{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,18]],"date-time":"2026-01-18T14:29:00Z","timestamp":1768746540442,"version":"3.49.0"},"reference-count":46,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"3","license":[{"start":{"date-parts":[[2023,3,1]],"date-time":"2023-03-01T00:00:00Z","timestamp":1677628800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,3,1]],"date-time":"2023-03-01T00:00:00Z","timestamp":1677628800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,3,1]],"date-time":"2023-03-01T00:00:00Z","timestamp":1677628800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2023,3,1]]},"DOI":"10.1109\/tpami.2022.3174724","type":"journal-article","created":{"date-parts":[[2022,5,12]],"date-time":"2022-05-12T19:36:42Z","timestamp":1652384202000},"page":"2698-2710","source":"Crossref","is-referenced-by-count":19,"title":["Adversarial Robustness Via Fisher-Rao Regularization"],"prefix":"10.1109","volume":"45","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6855-8284","authenticated-orcid":false,"given":"Marine","family":"Picot","sequence":"first","affiliation":[{"name":"Department of Electrical and Computer Engineering, McGill University, Montreal, QC, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9308-2572","authenticated-orcid":false,"given":"Francisco","family":"Messina","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, McGill University, Montreal, QC, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2047-6447","authenticated-orcid":false,"given":"Malik","family":"Boudiaf","sequence":"additional","affiliation":[{"name":"ETS, Montreal, QC, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5814-9156","authenticated-orcid":false,"given":"Fabrice","family":"Labeau","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, McGill University, Montreal, QC, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9668-8027","authenticated-orcid":false,"given":"Ismail Ben","family":"Ayed","sequence":"additional","affiliation":[{"name":"ETS, Montreal, QC, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8717-2117","authenticated-orcid":false,"given":"Pablo","family":"Piantanida","sequence":"additional","affiliation":[{"name":"International Laboratory on Learning Systems (ILLS), McGill - ETS - Mila - CNRS - Université Paris Saclay - CentraleSupelec, Montreal, QC, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Szegedy"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D18-1316"},{"key":"ref3","volume-title":"Adversarial Machine Learning, ser. Synthesis Lectures on Artificial Intelligence and Machine Learning","author":"Vorobeychik","year":"2018"},{"key":"ref4","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. 3rd Int. Conf. Learn. Representations","author":"Goodfellow"},{"key":"ref6","first-page":"125","article-title":"Adversarial examples are not bugs, they are features","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Ilyas"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref9","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref10","volume-title":"CoRR","author":"Feinman","year":"2017"},{"key":"ref11","first-page":"7924","article-title":"Robust detection of adversarial attacks by modeling the intrinsic properties of deep neural networks","volume-title":"Proc. 32nd Int. Conf. Neural Inf. Process. Syst.","author":"Zheng"},{"key":"ref12","article-title":"On the (statistical) detection of adversarial examples","author":"Grosse","year":"2017"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"ref14","first-page":"9464","article-title":"Certified adversarial robustness with additive noise","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Li"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00044"},{"key":"ref16","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Cohen"},{"key":"ref17","first-page":"2057","article-title":"Provable robustness of ReLU networks via maximization of linear regions","volume-title":"Proc. 22nd Int. Conf. Artif. Intell. Statist.","author":"Croce"},{"key":"ref18","first-page":"8400","article-title":"Scaling provable adversarial defenses","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Wong"},{"key":"ref19","article-title":"Towards stable and efficient training of verifiably robust neural networks","volume-title":"Proc. Int. Conf. Learn. Representation","author":"Zhang"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00494"},{"key":"ref21","first-page":"3578","article-title":"Differentiable abstract interpretation for provably robust neural networks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Mirman"},{"key":"ref22","article-title":"Certified defenses against adversarial examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Raghunathan"},{"key":"ref23","first-page":"5283","article-title":"Provable defenses against adversarial examples via the convex outer adversarial polytope","volume-title":"Proc. 35th Int. Conf. Mach. Learn.","author":"Wong"},{"key":"ref24","article-title":"Distilling the knowledge in a neural network","volume-title":"Proc. NIPS Deep Learn. Representation Learn. Workshop","author":"Hinton"},{"key":"ref25","article-title":"Transferability in machine learning: From phenomena to black-box attacks using adversarial samples","volume-title":"CoRR","author":"Papernot","year":"2016"},{"key":"ref26","first-page":"1","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang"},{"key":"ref27","article-title":"Improving adversarial robustness requires revisiting misclassified examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wang"},{"key":"ref28","first-page":"2712","article-title":"Using pre-training can improve model robustness and uncertainty","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Hendrycks"},{"key":"ref29","first-page":"8093","article-title":"Overfitting in adversarially robust deep learning","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Rice"},{"key":"ref30","first-page":"2034","article-title":"Controlling neural level sets","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Atzmon"},{"key":"ref31","first-page":"19365","article-title":"Self-adaptive training: Beyond empirical risk minimization","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Huang"},{"key":"ref32","first-page":"11192","article-title":"Unlabeled data improves adversarial robustness","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Carmon"},{"key":"ref33","first-page":"12214","article-title":"Are labels required for improving adversarial robustness?","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Alayrac"},{"key":"ref34","first-page":"2958","article-title":"Adversarial weight perturbation helps robust generalization","volume-title":"Proc. 34th Adv. Neural Inf. Process. Syst.","author":"Wu"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref36","first-page":"854","article-title":"Parseval networks: Improving robustness to adversarial examples","volume-title":"Proc. 34th Int. Conf. Mach. Learn.","author":"Cisse"},{"key":"ref37","first-page":"577","article-title":"On robustness and regularization of structural support vector machines","volume-title":"Proc. 31st Int. Conf. Mach. Learn.","author":"Torkamani"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-45528-0"},{"key":"ref39","volume-title":"ATT Labs","author":"LeCun","year":"2010"},{"key":"ref40","first-page":"32","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2008.128"},{"key":"ref42","article-title":"SGDR: Stochastic gradient descent with warm restarts","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Loshchilov"},{"key":"ref43","article-title":"Robustbench: A standardized adversarial robustness benchmark","author":"Croce","year":"2020"},{"issue":"3","key":"ref44","first-page":"345","article-title":"Raos distance measure","volume-title":"Sankhy\u0101: Indian J. Statist., Ser. A. (1961\u20132002)","volume":"43","author":"Atkinson","year":"1981"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-07779-6"},{"key":"ref46","volume-title":"Matrix analysis, ser. matrix analysis","author":"Horn","year":"2013"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1007\/b13794"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/34\/10036240\/09773978.pdf?arnumber=9773978","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,4,4]],"date-time":"2025-04-04T19:26:10Z","timestamp":1743794770000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9773978\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,3,1]]},"references-count":46,"journal-issue":{"issue":"3"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2022.3174724","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"value":"0162-8828","type":"print"},{"value":"2160-9292","type":"electronic"},{"value":"1939-3539","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,3,1]]}}}