{"type":"ScholarlyArticle","title":"Improving Adversarial Robustness via Feature Pattern Consistency Constraint","authors":[{"name":"Jiacong Hu","slug":"jiacong-hu","given":"Jiacong","family":"Hu","affiliation":"College of Computer Science and Technology , Zhejiang University; State Key Laboratory of Blockchain and Security , Zhejiang University; Hangzhou High-Tech Zone (Binjiang ) Institute of Blockchain and Data Security"},{"name":"Jingwen Ye","slug":"jingwen-ye","given":"Jingwen","family":"Ye","affiliation":"National University of Singapore"},{"name":"Zunlei Feng","slug":"zunlei-feng","given":"Zunlei","family":"Feng","affiliation":"School of Software Technology , Zhejiang University; State Key Laboratory of Blockchain and Security , Zhejiang University; Hangzhou High-Tech Zone (Binjiang ) Institute of Blockchain and Data Security"},{"name":"Jiazhen Yang","slug":"jiazhen-yang","given":"Jiazhen","family":"Yang","affiliation":"School of Software Technology , Zhejiang University"},{"name":"Shunyu Liu","slug":"shunyu-liu","given":"Shunyu","family":"Liu","affiliation":"College of Computer Science and Technology , Zhejiang University"},{"name":"Xiaotian Yu","slug":"xiaotian-yu","given":"Xiaotian","family":"Yu","affiliation":"College of Computer Science and Technology , Zhejiang University"},{"name":"Lingxiang Jia","slug":"lingxiang-jia","given":"Lingxiang","family":"Jia","affiliation":"College of Computer Science and Technology , Zhejiang University"},{"name":"Mingli Song","slug":"mingli-song","given":"Mingli","family":"Song","affiliation":"College of Computer Science and Technology , Zhejiang University; State Key Laboratory of Blockchain and Security , Zhejiang University; Hangzhou High-Tech Zone (Binjiang ) Institute of Blockchain and Data Security"}],"abstract":"Convolutional Neural Networks (CNNs) are well-known for their vulnerability to adversarial attacks, posing significant security concerns. In response to these threats, various defense methods have emerged to bolster the model's robustness. However, most existing methods either focus on learning from adversarial perturbations, leading to overfitting to the adversarial examples, or aim to eliminate such perturbations during inference, inevitably increasing computational burdens. Conversely, clean training, which strengthens the model's robustness by relying solely on clean examples, can address the aforementioned issues. In this paper, we align with this methodological stream and enhance its generalizability to unknown adversarial examples. This enhancement is achieved by scrutinizing the behavior of latent features within the network. Recognizing that a correct prediction relies on the correctness of the latent feature's pattern, we introduce a novel and effective Feature Pattern Consistency Constraint (FPCC) method to reinforce the latent feature's capacity to maintain the correct feature pattern. Specifically, we propose Spatial-wise Feature Modification and Channel-wise Feature Selection to enhance latent features. Subsequently, we employ the Pattern Consistency Loss to constrain the similarity between the feature pattern of the latent features and the correct feature pattern. Our experiments demonstrate that the FPCC method empowers latent features to uphold correct feature patterns even in the face of adversarial examples, resulting in inherent adversarial robustness surpassing state-of-the-art models.","doi":"10.24963/ijcai.2024/94","url":"https://ijcai.org/proceedings/2024/94","pdf":"https://ijcai.org/proceedings/2024/0094.pdf","markdown":"https://ijcai.org/proceedings/2024/94.md","bibtex":"https://ijcai.org/proceedings/2024/bibtex/94","volume":{"slug":"2024","title":"Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2024","url":"https://ijcai.org/proceedings/2024/","year":2024,"location":"Jeju, Korea","dates":"3-9 August 2024","editors":"Kate Larson","isbn":"978-1-956792-04-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2024"},"section":"Computer Vision","track":"Main Track","number":94,"pages":{"first":848,"last":856},"keywords":["Machine Learning: ML: Classification","Computer Vision: CV: Adversarial learning, adversarial attack and defense methods","Computer Vision: CV: Recognition (object detection, categorization)"],"videos":[],"references":[{"position":1,"raw":"[Athalye et al., 2018] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning, pages 274-283. PMLR, 2018.","title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","authors":"Anish Athalye, Nicholas Carlini, David Wagner","year":"2018","venue":"International conference on machine learning","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Carlini et al., 2019] Nicholas Carlini, Anish Athalye, Nico- las Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705, 2019.","title":"On evaluating adversarial robustness","authors":"Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, Alexey Kurakin","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Chen et al., 2021] Zhuotong Chen, Qianxiao Li, and Zheng Zhang. Towards robust neural networks via close-loop control. arXiv preprint arXiv:2102.01862, 2021.","title":"Towards robust neural networks via close-loop control","authors":"Chen","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Cheng et al., 2020] Minhao Cheng, Qi Lei, Pin-Yu Chen, Inderjit Dhillon, and Cho-Jui Hsieh. Cat: Customized ad- versarial training for improved robustness. arXiv preprint arXiv:2002.06789, 2020.","title":"Cat: Customized adversarial training for improved robustness","authors":"Cheng","year":"2020","venue":null,"doi":null,"url":null,"internal_url":"/proceedings/2022/95"},{"position":5,"raw":"[Croce and Hein, 2020] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an en- semble of diverse parameter-free attacks. In Interna- tional conference on machine learning, pages 2206-2216.","title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","authors":"Croce, Hein, Francesco Croce, Matthias Hein","year":"2020","venue":"International conference on machine learning","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"PMLR, 2020.","title":null,"authors":"Pmlr","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Croce et al., 2022] Francesco Croce, Sven Gowal, Thomas Brunner, Evan Shelhamer, Matthias Hein, and Taylan Cemgil. Evaluating the adversarial robustness of adaptive test-time defenses. In International Conference on Ma- chine Learning, pages 4421-4435. PMLR, 2022.","title":"Evaluating the adversarial robustness of adaptive test-time defenses","authors":"Francesco Croce, Sven Gowal, Thomas Brunner, Evan Shelhamer, Matthias Hein, Taylan Cemgil","year":"2022","venue":"International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Dong et al., 2022] Minjing Dong, Xinghao Chen, Yunhe Wang, and Chang Xu. Random normalization aggregation for adversarial defense. Advances in Neural Information Processing Systems, 35:33676-33688, 2022.","title":"Random normalization aggregation for adversarial defense","authors":"Dong","year":"2022","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Fu et al., 2021] Yonggan Fu, Qixuan Yu, Meng Li, Vikas Chandra, and Yingyan Lin. Double-win quant: Aggres- sively winning robustness of quantized deep neural net- works via random precision training and inference. In International Conference on Machine Learning, pages 3492-3504. PMLR, 2021.","title":"Double-win quant: Aggressively winning robustness of quantized deep neural networks via random precision training and inference","authors":"Fu","year":"2021","venue":"International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Gao et al., 2020a] Lianli Gao, Qilong Zhang, Jingkuan Song, Xianglong Liu, and Heng Tao Shen. Patch-wise at- tack for fooling deep neural network. In Computer Vision- ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XXVIII 16, pages 307-322. Springer, 2020.","title":"Patch-wise attack for fooling deep neural network","authors":"Gao","year":"2020","venue":"Computer Vision-ECCV 2020: 16th European Conference","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Gao et al., 2020b] Lianli Gao, Qilong Zhang, Jingkuan Song, and Heng Tao Shen. Patch-wise++ perturba- tion for adversarial targeted attacks. arXiv preprint arXiv:2012.15503, 2020.","title":"Patch-wise++ perturbation for adversarial targeted attacks","authors":"Gao","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Goodfellow et al., 2014a] Ian Goodfellow, Jean Pouget- Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Gen- erative adversarial nets. Advances in neural information processing systems, 27, 2014.","title":"Generative adversarial nets","authors":"Goodfellow","year":"2014","venue":"Advances in neural information processing systems","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Goodfellow et al., 2014b] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.","title":"Explaining and harnessing adversarial examples","authors":"Goodfellow","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Gowal et al., 2020] Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncover- ing the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593, 2020.","title":"Uncovering the limits of adversarial training against norm-bounded adversarial examples","authors":"Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, Pushmeet Kohli","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[He et al., 2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In CVPR, pages 770-778, 2016.","title":"Deep residual learning for image recognition","authors":"Kaiming He, Xiangyu Zhang, Shaoqing Ren, Jian Sun","year":"2016","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Hill et al., 2020] Mitch Hill, Jonathan Mitchell, and Song- Chun Zhu. Stochastic security: Adversarial defense using long-run dynamics of energy-based models. arXiv preprint arXiv:2005.13525, 2020.","title":"Stochastic security: Adversarial defense using long-run dynamics of energy-based models","authors":"Mitch Hill, Jonathan Mitchell, Song-Chun Zhu","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Ho et al., 2020] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-6851, 2020.","title":"Denoising diffusion probabilistic models","authors":"Jonathan Ho, Ajay Jain, Pieter Abbeel","year":"2020","venue":"Advances in neural information processing systems","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Kang et al., 2021] Qiyu Kang, Yang Song, Qinxu Ding, and Wee Peng Tay. Stable neural ode with lyapunov-stable equilibrium points for defending against adversarial at- tacks. Advances in Neural Information Processing Sys- tems, 34:14925-14937, 2021.","title":"Stable neural ode with lyapunov-stable equilibrium points for defending against adversarial attacks","authors":"Kang","year":"2021","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Krizhevsky, 2009] Alex Krizhevsky. Learning multiple lay- ers of features from tiny images. 2009.","title":"Learning multiple layers of features from tiny images","authors":"Alex Krizhevsky","year":"2009","venue":null,"doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Kurakin et al., 2018] Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pages 99-112.","title":"Adversarial examples in the physical world","authors":"Alexey Kurakin, Ian J Goodfellow, Samy Bengio","year":null,"venue":"Artificial intelligence safety and security","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"Chapman and Hall/CRC, 2018.","title":null,"authors":"Hall / Chapman, Crc","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Laidlaw et al., 2020] Cassidy Laidlaw, Sahil Singla, and Soheil Feizi. Perceptual adversarial robustness: De- fense against unseen threat models. arXiv preprint arXiv:2006.12655, 2020.","title":"Perceptual adversarial robustness: Defense against unseen threat models","authors":"Cassidy Laidlaw, Sahil Singla, Soheil Feizi","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Li et al., 2021] Xin Li, Xiangrui Li, Deng Pan, and Dongx- iao Zhu. Improving adversarial robustness via probabilisti- cally compact loss with logit constraints. In Proceedings of the AAAI conference on artificial intelligence, volume 35, pages 8482-8490, 2021.","title":"Improving adversarial robustness via probabilistically compact loss with logit constraints","authors":"Xin Li, Xiangrui Li, Deng Pan, Dongxiao Zhu","year":"2021","venue":"Proceedings of the AAAI conference on artificial intelligence","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Li et al., 2023] Bohan Li, Jingxin Dong, Yunnan Wang, Jin- ming Liu, Lianying Yin, Wei Zhao, Zheng Zhu, Xin Jin, and Wenjun Zeng. One at a time: Multi-step volumet- ric probability distribution diffusion for depth estimation. arXiv preprint arXiv:2306.12681, 2023.","title":"One at a time: Multi-step volumetric probability distribution diffusion for depth estimation","authors":"Bohan Li, Jingxin Dong, Yunnan Wang, Jinming Liu, Lianying Yin, Wei Zhao, Zheng Zhu, Xin Jin, Wenjun Zeng","year":"2023","venue":null,"doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Liu et al., 2018] Xuanqing Liu, Yao Li, Chongruo Wu, and Cho-Jui Hsieh. Adv-bnn: Improved adversarial defense through robust bayesian neural network. arXiv preprint arXiv:1810.01279, 2018.","title":"Adv-bnn: Improved adversarial defense through robust bayesian neural network","authors":"Xuanqing Liu, Yao Li, Chongruo Wu, Cho-Jui Hsieh","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Liu et al., 2023] Shunyu Liu, Wei Luo, Yanzhen Zhou, Kaixuan Chen, Quan Zhang, Huating Xu, Qinglai Guo, and Mingli Song. Transmission interface power flow ad- justment: A deep reinforcement learning approach based on multi-task attribution map. IEEE Transactions on Power Systems, 2023.","title":"Transmission interface power flow adjustment: A deep reinforcement learning approach based on multi-task attribution map","authors":"Shunyu Liu, Wei Luo, Yanzhen Zhou, Kaixuan Chen, Quan Zhang, Huating Xu, Qinglai Guo, Mingli Song","year":"2023","venue":"IEEE Transactions on Power Systems","doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Luo et al., 2022] Mandi Luo, Haoxue Wu, Huaibo Huang, Weizan He, and Ran He. Memory-modulated transformer network for heterogeneous face recognition. IEEE Trans- actions on Information Forensics and Security, 17:2095- 2109, 2022.","title":"Memory-modulated transformer network for heterogeneous face recognition","authors":"Mandi Luo, Haoxue Wu, Huaibo Huang, Weizan He, Ran He","year":"2022","venue":"IEEE Transactions on Information Forensics and Security","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Ma et al., 2023a] Xinyin Ma, Gongfan Fang, and Xinchao Wang. Deepcache: Accelerating diffusion models for free. arXiv preprint arXiv:2312.00858, 2023.","title":"Deepcache: Accelerating diffusion models for free","authors":"Ma","year":"2023","venue":null,"doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Ma et al., 2023b] Xinyin Ma, Gongfan Fang, and Xinchao Wang. Llm-pruner: On the structural pruning of large lan- guage models. Advances in neural information processing systems, 36:21702-21720, 2023.","title":"Llm-pruner: On the structural pruning of large language models","authors":"Ma","year":"2023","venue":"Advances in neural information processing systems","doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[Madry et al., 2017] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017.","title":"Towards deep learning models resistant to adversarial attacks","authors":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, Adrian Vladu","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":31,"raw":"[Mustafa et al., 2019] Aamir Mustafa, Salman Khan, Mu- nawar Hayat, Roland Goecke, Jianbing Shen, and Ling Shao. Adversarial defense by restricting the hidden space of deep neural networks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 3385-3394, 2019.","title":"Adversarial defense by restricting the hidden space of deep neural networks","authors":"Aamir Mustafa, Salman Khan, Munawar Hayat, Roland Goecke, Jianbing Shen, Ling Shao","year":"2019","venue":"Proceedings of the IEEE/CVF International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":32,"raw":"[Nie et al., 2022] Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. arXiv preprint arXiv:2205.07460, 2022.","title":"Diffusion models for adversarial purification","authors":"Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, Anima Anandkumar","year":"2022","venue":null,"doi":null,"url":null,"internal_url":null},{"position":33,"raw":"[Pang et al., 2019] Tianyu Pang, Kun Xu, Yinpeng Dong, Chao Du, Ning Chen, and Jun Zhu. Rethinking soft- max cross-entropy loss for adversarial robustness. arXiv preprint arXiv:1905.10626, 2019.","title":"Rethinking softmax cross-entropy loss for adversarial robustness","authors":"Tianyu Pang, Kun Xu, Yinpeng Dong, Chao Du, Ning Chen, Jun Zhu","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":34,"raw":"[Pang et al., 2022] Tianyu Pang, Min Lin, Xiao Yang, Jun Zhu, and Shuicheng Yan. Robustness and accuracy could be reconcilable by (proper) definition. In International Conference on Machine Learning, pages 17258-17277.","title":"Robustness and accuracy could be reconcilable by (proper) definition","authors":"Tianyu Pang, Min Lin, Xiao Yang, Jun Zhu, Shuicheng Yan","year":null,"venue":"International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":35,"raw":"PMLR, 2022.","title":null,"authors":"Pmlr","year":"2022","venue":null,"doi":null,"url":null,"internal_url":null},{"position":36,"raw":"[Prakash et al., 2021] Aditya Prakash, Kashyap Chitta, and Andreas Geiger. Multi-modal fusion transformer for end-to-end autonomous driving. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7077-7087, 2021.","title":"Multi-modal fusion transformer for end-to-end autonomous driving","authors":"Aditya Prakash, Kashyap Chitta, Andreas Geiger","year":"2021","venue":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":37,"raw":"[Pu et al., 2023] Nan Pu, Zhun Zhong, Nicu Sebe, and Michael S Lew. A memorizing and generalizing frame- work for lifelong person re-identification. IEEE Transac- tions on Pattern Analysis and Machine Intelligence, 2023.","title":"A memorizing and generalizing framework for lifelong person re-identification","authors":"Nan Pu, Zhun Zhong, Nicu Sebe, Michael S Lew","year":"2023","venue":"IEEE Transactions on Pattern Analysis and Machine Intelligence","doi":null,"url":null,"internal_url":null},{"position":38,"raw":"[Simonyan et al., 2013] Karen Simonyan, Andrea Vedaldi, and Andrew Zisserman. Deep inside convolutional networks: Visualising image classification models and saliency maps. In ICLR Workshop, 2013.","title":"Deep inside convolutional networks: Visualising image classification models and saliency maps","authors":"Karen Simonyan, Andrea Vedaldi, Andrew Zisserman","year":"2013","venue":"ICLR Workshop","doi":null,"url":null,"internal_url":null},{"position":39,"raw":"[Song et al., 2020] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.13456, 2020.","title":"Score-based generative modeling through stochastic differential equations","authors":"Song","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":40,"raw":"[Srivastava et al., 2014] Nitish Srivastava, Geoffrey Hinton, Alex Krizhevsky, Ilya Sutskever, and Ruslan Salakhutdi- nov. Dropout: a simple way to prevent neural networks from overfitting. The journal of machine learning re- search, 15(1):1929-1958, 2014.","title":"Dropout: a simple way to prevent neural networks from overfitting","authors":"Nitish Srivastava, Geoffrey Hinton, Alex Krizhevsky, Ilya Sutskever, Ruslan Salakhutdinov","year":"2014","venue":"The journal of machine learning research","doi":null,"url":null,"internal_url":null},{"position":41,"raw":"[Szegedy et al., 2013] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.","title":"Intriguing properties of neural networks","authors":"Szegedy","year":"2013","venue":null,"doi":null,"url":null,"internal_url":null},{"position":42,"raw":"[Tramèr et al., 2017] Florian Tramèr, Alexey Kurakin, Nico- las Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and de- fenses. arXiv preprint arXiv:1705.07204, 2017.","title":"Ensemble adversarial training: Attacks and defenses","authors":"Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, Patrick Mc-Daniel","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":43,"raw":"[Tramer et al., 2020] Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. Advances in neural information processing systems, 33:1633-1645, 2020.","title":"On adaptive attacks to adversarial example defenses","authors":"Florian Tramer, Nicholas Carlini, Wieland Brendel, Aleksander Madry","year":"2020","venue":"Advances in neural information processing systems","doi":null,"url":null,"internal_url":null},{"position":44,"raw":"[Wang et al., 2021] Dequan Wang, An Ju, Evan Shelhamer, David Wagner, and Trevor Darrell. Fighting gradients with gradients: Dynamic defenses against adversarial attacks. arXiv preprint arXiv:2105.08714, 2021.","title":"Fighting gradients with gradients: Dynamic defenses against adversarial attacks","authors":"Dequan Wang, An Ju, Evan Shelhamer, David Wagner, Trevor Darrell","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":45,"raw":"[Wang et al., 2022] Jinyi Wang, Zhaoyang Lyu, Dahua Lin, Bo Dai, and Hongfei Fu. Guided diffusion model for ad- versarial purification. arXiv preprint arXiv:2205.14969, 2022.","title":"Guided diffusion model for adversarial purification","authors":"Jinyi Wang, Zhaoyang Lyu, Dahua Lin, Bo Dai, Hongfei Fu","year":"2022","venue":null,"doi":null,"url":null,"internal_url":null},{"position":46,"raw":"[Wang et al., 2023] Qian Wang, Yongqin Xian, Hefei Ling, Jinyuan Zhang, Xiaorui Lin, Ping Li, Jiazhong Chen, and Ning Yu. Detecting adversarial faces using only real face self-perturbations. arXiv preprint arXiv:2304.11359, 2023.","title":"Detecting adversarial faces using only real face self-perturbations","authors":"Qian Wang, Yongqin Xian, Hefei Ling, Jinyuan Zhang, Xiaorui Lin, Ping Li, Jiazhong Chen, Ning Yu","year":"2023","venue":null,"doi":null,"url":null,"internal_url":"/proceedings/2023/165"},{"position":47,"raw":"[Wen et al., 2016] Yandong Wen, Kaipeng Zhang, Zhifeng Li, and Yu Qiao. A discriminative feature learning ap- proach for deep face recognition. In Computer Vision- ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11-14, 2016, Proceedings, Part VII 14, pages 499-515. Springer, 2016.","title":"A discriminative feature learning approach for deep face recognition","authors":"Yandong Wen, Kaipeng Zhang, Zhifeng Li, Yu Qiao","year":"2016","venue":"Computer Vision-ECCV 2016: 14th European Conference","doi":null,"url":null,"internal_url":null},{"position":48,"raw":"[Wu et al., 2020] Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust gen- eralization. Advances in Neural Information Processing Systems, 33:2958-2969, 2020.","title":"Adversarial weight perturbation helps robust generalization","authors":"Wu","year":"2020","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":49,"raw":"[Zagoruyko and Komodakis, 2016] Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. arXiv preprint arXiv:1605.07146, 2016.","title":"Wide residual networks","authors":"Sergey Zagoruyko, Nikos Komodakis","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":50,"raw":"[Zhang et al., 2019] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learn- ing, pages 7472-7482. PMLR, 2019.","title":"Theoretically principled trade-off between robustness and accuracy","authors":"Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, Michael Jordan","year":"2019","venue":"International conference on machine learning","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}