@inproceedings{goodfellow,
title	= {Explaining and Harnessing Adversarial Examples},
author	= {Ian Goodfellow and Jonathon Shlens and Christian Szegedy},
year	= {2015},
URL	= {http://arxiv.org/abs/1412.6572},
booktitle	= {International Conference on Learning Representations}
}

@inproceedings{biggio2013evasion,
  added-at = {2017-05-07T15:47:04.000+0200},
  author = {Biggio, Battista and Corona, Igino and Maiorca, Davide and Nelson, Blaine and {\v{S}}rndi{\'c}, Nedim and Laskov, Pavel and Giacinto, Giorgio and Roli, Fabio},
  biburl = {https://www.bibsonomy.org/bibtex/2c2c3a08344278ccc56ffc5ac28532472/joachimagne},
  booktitle = {Joint European Conference on Machine Learning and Knowledge Discovery in Databases},
  interhash = {0c53e04f1d8ffe40f957f4b3b1d8403f},
  intrahash = {c2c3a08344278ccc56ffc5ac28532472},
  keywords = {thema:adversarial},
  organization = {Springer},
  pages = {387--402},
  timestamp = {2017-05-09T08:56:50.000+0200},
  title = {Evasion attacks against machine learning at test time},
  year = 2013
}

@inproceedings{Szegedy2014,
title	= {Intriguing properties of neural networks},
author	= {Christian Szegedy and Wojciech Zaremba and Ilya Sutskever and Joan Bruna and Dumitru Erhan and Ian Goodfellow and Rob Fergus},
year	= {2014},
URL	= {http://arxiv.org/abs/1312.6199},
booktitle	= {International Conference on Learning Representations}
}

@inproceedings{bug_feature,
  title={Adversarial examples are not bugs, they are features},
  author={Ilyas, Andrew and Santurkar, Shibani and Tsipras, Dimitris and Engstrom, Logan and Tran, Brandon and Madry, Aleksander},
  booktitle={Advances in Neural Information Processing Systems},
  pages={125--136},
  year={2019}
}

@article{engstrom2017exploring,
  title={Exploring the landscape of spatial robustness},
  author={Engstrom, Logan and Tran, Brandon and Tsipras, Dimitris and Schmidt, Ludwig and Madry, Aleksander},
  journal={arXiv preprint arXiv:1712.02779},
  year={2017}
}

@inproceedings{
madry2018towards,
title={Towards Deep Learning Models Resistant to Adversarial Attacks},
author={Aleksander Madry and Aleksandar Makelov and Ludwig Schmidt and Dimitris Tsipras and Adrian Vladu},
booktitle={International Conference on Learning Representations},
year={2018},
url={https://openreview.net/forum?id=rJzIBfZAb},
}

@incollection{more_data,
title = {Adversarially Robust Generalization Requires More Data},
author = {Schmidt, Ludwig and Santurkar, Shibani and Tsipras, Dimitris and Talwar, Kunal and Madry, Aleksander},
booktitle = {Advances in Neural Information Processing Systems 31},
editor = {S. Bengio and H. Wallach and H. Larochelle and K. Grauman and N. Cesa-Bianchi and R. Garnett},
pages = {5014--5026},
year = {2018},
publisher = {Curran Associates, Inc.},
url = {http://papers.nips.cc/paper/7749-adversarially-robust-generalization-requires-more-data.pdf}
}

@inproceedings{
xiao2018spatially,
title={Spatially Transformed Adversarial Examples},
author={Chaowei Xiao and Jun-Yan Zhu and Bo Li and Warren He and Mingyan Liu and Dawn Song},
booktitle={International Conference on Learning Representations},
year={2018},
url={https://openreview.net/forum?id=HyydRMZC-},
}



@InProceedings{synthesizing,
  title = 	 {Synthesizing Robust Adversarial Examples},
  author = 	 {Athalye, Anish and Engstrom, Logan and Ilyas, Andrew and Kwok, Kevin},
  booktitle = 	 {Proceedings of the 35th International Conference on Machine Learning},
  pages = 	 {284--293},
  year = 	 {2018},
  editor = 	 {Dy, Jennifer and Krause, Andreas},
  volume = 	 {80},
  series = 	 {Proceedings of Machine Learning Research},
  address = 	 {Stockholmsmässan, Stockholm Sweden},
  month = 	 {10--15 Jul},
  publisher = 	 {PMLR},
  pdf = 	 {http://proceedings.mlr.press/v80/athalye18b/athalye18b.pdf},
  url = 	 {http://proceedings.mlr.press/v80/athalye18b.html},}
}

@article{physical,
title	= {Adversarial examples in the physical world},
author	= {Alexey Kurakin and Ian Goodfellow and Samy Bengio},
year	= {2017},
URL	= {https://arxiv.org/abs/1607.02533},
journal	= {ICLR Workshop}
}

@article{Kgler2018PhysicalAI,
  title={Physical Attacks in Dermoscopy: An Evaluation of Robustness for clinical Deep-Learning},
  author={K{\"u}gler, David and Bucher, Andreas and Kleemann, Johannes and Distergoft, Alexander and Jabhe, Ali and Uecker, Marc and Kazeminia, Salome and Fauser, Johannes and Alte, Daniel and Rajkarnikar, Angeelina and others},
  journal	= {https://openreview.net/},
  year={2018}
}

@article{zbontar2018fastmri,
  title={fastMRI: An open dataset and benchmarks for accelerated MRI},
  author={Zbontar, Jure and Knoll, Florian and Sriram, Anuroop and Muckley, Matthew J and Bruno, Mary and Defazio, Aaron and Parente, Marc and Geras, Krzysztof J and Katsnelson, Joe and Chandarana, Hersh and others},
  journal={arXiv preprint arXiv:1811.08839},
  year={2018}
}

@article{caliva2019distance,
  title={Distance map loss penalty term for semantic segmentation},
  author={Caliv{\'a}, Francesco and Iriondo, Claudia and Martinez, Alejandro Morales and Majumdar, Sharmila and Pedoia, Valentina},
  journal={arXiv preprint arXiv:1908.03679},
  year={2019}
}

@article{kervadec2018boundary,
  title={Boundary loss for highly unbalanced segmentation},
  author={Kervadec, Hoel and Bouchtiba, Jihene and Desrosiers, Christian and Granger, Eric and Dolz, Jose and Ayed, Ismail Ben},
  journal={arXiv preprint arXiv:1812.07032},
  year={2018}
}

@article{liang2019deep,
  title={Deep MRI Reconstruction: Unrolled optimization algorithms meet neural networks},
  author={Liang, Dong and Cheng, Jing and Ke, Ziwen and Ying, Leslie},
  journal={arXiv preprint arXiv:1907.11711},
  year={2019}
}

@incollection{hammernik2020machine,
  title={Machine learning for image reconstruction},
  author={Hammernik, Kerstin and Knoll, Florian},
  booktitle={Handbook of Medical Image Computing and Computer Assisted Intervention},
  pages={25--64},
  year={2020},
  publisher={Elsevier}
}

@article{generative,
  title={Adversarial Examples for Generative Models},
  author={Jernej Kos and Ian Fischer and Dawn Xiaodong Song},
  journal={2018 IEEE Security and Privacy Workshops (SPW)},
  year={2017},
  pages={36-42}
}

@article{random_search,
  added-at = {2019-07-10T00:00:00.000+0200},
  author = {Bergstra, James and Bengio, Yoshua},
  biburl = {https://www.bibsonomy.org/bibtex/2c2b93293f3765f0c3e67be30a235f100/dblp},
  ee = {http://dl.acm.org/citation.cfm?id=2188395},
  interhash = {43621a41bae9d8c8c45c9a0e4b12f1a0},
  intrahash = {c2b93293f3765f0c3e67be30a235f100},
  journal = {J. Mach. Learn. Res.},
  keywords = {dblp},
  pages = {281-305},
  timestamp = {2019-07-11T11:39:48.000+0200},
  title = {Random Search for Hyper-Parameter Optimization.},
  url = {http://dblp.uni-trier.de/db/journals/jmlr/jmlr13.html#BergstraB12},
  volume = 13,
  year = 2012
}

@inproceedings{adv_free,
  title={Adversarial training for free!},
  author={Shafahi, Ali and Najibi, Mahyar and Ghiasi, Mohammad Amin and Xu, Zheng and Dickerson, John and Studer, Christoph and Davis, Larry S and Taylor, Gavin and Goldstein, Tom},
  booktitle={Advances in Neural Information Processing Systems},
  pages={3353--3364},
  year={2019}
}

@inproceedings{alcorn2019strike,
  title={Strike (with) a pose: Neural networks are easily fooled by strange poses of familiar objects},
  author={Alcorn, Michael A and Li, Qi and Gong, Zhitao and Wang, Chengfei and Mai, Long and Ku, Wei-Shinn and Nguyen, Anh},
  booktitle={Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition},
  pages={4845--4854},
  year={2019}
}

@article{putzky2019rim,
  title={i-RIM applied to the fastMRI challenge},
  author={Putzky, Patrick and Karkalousos, Dimitrios and Teuwen, Jonas and Miriakov, Nikita and Bakker, Bart and Caan, Matthan and Welling, Max},
  journal={arXiv preprint arXiv:1910.08952},
  year={2019}
}

@inproceedings{putzky2019invert,
  title={Invert to learn to invert},
  author={Putzky, Patrick and Welling, Max},
  booktitle={Advances in Neural Information Processing Systems},
  pages={444--454},
  year={2019}
}


{@inproceedings{ronneberger2015u,
  title={U-net: Convolutional networks for biomedical image segmentation},
  author={Ronneberger, Olaf and Fischer, Philipp and Brox, Thomas},
  booktitle={International Conference on Medical image computing and computer-assisted intervention},
  pages={234--241},
  year={2015},
  organization={Springer}
}

@inproceedings{
balunovic2020adversarialgap,
title={Adversarial Training and Provable Defenses: Bridging the Gap},
author={Mislav Balunovic and Martin Vechev},
booktitle={International Conference on Learning Representations},
year={2020},
url={https://openreview.net/forum?id=SJxSDxrKDr}
}

@inproceedings{wong2018provable,
  title={Provable Defenses against Adversarial Examples via the Convex Outer Adversarial Polytope},
  author={Wong, Eric and Kolter, Zico},
  booktitle={International Conference on Machine Learning},
  pages={5286--5295},
  year={2018}
}

@inproceedings{
raghunathan2018certified,
title={Certified Defenses against Adversarial Examples },
author={Aditi Raghunathan and Jacob Steinhardt and Percy Liang},
booktitle={International Conference on Learning Representations},
year={2018},
url={https://openreview.net/forum?id=Bys4ob-Rb},
}

@inproceedings{mirman2018differentiable,
  title={Differentiable abstract interpretation for provably robust neural networks},
  author={Mirman, Matthew and Gehr, Timon and Vechev, Martin},
  booktitle={International Conference on Machine Learning},
  pages={3578--3586},
  year={2018}
}



@article{bubeck2018adversarialconstraints,
  title={Adversarial examples from computational constraints},
  author={Bubeck, S{\'e}bastien and Price, Eric and Razenshteyn, Ilya},
  journal={arXiv preprint arXiv:1805.10204},
  year={2018}
}

@article{gilmer2018adversarialsphere,
  title={Adversarial spheres},
  author={Gilmer, Justin and Metz, Luke and Faghri, Fartash and Schoenholz, Samuel S and Raghu, Maithra and Wattenberg, Martin and Goodfellow, Ian},
  journal={arXiv preprint arXiv:1801.02774},
  year={2018}
}

@inproceedings{mahloujifar2019curse,
  title={The curse of concentration in robust learning: Evasion and poisoning attacks from concentration of measure},
  author={Mahloujifar, Saeed and Diochnos, Dimitrios I and Mahmoody, Mohammad},
  booktitle={Proceedings of the AAAI Conference on Artificial Intelligence},
  volume={33},
  pages={4536--4543},
  year={2019}
}


@inproceedings{
shafahi2018adversarialinevitable,
title={Are adversarial examples inevitable?},
author={Ali Shafahi and W. Ronny Huang and Christoph Studer and Soheil Feizi and Tom Goldstein},
booktitle={International Conference on Learning Representations},
year={2019},
url={https://openreview.net/forum?id=r1lWUoA9FQ},
}

@article{knoll2020advancing,
  title={Advancing machine learning for MR image reconstruction with an open competition: Overview of the 2019 fastMRI challenge},
  author={Knoll, Florian and Murrell, Tullie and Sriram, Anuroop and Yakubova, Nafissa and Zbontar, Jure and Rabbat, Michael and Defazio, Aaron and Muckley, Matthew J and Sodickson, Daniel K and Zitnick, C Lawrence and others},
  journal={arXiv preprint arXiv:2001.02518},
  year={2020}
}