{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,31]],"date-time":"2026-10-31T23:56:17Z","timestamp":1793490977981,"version":"4.5.0"},"reference-count":239,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2020,1,1]],"date-time":"2020-01-01T00:00:00Z","timestamp":1577836800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2020,1,1]],"date-time":"2020-01-01T00:00:00Z","timestamp":1577836800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2020,1,1]],"date-time":"2020-01-01T00:00:00Z","timestamp":1577836800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Commun. Surv. Tutorials"],"published-print":{"date-parts":[[2020]]},"DOI":"10.1109\/comst.2020.2975048","type":"journal-article","created":{"date-parts":[[2020,2,19]],"date-time":"2020-02-19T16:31:58Z","timestamp":1582129918000},"page":"998-1026","source":"Crossref","is-referenced-by-count":254,"title":["Securing Connected & Autonomous Vehicles: Challenges Posed by Adversarial Machine Learning and the Way Forward"],"prefix":"10.1109","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6732-7601","authenticated-orcid":false,"given":"Adnan","family":"Qayyum","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5015-8605","authenticated-orcid":false,"given":"Muhammad","family":"Usama","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9466-2475","authenticated-orcid":false,"given":"Junaid","family":"Qadir","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0903-1204","authenticated-orcid":false,"given":"Ala","family":"Al-Fuqaha","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref170","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2018.8500421"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.1109\/ICESS.2019.8782514"},{"key":"ref171","doi-asserted-by":"publisher","DOI":"10.1145\/3302504.3311814"},{"key":"ref174","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.322"},{"key":"ref173","author":"aung","year":"2017","journal-title":"Building robust deep neural networks for road sign detection"},{"key":"ref176","author":"bansal","year":"2018","journal-title":"Chauffeurnet Learning to drive by imitating the best and synthesizing the worst"},{"key":"ref175","author":"redmon","year":"2018","journal-title":"YOLOv3 An Incremental Improvement"},{"key":"ref178","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-63387-9_5"},{"key":"ref177","author":"huang","year":"2015","journal-title":"Learning with a strong adversary"},{"key":"ref168","first-page":"1","article-title":"Physical adversarial examples for object detectors","author":"song","year":"2018","journal-title":"Proc 10th USENIX Workshop Offensive Technol (WOOT)"},{"key":"ref169","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref39","doi-asserted-by":"crossref","first-page":"938","DOI":"10.1109\/TPDS.2014.2308215","article-title":"ACPN: A novel authentication framework with conditional privacy-preservation and non-repudiation for VANETs","volume":"26","author":"li","year":"2015","journal-title":"IEEE Trans Parallel Distrib Syst"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/s11235-010-9400-5"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/CCNC.2019.8651763"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-287-158-9_5"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.3141\/2489-17"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2011.5940525"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1016\/j.aej.2015.07.011"},{"key":"ref36","first-page":"1","article-title":"Challenges in securing vehicular networks","author":"parno","year":"2005","journal-title":"Workshop on Hot Topics in Networks (HotNets-IV)"},{"key":"ref35","first-page":"546","article-title":"Potential cyberattacks on automated vehicles","volume":"16","author":"petit","year":"2015","journal-title":"IEEE Trans Intell Transp Syst"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2015.7346845"},{"key":"ref181","first-page":"1","article-title":"Adversarial example defense: Ensembles of weak defenses are not strong","author":"he","year":"2017","journal-title":"Proc 10th USENIX Workshop Offensive Technol (WOOT)"},{"key":"ref180","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"ref185","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2019.8683044"},{"key":"ref184","first-page":"1","article-title":"PixelDefend: Leveraging generative models to understand and defend against adversarial examples","author":"song","year":"2018","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref183","first-page":"10159","article-title":"A spectral view of adversarially robust features","author":"garg","year":"2018","journal-title":"Proc Adv Neural Inf Process Syst (NeurlIPS)"},{"key":"ref182","author":"gao","year":"2017","journal-title":"DeepCloak Masking deep neural network models for robustness against adversarial samples"},{"key":"ref189","author":"carlini","year":"2017","journal-title":"Ground-truth adversarial examples"},{"key":"ref188","article-title":"Distilling the knowledge in a neural network","author":"hinton","year":"2014","journal-title":"Proc Deep Learn Workshop Adv Neural Inf Process Syst (NIPS)"},{"key":"ref187","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref186","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134057"},{"key":"ref28","author":"staszewski","year":"2013","journal-title":"Making cars safer through technology innovation"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1016\/j.trc.2017.01.023"},{"key":"ref179","author":"gu","year":"2014","journal-title":"Towards deep neural network architectures robust to adversarial examples"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.34"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1504\/IJVAS.2002.001804"},{"key":"ref22","first-page":"132","article-title":"Super smart vehicle system: AVCS related systems for the future","author":"tsugawa","year":"1992","journal-title":"Proc IEEE Intell Veh Symp"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.4271\/942430"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/MVT.2015.2390920"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1038\/scientificamerican1097-80"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/TIV.2016.2577499"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2014.2327587"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-42553-5_32"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.3390\/computers5030016"},{"key":"ref154","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2013.03.022"},{"key":"ref153","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P18-1176"},{"key":"ref156","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2854599"},{"key":"ref155","author":"lin","year":"2018","journal-title":"Idsgan Generative adversarial networks for attack generation against intrusion detection"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23138"},{"key":"ref152","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D17-1215"},{"key":"ref151","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2016.7795300"},{"key":"ref146","author":"gondim-ribeiro","year":"2018","journal-title":"Adversarial attacks on variational autoencoders"},{"key":"ref147","author":"pasquini","year":"2019","journal-title":"Out-domain examples for generative models"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/601"},{"key":"ref149","first-page":"1","article-title":"Adversarial training methods for semi-supervised text classification","author":"miyato","year":"2017","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.3390\/s16010088"},{"key":"ref58","first-page":"114","article-title":"A vehicle-to-vehicle communication protocol for cooperative collision warning","author":"yang","year":"2004","journal-title":"Proc of 1st Annual International Conf on Mobile and Ubiquitous Systems Networking and Services (MobiQuitous'04)"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2018.8422586"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2018.2872122"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2017.2671030"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2004.838218"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1016\/j.adhoc.2016.02.017"},{"key":"ref52","author":"raya","year":"2006","journal-title":"Certificate revocation in vehicular networks"},{"key":"ref40","first-page":"251","article-title":"The sybil attack","author":"douceur","year":"2005","journal-title":"Proc Int Workshop Peer-to-Peer Syst"},{"key":"ref167","first-page":"1","article-title":"CAMOU: Learning physical vehicle camouflages to adversarially attack detectors in the wild","author":"zhang","year":"2018","journal-title":"Proc ICLR"},{"key":"ref166","author":"zhou","year":"2018","journal-title":"DeepBillboard Systematic physical-world testing of autonomous driving systems"},{"key":"ref165","first-page":"52","article-title":"ShapeShifter: Robust physical adversarial attack on faster R-CNN object detector","author":"chen","year":"2018","journal-title":"Proc Eur Conf Mach Learn Knowl Discovery Databases"},{"key":"ref164","author":"sch\u00f6nherr","year":"2018","journal-title":"Adversarial attacks against automatic speech recognition systems via psychoacoustic hiding"},{"key":"ref163","doi-asserted-by":"publisher","DOI":"10.1109\/ISCC.2017.8024621"},{"key":"ref162","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3138853"},{"key":"ref161","doi-asserted-by":"publisher","DOI":"10.1109\/LCNW.2018.8628538"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.23919\/EUSIPCO.2018.8553214"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TVT.2018.2833427"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2013.6515060"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref5","first-page":"77","article-title":"Comprehensive experimental analyses of automotive attack surfaces","author":"checkoway","year":"2011","journal-title":"Proc Usenix Security Symp"},{"key":"ref8","author":"sitawarin","year":"2018","journal-title":"Darts Deceiving autonomous cars with toxic signs"},{"key":"ref159","author":"grosse","year":"2016","journal-title":"Adversarial perturbations against deep neural networks for malware classification"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/WONS.2010.5437115"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref157","doi-asserted-by":"publisher","DOI":"10.1109\/UEMCON.2018.8796769"},{"key":"ref9","author":"szegedy","year":"2013","journal-title":"Intriguing properties of neural networks"},{"key":"ref158","first-page":"239","article-title":"Man vs. machine: Practical adversarial detection of malicious crowdsourcing workers","author":"wang","year":"2014","journal-title":"Proc 23rd USENIX Secur Symp (USENIX Secur )"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.14722\/sent.2015.23001"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2018.8500383"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40349-1_4"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/MITS.2016.2583491"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2015.7120028"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2015.2473820"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/VNC.2017.8275644"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2018.1800074"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2017.2749965"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/ITSC.2017.8317943"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.23919\/WIOPT.2017.7959912"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/TVT.2016.2622180"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2017.7995849"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2015.2479925"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.3390\/s19030648"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.312"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1016\/j.robot.2016.11.014"},{"key":"ref79","first-page":"1647","article-title":"Traffic sign recognition using kernel extreme learning machines with deep perceptual features","volume":"18","author":"zeng","year":"2017","journal-title":"IEEE Trans Intell Transp Syst"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/ISCC.2016.7543822"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2017.2706756"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/TVT.2014.2335201"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1186\/1687-1499-2012-222"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/LCOMM.2017.2676766"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2015.05.017"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2016.2546555"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2017.2709462"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/DSAA.2016.20"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/TVT.2016.2538461"},{"key":"ref197","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.56"},{"key":"ref198","author":"gopinath","year":"2017","journal-title":"Deepsafe A data-driven approach for checking adversarial robustness in neural networks"},{"key":"ref199","first-page":"1","article-title":"On detecting adversarial perturbations","author":"metzen","year":"2017","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref193","first-page":"1","article-title":"Towards the first adversarially robust neural network model on MNIST","author":"schott","year":"2019","journal-title":"Proc Int Conf Learn Represent (ICLR)ICLR"},{"key":"ref194","first-page":"7728","article-title":"Attacks meet interpretability: Attribute-steered detection of adversarial samples","author":"tao","year":"2018","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref195","author":"carlini","year":"2019","journal-title":"Is AmI (attacks meet interpretability) robust to adversarial examples?"},{"key":"ref196","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01554-1_26"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0155781"},{"key":"ref190","first-page":"1660","article-title":"Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients","author":"ross","year":"2018","journal-title":"Proc 32nd AAAI Conf Artif Intell"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2013.2278494"},{"key":"ref191","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2015.84"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/TVT.2017.2760281"},{"key":"ref192","author":"bradshaw","year":"2017","journal-title":"Adversarial examples uncertainty and transfer testing robustness in Gaussian process hybrid deep networks"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2018.8500630"},{"key":"ref91","author":"bouton","year":"2019","journal-title":"Reinforcement learning with probabilistic guarantees for autonomous driving"},{"key":"ref90","author":"liu","year":"2018","journal-title":"Elements of effective deep reinforcement learning towards tactical driving decision making"},{"key":"ref98","first-page":"387","article-title":"Evasion attacks against machine learning at test time","author":"biggio","year":"2013","journal-title":"Proc Eur Conf Mach Learn Knowl Discovery Databases"},{"key":"ref99","author":"goodfellow","year":"2014","journal-title":"Explaining and Harnessing Adversarial Examples"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1007\/s11431-017-9338-1"},{"key":"ref97","first-page":"1807","article-title":"Poisoning attacks against support vector machines","author":"biggio","year":"2012","journal-title":"Proc 29th Int Conf Mach Learn"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2846401"},{"key":"ref81","first-page":"30","article-title":"Deep learning-based human-driven vehicle trajectory prediction and its application for platoon control of connected and autonomous vehicles","author":"lin","year":"2018","journal-title":"Proc Auton Veh Symp"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.3389\/fnbot.2019.00012"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1016\/j.physa.2017.08.015"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/ITSC.2014.6958056"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2017.7995975"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1016\/j.trc.2015.09.011"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/IROS.2013.6696982"},{"key":"ref87","article-title":"Modeling uncertainty in vehicle trajectory prediction in a mixed connected and autonomous vehicle environment using deep learning and kernel density estimation","author":"li","year":"2018","journal-title":"Proc 4th Annu Symp Transp Inform"},{"key":"ref88","author":"bojarski","year":"2016","journal-title":"End to End Learning for Self-Driving Cars"},{"key":"ref200","doi-asserted-by":"publisher","DOI":"10.4204\/EPTCS.257.3"},{"key":"ref101","author":"khalil","year":"2018","journal-title":"Combinatorial attacks on binarized neural networks"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298640"},{"key":"ref209","first-page":"1","article-title":"Thermometer encoding: One hot way to resist adversarial examples","author":"buckman","year":"2018","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref203","first-page":"1","article-title":"Defense-GAN: Protecting classifiers against adversarial attacks using generative models","author":"samangouei","year":"2018","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref204","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00894"},{"key":"ref201","first-page":"1","article-title":"Ensemble adversarial training: Attacks and defenses","author":"tramer","year":"2018","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref202","author":"santhanam","year":"2018","journal-title":"Defending against adversarial attacks by leveraging an entire GAN"},{"key":"ref207","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref208","first-page":"1","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"2018","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref205","first-page":"1","article-title":"Mitigating adversarial effects through randomization","author":"xie","year":"2018","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref206","first-page":"1","article-title":"Countering adversarial images using input transformations","author":"guo","year":"2018","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref211","first-page":"2057","article-title":"Provable robustness of ReLU networks via maximization of linear regions","volume":"89","author":"croce","year":"2019","journal-title":"Mach Learn Res"},{"key":"ref210","first-page":"1","article-title":"Stochastic activation pruning for robust adversarial defense","author":"dhillon","year":"2018","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref212","author":"carlini","year":"2019","journal-title":"On evaluating adversarial robustness"},{"key":"ref213","doi-asserted-by":"publisher","DOI":"10.1038\/nature16961"},{"key":"ref214","author":"rajpurkar","year":"2017","journal-title":"CheXNet Radiologist-level pneumonia detection on chest X-rays with deep learning"},{"key":"ref215","doi-asserted-by":"publisher","DOI":"10.1109\/ISBI.2018.8363574"},{"key":"ref216","author":"papernot","year":"2016","journal-title":"Transferability in machine learning from phenomena to black-box attacks using adversarial samples"},{"key":"ref217","author":"ruan","year":"2018","journal-title":"Global robustness evaluation of deep neural networks with provable guarantees for L? norm"},{"key":"ref218","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3238172"},{"key":"ref219","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3238202"},{"key":"ref220","first-page":"1599","article-title":"Formal security analysis of neural networks using symbolic intervals","author":"wang","year":"2018","journal-title":"Proc 27th USENIX Security Symp (USENIX Security)"},{"key":"ref222","doi-asserted-by":"publisher","DOI":"10.1145\/3236024.3264835"},{"key":"ref221","first-page":"4901","article-title":"TensorFuzz: Debugging neural networks with coverage-guided fuzzing","volume":"96","author":"odena","year":"2019","journal-title":"Proceedings 36th Int Conf Mach Learn"},{"key":"ref229","author":"guo","year":"2018","journal-title":"Is it safe to drive? An overview of factors challenges and datasets for driveability assessment in autonomous driving"},{"key":"ref228","doi-asserted-by":"publisher","DOI":"10.1145\/3274783.3274838"},{"key":"ref227","doi-asserted-by":"publisher","DOI":"10.1109\/ICRA.2019.8793740"},{"key":"ref226","first-page":"11","article-title":"Robustness May be at odds with accuracy","volume":"1050","author":"tsipras","year":"2019","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref225","doi-asserted-by":"publisher","DOI":"10.1145\/3241979"},{"key":"ref224","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3238187"},{"key":"ref223","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180220"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1145\/1128817.1128824"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1145\/1081870.1081950"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1145\/1014052.1014066"},{"key":"ref124","first-page":"2687","article-title":"Learning to attack: Adversarial transformation networks","author":"baluja","year":"2018","journal-title":"Proc AAAI"},{"key":"ref129","author":"engstrom","year":"2017","journal-title":"A Rotation and a Translation Suffice Fooling CNNs with Simple Transformations"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1145\/2046684.2046692"},{"key":"ref130","author":"pei","year":"2017","journal-title":"Towards practical verification of machine learning The case of computer vision systems"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00009"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref232","doi-asserted-by":"publisher","DOI":"10.1109\/MVT.2018.2811185"},{"key":"ref233","doi-asserted-by":"crossref","first-page":"211","DOI":"10.1561\/0400000042","article-title":"The algorithmic foundations of differential privacy","volume":"9","author":"dwork","year":"2014","journal-title":"Foundations and Trends\ufffd in Theoretical Computer Science"},{"key":"ref230","first-page":"653","article-title":"Challenges in designing datasets and validation for autonomous driving","author":"uricar","year":"2019","journal-title":"Proc Int Conf Comput Vis Theory Appl (VISAPP)"},{"key":"ref231","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-96145-3_1"},{"key":"ref239","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-62416-7_19"},{"key":"ref238","doi-asserted-by":"publisher","DOI":"10.2352\/ISSN.2470-1173.2017.19.AVM-023"},{"key":"ref235","author":"wilson","year":"2019","journal-title":"Predictive inequity in object detection"},{"key":"ref234","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00068"},{"key":"ref237","author":"ford","year":"2019","journal-title":"Adversarial examples are a natural consequence of test error in noise"},{"key":"ref236","article-title":"Good word attacks on statistical spam filters","volume":"2005","author":"lowd","year":"2005","journal-title":"Proc 2nd Conf Email and Anti-Spam (CEAS 05)"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.2200\/S00861ED1V01Y201806AIM039"},{"key":"ref135","article-title":"Adversarial patch","author":"brown","year":"2017","journal-title":"Proc 31st Conf Neural Inf Process Syst (NIPS)"},{"key":"ref138","author":"sitawarin","year":"2018","journal-title":"Rogue signs Deceiving traffic sign recognition with malicious ads and logos"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2018.07.023"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00099"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.300"},{"key":"ref141","author":"fischer","year":"2017","journal-title":"Adversarial examples for semantic image segmentation"},{"key":"ref142","author":"tretschk","year":"2018","journal-title":"Sequential attacks on agents for long-term adversarial goals"},{"key":"ref143","first-page":"2040","article-title":"Robust deep reinforcement learning with adversarial attacks","author":"pattanaik","year":"2018","journal-title":"Proc 7th Int Conf Auton Agents Multiagent Syst"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2869360"},{"key":"ref144","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2017\/525"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1080\/15472450.2017.1336053"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00014"},{"key":"ref109","first-page":"1097","article-title":"ImageNet classification with deep convolutional neural networks","author":"krizhevsky","year":"2012","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref107","article-title":"Learning multiple layers of features from tiny images","author":"krizhevsky","year":"0"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"key":"ref105","author":"gilmer","year":"2018","journal-title":"Motivating the rules of the game for adversarial example research"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"ref103","first-page":"5283","article-title":"Provable defenses against adversarial examples via the convex outer adversarial polytope","author":"wong","year":"2018","journal-title":"Proc Int Conf Mach Learn (ICML)"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/ACSSC.2018.8645290"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298594"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1145\/2647868.2654889"},{"key":"ref110","article-title":"Very deep convolutional networks for large-scale image recognition","author":"simonyan","year":"2015","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1016\/j.vehcom.2014.05.001"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3003816"},{"key":"ref12","author":"chakraborty","year":"2018","journal-title":"Adversarial Attacks and Defences A Survey"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2807385"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2017.2749459"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2018.2886017"},{"key":"ref16","author":"wang","year":"2019","journal-title":"A survey on adversarial attacks and defenses in text"},{"key":"ref118","doi-asserted-by":"crossref","first-page":"99","DOI":"10.1201\/9781351251389-8","article-title":"Adversarial examples in the physical world","author":"kurakin","year":"2018","journal-title":"Artificial Intelligence Safety and Security"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1080\/01441647.2018.1518937"},{"key":"ref117","author":"papernot","year":"2016","journal-title":"Towards the science of security and privacy in machine learning"},{"key":"ref18","year":"2016","journal-title":"Taxonomy and Definitions for Terms Related to Driving Automation Systems for On-Road Motor Vehicles"},{"key":"ref19","first-page":"158","article-title":"Roadway automation technology—Research needs","author":"shladover","year":"1990","journal-title":"Transp Res Rec"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref114","author":"riggle","year":"2019","journal-title":"An Introduction to Approachable Threat Modeling"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref116","author":"tram\u00e8r","year":"2017","journal-title":"The space of transferable adversarial examples"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-010-5188-5"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref122","author":"sarkar","year":"2017","journal-title":"UPSET and ANGRI Breaking high performance image classifiers"},{"key":"ref123","first-page":"6977","article-title":"Houdini: Fooling deep structured visual and speech recognition models with adversarial examples","author":"cisse","year":"2017","journal-title":"Proc Adv Neural Inf Process Syst"}],"container-title":["IEEE Communications Surveys & Tutorials"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9739\/9102343\/09003212.pdf?arnumber=9003212","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,4,27]],"date-time":"2022-04-27T12:58:55Z","timestamp":1651064335000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9003212\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020]]},"references-count":239,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/comst.2020.2975048","relation":{},"ISSN":["1553-877X","2373-745X"],"issn-type":[{"value":"1553-877X","type":"electronic"},{"value":"2373-745X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020]]}}}