{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T23:43:56Z","timestamp":1792799036160,"version":"4.5.0"},"reference-count":185,"publisher":"Association for Computing Machinery (ACM)","issue":"8","license":[{"start":{"date-parts":[[2022,12,23]],"date-time":"2022-12-23T00:00:00Z","timestamp":1671753600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Australian Research Council, Australia","award":["DP190100981, and DP200100946"],"award-info":[{"award-number":["DP190100981, and DP200100946"]}],"id":[{"id":"https:\/\/ror.org\/05mmh0f86","id-type":"ROR","asserted-by":"crossref"}]},{"name":"NSF","award":["III-1763325, III-1909323, III-2106758, and SaTC-1930941"],"award-info":[{"award-number":["III-1763325, III-1909323, III-2106758, and SaTC-1930941"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2023,8,31]]},"abstract":"<jats:p>The outstanding performance of deep neural networks has promoted deep learning applications in a broad set of domains. However, the potential risks caused by adversarial samples have hindered the large-scale deployment of deep learning. In these scenarios, adversarial perturbations, imperceptible to human eyes, significantly decrease the model\u2019s final performance. Many papers have been published on adversarial attacks and their countermeasures in the realm of deep learning. Most focus on evasion attacks, where the adversarial examples are found at test time, as opposed to poisoning attacks where poisoned data is inserted into the training data. Further, it is difficult to evaluate the real threat of adversarial attacks or the robustness of a deep learning model, as there are no standard evaluation methods. Hence, with this article, we review the literature to date. Additionally, we attempt to offer the first analysis framework for a systematic understanding of adversarial attacks. The framework is built from the perspective of cybersecurity to provide a lifecycle for adversarial attacks and defenses.<\/jats:p>","DOI":"10.1145\/3547330","type":"journal-article","created":{"date-parts":[[2022,7,18]],"date-time":"2022-07-18T08:18:29Z","timestamp":1658132309000},"page":"1-39","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":145,"title":["Adversarial Attacks and Defenses in Deep Learning: From a Perspective of Cybersecurity"],"prefix":"10.1145","volume":"55","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7702-3417","authenticated-orcid":false,"given":"Shuai","family":"Zhou","sequence":"first","affiliation":[{"name":"University of Technology Sydney, Broadway NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6428-5514","authenticated-orcid":false,"given":"Chi","family":"Liu","sequence":"additional","affiliation":[{"name":"University of Technology Sydney, Broadway NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7561-0992","authenticated-orcid":false,"given":"Dayong","family":"Ye","sequence":"additional","affiliation":[{"name":"University of Technology Sydney, Broadway NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3411-7947","authenticated-orcid":false,"given":"Tianqing","family":"Zhu","sequence":"additional","affiliation":[{"name":"University of Technology Sydney, Broadway NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1680-2521","authenticated-orcid":false,"given":"Wanlei","family":"Zhou","sequence":"additional","affiliation":[{"name":"City University of Macau, Macau SAR, Pereira Taipa, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3491-5968","authenticated-orcid":false,"given":"Philip S.","family":"Yu","sequence":"additional","affiliation":[{"name":"University of Illinois at Chicago, Illinois, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2022,12,23]]},"reference":[{"key":"e_1_3_1_2_2","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354259"},{"key":"e_1_3_1_3_2","volume-title":"Proceedings of the 2nd International Conference on Learning Representations","author":"Szegedy Christian","year":"2014","unstructured":"Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. 2014. Intriguing properties of neural networks. In Proceedings of the 2nd International Conference on Learning Representations."},{"key":"e_1_3_1_4_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Madry Aleksander","unstructured":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards deep learning models resistant to adversarial attacks. In Proceedings of the 6th International Conference on Learning Representations."},{"key":"e_1_3_1_5_2","volume-title":"Proceedings of the 5th International Conference on Learning Representations","author":"Kurakin Alexey","unstructured":"Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. 2017. Adversarial examples in the physical world. In Proceedings of the 5th International Conference on Learning Representations."},{"key":"e_1_3_1_6_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Tsipras Dimitris","unstructured":"Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. 2019. Robustness may be at odds with accuracy. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_7_2","volume-title":"Proceedings of the 28th International Joint Conference on Artificial Intelligence","author":"Zhang Hengtong","unstructured":"Hengtong Zhang, Tianhang Zheng, Jing Gao, Chenglin Miao, Lu Su, Yaliang Li, and Kui Ren. 2019. Data poisoning attack against knowledge graph embedding. In Proceedings of the 28th International Joint Conference on Artificial Intelligence."},{"key":"e_1_3_1_8_2","volume-title":"Proceedings of the 28th International Joint Conference on Artificial Intelligence","author":"Ma Yuzhe","unstructured":"Yuzhe Ma, Xiaojin Zhu, and Justin Hsu. 2019. Data poisoning against differentially-private learners: Attacks and defenses. In Proceedings of the 28th International Joint Conference on Artificial Intelligence."},{"key":"e_1_3_1_9_2","first-page":"321","volume-title":"Proceedings of the 28th USENIX Security Symposium","author":"Demontis Ambra","unstructured":"Ambra Demontis, Marco Melis, Maura Pintor, Matthew Jagielski, Battista Biggio, Alina Oprea, Cristina Nita-Rotaru, and Fabio Roli. 2019. Why do adversarial attacks transfer? Explaining transferability of evasion and poisoning attacks. In Proceedings of the 28th USENIX Security Symposium. 321\u2013338."},{"key":"e_1_3_1_10_2","volume-title":"Artificial Intelligence Standardization White Paper","author":"Institute China Electronics Standardization","year":"2021","unstructured":"China Electronics Standardization Institute. 2021. Artificial Intelligence Standardization White Paper. Retrieved from http:\/\/www.cesi.cn\/202107\/7795.html."},{"key":"e_1_3_1_11_2","volume-title":"Information Technology - Artificial Intelligence - Artificial Intelligence Concepts and Terminology","author":"22989 ISO\/IEC","year":"2021","unstructured":"ISO\/IEC 22989. 2021. Information Technology - Artificial Intelligence - Artificial Intelligence Concepts and Terminology. Retrieved from https:\/\/www.iso.org\/obp\/ui\/#iso:std:iso-iec:22989:dis:ed-1:v1:en."},{"key":"e_1_3_1_12_2","doi-asserted-by":"publisher","DOI":"10.1049\/cit2.12028"},{"key":"e_1_3_1_13_2","doi-asserted-by":"publisher","DOI":"10.1145\/3487890"},{"key":"e_1_3_1_14_2","doi-asserted-by":"publisher","DOI":"10.1145\/3398394"},{"key":"e_1_3_1_15_2","doi-asserted-by":"publisher","DOI":"10.1145\/3485133"},{"issue":"8","key":"e_1_3_1_16_2","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3465397","article-title":"Adversarial perturbation defense on deep neural networks","volume":"54","author":"Zhang Xingwei","year":"2021","unstructured":"Xingwei Zhang, Xiaolong Zheng, and Wenji Mao. 2021. Adversarial perturbation defense on deep neural networks. ACM Comput. Surv. 54, 8 (2021), 1\u201336.","journal-title":"ACM Comput. Surv."},{"key":"e_1_3_1_17_2","doi-asserted-by":"publisher","DOI":"10.1145\/3439729"},{"key":"e_1_3_1_18_2","doi-asserted-by":"publisher","DOI":"10.1145\/3453158"},{"key":"e_1_3_1_19_2","doi-asserted-by":"publisher","DOI":"10.1126\/science.aaw4399"},{"key":"e_1_3_1_20_2","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2019.2891891"},{"key":"e_1_3_1_21_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11633-019-1211-x"},{"key":"e_1_3_1_22_2","article-title":"Security and privacy issues in deep learning","volume":"1807","author":"Bae Ho","year":"2018","unstructured":"Ho Bae, Jaehee Jang, Dahuin Jung, Hyemi Jang, Heonseok Ha, and Sungroh Yoon. 2018. Security and privacy issues in deep learning. CoRR abs\/1807.11655 (2018).","journal-title":"CoRR"},{"key":"e_1_3_1_23_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.eng.2019.12.012"},{"key":"e_1_3_1_24_2","article-title":"Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses","author":"Goldblum Micah","year":"2020","unstructured":"Micah Goldblum, Dimitris Tsipras, Chulin Xie, Xinyun Chen, Avi Schwarzschild, Dawn Song, Aleksander Madry, Bo Li, and Tom Goldstein. 2020. Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses. arXiv preprint arXiv:2012.10544 (2020).","journal-title":"arXiv preprint arXiv:2012.10544"},{"key":"e_1_3_1_25_2","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140451"},{"key":"e_1_3_1_26_2","article-title":"Generative poisoning attack method against neural networks","author":"Yang Chaofei","year":"2017","unstructured":"Chaofei Yang, Qing Wu, Hai Li, and Yiran Chen. 2017. Generative poisoning attack method against neural networks. arXiv preprint arXiv:1703.01340 (2017).","journal-title":"arXiv preprint arXiv:1703.01340"},{"key":"e_1_3_1_27_2","first-page":"12080","article-title":"Metapoison: Practical general-purpose clean-label data poisoning","volume":"33","author":"Huang W. Ronny","year":"2020","unstructured":"W. Ronny Huang, Jonas Geiping, Liam Fowl, Gavin Taylor, and Tom Goldstein. 2020. Metapoison: Practical general-purpose clean-label data poisoning. Adv. Neural Inf. Process. Syst. 33 (2020), 12080\u201312091.","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"e_1_3_1_28_2","volume-title":"Proceedings of the 29th International Joint Conference on Artificial Intelligence","author":"Yang Xiaoyu","unstructured":"Xiaoyu Yang, Yuefei Lyu, Tian Tian, Yifei Liu, Yudong Liu, and Xi Zhang. 2020. Rumor detection on social media with graph structured adversarial learning. In Proceedings of the 29th International Joint Conference on Artificial Intelligence."},{"key":"e_1_3_1_29_2","volume-title":"Proceedings of the 28th International Joint Conference on Artificial Intelligence","author":"Wei Xingxing","unstructured":"Xingxing Wei, Siyuan Liang, Ning Chen, and Xiaochun Cao. 2019. Transferable adversarial attacks for image and video object detection. In Proceedings of the 28th International Joint Conference on Artificial Intelligence."},{"key":"e_1_3_1_30_2","volume-title":"Proceedings of the 33rd AAAI Conference on Artificial Intelligence","author":"Zhao Chenxiao","unstructured":"Chenxiao Zhao, P. Thomas Fletcher, Mixue Yu, Yaxin Peng, Guixu Zhang, and Chaomin Shen. 2019. The adversarial attack and detection under the Fisher information metric. In Proceedings of the 33rd AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_31_2","volume-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","author":"Moosavi-Dezfooli Seyed-Mohsen","unstructured":"Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. 2016. DeepFool: A simple and accurate method to fool deep neural networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition."},{"key":"e_1_3_1_32_2","volume-title":"Proceedings of the 34th AAAI Conference on Artificial Intelligence","author":"Wei Zhipeng","unstructured":"Zhipeng Wei, Jingjing Chen, Xingxing Wei, Linxi Jiang, Tat-Seng Chua, Fengfeng Zhou, and Yu-Gang Jiang. 2020. Heuristic black-box adversarial attacks on video recognition models. In Proceedings of the 34th AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_33_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Zhang Yang","unstructured":"Yang Zhang, Hassan Foroosh, Philip David, and Boqing Gong. 2019. CAMOU: Learning physical vehicle camouflages to adversarially attack detectors in the wild. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_34_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_1_35_2","volume-title":"Proceedings of the IEEE European Symposium on Security and Privacy","author":"Papernot Nicolas","unstructured":"Nicolas Papernot, Patrick D. McDaniel, Somesh Jha, Matt Fredrikson, Z. Berkay Celik, and Ananthram Swami. 2016. The limitations of deep learning in adversarial settings. In Proceedings of the IEEE European Symposium on Security and Privacy."},{"key":"e_1_3_1_36_2","volume-title":"Proceedings of the ACM SIGSAC Conference on Computer and Communications Security","author":"Cao Yulong","unstructured":"Yulong Cao, Chaowei Xiao, Benjamin Cyr, Yimeng Zhou, Won Park, Sara Rampazzi, Qi Alfred Chen, Kevin Fu, and Z. Morley Mao. 2019. Adversarial sensor attack on LiDAR-based perception in autonomous driving. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security."},{"key":"e_1_3_1_37_2","first-page":"3405","volume-title":"Proceedings of the 34th AAAI Conference on Artificial Intelligence","author":"Che Zhaohui","unstructured":"Zhaohui Che, Ali Borji, Guangtao Zhai, Suiyi Ling, Jing Li, and Patrick Le Callet. 2020. A new ensemble adversarial attack powered by long-term gradient memories. In Proceedings of the 34th AAAI Conference on Artificial Intelligence. 3405\u20133413."},{"key":"e_1_3_1_38_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Alaifari Rima","unstructured":"Rima Alaifari, Giovanni S. Alberti, and Tandri Gauksson. 2019. ADef: An iterative algorithm to construct adversarial deformations. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_39_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Brendel Wieland","unstructured":"Wieland Brendel, Jonas Rauber, and Matthias Bethge. 2018. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In Proceedings of the 6th International Conference on Learning Representations."},{"key":"e_1_3_1_40_2","volume-title":"Proceedings of the ACM on Asia Conference on Computer and Communications Security","author":"Papernot Nicolas","unstructured":"Nicolas Papernot, Patrick D. McDaniel, Ian J. Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami. 2017. Practical black-box attacks against machine learning. In Proceedings of the ACM on Asia Conference on Computer and Communications Security."},{"key":"e_1_3_1_41_2","article-title":"Poison frogs! Targeted clean-label poisoning attacks on neural networks","volume":"31","author":"Shafahi Ali","year":"2018","unstructured":"Ali Shafahi, W. Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. 2018. Poison frogs! Targeted clean-label poisoning attacks on neural networks. Adv. Neural Inf. Process. Syst. 31 (2018).","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"e_1_3_1_42_2","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen Xinyun","year":"2017","unstructured":"Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. 2017. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 (2017).","journal-title":"arXiv preprint arXiv:1712.05526"},{"key":"e_1_3_1_43_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6871"},{"key":"e_1_3_1_44_2","first-page":"1014","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Boopathy Akhilan","year":"2020","unstructured":"Akhilan Boopathy, Sijia Liu, Gaoyuan Zhang, Cynthia Liu, Pin-Yu Chen, Shiyu Chang, and Luca Daniel. 2020. Proper network interpretability helps adversarial robustness in classification. In Proceedings of the International Conference on Machine Learning. PMLR, 1014\u20131023."},{"key":"e_1_3_1_45_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Ding Gavin Weiguang","unstructured":"Gavin Weiguang Ding, Kry Yik Chau Lui, Xiaomeng Jin, Luyu Wang, and Ruitong Huang. 2019. On the sensitivity of adversarial robustness to input data distributions. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_46_2","volume-title":"Proceedings of the 33rd AAAI Conference on Artificial Intelligence","author":"Mahloujifar Saeed","unstructured":"Saeed Mahloujifar, Dimitrios I. Diochnos, and Mohammad Mahmoody. 2019. The curse of concentration in robust learning: Evasion and poisoning attacks from concentration of measure. In Proceedings of the 33rd AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_47_2","volume-title":"Proceedings of the 3rd International Conference on Learning Representations","author":"Goodfellow Ian J.","year":"2015","unstructured":"Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. In Proceedings of the 3rd International Conference on Learning Representations."},{"key":"e_1_3_1_48_2","first-page":"3961","volume-title":"Proceedings of the 28th International Joint Conference on Artificial Intelligence","author":"Xu Kaidi","unstructured":"Kaidi Xu, Hongge Chen, Sijia Liu, Pin-Yu Chen, Tsui-Wei Weng, Mingyi Hong, and Xue Lin. 2019. Topology attack and defense for graph neural networks: An optimization perspective. In Proceedings of the 28th International Joint Conference on Artificial Intelligence. 3961\u20133967."},{"key":"e_1_3_1_49_2","first-page":"86","volume-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","author":"Moosavi-Dezfooli Seyed-Mohsen","unstructured":"Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. 2017. Universal adversarial perturbations. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. 86\u201394."},{"key":"e_1_3_1_50_2","volume-title":"Proceedings of the 34th AAAI Conference on Artificial Intelligence","author":"Chang Heng","unstructured":"Heng Chang, Yu Rong, Tingyang Xu, Wenbing Huang, Honglei Zhang, Peng Cui, Wenwu Zhu, and Junzhou Huang. 2020. A restricted black-box adversarial framework towards attacking graph embedding models. In Proceedings of the 34th AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_51_2","volume-title":"Proceedings of the 12th USENIX Workshop on Offensive Technologies","author":"Song Dawn","unstructured":"Dawn Song, Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Florian Tram\u00e8r, Atul Prakash, and Tadayoshi Kohno. 2018. Physical adversarial examples for object detectors. In Proceedings of the 12th USENIX Workshop on Offensive Technologies."},{"key":"e_1_3_1_52_2","first-page":"5334","volume-title":"Proceedings of the 28th International Joint Conference on Artificial Intelligence","author":"Yakura Hiromu","unstructured":"Hiromu Yakura and Jun Sakuma. 2019. Robust audio adversarial example for a physical attack. In Proceedings of the 28th International Joint Conference on Artificial Intelligence. 5334\u20135341."},{"key":"e_1_3_1_53_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Xu Kaidi","unstructured":"Kaidi Xu, Sijia Liu, Pu Zhao, Pin-Yu Chen, Huan Zhang, Quanfu Fan, Deniz Erdogmus, Yanzhi Wang, and Xue Lin. 2019. Structured adversarial attack: Towards general implementation and better interpretability. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_54_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Xiao Chaowei","unstructured":"Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. 2018. Spatially transformed adversarial examples. In Proceedings of the 6th International Conference on Learning Representations."},{"key":"e_1_3_1_55_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Liu Hsueh-Ti Derek","unstructured":"Hsueh-Ti Derek Liu, Michael Tao, Chun-Liang Li, Derek Nowrouzezahrai, and Alec Jacobson. 2019. Beyond pixel norm-balls: Parametric adversaries using an analytically differentiable renderer. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_56_2","volume-title":"Proceedings of the Annual Conference on Neural Information Processing Systems","author":"Ilyas Andrew","year":"2019","unstructured":"Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. 2019. Adversarial examples are not bugs, they are features. In Proceedings of the Annual Conference on Neural Information Processing Systems."},{"key":"e_1_3_1_57_2","volume-title":"Proceedings of the 32nd AAAI Conference on Artificial Intelligence","author":"Chen Pin-Yu","unstructured":"Pin-Yu Chen, Yash Sharma, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsieh. 2018. EAD: Elastic-net attacks to deep neural networks via adversarial examples. In Proceedings of the 32nd AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_58_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Zhang Huan","unstructured":"Huan Zhang, Hongge Chen, Zhao Song, Duane S. Boning, Inderjit S. Dhillon, and Cho-Jui Hsieh. 2019. The limitations of adversarial training and the blind-spot attack. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_59_2","first-page":"9185","volume-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","author":"Dong Yinpeng","unstructured":"Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. 2018. Boosting adversarial attacks with momentum. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. 9185\u20139193."},{"key":"e_1_3_1_60_2","volume-title":"Proceedings of the 34th AAAI Conference on Artificial Intelligence","author":"Chen Jinghui","unstructured":"Jinghui Chen, Dongruo Zhou, Jinfeng Yi, and Quanquan Gu. 2020. A Frank-Wolfe framework for efficient and effective adversarial attacks. In Proceedings of the 34th AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_61_2","volume-title":"Proceedings of the 33rd AAAI Conference on Artificial Intelligence","author":"Zheng Tianhang","unstructured":"Tianhang Zheng, Changyou Chen, and Kui Ren. 2019. Distributionally adversarial attack. In Proceedings of the 33rd AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_62_2","first-page":"2206","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Croce Francesco","year":"2020","unstructured":"Francesco Croce and Matthias Hein. 2020. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In Proceedings of the International Conference on Machine Learning. PMLR, 2206\u20132216."},{"key":"e_1_3_1_63_2","first-page":"2201","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Croce Francesco","year":"2021","unstructured":"Francesco Croce and Matthias Hein. 2021. Mind the box: \\(l\\_1\\) -APGD for sparse adversarial attacks on image classifiers. In Proceedings of the International Conference on Machine Learning. PMLR, 2201\u20132211."},{"key":"e_1_3_1_64_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Zhao Zhengli","unstructured":"Zhengli Zhao, Dheeru Dua, and Sameer Singh. 2018. Generating natural adversarial examples. In Proceedings of the 6th International Conference on Learning Representations."},{"key":"e_1_3_1_65_2","volume-title":"Proceedings of the 27th International Joint Conference on Artificial Intelligence","author":"Xiao Chaowei","unstructured":"Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song. 2018. Generating adversarial examples with adversarial networks. In Proceedings of the 27th International Joint Conference on Artificial Intelligence."},{"key":"e_1_3_1_66_2","volume-title":"Proceedings of the 34th AAAI Conference on Artificial Intelligence","author":"Phan Huy","unstructured":"Huy Phan, Yi Xie, Siyu Liao, Jie Chen, and Bo Yuan. 2020. CAG: A real-time low-cost enhanced-robustness high-transferability content-aware adversarial attack generator. In Proceedings of the 34th AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_67_2","article-title":"UPSET and ANGRI: Breaking high performance image classifiers","author":"Sarkar Sayantan","year":"2017","unstructured":"Sayantan Sarkar, Ankan Bansal, Upal Mahbub, and Rama Chellappa. 2017. UPSET and ANGRI: Breaking high performance image classifiers. arXiv preprint arXiv:1707.01159 (2017).","journal-title":"arXiv preprint arXiv:1707.01159"},{"key":"e_1_3_1_68_2","volume-title":"Proceedings of the 34th AAAI Conference on Artificial Intelligence","author":"Shafahi Ali","unstructured":"Ali Shafahi, Mahyar Najibi, Zheng Xu, John P. Dickerson, Larry S. Davis, and Tom Goldstein. 2020. Universal adversarial training. In Proceedings of the 34th AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_69_2","first-page":"275","volume-title":"Proceedings of the ACM SIGSAC Conference on Computer and Communications Security","author":"Co Kenneth T.","unstructured":"Kenneth T. Co, Luis Mu\u00f1oz-Gonz\u00e1lez, Sixte de Maupeou, and Emil C. Lupu. 2019. Procedural noise adversarial examples for black-box attacks on deep convolutional networks. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. 275\u2013289."},{"key":"e_1_3_1_70_2","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/635"},{"key":"e_1_3_1_71_2","first-page":"3389","volume-title":"Proceedings of the 28th International Joint Conference on Artificial Intelligence","author":"Sharma Yash","unstructured":"Yash Sharma, Gavin Weiguang Ding, and Marcus A. Brubaker. 2019. On the effectiveness of low frequency perturbations. In Proceedings of the 28th International Joint Conference on Artificial Intelligence. 3389\u20133396."},{"key":"e_1_3_1_72_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00765"},{"key":"e_1_3_1_73_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00196"},{"key":"e_1_3_1_74_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00754"},{"key":"e_1_3_1_75_2","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"e_1_3_1_76_2","volume-title":"Proceedings of the 33rd AAAI Conference on Artificial Intelligence","author":"Tu Chun-Chen","unstructured":"Chun-Chen Tu, Pai-Shun Ting, Pin-Yu Chen, Sijia Liu, Huan Zhang, Jinfeng Yi, Cho-Jui Hsieh, and Shin-Ming Cheng. 2019. AutoZOOM: Autoencoder-based zeroth order optimization method for attacking black-box neural networks. In Proceedings of the 33rd AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_77_2","first-page":"2137","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Ilyas Andrew","year":"2018","unstructured":"Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. 2018. Black-box adversarial attacks with limited queries and information. In Proceedings of the International Conference on Machine Learning. PMLR, 2137\u20132146."},{"key":"e_1_3_1_78_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"e_1_3_1_79_2","article-title":"Meta-learning the search distribution of black-box random search based adversarial attacks","volume":"34","author":"Yatsura Maksym","year":"2021","unstructured":"Maksym Yatsura, Jan Metzen, and Matthias Hein. 2021. Meta-learning the search distribution of black-box random search based adversarial attacks. Advances in Neural Information Processing Systems 34 (2021).","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_1_80_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Cheng Minhao","unstructured":"Minhao Cheng, Thong Le, Pin-Yu Chen, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsieh. 2019. Query-efficient hard-label black-box attack: An optimization-based approach. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_81_2","article-title":"Sign-opt: A query-efficient hard-label adversarial attack","author":"Cheng Minhao","year":"2019","unstructured":"Minhao Cheng, Simranjit Singh, Patrick Chen, Pin-Yu Chen, Sijia Liu, and Cho-Jui Hsieh. 2019. Sign-opt: A query-efficient hard-label adversarial attack. arXiv preprint arXiv:1909.10773 (2019).","journal-title":"arXiv preprint arXiv:1909.10773"},{"key":"e_1_3_1_82_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01029"},{"key":"e_1_3_1_83_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Ilyas Andrew","unstructured":"Andrew Ilyas, Logan Engstrom, and Aleksander Madry. 2019. Prior convictions: Black-box adversarial attacks with bandits and priors. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_84_2","article-title":"Simple black-box adversarial perturbations for deep networks","author":"Narodytska Nina","year":"2016","unstructured":"Nina Narodytska and Shiva Prasad Kasiviswanathan. 2016. Simple black-box adversarial perturbations for deep networks. arXiv preprint arXiv:1612.06299 (2016).","journal-title":"arXiv preprint arXiv:1612.06299"},{"key":"e_1_3_1_85_2","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"e_1_3_1_86_2","volume-title":"Proceedings of the 34th AAAI Conference on Artificial Intelligence","author":"Feng Yan","unstructured":"Yan Feng, Bin Chen, Tao Dai, and Shu-Tao Xia. 2020. Adversarial attack on deep product quantization network for image retrieval. In Proceedings of the 34th AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_87_2","volume-title":"Proceedings of the 34th AAAI Conference on Artificial Intelligence","author":"Tsai Tzungyu","unstructured":"Tzungyu Tsai, Kaichen Yang, Tsung-Yi Ho, and Yier Jin. 2020. Robust adversarial objects against deep learning models. In Proceedings of the 34th AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_88_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Khalil Elias B.","unstructured":"Elias B. Khalil, Amrita Gupta, and Bistra Dilkina. 2019. Combinatorial attacks on binarized neural networks. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_89_2","volume-title":"Proceedings of the 34th AAAI Conference on Artificial Intelligence","author":"Chhabra Anshuman","unstructured":"Anshuman Chhabra, Abhishek Roy, and Prasant Mohapatra. 2020. Suspicion-free adversarial attacks on clustering algorithms. In Proceedings of the 34th AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_90_2","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2013.120"},{"key":"e_1_3_1_91_2","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2014.2308188"},{"key":"e_1_3_1_92_2","article-title":"Adversarial attacks on neural network policies","author":"Huang Sandy","year":"2017","unstructured":"Sandy Huang, Nicolas Papernot, Ian Goodfellow, Yan Duan, and Pieter Abbeel. 2017. Adversarial attacks on neural network policies. arXiv preprint arXiv:1702.02284 (2017).","journal-title":"arXiv preprint arXiv:1702.02284"},{"key":"e_1_3_1_93_2","first-page":"1883","volume-title":"Proceedings of the 30th USENIX Security Symposium (USENIX Security\u201921)","author":"Wu Xian","year":"2021","unstructured":"Xian Wu, Wenbo Guo, Hua Wei, and Xinyu Xing. 2021. Adversarial policy training against deep reinforcement learning. In Proceedings of the 30th USENIX Security Symposium (USENIX Security\u201921). 1883\u20131900."},{"key":"e_1_3_1_94_2","article-title":"Improving black-box adversarial attacks with a transfer-based prior","volume":"32","author":"Cheng Shuyu","year":"2019","unstructured":"Shuyu Cheng, Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. 2019. Improving black-box adversarial attacks with a transfer-based prior. Adv. Neural Inf. Process. Syst. 32 (2019).","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"e_1_3_1_95_2","volume-title":"Proceedings of the 30th USENIX Security Symposium (USENIX Security\u201921)","author":"Lovisotto Giulio","year":"2021","unstructured":"Giulio Lovisotto, Henry Turner, Ivo Sluganovic, Martin Strohmeier, and Ivan Martinovic. 2021. SLAP: Improving physical adversarial examples with short-lived adversarial perturbations. In Proceedings of the 30th USENIX Security Symposium (USENIX Security\u201921)."},{"key":"e_1_3_1_96_2","volume-title":"Proceedings of the 34th AAAI Conference on Artificial Intelligence","author":"Hamdi Abdullah","unstructured":"Abdullah Hamdi, Matthias Mueller, and Bernard Ghanem. 2020. SADA: Semantic adversarial diagnostic attacks for autonomous applications. In Proceedings of the 34th AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_97_2","volume-title":"Proceedings of the 27th International Joint Conference on Artificial Intelligence","author":"Liang Bin","unstructured":"Bin Liang, Hongcheng Li, Miaoqiang Su, Pan Bian, Xirong Li, and Wenchang Shi. 2018. Deep text classification can be fooled. In Proceedings of the 27th International Joint Conference on Artificial Intelligence."},{"key":"e_1_3_1_98_2","volume-title":"Proceedings of the 28th USENIX Security Symposium","author":"Quiring Erwin","unstructured":"Erwin Quiring, Alwin Maier, and Konrad Rieck. 2019. Misleading authorship attribution of source code using adversarial learning. In Proceedings of the 28th USENIX Security Symposium."},{"key":"e_1_3_1_99_2","volume-title":"Proceedings of the 34th AAAI Conference on Artificial Intelligence","author":"Zhang Huangzhao","unstructured":"Huangzhao Zhang, Zhuo Li, Ge Li, Lei Ma, Yang Liu, and Zhi Jin. 2020. Generating adversarial examples for holding robustness of source code processing models. In Proceedings of the 34th AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_100_2","volume-title":"Proceedings of the 34th AAAI Conference on Artificial Intelligence","author":"Liu Xiaolei","unstructured":"Xiaolei Liu, Kun Wan, Yufei Ding, Xiaosong Zhang, and Qingxin Zhu. 2020. Weighted-sampling audio adversarial example attack. In Proceedings of the 34th AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_101_2","volume-title":"Proceedings of the 29th International Joint Conference on Artificial Intelligence","author":"Zhang Hongting","unstructured":"Hongting Zhang, Pan Zhou, Qiben Yan, and Xiao-Yang Liu. 2020. Generating robust audio adversarial examples with temporal dependency. In Proceedings of the 29th International Joint Conference on Artificial Intelligence."},{"key":"e_1_3_1_102_2","volume-title":"Proceedings of the 33rd AAAI Conference on Artificial Intelligence","author":"Wei Xingxing","unstructured":"Xingxing Wei, Jun Zhu, Sha Yuan, and Hang Su. 2019. Sparse adversarial perturbations for videos. In Proceedings of the 33rd AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_103_2","first-page":"4672","volume-title":"Proceedings of the 28th International Joint Conference on Artificial Intelligence","author":"Gong Yuan","unstructured":"Yuan Gong, Boyang Li, Christian Poellabauer, and Yiyu Shi. 2019. Real-time adversarial attacks. In Proceedings of the 28th International Joint Conference on Artificial Intelligence. 4672\u20134680."},{"key":"e_1_3_1_104_2","article-title":"Houdini: Fooling deep structured visual and speech recognition models with adversarial examples","volume":"30","author":"Cisse Moustapha M.","year":"2017","unstructured":"Moustapha M. Cisse, Yossi Adi, Natalia Neverova, and Joseph Keshet. 2017. Houdini: Fooling deep structured visual and speech recognition models with adversarial examples. Adv. Neural Inf. Process. Syst. 30 (2017).","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"e_1_3_1_105_2","article-title":"Speech commands: A dataset for limited-vocabulary speech recognition","volume":"1804","author":"Warden Pete","year":"2018","unstructured":"Pete Warden. 2018. Speech commands: A dataset for limited-vocabulary speech recognition. CoRR abs\/1804.03209 (2018).","journal-title":"CoRR"},{"key":"e_1_3_1_106_2","unstructured":"Tsui Wei Huan Zhang Pin Yu Chen Jinfeng Yi Dong Su Yupeng Gao Cho Jui Hsieh and Luca Daniel. 2018. Evaluating the robustness of neural networks: An extreme value theory approach. In Proceedings of the 6th International Conference on Learning Representations ."},{"key":"e_1_3_1_107_2","first-page":"5944","volume-title":"Proceedings of the 28th International Joint Conference on Artificial Intelligence","author":"Ruan Wenjie","unstructured":"Wenjie Ruan, Min Wu, Youcheng Sun, Xiaowei Huang, Daniel Kroening, and Marta Kwiatkowska. 2019. Global robustness evaluation of deep neural networks with provable guarantees for the Hamming distance. In Proceedings of the 28th International Joint Conference on Artificial Intelligence. 5944\u20135952."},{"key":"e_1_3_1_108_2","volume-title":"Proceedings of the 28th International Joint Conference on Artificial Intelligence","author":"Li Pengcheng","unstructured":"Pengcheng Li, Jinfeng Yi, Bowen Zhou, and Lijun Zhang. 2019. Improving the robustness of deep neural networks via adversarial training with triplet loss. In Proceedings of the 28th International Joint Conference on Artificial Intelligence."},{"key":"e_1_3_1_109_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Qian Haifeng","unstructured":"Haifeng Qian and Mark N. Wegman. 2019. L2-nonexpansive neural networks. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_110_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Schott Lukas","unstructured":"Lukas Schott, Jonas Rauber, Matthias Bethge, and Wieland Brendel. 2019. Towards the first adversarially robust neural network model on MNIST. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_111_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Song Yang","unstructured":"Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. 2018. PixelDefend: Leveraging generative models to understand and defend against adversarial examples. In Proceedings of the 6th International Conference on Learning Representations."},{"key":"e_1_3_1_112_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Samangouei Pouya","unstructured":"Pouya Samangouei, Maya Kabkab, and Rama Chellappa. 2018. Defense-GAN: Protecting classifiers against adversarial attacks using generative models. In Proceedings of the 6th International Conference on Learning Representations."},{"key":"e_1_3_1_113_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Guo Chuan","unstructured":"Chuan Guo, Mayank Rana, Moustapha Ciss\u00e9, and Laurens van der Maaten. 2018. Countering adversarial images using input transformations. In Proceedings of the 6th International Conference on Learning Representations."},{"key":"e_1_3_1_114_2","volume-title":"Proceedings of the 32nd AAAI Conference on Artificial Intelligence","author":"Goswami Gaurav","unstructured":"Gaurav Goswami, Nalini K. Ratha, Akshay Agarwal, Richa Singh, and Mayank Vatsa. 2018. Unravelling robustness of deep learning based face recognition against adversarial attacks. In Proceedings of the 32nd AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_115_2","first-page":"3","volume-title":"Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security","author":"Carlini Nicholas","unstructured":"Nicholas Carlini and David A. Wagner. 2017. Adversarial examples are not easily detected: Bypassing ten detection methods. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security. 3\u201314."},{"key":"e_1_3_1_116_2","article-title":"Gradient masking causes clever to overestimate adversarial perturbation size","author":"Goodfellow Ian","year":"2018","unstructured":"Ian Goodfellow. 2018. Gradient masking causes clever to overestimate adversarial perturbation size. arXiv preprint arXiv:1804.07870 (2018).","journal-title":"arXiv preprint arXiv:1804.07870"},{"key":"e_1_3_1_117_2","volume-title":"Proceedings of the 28th International Joint Conference on Artificial Intelligence","author":"Yu Fuxun","unstructured":"Fuxun Yu, Zhuwei Qin, Chenchen Liu, Liang Zhao, Yanzhi Wang, and Xiang Chen. 2019. Interpreting and evaluating neural network robustness. In Proceedings of the 28th International Joint Conference on Artificial Intelligence."},{"key":"e_1_3_1_118_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Raghunathan Aditi","unstructured":"Aditi Raghunathan, Jacob Steinhardt, and Percy Liang. 2018. Certified defenses against adversarial examples. In Proceedings of the 6th International Conference on Learning Representations."},{"key":"e_1_3_1_119_2","volume-title":"Proceedings of the 35th International Conference on Machine Learning","author":"Wong Eric","unstructured":"Eric Wong and J. Zico Kolter. 2018. Provable defenses against adversarial examples via the convex outer adversarial polytope. In Proceedings of the 35th International Conference on Machine Learning."},{"key":"e_1_3_1_120_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Sinha Aman","unstructured":"Aman Sinha, Hongseok Namkoong, and John C. Duchi. 2018. Certifying some distributional robustness with principled adversarial training. In Proceedings of the 6th International Conference on Learning Representations."},{"key":"e_1_3_1_121_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Xiao Kai Y.","unstructured":"Kai Y. Xiao, Vincent Tjeng, Nur Muhammad (Mahi) Shafiullah, and Aleksander Madry. 2019. Training for faster adversarial robustness verification via inducing ReLU stability. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_122_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Tjeng Vincent","unstructured":"Vincent Tjeng, Kai Y. Xiao, and Russ Tedrake. 2019. Evaluating robustness of neural networks with mixed integer programming. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_123_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Singh Gagandeep","unstructured":"Gagandeep Singh, Timon Gehr, Markus P\u00fcschel, and Martin T. Vechev. 2019. Boosting robustness certification of neural networks. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_124_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Buckman Jacob","unstructured":"Jacob Buckman, Aurko Roy, Colin Raffel, and Ian J. Goodfellow. 2018. Thermometer encoding: One hot way to resist adversarial examples. In Proceedings of the 6th International Conference on Learning Representations."},{"key":"e_1_3_1_125_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Liu Xuanqing","unstructured":"Xuanqing Liu, Yao Li, Chongruo Wu, and Cho-Jui Hsieh. 2019. Adv-BNN: Improved adversarial defense through robust Bayesian neural network. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_126_2","first-page":"2779","volume-title":"Proceedings of the 28th International Joint Conference on Artificial Intelligence","author":"Kumari Nupur","unstructured":"Nupur Kumari, Mayank Singh, Abhishek Sinha, Harshitha Machiraju, Balaji Krishnamurthy, and Vineeth N. Balasubramanian. 2019. Harnessing the vulnerability of latent layers in adversarially trained models. In Proceedings of the 28th International Joint Conference on Artificial Intelligence. 2779\u20132785."},{"key":"e_1_3_1_127_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Tram\u00e8r Florian","unstructured":"Florian Tram\u00e8r, Alexey Kurakin, Nicolas Papernot, Ian J. Goodfellow, Dan Boneh, and Patrick D. McDaniel. 2018. Ensemble adversarial training: Attacks and defenses. In Proceedings of the 6th International Conference on Learning Representations."},{"key":"e_1_3_1_128_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Na Taesik","unstructured":"Taesik Na, Jong Hwan Ko, and Saibal Mukhopadhyay. 2018. Cascade adversarial machine learning regularized with a unified embedding. In Proceedings of the 6th International Conference on Learning Representations."},{"key":"e_1_3_1_129_2","first-page":"3740","volume-title":"Proceedings of the 27th International Joint Conference on Artificial Intelligence","author":"Cai Qi-Zhi","unstructured":"Qi-Zhi Cai, Chang Liu, and Dawn Song. 2018. Curriculum adversarial training. In Proceedings of the 27th International Joint Conference on Artificial Intelligence. 3740\u20133747."},{"key":"e_1_3_1_130_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Farnia Farzan","unstructured":"Farzan Farnia, Jesse M. Zhang, and David Tse. 2019. Generalizable adversarial training via spectral normalization. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_131_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Song Chuanbiao","unstructured":"Chuanbiao Song, Kun He, Liwei Wang, and John E. Hopcroft. 2019. Improving the generalization of adversarial training with domain adaptation. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_132_2","volume-title":"Proceedings of the IEEE Symposium on Security and Privacy","author":"Papernot Nicolas","unstructured":"Nicolas Papernot, Patrick D. McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. 2016. Distillation as a defense to adversarial perturbations against deep neural networks. In Proceedings of the IEEE Symposium on Security and Privacy."},{"key":"e_1_3_1_133_2","volume-title":"Proceedings of the 34th AAAI Conference on Artificial Intelligence","author":"Goldblum Micah","unstructured":"Micah Goldblum, Liam Fowl, Soheil Feizi, and Tom Goldstein. 2020. Adversarially robust distillation. In Proceedings of the 34th AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_134_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Neklyudov Kirill","unstructured":"Kirill Neklyudov, Dmitry Molchanov, Arsenii Ashukha, and Dmitry P. Vetrov. 2019. Variance networks: When expectation does not meet your expectations. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_135_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Jacobsen J\u00f6rn-Henrik","unstructured":"J\u00f6rn-Henrik Jacobsen, Jens Behrmann, Richard S. Zemel, and Matthias Bethge. 2019. Excessive invariance causes adversarial vulnerability. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_136_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Dhillon Guneet S.","unstructured":"Guneet S. Dhillon, Kamyar Azizzadenesheli, Zachary C. Lipton, Jeremy Bernstein, Jean Kossaifi, Aran Khanna, and Animashree Anandkumar. 2018. Stochastic activation pruning for robust adversarial defense. In Proceedings of the 6th International Conference on Learning Representations."},{"key":"e_1_3_1_137_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Xie Cihang","unstructured":"Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan L. Yuille. 2018. Mitigating adversarial effects through randomization. In Proceedings of the 6th International Conference on Learning Representations."},{"key":"e_1_3_1_138_2","volume-title":"Proceedings of the 30th USENIX Security Symposium (USENIX Security\u201921)","author":"Xiang Chong","year":"2021","unstructured":"Chong Xiang, Arjun Nitin Bhagoji, Vikash Sehwag, and Prateek Mittal. 2021. PatchGuard: A provably robust defense against adversarial patches via small receptive fields and masking. In Proceedings of the 30th USENIX Security Symposium (USENIX Security\u201921)."},{"key":"e_1_3_1_139_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Yang Zhuolin","unstructured":"Zhuolin Yang, Bo Li, Pin-Yu Chen, and Dawn Song. 2019. Characterizing audio adversarial examples using temporal dependency. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_140_2","volume-title":"Proceedings of the 30th USENIX Security Symposium (USENIX Security\u201921)","author":"Hussain Shehzeen","year":"2021","unstructured":"Shehzeen Hussain, Paarth Neekhara, Shlomo Dubnov, Julian McAuley, and Farinaz Koushanfar. 2021. WaveGuard: Understanding and mitigating audio adversarial examples. In Proceedings of the 30th USENIX Security Symposium (USENIX Security\u201921)."},{"key":"e_1_3_1_141_2","volume-title":"Proceedings of the 7th International Conference on Learning Representations","author":"Svoboda Jan","unstructured":"Jan Svoboda, Jonathan Masci, Federico Monti, Michael M. Bronstein, and Leonidas J. Guibas. 2019. PeerNets: Exploiting peer wisdom against adversarial attacks. In Proceedings of the 7th International Conference on Learning Representations."},{"key":"e_1_3_1_142_2","first-page":"4816","volume-title":"Proceedings of the 28th International Joint Conference on Artificial Intelligence","author":"Wu Huijun","unstructured":"Huijun Wu, Chen Wang, Yuriy Tyshetskiy, Andrew Docherty, Kai Lu, and Liming Zhu. 2019. Adversarial examples for graph data: Deep insights into attack and defense. In Proceedings of the 28th International Joint Conference on Artificial Intelligence. 4816\u20134823."},{"key":"e_1_3_1_143_2","volume-title":"Proceedings of the 29th International Joint Conference on Artificial Intelligence","author":"Goodge Adam","unstructured":"Adam Goodge, Bryan Hooi, See-Kiong Ng, and Wee Siong Ng. 2020. Robustness of autoencoders for anomaly detection under adversarial impact. In Proceedings of the 29th International Joint Conference on Artificial Intelligence."},{"key":"e_1_3_1_144_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2020.3017497"},{"key":"e_1_3_1_145_2","doi-asserted-by":"publisher","DOI":"10.1109\/TCYB.2019.2906574"},{"key":"e_1_3_1_146_2","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2019.2936825"},{"key":"e_1_3_1_147_2","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2020.3014246"},{"key":"e_1_3_1_148_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460771"},{"key":"e_1_3_1_149_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.3016842"},{"key":"e_1_3_1_150_2","first-page":"259","volume-title":"Proceedings of the ACM SIGSAC Conference on Computer and Communications Security","author":"Jia Jinyuan","unstructured":"Jinyuan Jia, Ahmed Salem, Michael Backes, Yang Zhang, and Neil Zhenqiang Gong. 2019. MemGuard: Defending against black-box membership inference attacks via adversarial examples. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. 259\u2013274."},{"key":"e_1_3_1_151_2","volume-title":"Proceedings of the ACM SIGSAC Conference on Computer and Communications Security","author":"Nasr Milad","unstructured":"Milad Nasr, Reza Shokri, and Amir Houmansadr. 2018. Machine learning with membership privacy using adversarial regularization. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security."},{"key":"e_1_3_1_152_2","volume-title":"Proceedings of the 34th AAAI Conference on Artificial Intelligence","author":"Yang Puyudi","unstructured":"Puyudi Yang, Jianbo Chen, Cho-Jui Hsieh, Jane-Ling Wang, and Michael I. Jordan. 2020. ML-LOO: Detecting adversarial examples with feature attribution. In Proceedings of the 34th AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_153_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"He Warren","unstructured":"Warren He, Bo Li, and Dawn Song. 2018. Decision boundary analysis of adversarial examples. In Proceedings of the 6th International Conference on Learning Representations."},{"key":"e_1_3_1_154_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Ma Xingjun","unstructured":"Xingjun Ma, Bo Li, Yisen Wang, Sarah M. Erfani, Sudanthi N. R. Wijewickrema, Grant Schoenebeck, Dawn Song, Michael E. Houle, and James Bailey. 2018. Characterizing adversarial subspaces using local intrinsic dimensionality. In Proceedings of the 6th International Conference on Learning Representations."},{"key":"e_1_3_1_155_2","volume-title":"Proceedings of the 28th International Joint Conference on Artificial Intelligence","author":"Huang Bo","unstructured":"Bo Huang, Yi Wang, and Wei Wang. 2019. Model-agnostic adversarial detection by random perturbations. In Proceedings of the 28th International Joint Conference on Artificial Intelligence."},{"key":"e_1_3_1_156_2","first-page":"876","volume-title":"Proceedings of the 29th International Joint Conference on Artificial Intelligence","author":"Cintas Celia","unstructured":"Celia Cintas, Skyler Speakman, Victor Akinwande, William Ogallo, Komminist Weldemariam, Srihari Sridharan, and Edward McFowland. 2020. Detecting adversarial attacks via subset scanning of autoencoder activations and reconstruction error. In Proceedings of the 29th International Joint Conference on Artificial Intelligence. 876\u2013882."},{"key":"e_1_3_1_157_2","volume-title":"Proceedings of the 33rd AAAI Conference on Artificial Intelligence","author":"Ghosh Partha","unstructured":"Partha Ghosh, Arpan Losalka, and Michael J. Black. 2019. Resisting adversarial attacks using Gaussian mixture variational autoencoders. In Proceedings of the 33rd AAAI Conference on Artificial Intelligence."},{"key":"e_1_3_1_158_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00871"},{"key":"e_1_3_1_159_2","article-title":"The relationship between high-dimensional geometry and adversarial examples","author":"Gilmer Justin","year":"2018","unstructured":"Justin Gilmer, Luke Metz, Fartash Faghri, Samuel S. Schoenholz, Maithra Raghu, Martin Wattenberg, and Ian Goodfellow. 2018. The relationship between high-dimensional geometry and adversarial examples. arXiv preprint arXiv:1801.02774 (2018).","journal-title":"arXiv preprint arXiv:1801.02774"},{"key":"e_1_3_1_160_2","article-title":"Are adversarial examples inevitable?","author":"Shafahi Ali","year":"2018","unstructured":"Ali Shafahi, W. Ronny Huang, Christoph Studer, Soheil Feizi, and Tom Goldstein. 2018. Are adversarial examples inevitable? arXiv preprint arXiv:1809.02104 (2018).","journal-title":"arXiv preprint arXiv:1809.02104"},{"key":"e_1_3_1_161_2","article-title":"Adversarial vulnerability for any classifier","volume":"31","author":"Fawzi Alhussein","year":"2018","unstructured":"Alhussein Fawzi, Hamza Fawzi, and Omar Fawzi. 2018. Adversarial vulnerability for any classifier. Adv. Neural Inf. Process. Syst. 31 (2018).","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"e_1_3_1_162_2","unstructured":"Ludwig Schmidt Shibani Santurkar Dimitris Tsipras Kunal Talwar and Aleksander Madry. 2018. Adversarially robust generalization requires more data. In Proceedings of the 32nd International Conference on Neural Information Processing Systems . 5019\u20135031."},{"key":"e_1_3_1_163_2","first-page":"2712","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Hendrycks Dan","year":"2019","unstructured":"Dan Hendrycks, Kimin Lee, and Mantas Mazeika. 2019. Using pre-training can improve model robustness and uncertainty. In Proceedings of the International Conference on Machine Learning. PMLR, 2712\u20132721."},{"key":"e_1_3_1_164_2","volume-title":"Proceedings of the ICML, Workshop on Deep Learning","author":"Fawzi Alhussein","year":"2015","unstructured":"Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. 2015. Fundamental limits on adversarial robustness. In Proceedings of the ICML, Workshop on Deep Learning."},{"key":"e_1_3_1_165_2","article-title":"A boundary tilting persepective on the phenomenon of adversarial examples","author":"Tanay Thomas","year":"2016","unstructured":"Thomas Tanay and Lewis Griffin. 2016. A boundary tilting persepective on the phenomenon of adversarial examples. arXiv preprint arXiv:1608.07690 (2016).","journal-title":"arXiv preprint arXiv:1608.07690"},{"key":"e_1_3_1_166_2","first-page":"831","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Bubeck S\u00e9bastien","year":"2019","unstructured":"S\u00e9bastien Bubeck, Yin Tat Lee, Eric Price, and Ilya Razenshteyn. 2019. Adversarial examples from computational constraints. In Proceedings of the International Conference on Machine Learning. PMLR, 831\u2013840."},{"key":"e_1_3_1_167_2","article-title":"Adversarial robustness may be at odds with simplicity","author":"Nakkiran Preetum","year":"2019","unstructured":"Preetum Nakkiran. 2019. Adversarial robustness may be at odds with simplicity. arXiv preprint arXiv:1901.00532 (2019).","journal-title":"arXiv preprint arXiv:1901.00532"},{"key":"e_1_3_1_168_2","article-title":"Blind pre-processing: A robust defense method against adversarial examples","author":"Rakin Adnan Siraj","year":"2018","unstructured":"Adnan Siraj Rakin, Zhezhi He, Boqing Gong, and Deliang Fan. 2018. Blind pre-processing: A robust defense method against adversarial examples. arXiv preprint arXiv:1802.01549 (2018).","journal-title":"arXiv preprint arXiv:1802.01549"},{"key":"e_1_3_1_169_2","doi-asserted-by":"publisher","DOI":"10.1109\/FOCS52979.2021.00098"},{"key":"e_1_3_1_170_2","doi-asserted-by":"crossref","unstructured":"Yann LeCun L\u00e9on Bottou Yoshua Bengio and Patrick Haffner. 1998. Gradient-based learning applied to document recognition. Proc. IEEE 86 11 (1998) 2278\u20132324.","DOI":"10.1109\/5.726791"},{"key":"e_1_3_1_171_2","article-title":"Performance evaluation of adversarial attacks: Discrepancies and solutions","author":"Wu Jing","year":"2021","unstructured":"Jing Wu, Mingyi Zhou, Ce Zhu, Yipeng Liu, Mehrtash Harandi, and Li Li. 2021. Performance evaluation of adversarial attacks: Discrepancies and solutions. arXiv preprint arXiv:2104.11103 (2021).","journal-title":"arXiv preprint arXiv:2104.11103"},{"key":"e_1_3_1_172_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_1_173_2","unstructured":"Yuval Netzer Tao Wang Adam Coates Alessandro Bissacco Bo Wu and Andrew Y. Ng. 2011. Reading digits in natural images with unsupervised feature learning. In NIPS Workshop on Deep Learning and Unsupervised Feature Learning 2011 ."},{"key":"e_1_3_1_174_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"e_1_3_1_175_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"e_1_3_1_176_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations","author":"Papernot Nicolas","year":"2018","unstructured":"Nicolas Papernot, Shuang Song, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and \u00dalfar Erlingsson. 2018. Scalable private learning with PATE. In Proceedings of the 6th International Conference on Learning Representations. OpenReview.net."},{"key":"e_1_3_1_177_2","volume-title":"Proceedings of the 35th International Conference on Machine Learning","author":"Sanyal Amartya","unstructured":"Amartya Sanyal, Matt J. Kusner, Adri\u00e0 Gasc\u00f3n, and Varun Kanade. 2018. TAPAS: Tricks to accelerate (encrypted) prediction as a service. In Proceedings of the 35th International Conference on Machine Learning."},{"key":"e_1_3_1_178_2","doi-asserted-by":"publisher","DOI":"10.1145\/3195970.3196023"},{"key":"e_1_3_1_179_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"e_1_3_1_180_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00065"},{"key":"e_1_3_1_181_2","volume-title":"Proceedings of the ACM SIGSAC Conference on Computer and Communications Security","author":"Song Liwei","unstructured":"Liwei Song, Reza Shokri, and Prateek Mittal. 2019. Privacy risks of securing machine learning models against adversarial examples. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security."},{"key":"e_1_3_1_182_2","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978355"},{"key":"e_1_3_1_183_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i13.17387"},{"key":"e_1_3_1_184_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6930"},{"key":"e_1_3_1_185_2","doi-asserted-by":"publisher","DOI":"10.1145\/2898375.2898400"},{"key":"e_1_3_1_186_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134015"}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3547330","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3547330","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3547330","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T15:02:56Z","timestamp":1750172576000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3547330"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,12,23]]},"references-count":185,"journal-issue":{"issue":"8","published-print":{"date-parts":[[2023,8,31]]}},"alternative-id":["10.1145\/3547330"],"URL":"https:\/\/doi.org\/10.1145\/3547330","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,12,23]]},"assertion":[{"value":"2021-10-10","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-07-04","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-12-23","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}