
@inproceedings{he2016deep,
  title={Deep residual learning for image recognition},
  author={He, Kaiming and Zhang, Xiangyu and Ren, Shaoqing and Sun, Jian},
  booktitle={Proceedings of the IEEE conference on computer vision and pattern recognition},
  pages={770--778},
  year={2016}
}

@article{wang2021fighting,
  title={Fighting gradients with gradients: Dynamic defenses against adversarial attacks},
  author={Wang, Dequan and Ju, An and Shelhamer, Evan and Wagner, David and Darrell, Trevor},
  journal={arXiv preprint arXiv:2105.08714},
  year={2021}
}

@article{tramer2017ensemble,
  title={Ensemble adversarial training: Attacks and defenses},
  author={Tramer, Florian and Kurakin, Alexey and Papernot, Nicolas and Goodfellow, Ian and Boneh, Dan and McDaniel, Patrick},
  journal={arXiv preprint arXiv:1705.07204},
  year={2017}
}


@inproceedings{lecun1998gradient,
  title={Gradient-based learning applied to document recognition},
  author={Yann LeCun and Corinna Cortes and Christopher J.C. Burges},
  booktitle={Proceedings of the IEEE},
  volume={86},
  number={11},
  pages={2278--2324},
  year={1998},
  publisher={IEEE}
}

@inproceedings{krizhevsky2009learning,
  title={Learning multiple layers of features from tiny images},
  author={Alex Krizhevsky},
  booktitle={Master's thesis, University of Toronto},
  year={2009},
  address={Toronto, Canada}
}

@inproceedings{deng2009imagenet,
  title={ImageNet: A large-scale hierarchical image database},
  author={Jia Deng and Wei Dong and Richard Socher and Li-Jia Li and Kai Li and Li Fei-Fei},
  booktitle={Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)},
  pages={248--255},
  year={2009},
  organization={IEEE}
}

@INPROCEEDINGS{KaimingHe2016,
  author={He, Kaiming and Zhang, Xiangyu and Ren, Shaoqing and Sun, Jian},
  booktitle={The IEEE Conference on Computer Vision and Pattern Recognition}, 
  title={Deep Residual Learning for Image Recognition}, 
  year={2016},
  volume={},
  number={},
  pages={770-778},
  doi={10.1109/CVPR.2016.90}}

@misc{iandola2016squeezenet,
      title={SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and <0.5MB model size}, 
      author={Forrest N. Iandola and Song Han and Matthew W. Moskewicz and Khalid Ashraf and William J. Dally and Kurt Keutzer},
      year={2016},
      eprint={1602.07360},
      archivePrefix={arXiv},
      primaryClass={cs.CV}
}

@article{Sandler_MobileNetV2,
  author    = {Mark Sandler and
               Andrew G. Howard and
               Menglong Zhu and
               Andrey Zhmoginov and
               Liang{-}Chieh Chen},
  title     = {Inverted Residuals and Linear Bottlenecks: Mobile Networks for Classification,
               Detection and Segmentation},
  journal   = {CoRR},
  volume    = {abs/1801.04381},
  year      = {2018},
}

@InProceedings{Huang2017,
  author    = {Gao Huang and
               Zhuang Liu and
               L. van der Maaten and and K. Q. Weinberger},
  title     = {Densely Connected Convolutional Networks},
  journal   = {in 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR)},
  pages    = {2261â€“2269},
  year      = {2017}
}
@article{Christian_InceptionNet_V3,
  author    = {Christian Szegedy and
               Vincent Vanhoucke and
               Sergey Ioffe and
               Jonathon Shlens and
               Zbigniew Wojna},
  title     = {Rethinking the Inception Architecture for Computer Vision},
  journal   = {The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)},
  year      = {2016},
  pages     = {2818-2826},
  doi       = {10.1109/CVPR.2016.308}
 }

@inproceedings{papernot2016distillation,
  title={Distillation as a defense to adversarial perturbations against deep neural networks},
  author={Papernot, Nicolas and McDaniel, Patrick and Wu, Xi and Jha, Somesh and Swami, Ananthram},
  booktitle={2016 IEEE symposium on security and privacy (SP)},
  pages={582--597},
  year={2016},
  organization={IEEE}
}

@inproceedings{papernot2016limitations,
  title={The limitations of deep learning in adversarial settings},
  author={Papernot, Nicolas and McDaniel, Patrick and Jha, Somesh and Fredrikson, Matt and Celik, Z Berkay and Swami, Ananthram},
  booktitle={2016 IEEE European symposium on security and privacy (EuroS\&P)},
  pages={372--387},
  year={2016},
  organization={IEEE}
}

@inproceedings{jiang2023towards,
  title={Towards Stable and Efficient Adversarial Training against $ l\_1 $ Bounded Adversarial Attacks},
  author={Jiang, Yulun and Liu, Chen and Huang, Zhichao and Salzmann, Mathieu and Susstrunk, Sabine},
  booktitle={International Conference on Machine Learning},
  pages={15089--15104},
  year={2023},
  organization={PMLR}
}

@inproceedings{chen2020towards,
  title={Towards fast and robust adversarial training for image classification},
  author={Chen, Erh-Chung and Lee, Che-Rung},
  booktitle={Proceedings of the Asian Conference on Computer Vision},
  year={2020}
}
@article{zhang2019defense,
  title={Defense against adversarial attacks using feature scattering-based adversarial training},
  author={Zhang, Haichao and Wang, Jianyu},
  journal={Advances in neural information processing systems},
  volume={32},
  year={2019}
}

@article{sen2023adversarial,
title={Adversarial Attacks on Image Classification Models: Analysis and Defense},
author={Sen, Jaydip and Sen, Abhiraj and Chatterjee, Ananda},
journal={arXiv preprint arXiv:2312.16880},
year={2023}
}

@inproceedings{sen2024fgsm,
title={The FGSM attack on image classification models and distillation as its defense},
author={Sen, Jaydip},
booktitle={International Conference on Advances in Distributed Computing and Machine
Learning},
pages={347--360},
year={2024},
organization={Springer}
}

@article{goodfellow2014explaining,
title={Explaining and harnessing adversarial examples},
author={Goodfellow, Ian J and Shlens, Jonathon and Szegedy, Christian},
journal={arXiv preprint arXiv:1412.6572},
year={2014}
}

@article{mkadry2017towards,
title={Towards deep learning models resistant to adversarial attacks},
author={Mkadry, Aleksander and Makelov, Aleksandar and Schmidt, Ludwig and Tsipras,
Dimitris and Vladu, Adrian},
journal={stat},
volume={1050},
number={9},

year={2017}
}

@incollection{kurakin2018adversarial,
title={Adversarial examples in the physical world},
author={Kurakin, Alexey and Goodfellow, Ian J and Bengio, Samy},
booktitle={Artificial intelligence safety and security},
pages={99--112},
year={2018},
publisher={Chapman and Hall/CRC}
}

@inproceedings{carlini2017towards,
title={Towards evaluating the robustness of neural networks},
author={Carlini, Nicholas and Wagner, David},
booktitle={2017 ieee symposium on security and privacy (sp)},
pages={39--57},
year={2017},
organization={Ieee}
}

@inproceedings{chen2017zoo,
title={Zoo: Zeroth order optimization based black-box attacks to deep neural networks without
training substitute models},
author={Chen, Pin-Yu and Zhang, Huan and Sharma, Yash and Yi, Jinfeng and Hsieh, Cho-
Jui},
booktitle={Proceedings of the 10th ACM workshop on artificial intelligence and security},
pages={15--26},
year={2017}
}

@article{shi2022query,
title={Query-efficient black-box adversarial attack with customized iteration and sampling},
author={Shi, Yucheng and Han, Yahong and Hu, Qinghua and Yang, Yi and Tian, Qi},
journal={IEEE Transactions on Pattern Analysis and Machine Intelligence},
volume={45},
number={2},
pages={2226--2245},
year={2022},
publisher={IEEE}
}

@article{papernot2016transferability,
title={Transferability in machine learning: from phenomena to black-box attacks using
adversarial samples},
author={Papernot, Nicolas and McDaniel, Patrick and Goodfellow, Ian},
journal={arXiv preprint arXiv:1605.07277},
year={2016}
}

@article{ghaffari2022adversarial,
  title={Adversarial attacks and adversarial robustness in computational pathology},
  author={Ghaffari Laleh, Narmin and Truhn, Daniel and Veldhuizen, Gregory Patrick and Han, Tianyu and van Treeck, Marko and Buelow, Roman D and Langer, Rupert and Dislich, Bastian and Boor, Peter and Schulz, Volkmar and others},
  journal={Nature communications},
  volume={13},
  number={1},
  pages={5711},
  year={2022},
  publisher={Nature Publishing Group UK London}
}
@article{weng2024comparative,
  title={Comparative evaluation of recent universal adversarial perturbations in image classification},
  author={Weng, Juanjuan and Luo, Zhiming and Lin, Dazhen and Li, Shaozi},
  journal={Computers \& Security},
  volume={136},
  pages={103576},
  year={2024},
  publisher={Elsevier}
}
@article{hirano2021universal,
  title={Universal adversarial attacks on deep neural networks for medical image classification},
  author={Hirano, Hokuto and Minagi, Akinori and Takemoto, Kazuhiro},
  journal={BMC medical imaging},
  volume={21},
  pages={1--13},
  year={2021},
  publisher={Springer}
}

@article{shafahi2019adversarial,
  title={Adversarial training for free!},
  author={Shafahi, Ali and Najibi, Mahyar and Ghiasi, Mohammad Amin and Xu, Zheng and Dickerson, John and Studer, Christoph and Davis, Larry S and Taylor, Gavin and Goldstein, Tom},
  journal={Advances in neural information processing systems},
  volume={32},
  year={2019}
}
@article{miyato2016adversarial,
  title={Adversarial training methods for semi-supervised text classification},
  author={Miyato, Takeru and Dai, Andrew M and Goodfellow, Ian},
  journal={arXiv preprint arXiv:1605.07725},
  year={2016}
}

@article{zhang2019limitations,
  title={The limitations of adversarial training and the blind-spot attack},
  author={Zhang, Huan and Chen, Hongge and Song, Zhao and Boning, Duane and Dhillon, Inderjit S and Hsieh, Cho-Jui},
  journal={arXiv preprint arXiv:1901.04684},
  year={2019}
}

@article{shafahi2019adversarially,
  title={Adversarially robust transfer learning},
  author={Shafahi, Ali and Saadatpanah, Parsa and Zhu, Chen and Ghiasi, Amin and Studer, Christoph and Jacobs, David and Goldstein, Tom},
  journal={arXiv preprint arXiv:1905.08232},
  year={2019}
}
@inproceedings{athalye2018obfuscated,
  title={Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples},
  author={Athalye, Anish and Carlini, Nicholas and Wagner, David},
  booktitle={International conference on machine learning},
  pages={274--283},
  year={2018},
  organization={PMLR}
}

@article{liu2018zeroth,
  title={Zeroth-order optimization and its application to adversarial machine learning},
  author={Liu, Sijia and Chen, Pin-Yu},
  journal={Intelligent Informatics},
  pages={25},
  year={2018}
}


@article{ilyas2019adversarial,
  title={Adversarial examples are not bugs, they are features},
  author={Ilyas, Andrew and Santurkar, Shibani and Tsipras, Dimitris and Engstrom, Logan and Tran, Brandon and Madry, Aleksander},
  journal={Advances in neural information processing systems},
  volume={32},
  year={2019}
}

@inproceedings{chen2020hopskipjumpattack,
  title={Hopskipjumpattack: A query-efficient decision-based attack},
  author={Chen, Jianbo and Jordan, Michael I and Wainwright, Martin J},
  booktitle={2020 ieee symposium on security and privacy (sp)},
  pages={1277--1294},
  year={2020},
  organization={IEEE}
}

@inproceedings{andriushchenko2020square,
  title={Square attack: a query-efficient black-box adversarial attack via random search},
  author={Andriushchenko, Maksym and Croce, Francesco and Flammarion, Nicolas and Hein, Matthias},
  booktitle={European conference on computer vision},
  pages={484--501},
  year={2020},
  organization={Springer}
}

@article{su2019one,
  title={One pixel attack for fooling deep neural networks},
  author={Su, Jiawei and Vargas, Danilo Vasconcellos and Sakurai, Kouichi},
  journal={IEEE Transactions on Evolutionary Computation},
  volume={23},
  number={5},
  pages={828--841},
  year={2019},
  publisher={IEEE}
}

@article{madry2017towards,
  title={Towards deep learning models resistant to adversarial attacks},
  author={Madry, Aleksander and Makelov, Aleksandar and Schmidt, Ludwig and Tsipras, Dimitris and Vladu, Adrian},
  journal={arXiv preprint arXiv:1706.06083},
  year={2017}
}

@inproceedings{moosavi2016deepfool,
  title={Deepfool: a simple and accurate method to fool deep neural networks},
  author={Moosavi-Dezfooli, Seyed-Mohsen and Fawzi, Alhussein and Frossard, Pascal},
  booktitle={Proceedings of the IEEE conference on computer vision and pattern recognition},
  pages={2574--2582},
  year={2016}
}

