[20] F. Tramér, J. Behrmann, N. Carlini, N. Papernot, and J.-H. Jacobsen, “Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations,” 2020.
[21] H. Xu, Y. Ma, H. C. Liu, D. Deb, H. Liu, J. L. Tang, and A. K. Jain, "Adversarial Attacks and Defenses in Images, Graphs and Text: A Review," International Journal of Automation and Computing, vol. 17, pp. 151-178, 4 2020.
[22] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, "Towards deep learning models resistant to adversarial attacks," 2018.
[23] F. Croce and M. Hein, "Reliable Evaluation of Adversarial Robustness with an Ensemble of Diverse Parameter-free Attacks," 2020.
[24] L. Engstrom, A. Ilyas, S. Santurkar, D. Tsipras, B. Tran, and A. Madry, "Adversarial Robustness as a Prior for Learned Representations," 6 2019.
[25] S. Santurkar, D. Tsipras, B. Tran, A. Ilyas, L. Engstrom, and A. Madry, "Image Synthesis with a Single (Robust) Classifier," Advances in Neural Information Processing Systems, vol. 32, 6 2019.
[26] C. Ledig, L. Theis, F. Huszar, J. Caballero, A. Cunningham, A. Acosta, A. Aitken, A. Tejani, J. Totz, Z. Wang, and W. Shi Twitter, "Photo-Realistic Single Image Super-Resolution Using a Generative Adversarial Network,"
[27] J. Feather, G. Leclerc, A. Madry, and J. H. McDermott, "Model metamers reveal divergent invariances between biological and artificial neural networks," Nature Neuroscience 2023 26:11, vol. 26, pp. 2017-2034, 10 2023.
[28] A. Harrington and A. Deza, “Finding Biological Plausibility for Adversarily Robust Features via Metameric Tasks,” ICLR, 2022.
[29] J. Dapello, K. Kar, M. Schrimpf, R. Geary, M. Ferguson, D. D. Cox, and J. J. DiCarlo, "Aligning Model and Macaque Inferior Temporal Cortex Representations Improves Model-to-Human Behavioral Alignment and Adversarial Robustness," bioRxiv, p. 2022.07.01.498495, 7 2022.
[30] M. Schrimpf, J. Kubilius, M. J. Lee, N. A. Ratan Murty, R. Ajemian, and J. J. DiCarlo, "Integrative Benchmarking to Advance Neurally Mechanistic Models of Human Intelligence," *Neuron*, vol. 108, pp. 413-423, 11 2020.
[31] C. Guo, M. J. Lee, G. Leclerc, J. Dapello, Y. Rao, A. Madry, and J. J. Dicarlo, "Adversarily trained neural representations are already as robust as biological neural representations," 6 2022.
[32] H. S. . S. S. . D. T. Logan Engstrom, Andrew Ilyas, "Robustness (Python Library)," 2019.
[33] K. He, X. Zhang, S. Ren, and J. Sun, "Deep Residual Learning for Image Recognition," tech. rep.
[34] M. Schrimpf, J. Kubilius, H. Hong, N. J. Majaj, R. Rajalingham, E. B. Issa, K. Kar, P. Bashivan, J. Prescott-Roy, F. Geiger, K. Schmidt, D. L. Yamins, and J. J. DiCarlo, "Brain-Score: Which Artificial Neural Network for Object Recognition is most Brain-Like?", 9 2018.
[35] H. Jang, D. McCormack, and F. Tong, "Noise-trained deep neural networks effectively predict human vision and its neural responses to challenging images," PLOS Biology, vol. 19, p. e3001418, 12 2021.
[36] N. Carlini and D. Wagner, "Towards Evaluating the Robustness of Neural Networks," in Proceedings - IEEE Symposium on Security and Privacy, pp. 39-57, 2017.
[37] C. Qin, J. Martens, S. Gowal, D. Krishnan, G. Krishnamurthy, D. Deepmind, A. Fawzi, S. De, R. Stanforth, D. Pushmeet, and K. Deepmind, "Adversarial Robustness through Local Linearization,"
[38] J. Deng, W. Dong, R. Socher, L.-J. Li, Kai Li, and Li Fei-Fei, "ImageNet: A large-scale hierarchical image database," in 2009 IEEE Conference on Computer Vision and Pattern Recognition, pp. 248-255, IEEE, 6 2009.
[39] E. Margalit, H. Lee, D. Finzi, J. J. DiCarlo, K. Grill-Spector, and D. L. K. Yamins, “A Unifying Principle for the Functional Organization of Visual Cortex,” bioRxiv, p. 2023.05.18.541361, 5 2023.
[40] M. Masood, M. Nawaz, K. M. Malik, A. Javed, A. Irtaza, and H. Malik, “Deepfakes generation and detection: state-of-the-art, open challenges, countermeasures, and way forward,” Applied Intelligence, vol. 53, pp. 3974–4026, 2 2023.