{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,24]],"date-time":"2025-08-24T01:39:46Z","timestamp":1755999586905,"version":"3.28.0"},"reference-count":53,"publisher":"IEEE","license":[{"start":{"date-parts":[[2021,7,18]],"date-time":"2021-07-18T00:00:00Z","timestamp":1626566400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2021,7,18]],"date-time":"2021-07-18T00:00:00Z","timestamp":1626566400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2021,7,18]],"date-time":"2021-07-18T00:00:00Z","timestamp":1626566400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2021,7,18]]},"DOI":"10.1109\/ijcnn52387.2021.9533949","type":"proceedings-article","created":{"date-parts":[[2021,9,20]],"date-time":"2021-09-20T21:27:41Z","timestamp":1632173261000},"page":"1-8","source":"Crossref","is-referenced-by-count":4,"title":["Efficient Adversarial Defense without Adversarial Training: A Batch Normalization Approach"],"prefix":"10.1109","author":[{"given":"Yao","family":"Zhu","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiao","family":"Wei","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yue","family":"Zhu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"journal-title":"Towards deep learning models resistant to adversarial attacks","year":"2017","author":"madry","key":"ref39"},{"key":"ref38","volume":"6","author":"krizhevsky","year":"2009","journal-title":"CIFAR-10 and CIFAR-100 Datasets"},{"key":"ref33","article-title":"Provable tradeoffs in adversarially robust classification","author":"dobriban","year":"2020","journal-title":"ArXiv Preprint"},{"key":"ref32","article-title":"More data can expand the generalization gap between adversarially robust and standard models","author":"chen","year":"2020","journal-title":"ICML"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"journal-title":"On saliency maps and adversarial robustness","year":"2020","author":"mangla","key":"ref30"},{"key":"ref37","first-page":"8024","article-title":"Pytorch: An imperative style, high-performance deep learning library","author":"paszke","year":"2019","journal-title":"Advances in Neural IInformation Processing Systems"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58536-5_38"},{"journal-title":"Adversarial examples improve image recognition","year":"2019","author":"xie","key":"ref35"},{"key":"ref34","article-title":"Adversarial learning guarantees for linear hypotheses and neural networks","author":"awasthi","year":"2020","journal-title":"ICML"},{"key":"ref28","article-title":"Grad-cam++: Generalized gradient-based visual explanations for deep convolutional networks","volume":"abs 1710 11063","author":"chattopadhyay","year":"2017","journal-title":"CoRR"},{"key":"ref27","article-title":"Grad-cam: Why did you say that? visual explanations from deep networks via gradient-based localization","volume":"abs 1610 2391","author":"selvaraju","year":"2016","journal-title":"CoRR"},{"key":"ref29","article-title":"Robustness may be at odds with accuracy","author":"tsipras","year":"0","journal-title":"International Conference on Learning Representations"},{"key":"ref2","article-title":"Measuring neural net robustness with constraints","volume":"abs 1605 7262","author":"bastani","year":"2016","journal-title":"CoRR"},{"journal-title":"Rademacher complexity for adversarially robust generalization","year":"2019","author":"yin","key":"ref1"},{"key":"ref20","article-title":"Countering adversarial images using input transformations","volume":"abs 1711 117","author":"guo","year":"2017","journal-title":"CoRR"},{"key":"ref22","article-title":"Pixelde-fend: Leveraging generative models to understand and defend against adversarial examples","volume":"abs 1710 10766","author":"song","year":"2017","journal-title":"CoRR"},{"key":"ref21","article-title":"Mitigating adversarial effects through randomization","volume":"abs 1711 1991","author":"xie","year":"2017","journal-title":"CoRR"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58604-1_45"},{"key":"ref23","article-title":"Thermometer encoding: One hot way to resist adversarial examples","author":"buckman","year":"0","journal-title":"International Conference on Learning Representations"},{"key":"ref26","article-title":"Learning deep features for discriminative localization","volume":"abs 1512 4150","author":"zhou","year":"2015","journal-title":"CoRR"},{"key":"ref25","article-title":"Striving for simplicity: The all convolutional net","volume":"abs 1412 6806","author":"springenberg","year":"2015","journal-title":"CoRR"},{"journal-title":"Robustness via curvature regularization and vice versa","year":"2018","author":"moosavi-dezfooli","key":"ref50"},{"journal-title":"Adversarial robustness through local linearization","year":"2019","author":"qin","key":"ref51"},{"key":"ref53","article-title":"Interpreting adversarially trained convolutional neural networks","volume":"abs 1905 9797","author":"zhang","year":"2019","journal-title":"CoRR"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/3394486.3403225"},{"key":"ref10","article-title":"Fast is better than free: Revisiting adversarial training","author":"wong","year":"2020","journal-title":"ArXiv Preprint"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01216-8_12"},{"journal-title":"Towards Evaluating the Robustness of Neural Networks","year":"2016","author":"carlini","key":"ref40"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01070"},{"key":"ref13","article-title":"Deep inside convolutional networks: Visualising image classification models and saliency maps","author":"simonyan","year":"0","journal-title":"In International Conference on Learning Representations Workshop"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939778"},{"key":"ref15","article-title":"Revisiting batch normalization for practical domain adaptation","volume":"abs 1603 4779","author":"li","year":"2016","journal-title":"CoRR"},{"key":"ref16","article-title":"Intriguing properties of neural networks","author":"szegedy","year":"2013","journal-title":"ArXiv Preprint"},{"key":"ref17","article-title":"Explaining and harnessing adversarial examples","author":"goodfellow","year":"2015","journal-title":"ICLRE"},{"journal-title":"Theoretically principled trade-off between robustness and accuracy","year":"2019","author":"zhang","key":"ref18"},{"key":"ref19","first-page":"227","article-title":"You only propagate once: Accelerating adversarial training via maximal principle","author":"zhang","year":"2019","journal-title":"Advances in neural information processing systems"},{"key":"ref4","first-page":"14082","article-title":"Provable certificates for adversarial examples: Fitting a ball in the union of polytopes","author":"jordan","year":"2019","journal-title":"Advances in Neural IInformation Processing Systems"},{"key":"ref3","first-page":"1823","volume":"97","author":"etmann","year":"2019","journal-title":"On the connection between adversarial robustness and saliency map interpretability"},{"journal-title":"Going Deeper with Convolutions","year":"2014","author":"szegedy","key":"ref6"},{"key":"ref5","article-title":"A boundary tilting persepective on the phenomenon of adversarial examples","volume":"abs 1608 7690","author":"tanay","year":"2016","journal-title":"CoRR"},{"key":"ref8","article-title":"Certified defenses against adversarial examples","volume":"abs 1801 9344","author":"raghunathan","year":"2018","journal-title":"CoRR"},{"journal-title":"Towards deep learning models resistant to adversarial attacks","year":"2017","author":"madry","key":"ref7"},{"journal-title":"Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients","year":"2017","author":"ross","key":"ref49"},{"key":"ref9","first-page":"3353","article-title":"Adversarial training for free!","author":"shafahi","year":"2019","journal-title":"Advances in neural information processing systems"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"ref45","article-title":"AdverTorch v0.1: An adversarial robustness toolbox based on pytorch","author":"ding","year":"2019","journal-title":"ArXiv Preprint"},{"journal-title":"Adversarial weight perturbation helps robust generalization","year":"2020","author":"wu","key":"ref48"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"ref42","first-page":"284","article-title":"Synthesizing robust adversarial examples","volume":"80","author":"athalye","year":"2018","journal-title":"Stockholmsmässan"},{"journal-title":"Adv-bnn Improved adversarial defense through robust bayesian neural network","year":"2018","author":"liu","key":"ref41"},{"journal-title":"Obfuscated gradients give a false sense of security Circumventing defenses to adversarial examples","year":"2018","author":"athalye","key":"ref44"},{"journal-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","year":"2020","author":"croce","key":"ref43"}],"event":{"name":"2021 International Joint Conference on Neural Networks (IJCNN)","start":{"date-parts":[[2021,7,18]]},"location":"Shenzhen, China","end":{"date-parts":[[2021,7,22]]}},"container-title":["2021 International Joint Conference on Neural Networks (IJCNN)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9533266\/9533267\/09533949.pdf?arnumber=9533949","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,5,10]],"date-time":"2022-05-10T15:45:56Z","timestamp":1652197556000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9533949\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,7,18]]},"references-count":53,"URL":"https:\/\/doi.org\/10.1109\/ijcnn52387.2021.9533949","relation":{},"subject":[],"published":{"date-parts":[[2021,7,18]]}}}