are easily fooled: High confidence predictions for unrecognizable images","author":"nguyen","year":"2015","journal-title":"Proc IEEE Conf Comput Vis Pattern Recognit (CVPR)"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref16","first-page":"647","article-title":"DeCAF: A deep convolutional activation feature for generic visual recognition","author":"donahue","year":"2014","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref19","first-page":"1632","article-title":"Robustness of classifiers: From adversarial to random noise","author":"fawzi","year":"2016","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref18","article-title":"On the connection between adversarial robustness and saliency map interpretability","author":"etmann","year":"2019","journal-title":"arXiv 1905 04172"},{"key":"ref51","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"2017","journal-title":"arXiv 1706 06083"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2020.107332"},{"key":"ref46","doi-asserted-by":"crossref","first-page":"436","DOI":"10.1038\/nature14539","article-title":"Deep learning","volume":"521","author":"lecun","year":"2015","journal-title":"Nature"},{"key":"ref45","author":"lecun","year":"2010","journal-title":"MNIST Handwritten Digit Database"},{"key":"ref48","article-title":"Differentiable Learning-to-Normalize via switchable normalization","author":"luo","year":"2018","journal-title":"arXiv 1806 10779"},{"key":"ref47","article-title":"SGDR: Stochastic gradient descent with warm restarts","author":"loshchilov","year":"2016","journal-title":"arXiv 1608 03983"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3065386"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW.2013.77"},{"key":"ref44","article-title":"Adversarial machine learning at scale","author":"kurakin","year":"2016","journal-title":"arXiv 1611 01236"},{"key":"ref43","article-title":"Learning multiple layers of features from tiny images","author":"krizhevsky","year":"2009"},{"key":"ref49","first-page":"4203","article-title":"Differentiable dynamic normalization for learning deep representation","author":"luo","year":"2019","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref7","article-title":"A probabilistic approach to systems of parameters and noether normalization","author":"bruce","year":"2016","journal-title":"arXiv 1604 01704"},{"key":"ref9","article-title":"On evaluating adversarial robustness","author":"carlini","year":"2019","journal-title":"arXiv 1902 06705"},{"key":"ref4","article-title":"Layer normalization","author":"lei ba","year":"2016","journal-title":"arXiv 1607 06450"},{"key":"ref3","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","author":"athalye","year":"2018","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref6","article-title":"Adversarial patch","author":"brown","year":"2017","journal-title":"arXiv 1712 09665"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00772"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00277"},{"key":"ref35","first-page":"1945","article-title":"Batch renormalization: Towards reducing minibatch dependence in batch-normalized models","author":"ioffe","year":"2017","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref34","first-page":"125","article-title":"Adversarial examples are not bugs, they are features","author":"ilyas","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref37","article-title":"Excessive invariance causes adversarial vulnerability","author":"jacobsen","year":"2018","journal-title":"arXiv 1811 00401"},{"key":"ref36","article-title":"Batch normalization: Accelerating deep network training by reducing internal covariate shift","author":"ioffe","year":"2015","journal-title":"arXiv 1502 03167"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00090"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2017.10.013"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00059"},{"key":"ref33","first-page":"103","article-title":"GPipe: Efficient training of giant neural networks using pipeline parallelism","author":"huang","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.5244\/C.30.87"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00089"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01070"},{"key":"ref2","article-title":"Normalization propagation: A parametric technique for removing internal covariate shift in deep networks","author":"arpit","year":"2016","journal-title":"arXiv 1603 01431"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3149052"},{"key":"ref38","article-title":"Exploiting excessive invariance caused by norm-bounded adversarial robustness","author":"jacobsen","year":"2019","journal-title":"arXiv 1903 10484"},{"key":"ref71","article-title":"Fashion-MNIST: A novel image dataset for benchmarking machine learning algorithms","author":"xiao","year":"2017","journal-title":"ArXiv 1708 07747"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01261-8_1"},{"key":"ref73","article-title":"Adversarial examples improve image recognition","author":"xie","year":"2019","journal-title":"arXiv 1911 09665"},{"key":"ref72","article-title":"Intriguing properties of adversarial training at scale","author":"xie","year":"2019","journal-title":"arXiv 1906 03787"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.265"},{"key":"ref68","article-title":"The Caltech-UCSD birds-200–2011 Dataset","author":"wah","year":"2011"},{"key":"ref23","article-title":"Batch normalization is a cause of adversarial vulnerability","author":"galloway","year":"2019","journal-title":"arXiv 1905 02161"},{"key":"ref67","article-title":"Instance normalization: The missing ingredient for fast stylization","author":"ulyanov","year":"2016","journal-title":"arXiv 1607 08022"},{"key":"ref26","article-title":"Adversarial spheres","author":"gilmer","year":"2018","journal-title":"arXiv 1801 02774"},{"key":"ref25","article-title":"ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness","author":"geirhos","year":"2018","journal-title":"arXiv 1811 12231"},{"key":"ref69","article-title":"Batch Kalman normalization: Towards training deep neural networks with micro-batches","author":"wang","year":"2018","journal-title":"arXiv 1802 03133"},{"key":"ref20","first-page":"1178","article-title":"Adversarial vulnerability for any classifier","author":"fawzi","year":"2018","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref64","article-title":"First-order adversarial vulnerability of neural networks and input dimension","author":"simon-gabriel","year":"2018","journal-title":"arXiv 1802 01421"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00053"},{"key":"ref22","article-title":"Adversarial examples are a natural consequence of test error in noise","author":"ford","year":"2019","journal-title":"arXiv 1901 10513"},{"key":"ref66","article-title":"Intriguing properties of neural networks","author":"szegedy","year":"2013","journal-title":"arXiv 1312 6199"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2004.383"},{"key":"ref65","article-title":"Very deep convolutional networks for large-scale image recognition","author":"simonyan","year":"2014","journal-title":"arXiv 1409 1556"},{"key":"ref28","article-title":"Explaining and harnessing adversarial examples","author":"goodfellow","year":"2014","journal-title":"arXiv 1412 6572"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2015.2437384"},{"key":"ref29","article-title":"Caltech-256 object category dataset","author":"griffin","year":"2007"},{"key":"ref60","first-page":"901","article-title":"Weight normalization: A simple reparameterization to accelerate training of deep neural networks","author":"salimans","year":"2016","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref62","article-title":"Improving robustness against common corruptions by covariate shift adaptation","author":"schneider","year":"2020","journal-title":"arXiv 2006 16971"},{"key":"ref61","first-page":"5014","article-title":"Adversarially robust generalization requires more data","author":"schmidt","year":"2018","journal-title":"Proc Adv Neural Inf Process Syst"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6287639\/10005208\/10056932.pdf?arnumber=10056932","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,10,2]],"date-time":"2023-10-02T18:03:09Z","timestamp":1696269789000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10056932\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023]]},"references-count":77,"URL":"https:\/\/doi.org\/10.1109\/access.2023.3250661","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023]]}}}