[20] Y. Dong, F. Liao, T. Pang, X. Hu, and J. Zhu, "Discovering adversarial examples with momentum," arXiv preprint arXiv:1710.06081, vol. 5, 2017.
[21] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” CoRR, vol. abs/1412.6572, 2014.
[22] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, "Intriguing properties of neural networks," arXiv preprint arXiv:1312.6199, 2013.
[23] Y. Li and C. Xu, "Trade-off between robustness and accuracy of vision transformers," in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 7558-7568.
[24] M. Dong, Y. Li, Y. Wang, and C. Xu, "Adversarily robust neural architectures," arXiv preprint arXiv:2009.00902, 2020.
[25] Z. Cheng, Y. Li, M. Dong, X. Su, S. You, and C. Xu, "Neural architecture search for wide spectrum adversarial robustness," in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 1, 2023, pp. 442-451.
[26] M. Dong, Y. Wang, X. Chen, and C. Xu, "Towards stable and robust addernets," Advances in Neural Information Processing Systems, vol. 34, pp. 13255-13265, 2021.
[27] S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, “Deepfool: a simple and accurate method to fool deep neural networks,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 2574–2582.
[28] N. Carlini and D. Wagner, "Towards evaluating the robustness of neural networks," in 2017 IEEE symposium on security and privacy (sp). IEEE, 2017, pp. 39-57.
[29] I. M. Alabdulmohsin, X. Gao, and X. Zhang, "Adding robustness to support vector machines against adversarial reverse engineering," in Proceedings of the 23rd ACM International Conference on Conference on Information and Knowledge Management, ser. CIKM '14. New York, NY, USA: Association for Computing Machinery, 2014, p. 231-240. [Online]. Available: https://doi.org/10.1145/2661829.2662047
[30] V. Chandrasekaran, K. Chaudhuri, I. Giacomelli, S. Jha, and S. Yan, “Exploring connections between active learning and model extraction,” in 29th USENIX Security Symposium (USENIX Security 20), 2020, pp. 1309–1326.
[31] T. Orekondy, B. Schiele, and M. Fritz, "Prediction poisoning: Towards defenses against dnn model stealing attacks," arXiv preprint arXiv:1906.10908, 2019.
[32] S. Liu, K. Wang, X. Yang, J. Ye, and X. Wang, "Dataset distillation via factorization," in Advances in Neural Information Processing Systems, 2022.
[33] M. Dong and C. Xu, "Adversarial robustness via random projection filters," in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 4077-4086.
[34] C. Dwork and A. Roth, 2014.
[35] M. Dredze, K. Crammer, and F. Pereira, “Confidence-weighted linear classification,” in Proceedings of the 25th international conference on Machine learning, 2008, pp. 264–271.
[36] D. P. Kingma and M. Welling, "Auto-encoding variational bayes," arXiv preprint arXiv:1312.6114, 2013.
[37] L. Rice, E. Wong, and Z. Kolter, “Overfitting in adversarially robust deep learning,” in International Conference on Machine Learning. PMLR, 2020, pp. 8093–8104.
[38] A. Krizhevsky, "Learning multiple layers of features from tiny images," University of Toronto, 05 2012.
[39] K. He, X. Zhang, S. Ren, and J. Sun, "Deep residual learning for image recognition," in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770-778.
[40] A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga et al., "Pytorch: An imperative style, high-performance deep learning library," Advances in neural information processing systems, vol. 32, 2019.
[41] H. Kim, "Torchattacks: A pytorch repository for adversarial attacks," arXiv preprint arXiv:2010.01950, 2020.