{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T11:41:05Z","timestamp":1784288465570,"version":"3.55.0"},"reference-count":244,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/"}],"funder":[{"name":"Portuguese Funda\u00e7\u00e3o para a Ci\u00eancia e Tecnologia\/Minist\u00e9rio da Ci\u00eancia, Tecnologia e Ensino Superior (FCT\/MCTES) through National Funds and co-funded by European Union (EU) Funds","award":["UIDB\/50008\/2020"],"award-info":[{"award-number":["UIDB\/50008\/2020"]}]},{"name":"FCT Doctoral","award":["2020.09847.BD"],"award-info":[{"award-number":["2020.09847.BD"]}]},{"name":"FCT Doctoral","award":["2021.04905.BD"],"award-info":[{"award-number":["2021.04905.BD"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2024]]},"DOI":"10.1109\/access.2024.3395118","type":"journal-article","created":{"date-parts":[[2024,4,29]],"date-time":"2024-04-29T17:43:07Z","timestamp":1714412587000},"page":"61113-61136","source":"Crossref","is-referenced-by-count":125,"title":["How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defenses"],"prefix":"10.1109","volume":"12","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3995-4621","authenticated-orcid":false,"given":"Joana C.","family":"Costa","sequence":"first","affiliation":[{"name":"Instituto de Telecomunicações, sins-lab, Universidade da Beira Interior, Covilhã, Portugal"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9563-8039","authenticated-orcid":false,"given":"Tiago","family":"Roxo","sequence":"additional","affiliation":[{"name":"Instituto de Telecomunicações, sins-lab, Universidade da Beira Interior, Covilhã, Portugal"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hugo","family":"Proen\u00e7a","sequence":"additional","affiliation":[{"name":"Instituto de Telecomunicações, sins-lab, Universidade da Beira Interior, Covilhã, Portugal"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8221-0666","authenticated-orcid":false,"given":"Pedro Ricardo Morais","family":"In\u00e1cio","sequence":"additional","affiliation":[{"name":"Instituto de Telecomunicações, sins-lab, Universidade da Beira Interior, Covilhã, Portugal"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"Deep Learning","author":"Goodfellow","year":"2016"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-019-01247-4"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.3390\/s19051005"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/SIBGRAPI.2018.00067"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2020.10.081"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-demos.6"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2020.2979670"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00568"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2020.2976572"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/2619239.2631434"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2906934"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.2985082"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/BIBM.2014.6999219"},{"key":"ref14","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2013","journal-title":"arXiv:1312.6199"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref16","volume-title":"Vertex AI Pricing","year":"2022"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref18","first-page":"1","article-title":"Defense-GAN: Protecting classifiers against adversarial attacks using generative models","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Samangouei"},{"key":"ref19","first-page":"1","article-title":"Defense against adversarial attacks using feature scattering-based adversarial training","volume-title":"Proc. NIPS","author":"Zhang"},{"key":"ref20","article-title":"Zero-shot certified defense against adversarial patches with vision transformers","author":"Huang","year":"2021","journal-title":"arXiv:2111.10481"},{"key":"ref21","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014","journal-title":"arXiv:1412.6572"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102847"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.3390\/electronics11081283"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3547330"},{"key":"ref25","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref26","first-page":"1","article-title":"ImageNet classification with deep convolutional neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"25","author":"Krizhevsky"},{"key":"ref27","first-page":"1","article-title":"An image is worth 16\u00d716 words: Transformers for image recognition at scale","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Dosovitskiy"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/WACV45572.2020.9093429"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2807385"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.3390\/app9050909"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3398394"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1007\/s11633-019-1211-x"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/TETCI.2020.2968933"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1049\/cit2.12028"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2022.10.046"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.2139\/ssrn.4607819"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2805680"},{"key":"ref39","article-title":"The space of transferable adversarial examples","author":"Tram\u00e8r","year":"2017","journal-title":"arXiv:1704.03453"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00482"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00765"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/543"},{"key":"ref46","first-page":"1","article-title":"Generative adversarial nets","volume-title":"Proc. NIPS","author":"Goodfellow"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00421"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00398"},{"key":"ref49","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017","journal-title":"arXiv:1712.05526"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref51","first-page":"11973","article-title":"On the trade-off between adversarial and backdoor robustness","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Weng"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00015"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00409"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00439"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00401"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00108"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00411"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00410"},{"key":"ref62","first-page":"2137","article-title":"Black-box adversarial attacks with limited queries and information","volume-title":"Proc. ICML","author":"Ilyas"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/TETCI.2022.3214627"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-89960-2_22"},{"key":"ref65","first-page":"1","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Brendel"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00045"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/TETCI.2022.3147508"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00437"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00425"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01967"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00789"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00754"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/TETCI.2021.3122467"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01183"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00414"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/iccv51070.2023.00416"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00427"},{"key":"ref79","first-page":"2196","article-title":"Minimally distorted adversarial examples with a fast adaptive boundary attack","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref80","article-title":"Towards deep neural network architectures robust to adversarial examples","author":"Gu","year":"2014","journal-title":"arXiv:1412.5068"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.485"},{"key":"ref82","first-page":"1","article-title":"Adversarial machine learning at scale","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Kurakin"},{"key":"ref83","first-page":"1","article-title":"Ensemble adversarial training: Attacks and defenses","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Tram\u00e8r"},{"key":"ref84","first-page":"1","article-title":"Are labels required for improving adversarial robustness?","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Alayrac"},{"key":"ref85","first-page":"1","article-title":"Helper-based adversarial training: Reducing excessive margin to achieve a better accuracy vs. robustness trade-off","volume-title":"Proc. ICML","author":"Rade"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00503"},{"key":"ref87","first-page":"1","article-title":"Defending against physically realizable attacks on image classification","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Wu"},{"key":"ref88","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang"},{"key":"ref89","first-page":"1","article-title":"Robustness may be at odds with accuracy","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Tsipras"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_39"},{"key":"ref91","first-page":"1","article-title":"Improving adversarial robustness requires revisiting misclassified examples","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Wang"},{"key":"ref92","first-page":"1","article-title":"Adversarial training for free!","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Shafahi"},{"key":"ref93","first-page":"1","article-title":"You only propagate once: Accelerating adversarial training via maximal principle","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Zhang"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/385"},{"key":"ref95","first-page":"1","article-title":"Fast is better than free: Revisiting adversarial training","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Wong"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i6.20571"},{"key":"ref97","article-title":"SAT: Improving adversarial training via curriculum-based loss smoothing","author":"Sitawarin","year":"2020","journal-title":"arXiv:2003.09347"},{"key":"ref98","first-page":"11278","article-title":"Attacks which do not kill training make adversarial learning stronger","volume-title":"Proc. ICML","author":"Zhang"},{"key":"ref99","first-page":"1","article-title":"Towards achieving adversarial robustness beyond perceptual limits","volume-title":"Proc. ICML Workshop Adversarial Mach. Learn.","author":"Addepalli"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00068"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00673"},{"key":"ref102","first-page":"2958","article-title":"Adversarial weight perturbation helps robust generalization","volume-title":"Proc. NIPS","author":"Wu"},{"key":"ref103","first-page":"1","article-title":"Geometry-aware instance-reweighted adversarial training","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Zhang"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref105","article-title":"Extending defensive distillation","author":"Papernot","year":"2017","journal-title":"arXiv:1705.05264"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01613"},{"key":"ref107","article-title":"LTD: Low temperature distillation for robust adversarial training","author":"Chen","year":"2021","journal-title":"arXiv:2111.02331"},{"key":"ref108","first-page":"1","article-title":"Unlabeled data improves adversarial robustness","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Carmon"},{"key":"ref109","first-page":"19365","article-title":"Self-adaptive training: Beyond empirical risk minimization","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Huang"},{"key":"ref110","first-page":"1","article-title":"Visual causal feature learning","volume-title":"Proc. UAI","author":"Chalupka"},{"key":"ref111","first-page":"1147","article-title":"Fuzz testing based data augmentation to improve robustness of deep neural networks","volume-title":"Proc. IEEE\/ACM 42nd Int. Conf. Softw. Eng. (ICSE)","author":"Gao"},{"key":"ref112","article-title":"Improved regularization of convolutional neural networks with cutout","author":"DeVries","year":"2017","journal-title":"arXiv:1708.04552"},{"key":"ref113","first-page":"1","article-title":"mixup: Beyond empirical risk minimization","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Zhang"},{"key":"ref114","first-page":"8093","article-title":"Overfitting in adversarially robust deep learning","volume-title":"Proc. 37th Int. Conf. Mach. Learn.","author":"Rice"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00110"},{"key":"ref116","first-page":"1","article-title":"Metric learning for adversarial robustness","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Mao"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00929"},{"key":"ref118","article-title":"Manifold regularization for locally stable deep neural networks","author":"Jin","year":"2020","journal-title":"arXiv:2003.04286"},{"key":"ref119","first-page":"1","article-title":"Controlling neural level sets","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Atzmon"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2020.3042083"},{"key":"ref121","first-page":"17258","article-title":"Robustness and accuracy could be reconcilable by (proper) definition","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Pang"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1109\/SPW54247.2022.9833884"},{"key":"ref123","article-title":"Learning with a strong adversary","author":"Huang","year":"2015","journal-title":"arXiv:1511.03034"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01543"},{"key":"ref125","first-page":"1","article-title":"On robustness of neural ordinary differential equations","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Hanshu"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1088\/1361-6420\/aa9a90"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00036"},{"key":"ref128","first-page":"14925","article-title":"Stable neural ODE with Lyapunov-stable equilibrium points for defending against adversarial attacks","volume-title":"Proc. NeurIPS","volume":"34","author":"Kang"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134057"},{"key":"ref130","first-page":"1","article-title":"On detecting adversarial perturbations","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Metzen"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00759"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1109\/TNN.2008.2005605"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.1145\/1390156.1390294"},{"key":"ref135","first-page":"214","article-title":"Wasserstein generative adversarial networks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Arjovsky"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00740"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00778"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00852"},{"key":"ref139","first-page":"23818","article-title":"Disco: Adversarial defense with local implicit functions","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Ho"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00070"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00071"},{"key":"ref142","first-page":"19655","article-title":"Hydra: Pruning adversarially robust neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Sehwag"},{"key":"ref143","first-page":"344","article-title":"DNR: A tunable robust pruning framework through dynamic network rewiring of DNNs","volume-title":"Proc. 26th Asia South Pacific Design Autom. Conf. (ASP-DAC)","author":"Kundu"},{"key":"ref144","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00059"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140449"},{"key":"ref146","article-title":"Deep learning using rectified linear units (ReLU)","author":"Fred Agarap","year":"2018","journal-title":"arXiv:1803.08375"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.1038\/35016072"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2016.08.037"},{"key":"ref149","article-title":"Batch normalization increases adversarial vulnerability: Disentangling usefulness and robustness of model features","author":"Benz","year":"2020","journal-title":"arXiv:2010.03316"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.5555\/3045118.3045167"},{"key":"ref151","first-page":"1","article-title":"Mitigating adversarial effects through randomization","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Xie"},{"key":"ref152","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.01171"},{"key":"ref153","doi-asserted-by":"publisher","DOI":"10.1007\/BF03168505"},{"key":"ref154","article-title":"A study of the effect of JPG compression on adversarial images","author":"Karolina Dziugaite","year":"2016","journal-title":"arXiv:1608.00853"},{"key":"ref155","first-page":"1","article-title":"Bag of tricks for adversarial training","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Pang"},{"key":"ref156","article-title":"Fixing data augmentation to improve adversarial robustness","author":"Rebuffi","year":"2021","journal-title":"arXiv:2103.01946"},{"key":"ref157","article-title":"Uncovering the limits of adversarial training against norm-bounded adversarial examples","author":"Gowal","year":"2020","journal-title":"arXiv:2010.03593"},{"key":"ref158","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2017.12.012"},{"key":"ref159","doi-asserted-by":"publisher","DOI":"10.1145\/3132747.3132785"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3238202"},{"key":"ref161","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00108"},{"key":"ref162","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-63387-9_1"},{"key":"ref163","first-page":"1","article-title":"A unified view of piecewise linear neural network verification","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"31","author":"Bunel"},{"key":"ref164","first-page":"1","article-title":"Evaluating robustness of neural networks with mixed integer programming","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Tjeng"},{"key":"ref165","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-63387-9_5"},{"key":"ref166","first-page":"3","article-title":"A dual approach to scalable verification of deep networks","volume-title":"Proc. UAI","volume":"1","author":"Dvijotham"},{"key":"ref167","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00494"},{"key":"ref168","first-page":"1","article-title":"Scaling provable adversarial defenses","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"31","author":"Wong"},{"key":"ref169","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00058"},{"key":"ref170","first-page":"3578","article-title":"Differentiable abstract interpretation for provably robust neural networks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Mirman"},{"key":"ref171","first-page":"3943","article-title":"Patrol: Provable defense against adversarial policy in two-player games","volume-title":"Proc. 32nd USENIX Conf. Secur. Symp.","author":"Guo"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i19.30106"},{"key":"ref173","first-page":"4218","article-title":"Improving robustness using generated data","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Gowal"},{"key":"ref174","first-page":"6840","article-title":"Denoising diffusion probabilistic models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Ho"},{"key":"ref175","first-page":"2256","article-title":"Deep unsupervised learning using nonequilibrium thermodynamics","volume-title":"Proc. ICML","author":"Sohl-Dickstein"},{"key":"ref176","first-page":"1","article-title":"Robust learning meets generative models: Can proxy distributions improve adversarial robustness?","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Sehwag"},{"key":"ref177","first-page":"1","article-title":"Online adversarial purification based on self-supervised learning","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Shi"},{"key":"ref178","first-page":"12062","article-title":"Adversarial purification with score-based generative models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Yoon"},{"key":"ref179","first-page":"16805","article-title":"Diffusion models for adversarial purification","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","author":"Nie"},{"key":"ref180","article-title":"Guided diffusion model for adversarial purification from random noise","author":"Wu","year":"2022","journal-title":"arXiv:2206.10875"},{"key":"ref181","first-page":"1","article-title":"DensePure: Understanding diffusion models towards adversarial robustness","volume-title":"Proc. NIPS","author":"Chen"},{"key":"ref182","article-title":"Better diffusion models further improve adversarial training","author":"Wang","year":"2023","journal-title":"arXiv:2302.04638"},{"key":"ref183","first-page":"26565","article-title":"Elucidating the design space of diffusion-based generative models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Karras"},{"key":"ref184","first-page":"23296","article-title":"Intriguing properties of vision transformers","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Naseer"},{"key":"ref185","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref186","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00774"},{"key":"ref187","article-title":"Reveal of vision transformers robustness against adversarial attacks","author":"Aldahdooh","year":"2021","journal-title":"arXiv:2106.03734"},{"key":"ref188","first-page":"26831","article-title":"Are transformers more robust than CNNs?","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Bai"},{"key":"ref189","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i3.20169"},{"key":"ref190","doi-asserted-by":"publisher","DOI":"10.1145\/3503161.3547989"},{"key":"ref191","first-page":"1","article-title":"Patch-fool: Are vision transformers always robust against adversarial perturbations?","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Fu"},{"key":"ref192","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00061"},{"key":"ref193","doi-asserted-by":"publisher","DOI":"10.1088\/1742-5468\/ac9830"},{"key":"ref194","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01172"},{"key":"ref195","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00060"},{"key":"ref196","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00986"},{"key":"ref197","first-page":"10347","article-title":"Training data-efficient image transformers & distillation through attention","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Touvron"},{"key":"ref198","article-title":"How to train your ViT? Data, augmentation, and regularization in vision transformers","author":"Steiner","year":"2022","journal-title":"Trans. Mach. Learn. Res."},{"key":"ref199","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01173"},{"key":"ref200","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01553"},{"key":"ref201","first-page":"27378","article-title":"Understanding the robustness in vision transformers","volume-title":"Proc. ICML","author":"Zhou"},{"key":"ref202","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00730"},{"key":"ref203","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01471"},{"key":"ref204","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01306"},{"key":"ref205","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19775-8_24"},{"key":"ref206","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01472"},{"key":"ref207","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01575"},{"key":"ref208","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"key":"ref209","article-title":"Fashion-MNIST: A novel image dataset for benchmarking machine learning algorithms","author":"Xiao","year":"2017","journal-title":"arXiv:1708.07747"},{"key":"ref210","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref211","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2008.128"},{"key":"ref212","first-page":"1","article-title":"Reading digits in natural images with unsupervised feature learning","volume-title":"Proc. NIPS","author":"Netzer"},{"key":"ref213","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2012.02.016"},{"key":"ref214","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"issue":"7","key":"ref215","first-page":"3","article-title":"Tiny ImageNet visual recognition challenge","volume":"7","author":"Le","year":"2015","journal-title":"CS 231N"},{"key":"ref216","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01501"},{"key":"ref217","first-page":"1","article-title":"Benchmarking neural network robustness to common corruptions and perturbations","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Hendrycks"},{"key":"ref218","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW54120.2021.00009"},{"key":"ref219","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-47436-2_10"},{"key":"ref220","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW50498.2020.00397"},{"key":"ref221","first-page":"2712","article-title":"Using pre-training can improve model robustness and uncertainty","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","author":"Hendrycks"},{"key":"ref222","doi-asserted-by":"publisher","DOI":"10.5244\/C.30.87"},{"key":"ref223","first-page":"1","article-title":"RobustBench: A standardized adversarial robustness benchmark","volume-title":"Proc. 34th Conf. Neural Inf. Process. Syst. Datasets Benchmarks Track","author":"Croce"},{"key":"ref224","first-page":"3533","article-title":"Do adversarially robust ImageNet models transfer better?","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Salman"},{"key":"ref225","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2021.3099164"},{"key":"ref226","doi-asserted-by":"publisher","DOI":"10.1109\/tnnls.2023.3314512"},{"key":"ref227","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2021.09.027"},{"key":"ref228","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2021.3071405"},{"key":"ref229","doi-asserted-by":"publisher","DOI":"10.1016\/j.media.2021.102141"},{"key":"ref230","doi-asserted-by":"publisher","DOI":"10.3390\/cancers15174228"},{"key":"ref231","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2022.116815"},{"key":"ref232","doi-asserted-by":"publisher","DOI":"10.3390\/electronics10172132"},{"key":"ref233","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2019.8852414"},{"key":"ref234","doi-asserted-by":"publisher","DOI":"10.1109\/ICC42927.2021.9500893"},{"key":"ref235","doi-asserted-by":"publisher","DOI":"10.1016\/j.patrec.2021.10.015"},{"key":"ref236","doi-asserted-by":"publisher","DOI":"10.1109\/ICB45273.2019.8987399"},{"key":"ref237","doi-asserted-by":"publisher","DOI":"10.1145\/3510548.3519369"},{"key":"ref238","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2021.103080"},{"key":"ref239","doi-asserted-by":"publisher","DOI":"10.1145\/3593042"},{"key":"ref240","doi-asserted-by":"publisher","DOI":"10.1109\/TCSS.2022.3218743"},{"key":"ref241","doi-asserted-by":"publisher","DOI":"10.1145\/3447548.3467145"},{"key":"ref242","doi-asserted-by":"publisher","DOI":"10.1145\/3490354.3494367"},{"key":"ref243","doi-asserted-by":"publisher","DOI":"10.1016\/j.egyr.2021.11.026"},{"key":"ref244","doi-asserted-by":"publisher","DOI":"10.1109\/TETCI.2022.3201294"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6287639\/10380310\/10510296.pdf?arnumber=10510296","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,5,3]],"date-time":"2024-05-03T18:52:07Z","timestamp":1714762327000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10510296\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024]]},"references-count":244,"URL":"https:\/\/doi.org\/10.1109\/access.2024.3395118","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024]]}}}