{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,9]],"date-time":"2026-10-09T01:39:23Z","timestamp":1791509963424,"version":"4.3.4"},"reference-count":200,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2021,11,23]],"date-time":"2021-11-23T00:00:00Z","timestamp":1637625600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2023,1,31]]},"abstract":"<jats:p>Deep Learning algorithms have achieved state-of-the-art performance for Image Classification. For this reason, they have been used even in security-critical applications, such as biometric recognition systems and self-driving cars. However, recent works have shown those algorithms, which can even surpass human capabilities, are vulnerable to adversarial examples. In Computer Vision, adversarial examples are images containing subtle perturbations generated by malicious optimization algorithms to fool classifiers. As an attempt to mitigate these vulnerabilities, numerous countermeasures have been proposed recently in the literature. However, devising an efficient defense mechanism has proven to be a difficult task, since many approaches demonstrated to be ineffective against adaptive attackers. Thus, this article aims to provide all readerships with a review of the latest research progress on Adversarial Machine Learning in Image Classification, nevertheless, with a defender\u2019s perspective. This article introduces novel taxonomies for categorizing adversarial attacks and defenses, as well as discuss possible reasons regarding the existence of adversarial examples. In addition, relevant guidance is also provided to assist researchers when devising and evaluating defenses. Finally, based on the reviewed literature, this article suggests some promising paths for future research.<\/jats:p>","DOI":"10.1145\/3485133","type":"journal-article","created":{"date-parts":[[2021,11,23]],"date-time":"2021-11-23T12:36:59Z","timestamp":1637671019000},"page":"1-38","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":148,"title":["Adversarial Machine Learning in Image Classification: A Survey Toward the Defender\u2019s Perspective"],"prefix":"10.1145","volume":"55","author":[{"given":"Gabriel Resende","family":"Machado","sequence":"first","affiliation":[{"name":"Military Institute of Engineering (IME), Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Eug\u00eanio","family":"Silva","sequence":"additional","affiliation":[{"name":"State University of West Zone (UEZO), Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ronaldo Ribeiro","family":"Goldschmidt","sequence":"additional","affiliation":[{"name":"Military Institute of Engineering (IME), Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2021,11,23]]},"reference":[{"key":"e_1_3_2_2_2","article-title":"Robustness to adversarial examples through an ensemble of specialists","author":"Abbasi Mahdieh","year":"2017","unstructured":"Mahdieh Abbasi and Christian Gagn\u00e9. 2017. Robustness to adversarial examples through an ensemble of specialists. Retrieved from https:\/\/arXiv:1702.06856.","journal-title":"Retrieved from https:\/\/arXiv:1702.06856"},{"key":"e_1_3_2_3_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2807385"},{"key":"e_1_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.1145\/3321707.3321749"},{"key":"e_1_3_2_5_2","article-title":"On the robustness of the cvpr 2018 white-box adversarial example defenses","author":"Athalye Anish","year":"2018","unstructured":"Anish Athalye and Nicholas Carlini. 2018. On the robustness of the cvpr 2018 white-box adversarial example defenses. Retrieved from https:\/\/arXiv:1804.03286.","journal-title":"Retrieved from https:\/\/arXiv:1804.03286"},{"key":"e_1_3_2_6_2","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","author":"Athalye Anish","year":"2018","unstructured":"Anish Athalye, Nicholas Carlini, and David Wagner. 2018. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. Retrieved from https:\/\/arXiv:1802.00420.","journal-title":"Retrieved from https:\/\/arXiv:1802.00420"},{"key":"e_1_3_2_7_2","unstructured":"Anish Athalye and Ilya Sutskever. 2017. Synthesizing robust adversarial examples. Retrieved from http:\/\/arxiv.org\/abs\/1707.07397."},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2951526"},{"key":"e_1_3_2_9_2","article-title":"Adversarial transformation networks: Learning to generate adversarial examples","author":"Baluja Shumeet","year":"2017","unstructured":"Shumeet Baluja and Ian Fischer. 2017. Adversarial transformation networks: Learning to generate adversarial examples. Retrieved from https:\/\/arXiv:1703.09387.","journal-title":"Retrieved from https:\/\/arXiv:1703.09387"},{"key":"e_1_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-010-5188-5"},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1109\/WACV48630.2021.00148"},{"key":"e_1_3_2_12_2","article-title":"Dimensionality reduction as a defense against evasion attacks on machine learning classifiers","author":"Bhagoji Arjun Nitin","year":"2017","unstructured":"Arjun Nitin Bhagoji, Daniel Cullina, and Prateek Mittal. 2017. Dimensionality reduction as a defense against evasion attacks on machine learning classifiers. Retrieved from https:\/\/arXiv:1704.02654.","journal-title":"Retrieved from https:\/\/arXiv:1704.02654"},{"key":"e_1_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"e_1_3_2_14_2","article-title":"End to end learning for self-driving cars","author":"Bojarski Mariusz","year":"2016","unstructured":"Mariusz Bojarski, Davide Del Testa, Daniel Dworakowski, Bernhard Firner, Beat Flepp, Prasoon Goyal, Lawrence D. Jackel, Mathew Monfort, Urs Muller, Jiakai Zhanget al. 2016. End to end learning for self-driving cars. Retrieved from https:\/\/arXiv:1604.07316.","journal-title":"Retrieved from https:\/\/arXiv:1604.07316"},{"key":"e_1_3_2_15_2","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","author":"Brendel Wieland","year":"2017","unstructured":"Wieland Brendel, Jonas Rauber, and Matthias Bethge. 2017. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. Retrieved from https:\/\/arXiv:1712.04248.","journal-title":"Retrieved from https:\/\/arXiv:1712.04248"},{"key":"e_1_3_2_16_2","article-title":"Adversarial patch","author":"Brown Tom B.","year":"2017","unstructured":"Tom B. Brown, Dandelion Man\u00e9, Aurko Roy, Mart\u00edn Abadi, and Justin Gilmer. 2017. Adversarial patch. Retrieved from https:\/\/arXiv:1712.09665.","journal-title":"Retrieved from https:\/\/arXiv:1712.09665"},{"key":"e_1_3_2_17_2","unstructured":"Jacob Buckman Aurko Roy Colin Raffel and Ian Goodfellow. 2018. Thermometer encoding: One hot way to resist adversarial examples. In International Conference on Learning Representations ."},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1145\/3134600.3134606"},{"key":"e_1_3_2_19_2","article-title":"On evaluating adversarial robustness","author":"Carlini Nicholas","year":"2019","unstructured":"Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, and Aleksander Madry. 2019. On evaluating adversarial robustness. Retrieved from https:\/\/arXiv:1902.06705.","journal-title":"Retrieved from https:\/\/arXiv:1902.06705"},{"key":"e_1_3_2_20_2","unstructured":"Nicholas Carlini Guy Katz Clark W. Barrett and David L. Dill. 2017. Ground-truth adversarial examples. Retrieved from http:\/\/arxiv.org\/abs\/1709.10207."},{"key":"e_1_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"e_1_3_2_22_2","article-title":"MagNet and \u201cefficient defenses against adversarial attacks\u201d are not robust to adversarial examples","author":"Carlini Nicholas","year":"2017","unstructured":"Nicholas Carlini and David Wagner. 2017. MagNet and \u201cefficient defenses against adversarial attacks\u201d are not robust to adversarial examples. Retrieved from https:\/\/arXiv:1711.08478.","journal-title":"Retrieved from https:\/\/arXiv:1711.08478"},{"key":"e_1_3_2_23_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00009"},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11042-018-5853-4"},{"key":"e_1_3_2_26_2","article-title":"Adversarial attacks and defences: A survey","author":"Chakraborty Anirban","year":"2018","unstructured":"Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopadhyay. 2018. Adversarial attacks and defences: A survey. Retrieved from https:\/\/arXiv:1810.00069.","journal-title":"Retrieved from https:\/\/arXiv:1810.00069"},{"key":"e_1_3_2_27_2","doi-asserted-by":"crossref","unstructured":"Jianbo Chen and Michael I. Jordan. 2019. HopSkipJumpAttack: A query-efficient decision-based attack. Retrieved from http:\/\/arxiv.org\/abs\/1904.02144.","DOI":"10.1109\/SP40000.2020.00045"},{"key":"e_1_3_2_28_2","article-title":"ReabsNet: Detecting and revising adversarial examples","author":"Chen Jiefeng","year":"2017","unstructured":"Jiefeng Chen, Zihang Meng, Changtian Sun, Wei Tang, and Yinglun Zhu. 2017. ReabsNet: Detecting and revising adversarial examples. Retrieved from https:\/\/arXiv:1712.08250.","journal-title":"Retrieved from https:\/\/arXiv:1712.08250"},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.04.014"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.5555\/3504035.3504037"},{"key":"e_1_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"e_1_3_2_32_2","first-page":"52","volume-title":"Proceedings of the Joint European Conference on Machine Learning and Knowledge Discovery in Databases","author":"Chen Shang-Tse","year":"2018","unstructured":"Shang-Tse Chen, Cory Cornelius, Jason Martin, and Duen Horng Polo Chau. 2018. Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector. In Proceedings of the Joint European Conference on Machine Learning and Knowledge Discovery in Databases. Springer, 52\u201368."},{"key":"e_1_3_2_33_2","article-title":"Houdini: Fooling deep structured prediction models","author":"Cisse Moustapha","year":"2017","unstructured":"Moustapha Cisse, Yossi Adi, Natalia Neverova, and Joseph Keshet. 2017. Houdini: Fooling deep structured prediction models. Retrieved from https:\/\/arXiv:1707.05373.","journal-title":"Retrieved from https:\/\/arXiv:1707.05373"},{"key":"e_1_3_2_34_2","doi-asserted-by":"publisher","DOI":"10.5555\/3305381.3305470"},{"key":"e_1_3_2_35_2","article-title":"Detecting adversarial samples using influence functions and nearest neighbors","author":"Cohen Gilad","year":"2019","unstructured":"Gilad Cohen, Guillermo Sapiro, and Raja Giryes. 2019. Detecting adversarial samples using influence functions and nearest neighbors. Retrieved from https:\/\/arXiv:1909.06872.","journal-title":"Retrieved from https:\/\/arXiv:1909.06872"},{"key":"e_1_3_2_36_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2013.6638293"},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.1109\/TASL.2011.2134090"},{"key":"e_1_3_2_38_2","article-title":"Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression","author":"Das Nilaksh","year":"2017","unstructured":"Nilaksh Das, Madhuri Shanbhogue, Shang-Tse Chen, Fred Hohman, Li Chen, Michael E. Kounavis, and Duen Horng Chau. 2017. Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression. Retrieved from https:\/\/arXiv:1705.02900.","journal-title":"Retrieved from https:\/\/arXiv:1705.02900"},{"key":"e_1_3_2_39_2","article-title":"Three classes of deep learning architectures and their applications: A tutorial survey","author":"Deng Li","year":"2012","unstructured":"Li Deng. 2012. Three classes of deep learning architectures and their applications: A tutorial survey. APSIPA Trans. Signal Info. Process. 3 (2012), e2. DOI:10.1017\/atsip.2013.9","journal-title":"APSIPA Trans. Signal Info. Process."},{"key":"e_1_3_2_40_2","article-title":"Stochastic activation pruning for robust adversarial defense","author":"Dhillon Guneet S.","year":"2018","unstructured":"Guneet S. Dhillon, Kamyar Azizzadenesheli, Zachary C. Lipton, Jeremy Bernstein, Jean Kossaifi, Aran Khanna, and Anima Anandkumar. 2018. Stochastic activation pruning for robust adversarial defense. Retrieved from https:\/\/arXiv:1803.01442.","journal-title":"Retrieved from https:\/\/arXiv:1803.01442"},{"key":"e_1_3_2_41_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.autcon.2017.11.002"},{"key":"e_1_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"e_1_3_2_43_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"e_1_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00897"},{"key":"e_1_3_2_45_2","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN48605.2020.9207596"},{"key":"e_1_3_2_46_2","article-title":"Hotflip: White-box adversarial examples for text classification","author":"Ebrahimi Javid","year":"2017","unstructured":"Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2017. Hotflip: White-box adversarial examples for text classification. Retrieved from https:\/\/arXiv:1712.06751.","journal-title":"Retrieved from https:\/\/arXiv:1712.06751"},{"key":"e_1_3_2_47_2","article-title":"Evaluating and understanding the robustness of adversarial logit pairing","author":"Engstrom Logan","year":"2018","unstructured":"Logan Engstrom, Andrew Ilyas, and Anish Athalye. 2018. Evaluating and understanding the robustness of adversarial logit pairing. Retrieved from https:\/\/arXiv:1807.10272.","journal-title":"Retrieved from https:\/\/arXiv:1807.10272"},{"key":"e_1_3_2_48_2","first-page":"1528","volume-title":"Proceedings of the ACM SIGSAC Conference on Computer and Communications Security","author":"Evtimov Ivan","year":"2017","unstructured":"Ivan Evtimov, Kevin Eykholt, Earlence Fernandes, Tadayoshi Kohno, Bo Li, Atul Prakash, Amir Rahmati, and Dawn Song. 2017. Robust physical-world attacks on deep learning models. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. 1528\u20131540. Retrieved from http:\/\/arxiv.org\/abs\/1707.08945."},{"key":"e_1_3_2_49_2","article-title":"Robust physical-world attacks on deep learning models","author":"Eykholt Kevin","year":"2017","unstructured":"Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. 2017. Robust physical-world attacks on deep learning models. Retrieved from https:\/\/arXiv:1707.08945.","journal-title":"Retrieved from https:\/\/arXiv:1707.08945"},{"key":"e_1_3_2_50_2","doi-asserted-by":"publisher","DOI":"10.5555\/3326943.3327052"},{"key":"e_1_3_2_51_2","volume-title":"Proceedings of the ICML Workshop on Deep Learning","author":"Fawzi Alhussein","year":"2015","unstructured":"Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. 2015. Fundamental limits on adversarial robustness. In Proceedings of the ICML Workshop on Deep Learning."},{"key":"e_1_3_2_52_2","unstructured":"Reuben Feinman Ryan R. Curtin Saurabh Shintre and Andrew B. Gardner. 2017. Detecting adversarial samples from artifacts. Retrieved from http:\/\/arxiv.org\/abs\/1703.00410."},{"key":"e_1_3_2_53_2","article-title":"Adversarial defense based on structure-to-signal autoencoders","author":"Folz Joachim","year":"2018","unstructured":"Joachim Folz, Sebastian Palacio, Joern Hees, Damian Borth, and Andreas Dengel. 2018. Adversarial defense based on structure-to-signal autoencoders. Retrieved from https:\/\/arXiv:1803.07994.","journal-title":"Retrieved from https:\/\/arXiv:1803.07994"},{"key":"e_1_3_2_54_2","article-title":"Attacking binarized neural networks","author":"Galloway Angus","year":"2017","unstructured":"Angus Galloway, Graham W. Taylor, and Medhat Moussa. 2017. Attacking binarized neural networks. Retrieved from https:\/\/arXiv:1711.00449.","journal-title":"Retrieved from https:\/\/arXiv:1711.00449"},{"key":"e_1_3_2_55_2","article-title":"Deepcloak: Masking deep neural network models for robustness against adversarial samples","author":"Gao Ji","year":"2017","unstructured":"Ji Gao, Beilun Wang, Zeming Lin, Weilin Xu, and Yanjun Qi. 2017. Deepcloak: Masking deep neural network models for robustness against adversarial samples. Retrieved from https:\/\/arXiv:1702.06763.","journal-title":"Retrieved from https:\/\/arXiv:1702.06763"},{"key":"e_1_3_2_56_2","doi-asserted-by":"publisher","DOI":"10.5555\/3153997"},{"key":"e_1_3_2_57_2","article-title":"Fooling the machine: The byzantine science of deceiving artificial intelligence","volume":"30","author":"Gershgorn Dave","year":"2016","unstructured":"Dave Gershgorn. 2016. Fooling the machine: The byzantine science of deceiving artificial intelligence. Popular Sci. 30 (Mar. 2016).","journal-title":"Popular Sci."},{"key":"e_1_3_2_58_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.3301541"},{"key":"e_1_3_2_59_2","article-title":"Adversarial spheres","author":"Gilmer Justin","year":"2018","unstructured":"Justin Gilmer, Luke Metz, Fartash Faghri, Samuel S. Schoenholz, Maithra Raghu, Martin Wattenberg, and Ian Goodfellow. 2018. Adversarial spheres. Retrieved from https:\/\/arXiv:1801.02774.","journal-title":"Retrieved from https:\/\/arXiv:1801.02774"},{"key":"e_1_3_2_60_2","article-title":"Adversarial and clean data are not twins","author":"Gong Zhitao","year":"2017","unstructured":"Zhitao Gong, Wenlu Wang, and Wei-Shinn Ku. 2017. Adversarial and clean data are not twins. Retrieved from https:\/\/arXiv:1704.04960.","journal-title":"Retrieved from https:\/\/arXiv:1704.04960"},{"key":"e_1_3_2_61_2","unstructured":"Ian Goodfellow and Nicolas Papernot. 2017. Is attacking Machine Learning easier than defending it?Retrieved from http:\/\/www.cleverhans.io\/security\/privacy\/ml\/2017\/02\/15\/why-attacking-machine-learning-is-easier-than-defending-it.html."},{"key":"e_1_3_2_62_2","doi-asserted-by":"publisher","DOI":"10.5555\/2969033.2969125"},{"key":"e_1_3_2_63_2","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Goodfellow Ian","year":"2015","unstructured":"Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. In Proceedings of the International Conference on Learning Representations. Retrieved from http:\/\/arxiv.org\/abs\/1412.6572."},{"key":"e_1_3_2_64_2","article-title":"Advbox: A toolbox to generate adversarial examples that fool neural networks","author":"Goodman Dou","year":"2020","unstructured":"Dou Goodman, Hao Xin, Wang Yang, Wu Yuesheng, Xiong Junfeng, and Zhang Huan. 2020. Advbox: A toolbox to generate adversarial examples that fool neural networks. Retrieved from https:\/\/arXiv:2001.05574.","journal-title":"Retrieved from https:\/\/arXiv:2001.05574"},{"key":"e_1_3_2_65_2","unstructured":"Kathrin Grosse Praveen Manoharan Nicolas Papernot Michael Backes and Patrick McDaniel. 2017. On the (statistical) detection of adversarial examples. Retrieved from http:\/\/arxiv.org\/abs\/1702.06280."},{"key":"e_1_3_2_66_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66399-9_4"},{"key":"e_1_3_2_67_2","unstructured":"Shixiang Gu and Luca Rigazio. 2014. Towards deep neural network architectures robust to adversarial examples. Retrieved from http:\/\/arxiv.org\/abs\/1412.5068."},{"key":"e_1_3_2_68_2","article-title":"Countering adversarial images using input transformations","author":"Guo Chuan","year":"2017","unstructured":"Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. 2017. Countering adversarial images using input transformations. Retrieved from https:\/\/arXiv:1711.00117.","journal-title":"Retrieved from https:\/\/arXiv:1711.00117"},{"key":"e_1_3_2_69_2","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00015"},{"key":"e_1_3_2_70_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_2_71_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_2_72_2","unstructured":"Warren He Bo Li and Dawn Song. 2018. Decision boundary analysis of adversarial examples. In International Conference on Learning Representations ."},{"key":"e_1_3_2_73_2","doi-asserted-by":"publisher","DOI":"10.5555\/3154768.3154783"},{"key":"e_1_3_2_74_2","doi-asserted-by":"publisher","DOI":"10.1002\/asmb.2209"},{"key":"e_1_3_2_75_2","article-title":"Early methods for detecting adversarial images","author":"Hendrycks Dan","year":"2017","unstructured":"Dan Hendrycks and Kevin Gimpel. 2017. Early methods for detecting adversarial images. In Proceedings of the 5th International Conference on Learning Representations (ICLR\u201917).","journal-title":"Proceedings of the 5th International Conference on Learning Representations (ICLR\u201917)"},{"key":"e_1_3_2_76_2","article-title":"Distilling the knowledge in a neural network","author":"Hinton Geoffrey","year":"2015","unstructured":"Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. 2015. Distilling the knowledge in a neural network. In Proceedings of the Deep Learning and Representation Learning Workshop at NIPS 2014.","journal-title":"Proceedings of the Deep Learning and Representation Learning Workshop at NIPS 2014"},{"key":"e_1_3_2_77_2","doi-asserted-by":"publisher","DOI":"10.1126\/science.1127647"},{"key":"e_1_3_2_78_2","article-title":"Squeeze-and-excitation networks","author":"Hu Jie","year":"2017","unstructured":"Jie Hu, Li Shen, and Gang Sun. 2017. Squeeze-and-excitation networks. Retrieved from https:\/\/arXiv:1709.01507.","journal-title":"Retrieved from https:\/\/arXiv:1709.01507"},{"key":"e_1_3_2_79_2","doi-asserted-by":"publisher","DOI":"10.1145\/2046684.2046692"},{"key":"e_1_3_2_80_2","article-title":"Learning with a strong adversary","author":"Huang Ruitong","year":"2015","unstructured":"Ruitong Huang, Bing Xu, Dale Schuurmans, and Csaba Szepesv\u00e1ri. 2015. Learning with a strong adversary. Retrieved from https:\/\/arXiv:1511.03034.","journal-title":"Retrieved from https:\/\/arXiv:1511.03034"},{"key":"e_1_3_2_81_2","article-title":"Adversarial robustness of stabilized neuralODEs might be from obfuscated gradients","author":"Huang Yifei","year":"2020","unstructured":"Yifei Huang, Yaodong Yu, Hongyang Zhang, Yi Ma, and Yuan Yao. 2020. Adversarial robustness of stabilized neuralODEs might be from obfuscated gradients. Retrieved from https:\/\/arXiv:2009.13145.","journal-title":"Retrieved from https:\/\/arXiv:2009.13145"},{"key":"e_1_3_2_82_2","article-title":"Black-box adversarial attacks with limited queries and information","author":"Ilyas Andrew","year":"2018","unstructured":"Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. 2018. Black-box adversarial attacks with limited queries and information. Retrieved from https:\/\/arXiv:1804.08598.","journal-title":"Retrieved from https:\/\/arXiv:1804.08598"},{"key":"e_1_3_2_83_2","article-title":"Adversarial examples are not bugs, they are features","author":"Ilyas Andrew","year":"2019","unstructured":"Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. 2019. Adversarial examples are not bugs, they are features. Retrieved from https:\/\/arXiv:1905.02175.","journal-title":"Retrieved from https:\/\/arXiv:1905.02175"},{"key":"e_1_3_2_84_2","doi-asserted-by":"crossref","unstructured":"Phillip Isola Jun-Yan Zhu Tinghui Zhou and Alexei A. Efros. 2017. Image-to-image translation with conditional adversarial networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 1125\u20131134.","DOI":"10.1109\/CVPR.2017.632"},{"key":"e_1_3_2_85_2","article-title":"VectorDefense: Vectorization as a defense to adversarial examples","author":"Kabilan Vishaal Munusamy","year":"2018","unstructured":"Vishaal Munusamy Kabilan, Brandon Morris, and Anh Nguyen. 2018. VectorDefense: Vectorization as a defense to adversarial examples. Retrieved from https:\/\/arXiv:1804.08529.","journal-title":"Retrieved from https:\/\/arXiv:1804.08529"},{"key":"e_1_3_2_86_2","article-title":"Adversarial logit pairing","author":"Kannan Harini","year":"2018","unstructured":"Harini Kannan, Alexey Kurakin, and Ian Goodfellow. 2018. Adversarial logit pairing. Retrieved from https:\/\/arXiv:1803.06373.","journal-title":"Retrieved from https:\/\/arXiv:1803.06373"},{"key":"e_1_3_2_87_2","article-title":"LaVAN: Localized and visible adversarial noise","author":"Karmon Danny","year":"2018","unstructured":"Danny Karmon, Daniel Zoran, and Yoav Goldberg. 2018. LaVAN: Localized and visible adversarial noise. Retrieved from https:\/\/arXiv:1801.02608.","journal-title":"Retrieved from https:\/\/arXiv:1801.02608"},{"key":"e_1_3_2_88_2","unstructured":"Andrej Karpathy. 2014. What I learned from competing against a ConvNet on ImageNet. Retrieved from http:\/\/karpathy.github.io\/2014\/09\/02\/what-i-learned-from-competing-against-a-convnet-on-imagenet."},{"key":"e_1_3_2_89_2","doi-asserted-by":"publisher","DOI":"10.1145\/2994577"},{"key":"e_1_3_2_90_2","article-title":"How paypal beats the bad guys with machine learning","author":"Knorr Erick","year":"2015","unstructured":"Erick Knorr. 2015. How paypal beats the bad guys with machine learning. InfoWorld (Apr. 2015). Retrieved from https:\/\/www.infoworld.com\/article\/2907877\/machine-learning\/how-paypal-reduces-fraud-with-machine-learning.html.","journal-title":"InfoWorld"},{"key":"e_1_3_2_91_2","doi-asserted-by":"publisher","DOI":"10.1145\/3065386"},{"key":"e_1_3_2_92_2","unstructured":"Atul Kumar and Sameep Mehta. 2017. A survey on resilient machine learning. Retrieved from https:\/\/arxiv.org\/ftp\/arxiv\/papers\/1707\/1707.03184.pdf."},{"key":"e_1_3_2_93_2","article-title":"Adversarial examples in the physical world","author":"Kurakin Alexey","year":"2016","unstructured":"Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2016. Adversarial examples in the physical world. Retrieved from https:\/\/arXiv:1607.02533.","journal-title":"Retrieved from https:\/\/arXiv:1607.02533"},{"key":"e_1_3_2_94_2","article-title":"Adversarial machine learning at scale","author":"Kurakin Alexey","year":"2016","unstructured":"Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2016. Adversarial machine learning at scale. Retrieved from https:\/\/arXiv:1611.01236.","journal-title":"Retrieved from https:\/\/arXiv:1611.01236"},{"key":"e_1_3_2_95_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-94042-7_11"},{"key":"e_1_3_2_96_2","unstructured":"Alex Lamb Jonathan Binas Anirudh Goyal Dmitriy Serdyuk Sandeep Subramanian Ioannis Mitliagkas and Yoshua Bengio. 2019. Fortified Networks: Improving the Robustness of Deep Networks by Modeling the Manifold of Hidden Representations. Retrieved from https:\/\/openreview.net\/forum?id=SkgVRiC9Km."},{"key":"e_1_3_2_97_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-37337-5_25"},{"key":"e_1_3_2_98_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00072"},{"key":"e_1_3_2_99_2","article-title":"Adversarial examples detection in deep networks with convolutional filter statistics","author":"Li Xin","year":"2016","unstructured":"Xin Li and Fuxin Li. 2016. Adversarial examples detection in deep networks with convolutional filter statistics. Retrieved from https:\/\/arXiv:1612.07767.","journal-title":"Retrieved from https:\/\/arXiv:1612.07767"},{"key":"e_1_3_2_100_2","doi-asserted-by":"crossref","unstructured":"Xin Li and Fuxin Li. 2016. Adversarial examples detection in deep networks with convolutional filter statistics. Retrieved from https:\/\/arxiv.org\/abs\/1612.07767.","DOI":"10.1109\/ICCV.2017.615"},{"key":"e_1_3_2_101_2","unstructured":"Bin Liang Hongcheng Li Miaoqiang Su Xirong Li Wenchang Shi and Xiaofeng Wang. 2017. Detecting adversarial examples in deep networks with adaptive noise reduction. Retrieved from http:\/\/arxiv.org\/abs\/1705.08378."},{"key":"e_1_3_2_102_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"e_1_3_2_103_2","article-title":"Defensive quantization: When efficiency meets robustness","author":"Lin Ji","year":"2019","unstructured":"Ji Lin, Chuang Gan, and Song Han. 2019. Defensive quantization: When efficiency meets robustness. Retrieved from https:\/\/arXiv:1904.08444.","journal-title":"Retrieved from https:\/\/arXiv:1904.08444"},{"key":"e_1_3_2_104_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00023"},{"key":"e_1_3_2_105_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.media.2017.07.005"},{"key":"e_1_3_2_106_2","doi-asserted-by":"publisher","DOI":"10.1145\/3219819.3220027"},{"key":"e_1_3_2_107_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2805680"},{"issue":"2016","key":"e_1_3_2_108_2","first-page":"11","article-title":"A survey of deep neural network architectures and their applications","volume":"234","author":"Liu Weibo","year":"2017","unstructured":"Weibo Liu, Zidong Wang, Xiaohui Liu, Nianyin Zeng, Yurong Liu, and Fuad E. Alsaadi. 2017. A survey of deep neural network architectures and their applications. Neurocomputing 234(Nov. 2016), 11\u201326. https:\/\/doi.org\/10.1016\/j.neucom.2016.12.038","journal-title":"Neurocomputing"},{"key":"e_1_3_2_109_2","article-title":"Towards robust neural networks via random self-ensemble","author":"Liu Xuanqing","year":"2017","unstructured":"Xuanqing Liu, Minhao Cheng, Huan Zhang, and Cho-Jui Hsieh. 2017. Towards robust neural networks via random self-ensemble. Retrieved from https:\/\/arXiv:1712.00673.","journal-title":"Retrieved from https:\/\/arXiv:1712.00673"},{"key":"e_1_3_2_110_2","article-title":"ADV-BNN: Improved adversarial defense through robust bayesian neural network","author":"Liu Xuanqing","year":"2018","unstructured":"Xuanqing Liu, Yao Li, Chongruo Wu, and Cho-Jui Hsieh. 2018. ADV-BNN: Improved adversarial defense through robust bayesian neural network. Retrieved from https:\/\/arXiv:1810.01279.","journal-title":"Retrieved from https:\/\/arXiv:1810.01279"},{"key":"e_1_3_2_111_2","article-title":"Neural SDE: Stabilizing neural ode networks with stochastic noise","author":"Liu Xuanqing","year":"2019","unstructured":"Xuanqing Liu, Si Si, Qin Cao, Sanjiv Kumar, and Cho-Jui Hsieh. 2019. Neural SDE: Stabilizing neural ode networks with stochastic noise. Retrieved from https:\/\/arXiv:1906.02355.","journal-title":"Retrieved from https:\/\/arXiv:1906.02355"},{"key":"e_1_3_2_112_2","article-title":"Delving into transferable adversarial examples and black-box attacks","author":"Liu Yanpei","year":"2016","unstructured":"Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. 2016. Delving into transferable adversarial examples and black-box attacks. Retrieved from https:\/\/arXiv:1611.02770.","journal-title":"Retrieved from https:\/\/arXiv:1611.02770"},{"key":"e_1_3_2_113_2","article-title":"Feature distillation: DNN-Oriented JPEG compression against adversarial examples","author":"Liu Zihao","year":"2018","unstructured":"Zihao Liu, Qi Liu, Tao Liu, Yanzhi Wang, and Wujie Wen. 2018. Feature distillation: DNN-Oriented JPEG compression against adversarial examples. Retrieved from https:\/\/arXiv:1803.05787.","journal-title":"Retrieved from https:\/\/arXiv:1803.05787"},{"key":"e_1_3_2_114_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.56"},{"key":"e_1_3_2_115_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23415"},{"key":"e_1_3_2_116_2","article-title":"Characterizing adversarial subspaces using local intrinsic dimensionality","author":"Ma Xingjun","year":"2018","unstructured":"Xingjun Ma, Bo Li, Yisen Wang, Sarah M. Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Dawn Song, Michael E. Houle, and James Bailey. 2018. Characterizing adversarial subspaces using local intrinsic dimensionality. Retrieved from https:\/\/arXiv:1801.02613.","journal-title":"Retrieved from https:\/\/arXiv:1801.02613"},{"key":"e_1_3_2_117_2","doi-asserted-by":"publisher","DOI":"10.5220\/0007714203070318"},{"key":"e_1_3_2_118_2","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry Aleksander","year":"2017","unstructured":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. Retrieved from https:\/\/arXiv:1706.06083.","journal-title":"Retrieved from https:\/\/arXiv:1706.06083"},{"key":"e_1_3_2_119_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33014536"},{"key":"e_1_3_2_120_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134057"},{"key":"e_1_3_2_121_2","article-title":"On detecting adversarial perturbations","author":"Metzen Jan Hendrik","year":"2017","unstructured":"Jan Hendrik Metzen, Tim Genewein, Volker Fischer, and Bastian Bischoff. 2017. On detecting adversarial perturbations. Retrieved from https:\/\/arXiv:1702.04267.","journal-title":"Retrieved from https:\/\/arXiv:1702.04267"},{"key":"e_1_3_2_122_2","first-page":"19","article-title":"Universal adversarial perturbations against semantic image segmentation","volume":"1050","author":"Metzen Jan Hendrik","year":"2017","unstructured":"Jan Hendrik Metzen, Mummadi Chaithanya Kumar, Thomas Brox, and Volker Fischer. 2017. Universal adversarial perturbations against semantic image segmentation. Stat 1050(2017), 19.","journal-title":"Stat"},{"key":"e_1_3_2_123_2","article-title":"Adversarial training methods for semi-supervised text classification","author":"Miyato Takeru","year":"2016","unstructured":"Takeru Miyato, Andrew M. Dai, and Ian Goodfellow. 2016. Adversarial training methods for semi-supervised text classification. Retrieved from https:\/\/arXiv:1605.07725.","journal-title":"Retrieved from https:\/\/arXiv:1605.07725"},{"key":"e_1_3_2_124_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"e_1_3_2_125_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"e_1_3_2_126_2","article-title":"Divide, denoise, and defend against adversarial attacks","author":"Moosavi-Dezfooli Seyed-Mohsen","year":"2018","unstructured":"Seyed-Mohsen Moosavi-Dezfooli, Ashish Shrivastava, and Oncel Tuzel. 2018. Divide, denoise, and defend against adversarial attacks. Retrieved from https:\/\/arXiv:1802.06806.","journal-title":"Retrieved from https:\/\/arXiv:1802.06806"},{"key":"e_1_3_2_127_2","unstructured":"Aamir Mustafa Salman H. Khan Munawar Hayat Jianbing Shen and Ling Shao. 2019. Image super-resolution as a defense against adversarial attacks. Retrieved from http:\/\/arxiv.org\/abs\/1901.01677."},{"key":"e_1_3_2_128_2","article-title":"Cascade adversarial machine learning regularized with a unified embedding","author":"Na Taesik","year":"2017","unstructured":"Taesik Na, Jong Hwan Ko, and Saibal Mukhopadhyay. 2017. Cascade adversarial machine learning regularized with a unified embedding. Retrieved from https:\/\/arXiv:1708.02582.","journal-title":"Retrieved from https:\/\/arXiv:1708.02582"},{"key":"e_1_3_2_129_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2017.172"},{"key":"e_1_3_2_130_2","first-page":"427","article-title":"Deep neural networks are easily fooled: High confidence predictions for unrecognizable images","author":"Nguyen Anh","year":"2015","unstructured":"Anh Nguyen, Jason Yosinski, and Jeff Clune. 2015. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition. 427\u2013436. https:\/\/doi.org\/10.1109\/CVPR.2015.7298640arXiv:1412.1897","journal-title":"Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition"},{"key":"e_1_3_2_131_2","unstructured":"Maria-Irina Nicolae Mathieu Sinn Minh Ngoc Tran Ambrish Rawat Martin Wistuba Valentina Zantedeschi Nathalie Baracaldo Bryant Chen Heiko Ludwig Ian Molloy and Ben Edwards. 2018. Adversarial robustness toolbox v0.3.0. Retrieved from https:\/\/arxiv.org\/pdf\/1807.01069."},{"key":"e_1_3_2_132_2","article-title":"Robust deep learning via reverse cross-entropy training and thresholding test","volume":"3","author":"Pang Tianyu","year":"2017","unstructured":"Tianyu Pang, Chao Du, and Jun Zhu. 2017. Robust deep learning via reverse cross-entropy training and thresholding test. 3. Retrieved from https:\/\/arXiv:1706.00633.","journal-title":"Retrieved from https:\/\/arXiv:1706.00633"},{"key":"e_1_3_2_133_2","article-title":"A marauder\u2019s map of security and privacy in machine learning","author":"Papernot Nicolas","year":"2018","unstructured":"Nicolas Papernot. 2018. A marauder\u2019s map of security and privacy in machine learning. Retrieved from https:\/\/arXiv:1811.01134.","journal-title":"Retrieved from https:\/\/arXiv:1811.01134"},{"key":"e_1_3_2_134_2","article-title":"Cleverhans v2.1.0: An adversarial machine learning library","author":"Papernot Nicolas","year":"2018","unstructured":"Nicolas Papernot, Fartash Faghri, Nicholas Carlini, Ian Goodfellow, Reuben Feinman, Alexey Kurakin, Cihang Xie, Yash Sharma, Tom Brown, Aurko Roy, Alexander Matyasko, Vahid Behzadan, Karen Hambardzumyan, Zhishuai Zhang, Yi-Lin Juang, Zhi Li, Ryan Sheatsley, Abhibhav Garg, Jonathan Uesato, Willi Gierke, Yinpeng Dong, David Berthelot, Paul Hendricks, Jonas Rauber, and Rujun Long. 2018. Cleverhans v2.1.0: An adversarial machine learning library. Retrieved from https:\/\/arXiv:1610.00768.","journal-title":"Retrieved from https:\/\/arXiv:1610.00768"},{"key":"e_1_3_2_135_2","unstructured":"Nicolas Papernot and Patrick McDaniel. 2017. Extending defensive distillation. Retrieved from http:\/\/arxiv.org\/abs\/1705.05264."},{"key":"e_1_3_2_136_2","article-title":"Deep k-nearest neighbors: Towards confident, interpretable and robust deep learning","author":"Papernot Nicolas","year":"2018","unstructured":"Nicolas Papernot and Patrick McDaniel. 2018. Deep k-nearest neighbors: Towards confident, interpretable and robust deep learning. Retrieved from https:\/\/arXiv:1803.04765.","journal-title":"Retrieved from https:\/\/arXiv:1803.04765"},{"key":"e_1_3_2_137_2","unstructured":"Nicolas Papernot Patrick Mcdaniel and Ian Goodfellow. 2016. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. Retrieved from https:\/\/arxiv.org\/pdf\/1605.07277.pdf."},{"key":"e_1_3_2_138_2","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"e_1_3_2_139_2","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"e_1_3_2_140_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"e_1_3_2_141_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00894"},{"key":"e_1_3_2_142_2","article-title":"Improving network robustness against adversarial attacks with compact convolution","author":"Ranjan Rajeev","year":"2017","unstructured":"Rajeev Ranjan, Swami Sankaranarayanan, Carlos D Castillo, and Rama Chellappa. 2017. Improving network robustness against adversarial attacks with compact convolution. Retrieved from https:\/\/arXiv:1712.00699.","journal-title":"Retrieved from https:\/\/arXiv:1712.00699"},{"key":"e_1_3_2_143_2","unstructured":"Jonas Rauber Wieland Brendel and Matthias Bethge. 2017. Foolbox: A python toolbox to benchmark the robustness of machine learning models. Retrieved from http:\/\/arxiv.org\/abs\/1707.04131."},{"key":"e_1_3_2_144_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2016.58"},{"key":"e_1_3_2_145_2","doi-asserted-by":"publisher","DOI":"10.3390\/fi10030026"},{"key":"e_1_3_2_146_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"e_1_3_2_147_2","article-title":"Defense-gan: Protecting classifiers against adversarial attacks using generative models","author":"Samangouei Pouya","year":"2018","unstructured":"Pouya Samangouei, Maya Kabkab, and Rama Chellappa. 2018. Defense-gan: Protecting classifiers against adversarial attacks using generative models. Retrieved from https:\/\/arXiv:1805.06605.","journal-title":"Retrieved from https:\/\/arXiv:1805.06605"},{"key":"e_1_3_2_148_2","article-title":"UPSET and ANGRI: Breaking high performance image classifiers","author":"Sarkar Sayantan","year":"2017","unstructured":"Sayantan Sarkar, Ankan Bansal, Upal Mahbub, and Rama Chellappa. 2017. UPSET and ANGRI: Breaking high performance image classifiers. Retrieved from https:\/\/arXiv:1707.01159.","journal-title":"Retrieved from https:\/\/arXiv:1707.01159"},{"key":"e_1_3_2_149_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2014.09.003"},{"key":"e_1_3_2_150_2","doi-asserted-by":"publisher","DOI":"10.5555\/3327345.3327409"},{"key":"e_1_3_2_151_2","unstructured":"Sailik Sengupta Tathagata Chakraborti and Subbarao Kambhampati. 2017. MTDeep: Securing deep neural nets against adversarial attacks with moving target defense. Retrieved from http:\/\/arxiv.org\/abs\/1705.07213."},{"key":"e_1_3_2_152_2","article-title":"Are adversarial examples inevitable?","author":"Shafahi Ali","year":"2018","unstructured":"Ali Shafahi, W. Ronny Huang, Christoph Studer, Soheil Feizi, and Tom Goldstein. 2018. Are adversarial examples inevitable?Retrieved from https:\/\/arXiv:1809.02104.","journal-title":"Retrieved from https:\/\/arXiv:1809.02104"},{"key":"e_1_3_2_153_2","article-title":"APE-GAN: Adversarial perturbation elimination with GAN","author":"Shen S.","year":"2017","unstructured":"S. Shen, G. Jin, K. Gao, and Y. Zhang. 2017. APE-GAN: Adversarial perturbation elimination with GAN. Retrieved from https:\/\/arXiv:1707.05474.","journal-title":"Retrieved from https:\/\/arXiv:1707.05474"},{"key":"e_1_3_2_154_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"e_1_3_2_155_2","doi-asserted-by":"publisher","DOI":"10.1126\/science.aar6404"},{"key":"e_1_3_2_156_2","doi-asserted-by":"publisher","DOI":"10.3390\/electronics8060661"},{"key":"e_1_3_2_157_2","article-title":"Very deep convolutional networks for large-scale image recognition","author":"Simonyan Karen","year":"2014","unstructured":"Karen Simonyan and Andrew Zisserman. 2014. Very deep convolutional networks for large-scale image recognition. Retrieved from https:\/\/arXiv:1409.1556.","journal-title":"Retrieved from https:\/\/arXiv:1409.1556"},{"key":"e_1_3_2_158_2","article-title":"Certifying some distributional robustness with principled adversarial training","author":"Sinha Aman","year":"2017","unstructured":"Aman Sinha, Hongseok Namkoong, and John Duchi. 2017. Certifying some distributional robustness with principled adversarial training. Retrieved from https:\/\/arXiv:1710.10571.","journal-title":"Retrieved from https:\/\/arXiv:1710.10571"},{"key":"e_1_3_2_159_2","article-title":"On the robustness of deep k-nearest neighbors","author":"Sitawarin Chawin","year":"2019","unstructured":"Chawin Sitawarin and David Wagner. 2019. On the robustness of deep k-nearest neighbors. Retrieved from https:\/\/arXiv:1903.08333.","journal-title":"Retrieved from https:\/\/arXiv:1903.08333"},{"key":"e_1_3_2_160_2","article-title":"Pixeldefend: Leveraging generative models to understand and defend against adversarial examples","author":"Song Yang","year":"2017","unstructured":"Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. 2017. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. Retrieved from https:\/\/arXiv:1710.10766.","journal-title":"Retrieved from https:\/\/arXiv:1710.10766"},{"key":"e_1_3_2_161_2","article-title":"Counterstrike: Defending deep learning architectures against adversarial samples by langevin dynamics with supervised denoising autoencoder","author":"Srinivasan Vignesh","year":"2018","unstructured":"Vignesh Srinivasan, Arturo Marban, Klaus-Robert M\u00fcller, Wojciech Samek, and Shinichi Nakajima. 2018. Counterstrike: Defending deep learning architectures against adversarial samples by langevin dynamics with supervised denoising autoencoder. Retrieved from https:\/\/arXiv:1805.12017.","journal-title":"Retrieved from https:\/\/arXiv:1805.12017"},{"key":"e_1_3_2_162_2","doi-asserted-by":"crossref","first-page":"589","DOI":"10.1007\/978-981-13-1822-1_55","volume-title":"Applications of Artificial Intelligence Techniques in Engineering","author":"Srivastava Shriansh","year":"2019","unstructured":"Shriansh Srivastava, J. Priyadarshini, Sachin Gopal, Sanchay Gupta, and Har Shobhit Dayal. 2019. Optical character recognition on bank cheques using 2D convolution neural network. In Applications of Artificial Intelligence Techniques in Engineering. Springer, 589\u2013596."},{"key":"e_1_3_2_163_2","article-title":"Ensemble methods as a defense to adversarial perturbations against deep neural networks","author":"Strauss Thilo","year":"2017","unstructured":"Thilo Strauss, Markus Hanselmann, Andrej Junginger, and Holger Ulmer. 2017. Ensemble methods as a defense to adversarial perturbations against deep neural networks. Retrieved from https:\/\/arXiv:1709.03423.","journal-title":"Retrieved from https:\/\/arXiv:1709.03423"},{"key":"e_1_3_2_164_2","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"e_1_3_2_165_2","doi-asserted-by":"crossref","unstructured":"Christian Szegedy Wei Liu Yangqing Jia Pierre Sermanet Scott Reed Dragomir Anguelov Dumitru Erhan Vincent Vanhoucke and Andrew Rabinovich. 2015. Going deeper with convolutions. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR\u201915) . 1\u20139. DOI:10.1109\/CVPR.2015.7298594","DOI":"10.1109\/CVPR.2015.7298594"},{"key":"e_1_3_2_166_2","first-page":"2818","volume-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","author":"Szegedy Christian","year":"2015","unstructured":"Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jonathon Shlens, and Zbigniew Wojna. 2015. Rethinking the inception architecture for computer vision. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. 2818\u20132826. Retrieved from http:\/\/arxiv.org\/abs\/1512.00567."},{"key":"e_1_3_2_167_2","first-page":"1","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Szegedy Christian","year":"2013","unstructured":"Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013. Intriguing properties of neural networks. In Proceedings of the International Conference on Learning Representations. 1\u201310. Retrieved from http:\/\/arxiv.org\/abs\/1312.6199."},{"key":"e_1_3_2_168_2","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2016.7727230"},{"key":"e_1_3_2_169_2","article-title":"A boundary tilting perspective on the phenomenon of adversarial examples","author":"Tanay Thomas","year":"2016","unstructured":"Thomas Tanay and Lewis Griffin. 2016. A boundary tilting perspective on the phenomenon of adversarial examples. Retrieved from https:\/\/arXiv:1608.07690.","journal-title":"Retrieved from https:\/\/arXiv:1608.07690"},{"key":"e_1_3_2_170_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2019.00012"},{"issue":"5128","key":"e_1_3_2_171_2","first-page":"1","article-title":"Exploring recurrent neural networks for on-line handwritten signature biometrics","volume":"6","author":"Tolosana Ruben","year":"2018","unstructured":"Ruben Tolosana, Ruben Vera-Rodriguez, Julian Fierrez, and Javier Ortega-Garcia. 2018. Exploring recurrent neural networks for on-line handwritten signature biometrics. IEEE Access 6, 5128\u20135138 (2018), 1\u20137.","journal-title":"IEEE Access"},{"key":"e_1_3_2_172_2","article-title":"On adaptive attacks to adversarial example defenses","author":"Tramer Florian","year":"2020","unstructured":"Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. 2020. On adaptive attacks to adversarial example defenses. Retrieved from https:\/\/arXiv:2002.08347.","journal-title":"Retrieved from https:\/\/arXiv:2002.08347"},{"key":"e_1_3_2_173_2","unstructured":"Florian Tram\u00e8r Alexey Kurakin Nicolas Papernot Dan Boneh and Patrick McDaniel. 2017. Ensemble adversarial training: Attacks and defenses. Retrieved from http:\/\/arxiv.org\/abs\/1705.07204."},{"key":"e_1_3_2_174_2","article-title":"The space of transferable adversarial examples","author":"Tram\u00e8r Florian","year":"2017","unstructured":"Florian Tram\u00e8r, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. 2017. The space of transferable adversarial examples. Retrieved from https:\/\/arXiv:1704.03453.","journal-title":"Retrieved from https:\/\/arXiv:1704.03453"},{"key":"e_1_3_2_175_2","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241142"},{"key":"e_1_3_2_176_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.3301742"},{"key":"e_1_3_2_177_2","article-title":"Adversarial risk and the dangers of evaluating against weak attacks","author":"Uesato Jonathan","year":"2018","unstructured":"Jonathan Uesato, Brendan O\u2019Donoghue, Aaron van den Oord, and Pushmeet Kohli. 2018. Adversarial risk and the dangers of evaluating against weak attacks. Retrieved from https:\/\/arXiv:1802.05666.","journal-title":"Retrieved from https:\/\/arXiv:1802.05666"},{"key":"e_1_3_2_178_2","doi-asserted-by":"publisher","DOI":"10.5555\/3276449"},{"key":"e_1_3_2_179_2","article-title":"Defending against adversarial attack towards deep neural networks via collaborative multi-task training","author":"Wang Derui","year":"2020","unstructured":"Derui Wang, Chaoran Li, Sheng Wen, Surya Nepal, and Yang Xiang. 2020. Defending against adversarial attack towards deep neural networks via collaborative multi-task training. IEEE Trans. Depend. Secure Comput. (2020), 1\u201312. DOI:10.1109\/TDSC.2020.3014390","journal-title":"IEEE Trans. Depend. Secure Comput."},{"key":"e_1_3_2_180_2","doi-asserted-by":"publisher","DOI":"10.5555\/2671225.2671241"},{"key":"e_1_3_2_181_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00673"},{"key":"e_1_3_2_182_2","article-title":"Data poisoning attacks against online learning","author":"Wang Yizhen","year":"2018","unstructured":"Yizhen Wang and Kamalika Chaudhuri. 2018. Data poisoning attacks against online learning. Retrieved from https:\/\/arXiv:1808.08994.","journal-title":"Retrieved from https:\/\/arXiv:1808.08994"},{"key":"e_1_3_2_183_2","article-title":"Adversarial examples in deep learning: Characterization and divergence","author":"Wei Wenqi","year":"2018","unstructured":"Wenqi Wei, Ling Liu, Margaret Loper, Stacey Truex, Lei Yu, Mehmet Emre Gursoy, and Yanzhao Wu. 2018. Adversarial examples in deep learning: Characterization and divergence. Retrieved from https:\/\/arXiv:1807.00051.","journal-title":"Retrieved from https:\/\/arXiv:1807.00051"},{"key":"e_1_3_2_184_2","article-title":"Adversarial examples in modern machine learning: A review","author":"Wiyatno Rey Reza","year":"2019","unstructured":"Rey Reza Wiyatno, Anqi Xu, Ousmane Dia, and Archy de Berker. 2019. Adversarial examples in modern machine learning: A review. Retrieved from https:\/\/arXiv:1911.05268.","journal-title":"Retrieved from https:\/\/arXiv:1911.05268"},{"key":"e_1_3_2_185_2","doi-asserted-by":"publisher","DOI":"10.5555\/3304222.3304312"},{"key":"e_1_3_2_186_2","article-title":"Spatially transformed adversarial examples","author":"Xiao Chaowei","year":"2018","unstructured":"Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. 2018. Spatially transformed adversarial examples. Retrieved from https:\/\/arXiv:1801.02612.","journal-title":"Retrieved from https:\/\/arXiv:1801.02612"},{"key":"e_1_3_2_187_2","unstructured":"Huang Xiao. 2017. Adversarial and Secure Machine Learning . Ph.D. Dissertation. Universit\u00e4t M\u00fcnchen. Retrieved from https:\/\/mediatum.ub.tum.de\/1335448."},{"key":"e_1_3_2_188_2","article-title":"Mitigating adversarial effects through randomization","author":"Xie Cihang","year":"2017","unstructured":"Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. 2017. Mitigating adversarial effects through randomization. Retrieved from https:\/\/arXiv:1711.01991.","journal-title":"Retrieved from https:\/\/arXiv:1711.01991"},{"key":"e_1_3_2_189_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00059"},{"key":"e_1_3_2_190_2","article-title":"NADAQ: Natural language database querying based on deep learning","author":"Xu Boyan","year":"2019","unstructured":"Boyan Xu, Ruichu Cai, Zhenjie Zhang, Xiaoyan Yang, Zhifeng Hao, Zijian Li, and Zhihao Liang. 2019. NADAQ: Natural language database querying based on deep learning. IEEE Access 7 (2019), 35012\u201335017. DOI:10.1109\/ACCESS.2019.2904720","journal-title":"IEEE Access"},{"key":"e_1_3_2_191_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"e_1_3_2_192_2","article-title":"On robustness of neural ordinary differential equations","author":"Yan Hanshu","year":"2019","unstructured":"Hanshu Yan, Jiawei Du, Vincent Y. F. Tan, and Jiashi Feng. 2019. On robustness of neural ordinary differential equations. Retrieved from https:\/\/arXiv:1910.05513.","journal-title":"Retrieved from https:\/\/arXiv:1910.05513"},{"key":"e_1_3_2_193_2","doi-asserted-by":"publisher","DOI":"10.5555\/3326943.3326982"},{"key":"e_1_3_2_194_2","article-title":"ME-Net: Towards effective adversarial robustness with matrix estimation","author":"Yang Yuzhe","year":"2019","unstructured":"Yuzhe Yang, Guo Zhang, Dina Katabi, and Zhi Xu. 2019. ME-Net: Towards effective adversarial robustness with matrix estimation. Retrieved from https:\/\/arXiv:1905.11971.","journal-title":"Retrieved from https:\/\/arXiv:1905.11971"},{"key":"e_1_3_2_195_2","article-title":"Adversarial neural network inversion via auxiliary knowledge alignment","author":"Yang Ziqi","year":"2019","unstructured":"Ziqi Yang, Ee-Chien Chang, and Zhenkai Liang. 2019. Adversarial neural network inversion via auxiliary knowledge alignment. Retrieved from https:\/\/arXiv:1902.08552.","journal-title":"Retrieved from https:\/\/arXiv:1902.08552"},{"key":"e_1_3_2_196_2","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2018.2886017"},{"key":"e_1_3_2_197_2","doi-asserted-by":"publisher","DOI":"10.1109\/SMARTCOMP.2017.7946998"},{"key":"e_1_3_2_198_2","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140449"},{"key":"e_1_3_2_199_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10590-1_53"},{"key":"e_1_3_2_200_2","doi-asserted-by":"publisher","DOI":"10.5555\/3327757.3327888"},{"key":"e_1_3_2_201_2","article-title":"Unpaired image-to-image translation using cycle-consistent adversarial networks","author":"Zhu Jun-Yan","year":"2017","unstructured":"Jun-Yan Zhu, Taesung Park, Phillip Isola, and Alexei A. Efros. 2017. Unpaired image-to-image translation using cycle-consistent adversarial networks. Retrieved from https:\/\/arXiv:1703.10593.","journal-title":"Retrieved from https:\/\/arXiv:1703.10593"}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3485133","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3485133","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T16:18:35Z","timestamp":1750177115000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3485133"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,11,23]]},"references-count":200,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2023,1,31]]}},"alternative-id":["10.1145\/3485133"],"URL":"https:\/\/doi.org\/10.1145\/3485133","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,11,23]]},"assertion":[{"value":"2020-02-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2021-08-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2021-11-23","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}