{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,7]],"date-time":"2026-10-07T22:45:50Z","timestamp":1791413150238,"version":"4.3.3"},"reference-count":132,"publisher":"Association for Computing Machinery (ACM)","issue":"6","license":[{"start":{"date-parts":[[2025,2,10]],"date-time":"2025-02-10T00:00:00Z","timestamp":1739145600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/100011937","name":"Lower Saxony Ministry of Science and Culture","doi-asserted-by":"crossref","award":["ZN3492"],"award-info":[{"award-number":["ZN3492"]}],"id":[{"id":"10.13039\/100011937","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Lower Saxony \u201cVorab\u201d of the Volkswagen Foundation and supported by the Center for Digital Innovations"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2025,6,30]]},"abstract":"<jats:p>We survey the adversarial robustness of neural networks from the perspective of Lipschitz calculus in a unifying fashion by expressing models, attacks and safety guarantees\u2014that is, a notion of measurable trustworthiness\u2014in a mathematical language. After an intuitive motivation, we discuss algorithms to estimate a network\u2019s Lipschitz constant, Lipschitz regularisation techniques, robustness guarantees, and the connection between a model\u2019s Lipschitz constant and its generalisation capabilities. Afterwards, we present a new vantage point regarding minimal Lipschitz extensions, corroborate its value empirically and discuss possible research directions. Finally, we add a toolbox containing mathematical prerequisites for navigating the field (Appendix).<\/jats:p>","DOI":"10.1145\/3648351","type":"journal-article","created":{"date-parts":[[2024,2,15]],"date-time":"2024-02-15T06:56:32Z","timestamp":1707980192000},"page":"1-41","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":27,"title":["Adversarial Robustness of Neural Networks from the Perspective of Lipschitz Calculus: A Survey"],"prefix":"10.1145","volume":"57","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-1293-3198","authenticated-orcid":false,"given":"Monty-Maximilian","family":"Z\u00fchlke","sequence":"first","affiliation":[{"name":"L3S Research Center, Hannover, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3359-3255","authenticated-orcid":false,"given":"Daniel","family":"Kudenko","sequence":"additional","affiliation":[{"name":"L3S Research Center, Hannover, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2025,2,10]]},"reference":[{"key":"e_1_3_3_2_2","doi-asserted-by":"publisher","DOI":"10.1007\/s00039-016-0354-y"},{"key":"e_1_3_3_3_2","doi-asserted-by":"crossref","unstructured":"Moustafa Alzantot Yash Sharma Bo-Jhang Ho Mani Srivastava and Kai-Wei Chang. 2018. Generating natural language adversarial examples. arXiv:1804.07998 (2018).","DOI":"10.18653\/v1\/D18-1316"},{"key":"e_1_3_3_4_2","volume-title":"Proceedings of the 2019 International Conference on Machine Learning (ICML \u201919)","author":"Anil Cem","year":"2019","unstructured":"Cem Anil, James Lucas, and Roger B. Grosse. 2019. Sorting out Lipschitz function approximation. In Proceedings of the 2019 International Conference on Machine Learning (ICML \u201919)."},{"key":"e_1_3_3_5_2","doi-asserted-by":"publisher","DOI":"10.3390\/electronics10172132"},{"key":"e_1_3_3_6_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i8.16824"},{"key":"e_1_3_3_7_2","unstructured":"Martin Arjovsky Soumith Chintala and L\u00e9on Bottou. 2017. Wasserstein generative adversarial networks. In Proceedings of the 34th International Conference on Machine Learning Doina Precup and Yee Whye Teh (Eds.). Proceedings of Machine Learning Research Vol. 70. PMLR 214\u2013223. https:\/\/proceedings.mlr.press\/v70\/arjovsky17a.html"},{"key":"e_1_3_3_8_2","doi-asserted-by":"publisher","DOI":"10.1007\/BF02591928"},{"key":"e_1_3_3_9_2","doi-asserted-by":"publisher","DOI":"10.1090\/S0273-0979-04-01035-3"},{"key":"e_1_3_3_10_2","doi-asserted-by":"publisher","DOI":"10.4064\/sm-57-2-147-190"},{"key":"e_1_3_3_11_2","unstructured":"Anish Athalye Nicholas Carlini and David A. Wagner. 2018. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In Proceedings of the 2018 International Conference on Machine Learning (ICML \u201918). 274\u2013283. http:\/\/proceedings.mlr.press\/v80\/athalye18a.html"},{"key":"e_1_3_3_12_2","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/591"},{"key":"e_1_3_3_13_2","doi-asserted-by":"publisher","DOI":"10.1090\/conm\/706\/14205"},{"key":"e_1_3_3_14_2","doi-asserted-by":"publisher","DOI":"10.5555\/3295222.3295372"},{"key":"e_1_3_3_15_2","doi-asserted-by":"publisher","DOI":"10.1137\/0708036"},{"key":"e_1_3_3_16_2","doi-asserted-by":"publisher","DOI":"10.1561\/2200000016"},{"issue":"85","key":"e_1_3_3_17_2","first-page":"2617","article-title":"Static prediction games for adversarial learning problems","volume":"13","author":"Br\u00fcckner Michael","year":"2012","unstructured":"Michael Br\u00fcckner, Christian Kanzow, and Tobias Scheffer. 2012. Static prediction games for adversarial learning problems. Journal of Machine Learning Research 13, 85 (2012), 2617\u20132654. http:\/\/jmlr.org\/papers\/v13\/brueckner12a.html","journal-title":"Journal of Machine Learning Research"},{"key":"e_1_3_3_18_2","article-title":"On evaluating adversarial robustness.","volume":"1902","author":"Carlini Nicholas","year":"2019","unstructured":"Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian J. Goodfellow, Aleksander Madry, and Alexey Kurakin. 2019. On evaluating adversarial robustness. CoRR abs\/1902.06705 (2019). http:\/\/arxiv.org\/abs\/1902.06705","journal-title":"CoRR"},{"key":"e_1_3_3_19_2","doi-asserted-by":"publisher","unstructured":"Nicholas Carlini and David Wagner. 2017. Towards evaluating the robustness of neural networks. In Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP \u201917). 39\u201357. DOI:10.1109\/SP.2017.49","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_3_20_2","volume-title":"Proceedings of the 34th International Conference on Neural Information Processing Systems (NIPS \u201920)","author":"Chen Tong","year":"2020","unstructured":"Tong Chen, Jean-Bernard Lasserre, Victor Magron, and Edouard Pauwels. 2020. Semialgebraic optimization for Lipschitz constants of ReLU networks. In Proceedings of the 34th International Conference on Neural Information Processing Systems (NIPS \u201920). Article 1610, 12 pages."},{"key":"e_1_3_3_21_2","first-page":"854","volume-title":"Proceedings of the 34th International Conference on Machine Learning\u2014Volume 70 (ICML \u201917)","author":"Cisse Moustapha","year":"2017","unstructured":"Moustapha Cisse, Piotr Bojanowski, Edouard Grave, Yann Dauphin, and Nicolas Usunier. 2017. Parseval networks: Improving robustness to adversarial examples. In Proceedings of the 34th International Conference on Machine Learning\u2014Volume 70 (ICML \u201917). 854\u2013863."},{"key":"e_1_3_3_22_2","doi-asserted-by":"publisher","DOI":"10.1090\/S0002-9947-1975-0367131-6"},{"key":"e_1_3_3_23_2","doi-asserted-by":"crossref","unstructured":"\u015e. Cobza\u015f R. Miculescu and A. Nicolae. 2019. Lipschitz Functions. Lecture Notes in Mathematics Springer International Publishing. https:\/\/books.google.de\/books?id=zshEwgEACAAJ","DOI":"10.1007\/978-3-030-16489-8"},{"key":"e_1_3_3_24_2","unstructured":"Jeremy Cohen Elan Rosenfeld and Zico Kolter. 2019. Certified adversarial robustness via randomized smoothing. In Proceedings of the 36th International Conference on Machine Learning Kamalika Chaudhuri and Ruslan Salakhutdinov (Eds.). Proceedings of Machine Learning Research Vol. 97. PMLR 1310\u20131320. https:\/\/proceedings.mlr.press\/v97\/cohen19c.html"},{"key":"e_1_3_3_25_2","doi-asserted-by":"publisher","DOI":"10.1137\/19M1272780"},{"key":"e_1_3_3_26_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10107-015-0946-6"},{"key":"e_1_3_3_27_2","doi-asserted-by":"publisher","DOI":"10.1007\/s005260000065"},{"key":"e_1_3_3_28_2","unstructured":"Zac Cranko Zhan Shi Xinhua Zhang Richard Nock and Simon Kornblith. 2021. Generalised lipschitz regularisation equals distributional robustness. In Proceedings of the 38th International Conference on Machine Learning Marina Meila and Tong Zhang (Eds.). Proceedings of Machine Learning Research Vol. 139. PMLR 2178\u20132188. https:\/\/proceedings.mlr.press\/v139\/cranko21a.html"},{"key":"e_1_3_3_29_2","volume-title":"Proceedings of the 35th Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2)","author":"Croce Francesco","year":"2021","unstructured":"Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. 2021. RobustBench: A standardized adversarial robustness benchmark. In Proceedings of the 35th Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2). https:\/\/openreview.net\/forum?id=SSKZPJCt7B"},{"key":"e_1_3_3_30_2","doi-asserted-by":"publisher","DOI":"10.1145\/1014052.1014066"},{"key":"e_1_3_3_31_2","volume-title":"Extreme Value Theory: An Introduction","author":"Haan L. de","year":"2007","unstructured":"L. de Haan and A. Ferreira. 2007. Extreme Value Theory: An Introduction. Springer New York. 2006925909https:\/\/books.google.de\/books?id=t6tfXnykazEC"},{"key":"e_1_3_3_32_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-68238-5_36"},{"key":"e_1_3_3_33_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2022.3202366"},{"key":"e_1_3_3_34_2","doi-asserted-by":"publisher","unstructured":"Yinpeng Dong Fangzhou Liao Tianyu Pang Hang Su Jun Zhu Xiaolin Hu and Jianguo Li. 2018. Boosting adversarial attacks with momentum. In Proceedings of the 2018 IEEE\/CVF Conference on Computer Vision and Pattern Recognition. 9185\u20139193. DOI:10.1109\/CVPR.2018.00957","DOI":"10.1109\/CVPR.2018.00957"},{"issue":"72","key":"e_1_3_3_35_2","first-page":"2153","article-title":"On the Nystrom method for approximating a gram matrix for improved kernel-based learning","volume":"6","author":"Drineas Petros","year":"2005","unstructured":"Petros Drineas and Michael W. Mahoney. 2005. On the Nystrom method for approximating a gram matrix for improved kernel-based learning. Journal of Machine Learning Research 6, 72 (2005), 2153\u20132175. http:\/\/jmlr.org\/papers\/v6\/drineas05a.html","journal-title":"Journal of Machine Learning Research"},{"key":"e_1_3_3_36_2","doi-asserted-by":"publisher","DOI":"10.1090\/gsm\/019"},{"key":"e_1_3_3_37_2","doi-asserted-by":"publisher","unstructured":"Kevin Eykholt Ivan Evtimov Earlence Fernandes Bo Li Amir Rahmati Chaowei Xiao Atul Prakash Tadayoshi Kohno and Dawn Song. 2018. Robust physical-world attacks on deep learning visual classification. In Proceedings of the 2018 IEEE\/CVF Conference on Computer Vision and Pattern Recognition. 1625\u20131634. DOI:10.1109\/CVPR.2018.00175","DOI":"10.1109\/CVPR.2018.00175"},{"key":"e_1_3_3_38_2","doi-asserted-by":"publisher","DOI":"10.1109\/TAC.2020.3046193"},{"key":"e_1_3_3_39_2","volume-title":"Efficient and Accurate Estimation of Lipschitz Constants for Deep Neural Networks","author":"Fazlyab Mahyar","year":"2019","unstructured":"Mahyar Fazlyab, Alexander Robey, Hamed Hassani, Manfred Morari, and George J. Pappas. 2019. Efficient and Accurate Estimation of Lipschitz Constants for Deep Neural Networks. Curran Associates, Red Hook, NY, USA."},{"key":"e_1_3_3_40_2","doi-asserted-by":"publisher","DOI":"10.1112\/jlms\/s2-7.4.604"},{"key":"e_1_3_3_41_2","unstructured":"Bolin Gao and Lacra Pavel. 2017. On the properties of the softmax function with application in game theory and reinforcement learning. arXiv:abs\/1704.00805 (2017)."},{"key":"e_1_3_3_42_2","doi-asserted-by":"publisher","DOI":"10.1137\/1.9780898717822"},{"key":"e_1_3_3_43_2","doi-asserted-by":"publisher","DOI":"10.56021\/9781421407944"},{"key":"e_1_3_3_44_2","volume-title":"Advances in Neural Information Processing Systems","author":"Goodfellow Ian","year":"2014","unstructured":"Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014. Generative adversarial nets. In Advances in Neural Information Processing Systems, Z. Ghahramani, M. Welling, C. Cortes, N. Lawrence, and K. Q. Weinberger (Eds.). Vol. 27. Curran Associates, Red Hook, NY, USA, 1\u20139.https:\/\/proceedings.neurips.cc\/paper\/2014\/file\/5ca3e9b122f61f8f06494c97b1afccf3-Paper.pdf"},{"key":"e_1_3_3_45_2","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow Ian","year":"2014","unstructured":"Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv:1412.6572 (2004).","journal-title":"arXiv:1412.6572"},{"key":"e_1_3_3_46_2","article-title":"Explaining and harnessing adversarial examples","volume":"1412","author":"Goodfellow Ian J.","year":"2015","unstructured":"Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. arXiv:CoRR abs\/1412.6572 (2015).","journal-title":"arXiv:CoRR"},{"key":"e_1_3_3_47_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-020-05929-w"},{"key":"e_1_3_3_48_2","doi-asserted-by":"publisher","DOI":"10.1145\/3593042"},{"key":"e_1_3_3_49_2","doi-asserted-by":"publisher","DOI":"10.5555\/3295222.3295327"},{"key":"e_1_3_3_50_2","doi-asserted-by":"publisher","DOI":"10.3389\/frsip.2022.794469"},{"key":"e_1_3_3_51_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jfa.2007.11.020"},{"key":"e_1_3_3_52_2","doi-asserted-by":"publisher","DOI":"10.1145\/3594869"},{"key":"e_1_3_3_53_2","doi-asserted-by":"publisher","unstructured":"Kaiming He Xiangyu Zhang Shaoqing Ren and Jian Sun. 2016. Identity mappings in deep residual networks. In Computer Vision\u2014ECCV 2016. Lecture Notes in Computer Science Vol. 9908. Springer 630\u2013645. DOI:10.1007\/978-3-319-46493-0_38","DOI":"10.1007\/978-3-319-46493-0_38"},{"key":"e_1_3_3_54_2","doi-asserted-by":"publisher","DOI":"10.5555\/3294771.3294987"},{"key":"e_1_3_3_55_2","doi-asserted-by":"publisher","DOI":"10.1007\/s00208-013-1003-5"},{"key":"e_1_3_3_56_2","volume-title":"Matrix Analysis","author":"Horn R. A.","year":"2013","unstructured":"R. A. Horn and C. R. Johnson. 2013. Matrix Analysis. Cambridge University Press. 2012012300https:\/\/books.google.de\/books?id=5I5AYeeh0JUC"},{"key":"e_1_3_3_57_2","doi-asserted-by":"publisher","DOI":"10.1016\/0893-6080(91)90009-T"},{"key":"e_1_3_3_58_2","doi-asserted-by":"publisher","DOI":"10.1016\/0893-6080(89)90020-8"},{"key":"e_1_3_3_59_2","doi-asserted-by":"publisher","DOI":"10.1145\/2046684.2046692"},{"key":"e_1_3_3_60_2","doi-asserted-by":"crossref","unstructured":"Todd P. Huster Cho-Yu Jason Chiang and Ritu Chadha. 2018. Limitations of the lipschitz constant as a defense against adversarial examples. In ECML PKDD 2018 Workshops. Lecture Notes in Computer Science Vol. 11329. Springer 16\u201329.","DOI":"10.1007\/978-3-030-13453-2_2"},{"key":"e_1_3_3_61_2","volume-title":"Proceedings of the Conference on Uncertainty in Artificial Intelligence","author":"Izmailov Pavel","year":"2018","unstructured":"Pavel Izmailov, Dmitrii Podoprikhin, T. Garipov, Dmitry P. Vetrov, and Andrew Gordon Wilson. 2018. Averaging weights leads to wider optima and better generalization. In Proceedings of the Conference on Uncertainty in Artificial Intelligence."},{"key":"e_1_3_3_62_2","doi-asserted-by":"publisher","DOI":"10.1007\/BF00386368"},{"key":"e_1_3_3_63_2","first-page":"7344","volume-title":"Advances in Neural Information Processing Systems","author":"Jordan Matt","year":"2020","unstructured":"Matt Jordan and Alexandros G. Dimakis. 2020. Exactly computing the local Lipschitz constant of relu networks. In Advances in Neural Information Processing Systems, H. Larochelle, M. Ranzato, R. Hadsell, M. F. Balcan, and H. Lin (Eds.), Vol. 33. Curran Associates, Red Hook, NY, USA, 7344\u20137353. https:\/\/proceedings.neurips.cc\/paper\/2020\/file\/5227fa9a19dce7ba113f50a405dcaf09-Paper.pdf"},{"key":"e_1_3_3_64_2","volume-title":"Proceedings of the 2021 International Conference on Machine Learning (ICML \u201921)","author":"Jordan Matt","year":"2021","unstructured":"Matt Jordan and Alexandros G. Dimakis. 2021. Provable Lipschitz certification for generative models. In Proceedings of the 2021 International Conference on Machine Learning (ICML \u201921)."},{"key":"e_1_3_3_65_2","first-page":"57","article-title":"Absolutely minimizing Lipschitz extensions on a metric space","volume":"27","author":"Juutinen Petri","year":"2002","unstructured":"Petri Juutinen. 2002. Absolutely minimizing Lipschitz extensions on a metric space. Annales Academiae Scientiarum Fennicae Mathematica Volumen 27 (2002), 57\u201367.","journal-title":"Annales Academiae Scientiarum Fennicae Mathematica Volumen"},{"key":"e_1_3_3_66_2","doi-asserted-by":"publisher","DOI":"10.5555\/3600270.3602196"},{"key":"e_1_3_3_67_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-63387-9_5"},{"key":"e_1_3_3_68_2","doi-asserted-by":"publisher","DOI":"10.4064\/fm-22-1-77-108"},{"key":"e_1_3_3_69_2","doi-asserted-by":"publisher","DOI":"10.1561\/2000000006"},{"key":"e_1_3_3_70_2","volume-title":"Proceedings of the 34th International Conference on Neural Information Processing Systems (NIPS \u201920)","author":"Krishnan Vishaal","year":"2020","unstructured":"Vishaal Krishnan, Abed AlRahman Al Makdah, and Fabio Pasqualetti. 2020. Lipschitz bounds and provably robust training by Laplacian smoothing. In Proceedings of the 34th International Conference on Neural Information Processing Systems (NIPS \u201920). Article 917, 12 pages."},{"key":"e_1_3_3_71_2","article-title":"Learning Multiple Layers of Features from Tiny Images","author":"Krizhevsky Alex","year":"2012","unstructured":"Alex Krizhevsky. 2012. Learning Multiple Layers of Features from Tiny Images. University of Toronto.","journal-title":"University of Toronto."},{"key":"e_1_3_3_72_2","volume-title":"Advances in Neural Information Processing Systems","author":"Krizhevsky Alex","year":"2012","unstructured":"Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. 2012. ImageNet classification with deep convolutional neural networks. In Advances in Neural Information Processing Systems, F. Pereira, C. J. Burges, L. Bottou, and K. Q. Weinberger (Eds.), Vol. 25. Curran Associates, Red Hook, NY, USA, 1\u20139.https:\/\/proceedings.neurips.cc\/paper\/2012\/file\/c399862d3b9d6b76c8436e924a68c45b-Paper.pdf"},{"key":"e_1_3_3_73_2","unstructured":"Alexey Kurakin Ian Goodfellow and Samy Bengio. 2016. Adversarial examples in the physical world. arXiv:1607.02533 (2016)."},{"key":"e_1_3_3_74_2","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Latorre Fabian","year":"2020","unstructured":"Fabian Latorre, Paul Rolland, and Volkan Cevher. 2020. Lipschitz constant estimation of neural networks via sparse polynomial optimization. In Proceedings of the International Conference on Learning Representations. https:\/\/openreview.net\/forum?id=rJe4_xSFDB"},{"key":"e_1_3_3_75_2","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"key":"e_1_3_3_76_2","doi-asserted-by":"publisher","DOI":"10.1090\/gsm\/181"},{"key":"e_1_3_3_77_2","unstructured":"Alexander Levine Sahil Singla and Soheil Feizi. 2019. Certifiably robust interpretation in deep learning. arXiv:1905.12105 (2019)."},{"key":"e_1_3_3_78_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485258"},{"key":"e_1_3_3_79_2","volume-title":"Preventing Gradient Attenuation in Lipschitz Constrained Convolutional Networks","author":"Li Qiyang","year":"2019","unstructured":"Qiyang Li, Saminul Haque, Cem Anil, James Lucas, Roger Grosse, and J\u00f6rn-Henrik Jacobsen. 2019. Preventing Gradient Attenuation in Lipschitz Constrained Convolutional Networks. Curran Associates, Red Hook, NY, USA."},{"key":"e_1_3_3_80_2","doi-asserted-by":"publisher","DOI":"10.1145\/3485133"},{"key":"e_1_3_3_81_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations: Conference Track (ICLR \u201918)","author":"Madry Aleksander","year":"2018","unstructured":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards deep learning models resistant to adversarial attacks. In Proceedings of the 6th International Conference on Learning Representations: Conference Track (ICLR \u201918). OpenReview.net. https:\/\/openreview.net\/forum?id=rJzIBfZAb"},{"key":"e_1_3_3_82_2","doi-asserted-by":"publisher","DOI":"10.1090\/S0002-9904-1934-05978-0"},{"key":"e_1_3_3_83_2","doi-asserted-by":"crossref","unstructured":"Facundo M\u00e9moli Guillermo Sapiro and Paul M. Thompson. 2005. Brain and surface warping via minimizing Lipschitz extensions. Preprint.","DOI":"10.21236\/ADA478383"},{"key":"e_1_3_3_84_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3179131"},{"key":"e_1_3_3_85_2","doi-asserted-by":"publisher","DOI":"10.1109\/EUVIP53989.2022.9922753"},{"issue":"95","key":"e_1_3_3_86_2","first-page":"2651","article-title":"Universal kernels","volume":"7","author":"Micchelli Charles A.","year":"2006","unstructured":"Charles A. Micchelli, Yuesheng Xu, and Haizhang Zhang. 2006. Universal kernels. Journal of Machine Learning Research 7, 95 (2006), 2651\u20132667. http:\/\/jmlr.org\/papers\/v7\/micchelli06a.html","journal-title":"Journal of Machine Learning Research"},{"key":"e_1_3_3_87_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"e_1_3_3_88_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3216291"},{"key":"e_1_3_3_89_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4612-0919-5_6"},{"key":"e_1_3_3_90_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cviu.2022.103525"},{"key":"e_1_3_3_91_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.441"},{"key":"e_1_3_3_92_2","doi-asserted-by":"publisher","DOI":"10.1090\/S0002-9939-08-09457-4"},{"key":"e_1_3_3_93_2","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"e_1_3_3_94_2","doi-asserted-by":"publisher","unstructured":"Nicolas Papernot Patrick McDaniel Xi Wu Somesh Jha and Ananthram Swami. 2016. Distillation as a defense to adversarial perturbations against deep neural networks. In Proceedings of the 2016 IEEE Symposium on Security and Privacy (SP \u201916). 582\u2013597. DOI:10.1109\/SP.2016.41","DOI":"10.1109\/SP.2016.41"},{"key":"e_1_3_3_95_2","doi-asserted-by":"publisher","DOI":"10.1145\/3433667.3433670"},{"key":"e_1_3_3_96_2","doi-asserted-by":"publisher","DOI":"10.1109\/LCSYS.2021.3050444"},{"key":"e_1_3_3_97_2","volume-title":"Advances in Neural Information Processing Systems","author":"Peck Jonathan","year":"2017","unstructured":"Jonathan Peck, Joris Roels, Bart Goossens, and Yvan Saeys. 2017. Lower bounds on the robustness to adversarial perturbations. In Advances in Neural Information Processing Systems, I. Guyon, U. Von Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett (Eds.), Vol. 30. Curran Associates, Red Hook, NY, USA, 1\u201310.https:\/\/proceedings.neurips.cc\/paper\/2017\/file\/298f95e1bf9136124592c8d4825a06fc-Paper.pdf"},{"key":"e_1_3_3_98_2","doi-asserted-by":"publisher","DOI":"10.1090\/S0894-0347-08-00606-1"},{"key":"e_1_3_3_99_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2022.108889"},{"key":"e_1_3_3_100_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jvlc.2009.01.010"},{"key":"e_1_3_3_101_2","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/368"},{"key":"e_1_3_3_102_2","doi-asserted-by":"publisher","DOI":"10.1145\/3459637.3482029"},{"key":"e_1_3_3_103_2","volume-title":"Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers","author":"Salman Hadi","year":"2019","unstructured":"Hadi Salman, Greg Yang, Jerry Li, Pengchuan Zhang, Huan Zhang, Ilya Razenshteyn, and S\u00e9bastien Bubeck. 2019. Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers. Curran Associates, Red Hook, NY, USA."},{"key":"e_1_3_3_104_2","doi-asserted-by":"publisher","unstructured":"Mark Sandler Andrew Howard Menglong Zhu Andrey Zhmoginov and Liang-Chieh Chen. 2018. MobileNetV2: Inverted residuals and linear bottlenecks. In Proceedings of the 2018 IEEE\/CVF Conference on Computer Vision and Pattern Recognition. 4510\u20134520. DOI:10.1109\/CVPR.2018.00474","DOI":"10.1109\/CVPR.2018.00474"},{"key":"e_1_3_3_105_2","first-page":"3839","volume-title":"Proceedings of the 32nd International Conference on Neural Information Processing Systems (NIPS \u201918)","author":"Scaman Kevin","year":"2018","unstructured":"Kevin Scaman and Aladin Virmaux. 2018. Lipschitz regularity of deep neural networks: Analysis and efficient estimation. In Proceedings of the 32nd International Conference on Neural Information Processing Systems (NIPS \u201918). 3839\u20133848."},{"key":"e_1_3_3_106_2","doi-asserted-by":"publisher","unstructured":"Lea Sch\u00f6nherr Katharina Kohls Steffen Zeiler Thorsten Holz and Dorothea Kolossa. 2019. Adversarial attacks against automatic speech recognition systems via psychoacoustic hiding. In Proceedings of the Network and Distributed Systems Security Symposium (NDSS \u201919). DOI:10.14722\/ndss.2019.23288","DOI":"10.14722\/ndss.2019.23288"},{"key":"e_1_3_3_107_2","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Sedghi Hanie","year":"2019","unstructured":"Hanie Sedghi, Vineet Gupta, and Philip M. Long. 2019. The singular values of convolutional layers. In Proceedings of the International Conference on Learning Representations. https:\/\/openreview.net\/forum?id=rJevYoA9Fm"},{"key":"e_1_3_3_108_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00057"},{"key":"e_1_3_3_109_2","doi-asserted-by":"publisher","DOI":"10.1002\/cpa.20391"},{"key":"e_1_3_3_110_2","article-title":"Very deep convolutional networks for large-scale image recognition","author":"Simonyan Karen","year":"2014","unstructured":"Karen Simonyan and Andrew Zisserman. 2014. Very deep convolutional networks for large-scale image recognition. arXiv:1409.1556 (2014).","journal-title":"arXiv:1409.1556"},{"key":"e_1_3_3_111_2","article-title":"Bounding singular values of convolution layers","volume":"1911","author":"Singla Sahil","year":"2019","unstructured":"Sahil Singla and Soheil Feizi. 2019. Bounding singular values of convolution layers. CoRR abs\/1911.10258 (2019). http:\/\/arxiv.org\/abs\/1911.10258","journal-title":"CoRR"},{"key":"e_1_3_3_112_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"e_1_3_3_113_2","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Szegedy Christian","year":"2014","unstructured":"Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. Intriguing properties of neural networks. In Proceedings of the International Conference on Learning Representations. http:\/\/arxiv.org\/abs\/1312.6199"},{"key":"e_1_3_3_114_2","unstructured":"Dimitris Tsipras Shibani Santurkar Logan Engstrom Alexander Turner and Aleksander Madry. 2018. There is no free lunch in adversarial robustness (but there are unexpected benefits). arXiv:abs\/1805.12152 (2018)."},{"key":"e_1_3_3_115_2","unstructured":"Dimitris Tsipras Shibani Santurkar Logan Engstrom Alexander Turner and Aleksander Madry. 2019. Robustness may be at odds with accuracy. arXiv:1805.12152 (2019)."},{"key":"e_1_3_3_116_2","first-page":"6542","volume-title":"Proceedings of the 32nd International Conference on Neural Information Processing Systems (NIPS \u201918)","author":"Tsuzuku Yusuke","year":"2018","unstructured":"Yusuke Tsuzuku, Issei Sato, and Masashi Sugiyama. 2018. Lipschitz-margin training: Scalable certification of perturbation invariance for deep neural networks. In Proceedings of the 32nd International Conference on Neural Information Processing Systems (NIPS \u201918). 6542\u20136551."},{"key":"e_1_3_3_117_2","unstructured":"Jonathan Uesato Brendan O\u2019Donoghue Aaron Oord and Pushmeet Kohli. 2018. Adversarial risk and the dangers of evaluating against weak attacks. arXiv:1802.05666 (2018)."},{"key":"e_1_3_3_118_2","doi-asserted-by":"publisher","DOI":"10.2307\/2371917"},{"key":"e_1_3_3_119_2","volume-title":"Optimal Transport: Old and New","author":"Villani C.","year":"2016","unstructured":"C. Villani. 2016. Optimal Transport: Old and New. Springer, Berlin, Germany. https:\/\/books.google.de\/books?id=5p8SDAEACAAJ"},{"key":"e_1_3_3_120_2","doi-asserted-by":"publisher","DOI":"10.1002\/zamm.19290090206"},{"key":"e_1_3_3_121_2","doi-asserted-by":"publisher","unstructured":"Chengyu Wang Jia Wang and Qiuzhen Lin. 2021. Adversarial attacks and defenses in deep learning: A survey. In Intelligent Computing Theories and Application. Lecture Notes in Computer Science Vol. 12836. Springer 450\u2013461. DOI:10.1007\/978-3-030-84522-3_37","DOI":"10.1007\/978-3-030-84522-3_37"},{"key":"e_1_3_3_122_2","unstructured":"Zekai Wang Tianyu Pang Chao Du Min Lin Weiwei Liu and Shuicheng Yan. 2023. Better diffusion models further improve adversarial training. arXiv:abs\/2302.04638 (2023)."},{"key":"e_1_3_3_123_2","volume-title":"Proceedings of the 2022 International Conference on Machine Learning (ICML \u201922)","author":"Weber Maurice","year":"2022","unstructured":"Maurice Weber, Linyi Li, Boxin Wang, Zhikuan Zhao, Bo Li, and Ce Zhang. 2022. Certifying out-of-domain generalization for blackbox functions. In Proceedings of the 2022 International Conference on Machine Learning (ICML \u201922)."},{"key":"e_1_3_3_124_2","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR \u201918)","author":"Weng Tsui-Wei","year":"2018","unstructured":"Tsui-Wei Weng, Huan Zhang, Pin-Yu Chen, Jinfeng Yi, Dong Su, Yupeng Gao, Cho-Jui Hsieh, and Luca Daniel. 2018. Evaluating the robustness of neural networks: An extreme value theory approach. In Proceedings of the International Conference on Learning Representations (ICLR \u201918)."},{"key":"e_1_3_3_125_2","doi-asserted-by":"publisher","DOI":"10.1038\/s42256-023-00661-1"},{"key":"e_1_3_3_126_2","doi-asserted-by":"publisher","DOI":"10.1090\/S0002-9947-1934-1501735-3"},{"key":"e_1_3_3_127_2","volume-title":"Advances in Neural Information Processing Systems","author":"Williams Christopher","year":"2000","unstructured":"Christopher Williams and Matthias Seeger. 2000. Using the Nystr\u00f6m method to speed up kernel machines. In Advances in Neural Information Processing Systems, T. Leen, T. Dietterich, and V. Tresp (Eds.), Vol. 13. MIT Press, 1\u20137. https:\/\/proceedings.neurips.cc\/paper\/2000\/file\/19de10adbaa1b2ee13f77f679fa1483a-Paper.pdf"},{"key":"e_1_3_3_128_2","doi-asserted-by":"publisher","DOI":"10.1007\/BF00229304"},{"key":"e_1_3_3_129_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00039"},{"key":"e_1_3_3_130_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-011-5268-1"},{"key":"e_1_3_3_131_2","first-page":"8588","volume-title":"Advances in Neural Information Processing Systems","author":"Yang Yao-Yuan","year":"2020","unstructured":"Yao-Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Russ R. Salakhutdinov, and Kamalika Chaudhuri. 2020. A closer look at accuracy vs. robustness. In Advances in Neural Information Processing Systems, H. Larochelle, M. Ranzato, R. Hadsell, M. F. Balcan, and H. Lin (Eds.), Vol. 33. Curran Associates, Red Hook, NY, USA, 8588\u20138601. https:\/\/proceedings.neurips.cc\/paper\/2020\/file\/61d77652c97ef636343742fc3dcf3ba9-Paper.pdf"},{"key":"e_1_3_3_132_2","unstructured":"Xin Zhao Zeru Zhang Zijie Zhang Lingfei Wu Jiayin Jin Yang Zhou Ruoming Jin Dejing Dou and Da Yan. 2021. Expressive 1-Lipschitz neural networks for robust multiple graph learning against adversarial attacks. In Proceedings of the 38th International Conference on Machine Learning Marina Meila and Tong Zhang (Eds.). Proceedings of Machine Learning Vol. 139. PMLR 12719\u201312735. https:\/\/proceedings.mlr.press\/v139\/zhao21e.html"},{"key":"e_1_3_3_133_2","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Zhu Zhenyu","year":"2022","unstructured":"Zhenyu Zhu, Fabian Latorre, Grigorios Chrysos, and Volkan Cevher. 2022. Controlling the complexity and Lipschitz constant improves polynomial nets. In Proceedings of the International Conference on Learning Representations. https:\/\/openreview.net\/forum?id=dQ7Cy_ndl1s"}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3648351","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3648351","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T20:04:13Z","timestamp":1750277053000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3648351"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,2,10]]},"references-count":132,"journal-issue":{"issue":"6","published-print":{"date-parts":[[2025,6,30]]}},"alternative-id":["10.1145\/3648351"],"URL":"https:\/\/doi.org\/10.1145\/3648351","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,2,10]]},"assertion":[{"value":"2022-10-21","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-01-31","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-02-10","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}