B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. Srndic, P. Laskov, G. Giacinto, and F. Roli, "Evasion attacks against machine learning at test time," in Proc of ECML PKDD, 2013.
C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. J. Goodfellow, and R. Fergus, "Intriguing properties of neural networks," in Proc. of ICLR, 2014.
V. Tjeng, K. Y. Xiao, and R. Tedrake, “Evaluating robustness of neural networks with mixed integer programming,” in Proc. of ICLR, 2019.
R. Bunel, J. Lu, I. Turkaslan, P. H. S. Torr, P. Kohli, and M. P. Kumar, "Branch and bound for piecewise linear neural network verification," J. Mach. Learn. Res., 2020.
H. Zhang, S. Wang, K. Xu, L. Li, B. Li, S. Jana, C. Hsieh, and J. Z. Kolter, "General cutting planes for bound-propagation-based neural network verification," ArXiv preprint, vol. abs/2208.05740, 2022.
C. Ferrari, M. N. Müller, N. Jovanovic, and M. T. Vechev, "Complete verification via multi-neuron relaxation guided branch-and-bound," in Proc. of ICLR, 2022.
E. Wong and J. Z. Kolter, "Provable defenses against adversarial examples via the convex outer adversarial polytope," in Proc. of ICML, 2018.
G. Singh, T. Gehr, M. Puschel, and M. T. Vechev, "An abstract domain for certifying neural networks," in Proc. of POPL, 2019.
H. Zhang, T. Weng, P. Chen, C. Hsieh, and L. Daniel, "Efficient neural network robustness certification with general activation functions," in Proc. of NeurIPS, 2018.
A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, "Towards deep learning models resistant to adversarial attacks," in Proc. of ICLR, 2018.
F. Tramèr, N. Carlini, W. Brendel, and A. Madry, “On adaptive attacks to adversarial example defenses,” in Proc. of NeurIPS, 2020.
M. Mirman, T. Gehr, and M. T. Vechev, "Differentiable abstract interpretation for provably robust neural networks," in Proc. of ICML, 2018.
S. Gowal, K. Dvijotham, R. Stanforth, R. Bunel, C. Qin, J. Uesato, R. Arandjelovic, T. A. Mann, and P. Kohli, "On the effectiveness of interval bound propagation for training verifiably robust models," ArXiv preprint, vol. abs/1810.12715, 2018.
Z. Shi, Y. Wang, H. Zhang, J. Yi, and C. Hsieh, "Fast certified robust training with short warmup," in Proc. of NeurIPS, 2021.
N. Jovanović, M. Balunović, M. Baader, and M. Vechev, “On the paradox of certified training,” in Proc. of International Conference on Machine Learning (ICML), 2022.
M. Balunovic and M. T. Vechev, "Adversarial training and provable defenses: Bridging the gap," in Proc. of ICLR, 2020.
A. D. Palma, R. Bunel, K. Dvijotham, M. P. Kumar, and R. Stanforth, "IBP regularization for verified adversarial robustness via branch-and-bound," ArXiv preprint, vol. abs/2206.14772, 2022.
M. N. Müller, F. Eckert, M. Fischer, and M. T. Vechev, "Certified training: Small boxes are all you need," CoRR, vol. abs/2210.04871, 2022.
F. Croce and M. Hein, "Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks," in Proc. of ICML, 2020.
M. Fischer, M. Balunovic, D. Drachsler-Cohen, T. Gehr, C. Zhang, and M. T. Vechev, "DL2: training and querying neural networks with logic," in Proc. of ICML, 2019.
Y. Mao, M. N. Müller, M. Fischer, and M. T. Vechev, "Understanding certified training with interval bound propagation," CoRR, vol. abs/2306.10426, 2023.