{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,12]],"date-time":"2026-03-12T05:54:53Z","timestamp":1773294893024,"version":"3.50.1"},"reference-count":50,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2023,4,1]],"date-time":"2023-04-01T00:00:00Z","timestamp":1680307200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,4,1]],"date-time":"2023-04-01T00:00:00Z","timestamp":1680307200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,4,1]],"date-time":"2023-04-01T00:00:00Z","timestamp":1680307200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"Huawei Technologies Company, Ltd."}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2023,4,1]]},"DOI":"10.1109\/tpami.2022.3195616","type":"journal-article","created":{"date-parts":[[2022,8,2]],"date-time":"2022-08-02T21:57:38Z","timestamp":1659477458000},"page":"5038-5052","source":"Crossref","is-referenced-by-count":4,"title":["On the Minimal Adversarial Perturbation for Deep Neural Networks With Provable Estimation Error"],"prefix":"10.1109","volume":"45","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9948-111X","authenticated-orcid":false,"given":"Fabio","family":"Brau","sequence":"first","affiliation":[{"name":"Department of Excellence in Robotics, AI, Scuola Superiore Sant’Anna, Pisa, Italy"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6404-2627","authenticated-orcid":false,"given":"Giulio","family":"Rossolini","sequence":"additional","affiliation":[{"name":"Department of Excellence in Robotics, AI, Scuola Superiore Sant’Anna, Pisa, Italy"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6625-9336","authenticated-orcid":false,"given":"Alessandro","family":"Biondi","sequence":"additional","affiliation":[{"name":"Department of Excellence in Robotics, AI, Scuola Superiore Sant’Anna, Pisa, Italy"}]},{"given":"Giorgio","family":"Buttazzo","sequence":"additional","affiliation":[{"name":"Department of Excellence in Robotics, AI, Scuola Superiore Sant’Anna, Pisa, Italy"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.91"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"ref4","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2013"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref7","first-page":"2196","article-title":"Minimally distorted adversarial examples with a fast adaptive boundary attack","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref8","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2017"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00445"},{"key":"ref10","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014"},{"key":"ref11","article-title":"On detecting adversarial perturbations","author":"Metzen","year":"2017"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/tse.2022.3163682"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"ref14","article-title":"Ensemble adversarial training: Attacks and defenses","volume-title":"Proc. Int. Conf. Learn. Representations (Poster)","author":"Tram\u00e8r"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/tnnls.2021.3105238"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1038\/sj.jors.2600425"},{"key":"ref18","first-page":"20052","article-title":"Fast minimum-norm adversarial attacks through adaptive norm constraints","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Pintor"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00764"},{"key":"ref20","volume-title":"Constrained Optimization and Lagrange Multiplier Methods","author":"Bertsekas","year":"2014"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-017-5663-3"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-63387-9_5"},{"key":"ref23","first-page":"5286","article-title":"Provable defenses against adversarial examples via the convex outer adversarial polytope","volume-title":"Proc. 35th Int. Conf. Mach. Learn.","author":"Wong"},{"key":"ref24","first-page":"10825","article-title":"Fast and effective robustness certification","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Singh"},{"key":"ref25","first-page":"4944","article-title":"Efficient neural network robustness certification with general activation functions","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zhang"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33013240"},{"key":"ref27","first-page":"4072","article-title":"On certifying non-uniform bounds against adversarial attacks","volume-title":"Proc. 36th Int. Conf. Mach. Learn.","author":"Liu"},{"key":"ref28","article-title":"A dual approach to scalable verification of deep networks","volume-title":"Proc. 34th Conf. Annu. Conf. Uncertainty Artif. Intell.","author":"Dvijotham"},{"key":"ref29","first-page":"29909","article-title":"Beta-crown: Efficient bound propagation with per-neuron split constraints for neural network robustness verification","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Wang"},{"key":"ref30","first-page":"5276","article-title":"Towards fast computation of certified robustness for relu networks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Weng"},{"key":"ref31","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"Proc. 36th Int. Conf. Mach. Learn.","author":"Cohen"},{"key":"ref32","article-title":"A framework for robustness certification of smoothed classifiers using f-divergences","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Dvijotham"},{"key":"ref33","volume-title":"Differential Geometry of Curves and Surfaces","author":"Carmo"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1007\/BF02922668"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1137\/0916069"},{"key":"ref36","article-title":"Adam: A. method for stochastic optimization","author":"Kingma","year":"2017"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"key":"ref39","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref41","first-page":"1139","article-title":"On the importance of initialization and momentum in deep learning","volume-title":"Proc. 30th Int. Conf. Mach. Learn.","author":"Sutskever"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2012.02.016"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2873948"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.21105\/joss.02607"},{"key":"ref45","article-title":"Adversarial robustness toolbox"},{"key":"ref46","first-page":"15390","article-title":"Preventing gradient attenuation in lipschitz constrained convolutional networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Li"},{"key":"ref47","article-title":"Orthogonalizing convolutional layers with the cayley transform","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Trockman"},{"key":"ref48","article-title":"projUNN: Efficient method for training deep networks with unitary matrices","author":"Kiani","year":"2022"},{"key":"ref49","first-page":"1","article-title":"Higher-order derivatives and taylors formula in several variables","author":"Folland","year":"2005","journal-title":"Preprint"},{"key":"ref50","volume-title":"Matrix Computations. Johns Hopkins Studies in the Mathematical Sciences","author":"Golub","year":"1996"},{"key":"ref51","article-title":"Fashion-mnist: A novel image dataset for benchmarking machine learning algorithms","author":"Xiao"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/34\/10061515\/09847083.pdf?arnumber=9847083","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,6,25]],"date-time":"2024-06-25T19:53:09Z","timestamp":1719345189000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9847083\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,4,1]]},"references-count":50,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2022.3195616","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"value":"0162-8828","type":"print"},{"value":"2160-9292","type":"electronic"},{"value":"1939-3539","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,4,1]]}}}