{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T04:29:44Z","timestamp":1783571384012,"version":"3.55.0"},"reference-count":279,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2020,8,1]],"date-time":"2020-08-01T00:00:00Z","timestamp":1596240000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2020,8,1]],"date-time":"2020-08-01T00:00:00Z","timestamp":1596240000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2020,8,1]],"date-time":"2020-08-01T00:00:00Z","timestamp":1596240000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"CNS","award":["#1218505"],"award-info":[{"award-number":["#1218505"]}]},{"name":"IIS","award":["#1116385"],"award-info":[{"award-number":["#1116385"]}]},{"name":"NIH","award":["#EB019202"],"award-info":[{"award-number":["#EB019202"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Emerg. Top. Comput. Intell."],"published-print":{"date-parts":[[2020,8]]},"DOI":"10.1109\/tetci.2020.2968933","type":"journal-article","created":{"date-parts":[[2020,5,25]],"date-time":"2020-05-25T22:39:50Z","timestamp":1590446390000},"page":"450-467","source":"Crossref","is-referenced-by-count":78,"title":["A System-Driven Taxonomy of Attacks and Defenses in Adversarial Machine Learning"],"prefix":"10.1109","volume":"4","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1246-2494","authenticated-orcid":false,"given":"Koosha","family":"Sadeghi","sequence":"first","affiliation":[{"name":"IMPACT lab, CIDSE, Arizona State University, Tempe, Arizona, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ayan","family":"Banerjee","sequence":"additional","affiliation":[{"name":"IMPACT lab, CIDSE, Arizona State University, Tempe, Arizona, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6108-5584","authenticated-orcid":false,"given":"Sandeep K. S.","family":"Gupta","sequence":"additional","affiliation":[{"name":"IMPACT lab, CIDSE, Arizona State University, Tempe, Arizona, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref275","doi-asserted-by":"publisher","DOI":"10.1145\/3068287"},{"key":"ref274","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-62416-7_19"},{"key":"ref277","doi-asserted-by":"publisher","DOI":"10.1145\/3132747.3132785"},{"key":"ref276","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-63387-9_1"},{"key":"ref271","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2009.5459250"},{"key":"ref270","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2017.09.053"},{"key":"ref273","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2017.2740965"},{"key":"ref170","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.243"},{"key":"ref272","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2016.0045"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2017-1798"},{"key":"ref171","article-title":"Mobilenets: Efficient convolutional neural networks for mobile vision applications","author":"howard","year":"2017"},{"key":"ref174","first-page":"513","article-title":"Hidden voice commands","author":"carlini","year":"0","journal-title":"Proc Usenix Secur Symp"},{"key":"ref173","first-page":"4278","article-title":"Inception-v4, inception-resnet and the impact of residual connections on learning","author":"szegedy","year":"2017","journal-title":"Proc 31st AAAI Conf Artif Intell"},{"key":"ref176","first-page":"601","article-title":"Stealing machine learning models via prediction APIs","author":"tram\u00e8r","year":"0","journal-title":"Proc Usenix Secur Symp"},{"key":"ref175","doi-asserted-by":"publisher","DOI":"10.1504\/IJSN.2015.071829"},{"key":"ref178","doi-asserted-by":"publisher","DOI":"10.1109\/ICB.2013.6613006"},{"key":"ref177","first-page":"17","article-title":"Privacy in pharmacogenetics: An end-to-end case study of personalized warfarin dosing","author":"fredrikson","year":"0","journal-title":"Proc Usenix Secur Symp"},{"key":"ref168","article-title":"[Online]. Available:","year":"0"},{"key":"ref169","article-title":"Cleverhans v1. 0.0: An adversarial machine learning library","author":"papernot","year":"2016"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3003816"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-010-5188-5"},{"key":"ref33","article-title":"Certified adversarial robustness with additive gaussian noise","author":"li","year":"2018"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01234-2_23"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00044"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1108\/ICS-05-2018-0060"},{"key":"ref37","article-title":"On evaluating adversarial robustness","author":"carlini","year":"2019"},{"key":"ref267","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.35"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.2514\/6.2019-0770"},{"key":"ref268","first-page":"1","article-title":"Adversarial example defense: Ensembles of weak defenses are not strong","author":"he","year":"2017","journal-title":"Proc USENIX Workshop Offensive Technol"},{"key":"ref35","first-page":"134","article-title":"The driverless car and the legal system: Hopes and fears as the courts, regulatory agencies, Waymo, Tesla, and Uber deal with this exciting and terrifying new technology","volume":"14","author":"rice","year":"2019","journal-title":"7 Strategies for Sustained Innovation"},{"key":"ref269","first-page":"2613","article-title":"Measuring neural net robustness with constraints","author":"bastani","year":"0","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref34","article-title":"Certified adversarial robustness via randomized smoothing","author":"cohen","year":"2019"},{"key":"ref181","doi-asserted-by":"publisher","DOI":"10.1109\/THS.2017.7943475"},{"key":"ref180","doi-asserted-by":"publisher","DOI":"10.1145\/2661829.2662047"},{"key":"ref185","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23408"},{"key":"ref184","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.20"},{"key":"ref183","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2006.873653"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.1023\/A:1022948414856"},{"key":"ref189","article-title":"Adversarial perturbations against deep neural networks for malware classification","author":"grosse","year":"2016"},{"key":"ref188","doi-asserted-by":"publisher","DOI":"10.1109\/APSIPA.2013.6694344"},{"key":"ref187","doi-asserted-by":"publisher","DOI":"10.1109\/WIFS.2016.7823907"},{"key":"ref186","year":"2016","journal-title":"information technology - Biometric presentation attack detection - Part 1 Framework"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/DCOSS.2016.36"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/1989656.1989664"},{"key":"ref179","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2018.2809624"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2017.10.009"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/1014052.1014066"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2017.10"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.IR.7298r1"},{"key":"ref24","first-page":"1452","article-title":"Data poisoning attacks against autoregressive models","author":"alfeld","year":"2016","journal-title":"Proc 13th AAAI Conf Artif Intell"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298640"},{"key":"ref278","doi-asserted-by":"publisher","DOI":"10.1109\/SAI.2016.7556118"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2017.2718494"},{"key":"ref279","doi-asserted-by":"publisher","DOI":"10.1109\/TSMCC.2005.848192"},{"key":"ref25","first-page":"27","article-title":"Towards poisoning of deep learning algorithms with back-gradient optimization","author":"mu\u00f1oz-gonz\u00e1lez","year":"0","journal-title":"Proc ACM Workshop Artif Intell Security"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/1654988.1654990"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/2046684.2046692"},{"key":"ref154","first-page":"1","article-title":"TREC 2007 SPAM track overview","author":"cormack","year":"0","journal-title":"Proc of the 16th Text REtrieval Conference"},{"key":"ref153","doi-asserted-by":"publisher","DOI":"10.1145\/1961189.1961199"},{"key":"ref156","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref155","article-title":"[Online]. Available","year":"0"},{"key":"ref150","article-title":"[Online]. Available","year":"0"},{"key":"ref152","article-title":"Learning multiple layers of features from tiny images","author":"krizhevsky","year":"2009"},{"key":"ref151","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2016.58"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.165"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2017.7966196"},{"key":"ref148","first-page":"53","article-title":"Comparison of learning algorithms for handwritten digit recognition","author":"cun","year":"0","journal-title":"1st IEE Int Conf Artif Neural Netw"},{"key":"ref149","article-title":"Multi-digit number recognition from street view imagery using deep convolutional neural networks","author":"goodfellow","year":"2013","journal-title":"arXiv 1312 6082"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2018.8489495"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/3186282"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2017.0-142"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2016.0110"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2018.00035"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref53","first-page":"197","article-title":"Practical evasion of a learning-based classifier: A case study","author":"laskov","year":"2014","journal-title":"Proc IEEE Symp Secur Privacy"},{"key":"ref52","first-page":"3681","article-title":"Security analysis of online centroid anomaly detection","volume":"13","author":"kloft","year":"2012","journal-title":"J Mach Learn Res"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2018.07.023"},{"key":"ref167","article-title":"[Online]. Available:","year":"0"},{"key":"ref166","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2012.02.016"},{"key":"ref165","article-title":"[Online]. Available:","year":"0"},{"key":"ref164","doi-asserted-by":"publisher","DOI":"10.1145\/3065386"},{"key":"ref163","first-page":"1","article-title":"Overfeat: Integrated recognition, localization and detection using convolutional networks","author":"sermanet","year":"2014","journal-title":"Proc Intl Conf on Learning Representations"},{"key":"ref162","first-page":"818","article-title":"Visualizing and understanding convolutional networks","author":"zeiler","year":"0","journal-title":"Proc Eur Conf Comput Vision"},{"key":"ref161","doi-asserted-by":"publisher","DOI":"10.5244\/C.28.6"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TMI.2016.2528162"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1038\/nature14236"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978392"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/2815317.2815341"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1186\/s40537-014-0007-7"},{"key":"ref159","first-page":"1","article-title":"Feature weighting for improved classifier robustness","author":"ko?cz","year":"0","journal-title":"Proc of the Conf on Email and Anti-Spam"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/1128817.1128824"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P16-1231"},{"key":"ref157","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/2835375"},{"key":"ref158","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23247"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/FIT.2018.00064"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00027"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2013.57"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2018.2888779"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1002\/widm.1259"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2805680"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2018.10.315"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2807385"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134052"},{"key":"ref72","article-title":"Fooling OCR systems with adversarial text images","author":"song","year":"2018"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/TCYB.2015.2415032"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-20248-8_15"},{"key":"ref76","article-title":"Adversarial attacks on neural network policies","author":"huang","year":"2017"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2016.0020"},{"key":"ref74","article-title":"Adversarial examples in the physical world","author":"kurakin","year":"2016"},{"key":"ref75","article-title":"Realistic adversarial examples in 3D meshes","author":"yang","year":"2018"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2016.2593488"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1016\/j.jpdc.2019.03.003"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00023"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-019-0027-x"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2018.8599715"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01554-1_26"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1002\/widm.1245"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1145\/3207677.3277988"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/SPAWC.2018.8445767"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2018.2886017"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420987"},{"key":"ref197","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2010.936021"},{"key":"ref198","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2017.2718494"},{"key":"ref199","article-title":"Synthesizing robust adversarial examples","author":"athalye","year":"2017"},{"key":"ref193","article-title":"Adversarial regression with multiple learners","author":"tong","year":"2018"},{"key":"ref194","first-page":"211","article-title":"Adversarial classification on social networks","author":"yu","year":"2018","journal-title":"Proc 7th Int Conf Auton Agents Multiagent Syst"},{"key":"ref195","doi-asserted-by":"publisher","DOI":"10.1145\/2020408.2020495"},{"key":"ref196","first-page":"2617","article-title":"Static prediction games for adversarial learning problems","volume":"13","author":"br\u00fcckner","year":"2012","journal-title":"J Mach Learn Res"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1145\/2339530.2339697"},{"key":"ref190","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00009"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_23"},{"key":"ref191","doi-asserted-by":"publisher","DOI":"10.1109\/EISIC.2017.21"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref192","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2017.00-12"},{"key":"ref92","article-title":"Transferability in machine learning: From phenomena to black-box attacks using adversarial samples","author":"papernot","year":"2016"},{"key":"ref91","article-title":"Adversarial transformation networks: Learning to generate adversarial examples","author":"baluja","year":"2017"},{"key":"ref90","article-title":"Feature conservation in adversarial classifier evasion: A case study","author":"tong","year":"2017"},{"key":"ref98","article-title":"Distilling the knowledge in a neural network","author":"hinton","year":"2015"},{"key":"ref99","article-title":"Machine learning in the presence of an adversary: Attacking and defending the Spambayes spam filter","author":"saini","year":"2008"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1145\/2996758.2996771"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/UIC-ATC.2017.8397607"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2017.2700270"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2017.2718479"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1145\/3134600.3134606"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-34620-0_21"},{"key":"ref85","article-title":"Feature squeezing: Detecting adversarial examples in deep neural networks","author":"xu","year":"2017"},{"key":"ref86","first-page":"2687","article-title":"Learning to Attack: Adversarial Transformation Networks","volume":"1","author":"baluja","year":"2018","journal-title":"Proc AAAI"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.1998.687114"},{"key":"ref88","first-page":"870","article-title":"Machine learning. 1997","volume":"45","author":"mitchell","year":"1997","journal-title":"Burr Ridge"},{"key":"ref200","article-title":"Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression","author":"das","year":"2017"},{"key":"ref101","article-title":"Black-box adversarial attacks with limited queries and information","author":"ilyas","year":"2018"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref209","article-title":"Learning with a strong adversary","author":"huang","year":"2015"},{"key":"ref203","article-title":"Dimensionality reduction as a defense against evasion attacks on machine learning classifiers","author":"bhagoji","year":"2017"},{"key":"ref204","article-title":"Standard detectors aren't (currently) fooled by physical adversarial stop signs","author":"lu","year":"2017"},{"key":"ref201","doi-asserted-by":"publisher","DOI":"10.1109\/CISS.2018.8362326"},{"key":"ref202","article-title":"No need to worry about adversarial examples in object detection in autonomous vehicles","author":"lu","year":"2017"},{"key":"ref207","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134057"},{"key":"ref208","article-title":"Pixeldefend: Leveraging generative models to understand and defend against adversarial examples","author":"song","year":"2017"},{"key":"ref205","article-title":"Countering adversarial images using input transformations","author":"guo","year":"2017"},{"key":"ref206","article-title":"Mitigating adversarial effects through randomization","author":"xie","year":"2017"},{"key":"ref211","article-title":"Provably minimally-distorted adversarial examples","author":"carlini","year":"2017"},{"key":"ref210","first-page":"2387","article-title":"Evasion and hardening of tree ensemble classifiers","author":"kantchelian","year":"0","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref212","article-title":"Blocking transferability of adversarial examples in black-box learning systems","author":"hosseini","year":"2017"},{"key":"ref213","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00020"},{"key":"ref214","article-title":"Generative adversarial trainer: Defense to adversarial perturbations with GAN","author":"lee","year":"2017"},{"key":"ref215","doi-asserted-by":"publisher","DOI":"10.1109\/SNPD.2017.8022700"},{"key":"ref216","article-title":"Towards robust deep neural networks with bang","author":"rozsa","year":"2016"},{"key":"ref217","article-title":"The space of transferable adversarial examples","author":"tram\u00e8r","year":"2017"},{"key":"ref218","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/520"},{"key":"ref219","first-page":"1","article-title":"Provable defenses against adversarial examples via the convex outer adversarial polytope","author":"wong","year":"2018","journal-title":"Proc 35th Int Conf Mach Learn"},{"key":"ref220","first-page":"8400","article-title":"Scaling provable adversarial defenses","author":"wong","year":"0","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref222","article-title":"DeepCloak: Masking deep neural network models for robustness against adversarial samples","author":"gao","year":"2017"},{"key":"ref221","first-page":"10\ufffd877","article-title":"Semidefinite relaxations for certifying robustness to adversarial examples","author":"raghunathan","year":"0","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref229","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.485"},{"key":"ref228","doi-asserted-by":"publisher","DOI":"10.1109\/72.165600"},{"key":"ref227","first-page":"1660","article-title":"Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients","author":"ross","year":"0","journal-title":"Proc 30nd AAAI Conf Artif Intell"},{"key":"ref226","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref225","doi-asserted-by":"publisher","DOI":"10.1109\/ASPDAC.2018.8297407"},{"key":"ref224","article-title":"Foveation-based mechanisms alleviate adversarial examples","author":"luo","year":"2015"},{"key":"ref223","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098158"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2017.230"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66399-9_4"},{"key":"ref125","first-page":"1","article-title":"Physical adversarial examples for object detectors","author":"song","year":"0","journal-title":"Proc USENIX Workshop Offensive Technol"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref129","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"2017"},{"key":"ref128","article-title":"Adversarial machine learning at scale","author":"kurakin","year":"2016"},{"key":"ref130","article-title":"Ensemble adversarial training: Attacks and defenses","author":"t","year":"2017"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref134","first-page":"1145","article-title":"A quasi-newton approach to nonsmooth convex optimization problems in machine learning","volume":"11","author":"yu","year":"2010","journal-title":"J Mach Learn Res"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref132","first-page":"1139","article-title":"On the importance of initialization and momentum in deep learning","author":"sutskever","year":"0","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref232","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2017.7965897"},{"key":"ref233","first-page":"1489","article-title":"Convex learning with invariances","author":"teo","year":"0","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref230","article-title":"Defend deep neural networks against adversarial examples via fixed and dynamic quantized activation functions","author":"rakin","year":"2018"},{"key":"ref231","first-page":"3248","article-title":"Large-margin convex polytope machine","author":"kantchelian","year":"0","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref239","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140449"},{"key":"ref238","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2017.06.032"},{"key":"ref235","first-page":"106","article-title":"Infinity-norm support vector machines against adversarial label contamination","author":"demontis","year":"2017","journal-title":"ITASEC"},{"key":"ref234","article-title":"Towards deep neural network architectures robust to adversarial examples","author":"gu","year":"2014"},{"key":"ref237","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2016.08.037"},{"key":"ref236","doi-asserted-by":"publisher","DOI":"10.1145\/1143844.1143889"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1137\/0916069"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1007\/s10107-012-0522-2"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2016.7727230"},{"key":"ref137","article-title":"Adversarial manipulation of deep representations","author":"sabour","year":"2015"},{"key":"ref139","article-title":"Spatially transformed adversarial examples","author":"xiao","year":"2018"},{"key":"ref140","first-page":"6808","article-title":"Wasserstein adversarial examples via projected sinkhorn iterations","author":"wong","year":"2019","journal-title":"Proceedings 36th Int Conf Mach Learn"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511804441"},{"key":"ref142","first-page":"2672","article-title":"Generative adversarial nets","author":"goodfellow","year":"0","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref143","article-title":"On distinguishability criteria for estimating generative models","author":"goodfellow","year":"2014"},{"key":"ref2","article-title":"Bringing big neural networks to self-driving cars, smartphones, and drones","author":"bourzac","year":"2016","journal-title":"IEEE Spectr"},{"key":"ref144","article-title":"Unsupervised representation learning with deep convolutional generative adversarial networks","author":"radford","year":"2015"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180220"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/543"},{"key":"ref241","first-page":"2266","article-title":"Formal guarantees on the robustness of a classifier against adversarial manipulation","author":"hein","year":"0","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref242","first-page":"854","article-title":"Parseval networks: Improving robustness to adversarial examples","author":"cisse","year":"0","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref243","article-title":"Stochastic activation pruning for robust adversarial defense","author":"dhillon","year":"2018"},{"key":"ref244","article-title":"Muldef: Multi-model-based defense against adversarial examples for neural networks","author":"srisakaokul","year":"2018"},{"key":"ref240","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-017-5663-3"},{"key":"ref248","article-title":"Adversary detection in neural networks via persistent homology","author":"gebhart","year":"2017"},{"key":"ref247","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.56"},{"key":"ref246","article-title":"On the (statistical) detection of adversarial examples","author":"grosse","year":"2017"},{"key":"ref245","article-title":"Deep k-nearest neighbors: Towards confident, interpretable and robust deep learning","author":"papernot","year":"2018"},{"key":"ref249","article-title":"Characterizing audio adversarial examples using temporal dependency","author":"yang","year":"2018"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2017.172"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"ref107","volume":"65","author":"spall","year":"2005","journal-title":"Introduction to Stochastic Search and Optimization Estimation Simulation and Control"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_10"},{"key":"ref105","article-title":"Exploring the space of black-box attacks on deep neural networks","author":"bhagoji","year":"2017"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00015"},{"key":"ref103","first-page":"1","article-title":"Automatically evading classifiers","volume":"10","author":"xu","year":"2016","journal-title":"Proc Symp Netw Distrib Syst"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1007\/11856214_5"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1109\/ICB.2012.6199756"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1109\/BTAS.2013.6712726"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2015.02.007"},{"key":"ref250","article-title":"Characterizing adversarial subspaces using local intrinsic dimensionality","author":"ma","year":"2018"},{"key":"ref251","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01249-6_14"},{"key":"ref254","article-title":"Detecting adversarial samples from artifacts","author":"feinman","year":"2017"},{"key":"ref255","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2018.2874243"},{"key":"ref252","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.615"},{"key":"ref253","doi-asserted-by":"publisher","DOI":"10.1145\/3095713.3095753"},{"key":"ref257","article-title":"On detecting adversarial perturbations","author":"metzen","year":"2017"},{"key":"ref256","article-title":"Early methods for detecting adversarial images","author":"hendrycks","year":"2016"},{"key":"ref259","first-page":"2172","article-title":"Infogan: Interpretable representation learning by information maximizing generative adversarial nets","author":"chen","year":"0","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/1081870.1081950"},{"key":"ref258","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00357"},{"key":"ref11","article-title":"Intriguing properties of neural networks","author":"szegedy","year":"2013"},{"key":"ref12","article-title":"Explaining and harnessing adversarial examples","author":"goodfellow","year":"2014"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1126\/science.aaw4399"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/MSECP.2003.1253575"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2006.88"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1007\/s13042-010-0007-7"},{"key":"ref118","article-title":"Robust physical-world attacks on machine learning models","author":"evtimov","year":"2017"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"ref117","first-page":"10","article-title":"EAD: Elastic-net attacks to deep neural networks via adversarial examples","author":"chen","year":"0","journal-title":"Proc 30nd AAAI Conf Artif Intell"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/TCYB.2015.2415032"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3332184"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.23919\/EUSIPCO.2018.8553214"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00016"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133978"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00014"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.153"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2016.7795300"},{"key":"ref122","article-title":"Deep inside convolutional networks: Visualising image classification models and saliency maps","author":"simonyan","year":"2013"},{"key":"ref123","article-title":"Defensive distillation is not robust to adversarial examples","author":"carlini","year":"2016"},{"key":"ref260","first-page":"6604","article-title":"Contamination attacks and mitigation in multi-party machine learning","author":"hayes","year":"0","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref261","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00057"},{"key":"ref262","first-page":"870","article-title":"Adversarial label flips attack on support vector machines","author":"xiao","year":"0","journal-title":"Proc 20th Eur Conf Artif Intell"},{"key":"ref263","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2017\/551"},{"key":"ref264","first-page":"1467","article-title":"Poisoning attacks against support vector machines","author":"biggio","year":"2012","journal-title":"Proc 29th Int Conf Mach Learn"},{"key":"ref265","doi-asserted-by":"publisher","DOI":"10.1142\/S0218001414600027"},{"key":"ref266","article-title":"Certified defenses against adversarial examples","author":"raghunathan","year":"2018"}],"container-title":["IEEE Transactions on Emerging Topics in Computational Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/7433297\/9145895\/09099439.pdf?arnumber=9099439","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,11,26]],"date-time":"2024-11-26T18:57:37Z","timestamp":1732647457000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9099439\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,8]]},"references-count":279,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/tetci.2020.2968933","relation":{},"ISSN":["2471-285X"],"issn-type":[{"value":"2471-285X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,8]]}}}