@article{einstein,
author =       "Albert Einstein",
title =        "{Zur Elektrodynamik bewegter Körper}",
journal =      "Annalen der Physik",
volume =       "322",
number =       "10",
pages =        "891--921",
year =         "1905"}

@book{latexcompanion,
author    = "Michel Goossens and Frank Mittelbach and Alexander Samarin",
title     = "The \LaTeX\ Companion",
year      = "1993",
publisher = "Addison-Wesley"}


@article{nalisnick2018deep,
  title={Do deep generative models know what they don't know?},
  author={Nalisnick, Eric and Matsukawa, Akihiro and Teh, Yee Whye and Gorur, Dilan and Lakshminarayanan, Balaji},
  journal={arXiv preprint arXiv:1810.09136},
  year={2018}
}

@misc{ren2019likelihood,
    title={Likelihood Ratios for Out-of-Distribution Detection},
    author={Jie Ren and Peter J. Liu and Emily Fertig and Jasper Snoek and Ryan Poplin and Mark A. DePristo and Joshua V. Dillon and Balaji Lakshminarayanan},
    year={2019},
    eprint={1906.02845},
    archivePrefix={arXiv},
    primaryClass={stat.ML}
}

@misc{daxberger2019bayesian,
    title={Bayesian Variational Autoencoders for Unsupervised Out-of-Distribution Detection},
    author={Erik Daxberger and José Miguel Hernández-Lobato},
    year={2019},
    eprint={1912.05651},
    archivePrefix={arXiv},
    primaryClass={cs.LG}
}

@misc{choi2019waic,
      title={WAIC, but Why? Generative Ensembles for Robust Anomaly Detection}, 
      author={Hyunsun Choi and Eric Jang and Alexander A. Alemi},
      year={2019},
      eprint={1810.01392},
      archivePrefix={arXiv},
      primaryClass={stat.ML}
}

@misc{nalisnick2019detecting,
      title={Detecting Out-of-Distribution Inputs to Deep Generative Models Using Typicality}, 
      author={Eric Nalisnick and Akihiro Matsukawa and Yee Whye Teh and Balaji Lakshminarayanan},
      year={2019},
      eprint={1906.02994},
      archivePrefix={arXiv},
      primaryClass={stat.ML}
}

@article{Lan2020PerfectDM,
  title={Perfect density models cannot guarantee anomaly detection},
  author={C. L. Lan and Laurent Dinh},
  journal={ArXiv},
  year={2020},
  volume={abs/2012.03808}
}

@inproceedings{
glazunov2022do,
title={Do Bayesian Variational Autoencoders Know What They Don't Know?},
author={Misha Glazunov and Apostolis Zarras},
booktitle={The 38th Conference on Uncertainty in Artificial Intelligence},
year={2022},
url={https://openreview.net/forum?id=SSr4JOIs5l5}
}

@misc{xiao2020likelihood,
      title={Likelihood Regret: An Out-of-Distribution Detection Score For Variational Auto-encoder}, 
      author={Zhisheng Xiao and Qing Yan and Yali Amit},
      year={2020},
      eprint={2003.02977},
      archivePrefix={arXiv},
      primaryClass={cs.LG}
}

@article{Serr2020GENERATIVEM,
  title={Input complexity and out-of-distribution detection with likelihood-based generative models},
  author={Serr{\`a}, Joan and {\'A}lvarez, David and G{\'o}mez, Vicen{\c{c}} and Slizovskaia, Olga and N{\'u}{\~n}ez, Jos{\'e} F and Luque, Jordi},
  journal={arXiv preprint arXiv:1909.11480},
  year={2019}
}

@misc{hendrycks2018deep,
    title={Deep Anomaly Detection with Outlier Exposure},
    author={Dan Hendrycks and Mantas Mazeika and Thomas Dietterich},
    year={2018},
    eprint={1812.04606},
    archivePrefix={arXiv},
    primaryClass={cs.LG}
}

@Article{cybenko,
author="Cybenko, G.",
title="Approximation by superpositions of a sigmoidal function",
journal_full="Mathematics of Control, Signals and Systems",
journal={Math. Control Signals Syst.},
year="1989",
volume="2",
number="4",
pages="303--314",
}

@article{hornik,
title = "Approximation capabilities of multilayer feedforward networks",
journal_full = "Neural Networks",
journal = {Neural Netw.},
volume = "4",
number = "2",
pages = "251--257",
year = "1991",
author_fullname = "Kurt Hornik",
author = {Hornik, K.},
}

@ARTICLE{pinkus,
    author_fullname = {Allan Pinkus},
    author = {Pinkus, A.},
    title = {Approximation theory of the {MLP} model in neural networks},
    journal_full = {Acta Numerica},
    journal = {Acta Numer.},
    year = {1999},
    volume = {8},
    pages = {143--195},
    publisher={Cambridge University Press}
}

@inproceedings{pixelcnn,
author = {Oord, A\"{a}ron van den and Kalchbrenner, Nal and Vinyals, Oriol and Espeholt, Lasse and Graves, Alex and Kavukcuoglu, Koray},
title = {Conditional Image Generation with PixelCNN Decoders},
year = {2016},
isbn = {9781510838819},
publisher = {Curran Associates Inc.},
address = {Red Hook, NY, USA},
abstract = {This work explores conditional image generation with a new image density model based on the PixelCNN architecture. The model can be conditioned on any vector, including descriptive labels or tags, or latent embeddings created by other networks. When conditioned on class labels from the ImageNet database, the model is able to generate diverse, realistic scenes representing distinct animals, objects, landscapes and structures. When conditioned on an embedding produced by a convolutional network given a single image of an unseen face, it generates a variety of new portraits of the same person with different facial expressions, poses and lighting conditions. We also show that conditional PixelCNN can serve as a powerful decoder in an image autoencoder. Additionally, the gated convolutional layers in the proposed model improve the log-likelihood of PixelCNN to match the state-of-the-art performance of PixelRNN on ImageNet, with greatly reduced computational cost.},
booktitle = {Proceedings of the 30th International Conference on Neural Information Processing Systems},
pages = {4797–4805},
numpages = {9},
location = {Barcelona, Spain},
series = {NIPS'16}
}

@inproceedings{
dinh2017density,
title={Density estimation using Real {NVP}},
author={Laurent Dinh and Jascha Sohl-Dickstein and Samy Bengio},
booktitle={International Conference on Learning Representations},
year={2017},
url={https://openreview.net/forum?id=HkpbnH9lx}
}


@misc{kingma2013autoencoding,
    title={Auto-Encoding Variational Bayes},
    author={Diederik P Kingma and Max Welling},
    year={2013},
    eprint={1312.6114},
    archivePrefix={arXiv},
    primaryClass={stat.ML}
}

@inproceedings{rezende2014stochastic,
  title={Stochastic backpropagation and approximate inference in deep generative models},
  author={Rezende, Danilo Jimenez and Mohamed, Shakir and Wierstra, Daan},
  booktitle={International conference on machine learning},
  pages={1278--1286},
  year={2014},
  organization={PMLR}
}

@misc{mnist,
title = {{MNIST} handwritten digit database},
author = {LeCun, Yann and Cortes, Corinna},
howpublished = {\url{http://yann.lecun.com/exdb/mnist/}},
year = 2010
}

@inproceedings{HernndezLobato2016ImportanceWA,
  title={Importance weighted autoencoders with random neural network parameters},
  author={Hern{\'a}ndez-Lobato, Daniel and Bui, Thang D and Li, Yinzhen and Hern{\'a}ndez-Lobato, Jos{\'e} Miguel and Turner, Richard E},
  booktitle={Workshop on Bayesian Deep Learning, NIPS},
  volume={2016},
  year={2016}
}


@article{Schirrmeister2020UnderstandingAD,
  title={Understanding Anomaly Detection with Deep Invertible Networks through Hierarchies of Distributions and Features},
  author = {Schirrmeister, Robin and Zhou, Yuxuan and Ball, Tonio and Zhang, Dan},
  journal={ArXiv},
  year={2020},
  month = {06},
  volume={abs/2006.10848}
}

@INPROCEEDINGS{jarrett,
  author={Jarrett, Kevin and Kavukcuoglu, Koray and Ranzato, Marc'Aurelio and LeCun, Yann},
  booktitle={2009 IEEE 12th International Conference on Computer Vision}, 
  title={What is the best multi-stage architecture for object recognition?}, 
  year={2009},
  volume={},
  number={},
  pages={2146-2153},
  doi={10.1109/ICCV.2009.5459469}}

@misc{kirichenko2020normalizing,
      title={Why Normalizing Flows Fail to Detect Out-of-Distribution Data}, 
      author={Polina Kirichenko and Pavel Izmailov and Andrew Gordon Wilson},
      year={2020},
      eprint={2006.08545},
      archivePrefix={arXiv},
      primaryClass={stat.ML}
}

@article{hvae,
  title={Hyperspherical variational auto-encoders},
  author={Davidson, Tim R and Falorsi, Luca and De Cao, Nicola and Kipf, Thomas and Tomczak, Jakub M},
  journal={arXiv preprint arXiv:1804.00891},
  year={2018}
}


@misc{yoshida,
  doi = {10.48550/ARXIV.1705.10941},  
  url = {https://arxiv.org/abs/1705.10941},  
  author = {Yoshida, Yuichi and Miyato, Takeru},  
  keywords = {Machine Learning (stat.ML), Machine Learning (cs.LG), FOS: Computer and information sciences, FOS: Computer and information sciences},  
  title = {Spectral Norm Regularization for Improving the Generalizability of Deep Learning},  
  publisher = {arXiv},  
  year = {2017},  
  copyright = {arXiv.org perpetual, non-exclusive license}
}

@misc{cisse,
  doi = {10.48550/ARXIV.1704.08847},  
  url = {https://arxiv.org/abs/1704.08847},  
  author = {Cisse, Moustapha and Bojanowski, Piotr and Grave, Edouard and Dauphin, Yann and Usunier, Nicolas},  
  keywords = {Machine Learning (stat.ML), Artificial Intelligence (cs.AI), Cryptography and Security (cs.CR), Machine Learning (cs.LG), FOS: Computer and information sciences, FOS: Computer and information sciences},  
  title = {Parseval Networks: Improving Robustness to Adversarial Examples},  
  publisher = {arXiv},  
  year = {2017},  
  copyright = {arXiv.org perpetual, non-exclusive license}
}

@misc{huster,
  doi = {10.48550/ARXIV.1807.09705},  
  url = {https://arxiv.org/abs/1807.09705},  
  author = {Huster, Todd and Chiang, Cho-Yu Jason and Chadha, Ritu},  
  keywords = {Machine Learning (cs.LG), Machine Learning (stat.ML), FOS: Computer and information sciences, FOS: Computer and information sciences},  
  title = {Limitations of the Lipschitz constant as a defense against adversarial examples},  
  publisher = {arXiv},  
  year = {2018},  
  copyright = {arXiv.org perpetual, non-exclusive license}
}

@misc{anil,
  doi = {10.48550/ARXIV.1811.05381},  
  url = {https://arxiv.org/abs/1811.05381},  
  author = {Anil, Cem and Lucas, James and Grosse, Roger},  
  keywords = {Machine Learning (cs.LG), Machine Learning (stat.ML), FOS: Computer and information sciences, FOS: Computer and information sciences},  
  title = {Sorting out Lipschitz function approximation},  
  publisher = {arXiv},  
  year = {2018},  
  copyright = {arXiv.org perpetual, non-exclusive license}
}

@inproceedings{Maale2019BIVAAV,
  title={BIVA: A Very Deep Hierarchy of Latent Variables for Generative Modeling},
  author={Lars Maal{\o}e and Marco Fraccaro and Valentin Li{\'e}vin and O. Winther},
  booktitle={NeurIPS},
  year={2019},
  month = {02}
}

@inproceedings{falorsi2018,
  title={Explorations in homeomorphic variational auto-encoding},
  author={Falorsi, Luca and de Haan, Pim and Davidson, Tim R and De Cao, Nicola and Weiler, Maurice and Forr{\'e}, Patrick and Cohen, Taco S},
  booktitle={TADGM Workshop @ ICML},
  year={2018}
}

 @inproceedings{xu2020,
  title={On variational learning of controllable representations for text without supervision},
  author={Xu, Peng and Cheung, Jackie Chi Kit and Cao, Yanshuai},
  booktitle={International Conference on Machine Learning},
  pages={10534--10543},
  year={2020},
  organization={PMLR}
}

@misc{ruizhe2021,
  doi = {10.48550/ARXIV.2110.03318},
  url = {https://arxiv.org/abs/2110.03318},
  author = {Li, Ruizhe and Peng, Xutan and Lin, Chenghua},
  keywords = {Machine Learning (cs.LG), Artificial Intelligence (cs.AI), Computation and Language (cs.CL), FOS: Computer and information sciences, FOS: Computer and information sciences},
  title = {On the Latent Holes of VAEs for Text Generation},
  publisher = {arXiv},
  year = {2021},
  copyright = {arXiv.org perpetual, non-exclusive license}
}

@article{xiao2017,
  title={Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms},
  author={Xiao, Han and Rasul, Kashif and Vollgraf, Roland},
  journal={arXiv preprint arXiv:1708.07747},
  year={2017}
}

@article{tarin,
  title={Deep learning for classical japanese literature},
  author={Clanuwat, Tarin and Bober-Irizar, Mikel and Kitamoto, Asanobu and Lamb, Alex and Yamamoto, Kazuaki and Ha, David},
  journal={arXiv preprint arXiv:1812.01718},
  year={2018}
}

@inproceedings{blundell2015weight,
  title={Weight uncertainty in neural network},
  author={Blundell, Charles and Cornebise, Julien and Kavukcuoglu, Koray and Wierstra, Daan},
  booktitle={International conference on machine learning},
  pages={1613--1622},
  year={2015},
  organization={PMLR}
}

@inproceedings{barrett2021,
  title={Certifiably robust variational autoencoders},
  author={Barrett, Ben and Camuto, Alexander and Willetts, Matthew and Rainforth, Tom},
  booktitle={International Conference on Artificial Intelligence and Statistics},
  pages={3663--3683},
  year={2022},
  organization={PMLR}
}

@incollection{Andriushchenko,
	title = {Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation},
	author = {Hein, Matthias and Andriushchenko, Maksym},
	booktitle = {Advances in Neural Information Processing Systems 30},
	editor = {I. Guyon and U. V. Luxburg and S. Bengio and H. Wallach and R. Fergus and S. Vishwanathan and R. Garnett},
	pages = {2263--2273},
	year = {2017},
	publisher = {Curran Associates, Inc.}
}

@inproceedings{tsuzuku,
author = {Tsuzuku, Yusuke and Sato, Issei and Sugiyama, Masashi},
title = {Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networks},
year = {2018},
publisher = {Curran Associates Inc.},
address = {Red Hook, NY, USA},
booktitle = {Proceedings of the 32nd International Conference on Neural Information Processing Systems},
pages = {6542–6551},
numpages = {10},
location = {Montr\'{e}al, Canada},
series = {NIPS'18}
}

@misc{yang2020,
  doi = {10.48550/ARXIV.2003.02460},
  url = {https://arxiv.org/abs/2003.02460},
  author = {Yang, Yao-Yuan and Rashtchian, Cyrus and Zhang, Hongyang and Salakhutdinov, Ruslan and Chaudhuri, Kamalika},
  keywords = {Machine Learning (cs.LG), Cryptography and Security (cs.CR), Machine Learning (stat.ML), FOS: Computer and information sciences, FOS: Computer and information sciences},  
  title = {A Closer Look at Accuracy vs. Robustness},  
  publisher = {arXiv},  
  year = {2020},  
  copyright = {arXiv.org perpetual, non-exclusive license}
}

@inproceedings{davis2006relationship,
  title={The relationship between Precision-Recall and ROC curves},
  author={Davis, Jesse and Goadrich, Mark},
  booktitle={Proceedings of the 23rd international conference on Machine learning},
  pages={233--240},
  year={2006}
}