[1] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. "Intriguing properties of neural networks". In: arXiv preprint arXiv:1312.6199 (2013).
[2] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. "Explaining and harnessing adversarial examples". In: arXiv preprint arXiv:1412.6572 (2014).
[3] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. "Adversarial machine learning at scale". In: arXiv preprint arXiv:1611.01236 (2016).
[4] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. "Towards deep learning models resistant to adversarial attacks". In: arXiv preprint arXiv:1706.06083 (2017).
[5] Klas Leino, Zifan Wang, and Matt Fredrikson. "Globally-robust neural networks". In: International Conference on Machine Learning. PMLR. 2021, pp. 6212-6222.
[6] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. “Theoretically principled trade-off between robustness and accuracy”. In: International conference on machine learning. PMLR. 2019, pp. 7472–7482.
[7] Moustapha Cisse, Piotr Bojanowski, Edouard Grave, Yann Dauphin, and Nicolas Usunier. "Parseval networks: Improving robustness to adversarial examples". In: International Conference on Machine Learning. PMLR. 2017, pp. 854-863.
[8] Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. "Certified adversarial robustness via randomized smoothing". In: international conference on machine learning. PMLR. 2019, pp. 1310-1320.
[9] Aounon Kumar, Alexander Levine, Soheil Feizi, and Tom Goldstein. "Certifying confidence via randomized smoothing". In: Advances in Neural Information Processing Systems 33 (2020), pp. 5165-5177.
[10] Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. "Provably robust deep learning via adversarially trained smoothed classifiers". In: Advances in Neural Information Processing Systems 32 (2019).
[11] Eric Wong and Zico Kolter. "Provable defenses against adversarial examples via the convex outer adversarial polytope". In: International Conference on Machine Learning. PMLR. 2018, pp. 5286-5295.
[12] Sumanth Dathathri, Krishnamurthy Dvijotham, Alexey Kurakin, Aditi Raghunathan, Jonathan Uesato, Rudy R Bunel, Shreya Shankar, Jacob Steinhardt, Ian Goodfellow, Percy S Liang, et al. "Enabling certification of verification-agnostic networks via memory-efficient semidefinite programming". In: Advances in Neural Information Processing Systems 33 (2020), pp. 5318-5331.
[13] Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. "Defense against adversarial attacks using high-level representation guided denoiser". In: Proceedings of the IEEE conference on computer vision and pattern recognition. 2018, pp. 1778-1787.
[14] Florian Tramér, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. "Ensemble adversarial training: Attacks and defenses". In: arXiv preprint arXiv:1705.07204 (2017).
[15] Nikolaos Tsilivis, Jingtong Su, and Julia Kempe. "Can we achieve robustness from data alone?" In: arXiv preprint arXiv:2207.11727 (2022).
[16] Gavin Weiguang Ding, Yash Sharma, Kry Yuk Chau Lui, and Ruitong Huang. "Mma training: Direct input space margin maximization through adversarial training". In: arXiv preprint arXiv:1812.02637 (2018).
[17] Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. "Geometry-aware instance-reweighted adversarial training". In: arXiv preprint arXiv:2010.01736 (2020).
[18] Yuancheng Xu, Yanchao Sun, Micah Goldblum, Tom Goldstein, and Furong Huang. "Exploring and Exploiting Decision Boundary Dynamics for Adversarial Robustness". In: arXiv preprint arXiv:2302.03015 (2023).
[19] Yusuke Tsuzuku, Issei Sato, and Masashi Sugiyama. "Lipschitz-margin training: Scalable certification of perturbation invariance for deep neural networks". In: Advances in neural information processing systems 31 (2018).