@inproceedings{hendrycks2019augmix,
  title={AugMix: A Simple Data Processing Method to Improve Robustness and Uncertainty},
  author={Hendrycks, Dan and Mu, Norman and Cubuk, Ekin Dogus and Zoph, Barret and Gilmer, Justin and Lakshminarayanan, Balaji},
  booktitle={ICLR},
  year={2019}
}

@article{devries2017improved,
  title={Improved regularization of convolutional neural networks with cutout},
  author={DeVries, Terrance and Taylor, Graham W},
  journal={arXiv preprint arXiv:1708.04552},
  year={2017}
}
@inproceedings{yun2019cutmix,
      title={CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Features}, 
      author={Sangdoo Yun and Dongyoon Han and Seong Joon Oh and Sanghyuk Chun and Junsuk Choe and Youngjoon Yoo},
      year={2019},
      booktitle={ICCV}
}

@inproceedings{cubuk2018autoaugment,
  title={AutoAugment: Learning augmentation policies from data},
  author={Cubuk, Ekin D and Zoph, Barret and Mane, Dandelion and Vasudevan, Vijay and Le, Quoc V},
  booktitle={CVPR},
  year={2019}
}

@inproceedings{rusak2020simple,
  title={A simple way to make neural networks robust against diverse image corruptions},
  author={Rusak, Evgenia and Schott, Lukas and Zimmermann, Roland S and Bitterwolf, Julian and Bringmann, Oliver and Bethge, Matthias and Brendel, Wieland},
  booktitle={ECCV},
  year={2020}
}
@inproceedings{ford2019adversarial,
  title={Adversarial examples are a natural consequence of test error in noise},
  author={Ford, Nic and Gilmer, Justin and Carlini, Nicolas and Cubuk, Dogus},
  booktitle={ICML},
  year={2019}
}
@article{drucker1992improving,
  title={Improving generalization performance using double backpropagation},
  author={Drucker, Harris and LeCun, Yann},
  journal={IEEE Transactions on Neural Networks},
  year={1992}
}
@inproceedings{hendrycks2020many,
  title={The many faces of robustness: A critical analysis of out-of-distribution generalization},
  author={Hendrycks, Dan and Basart, Steven and Mu, Norman and Kadavath, Saurav and Wang, Frank and Dorundo, Evan and Desai, Rahul and Zhu, Tyler and Parajuli, Samyak and Guo, Mike and others},
  booktitle={ICCV},
  year={2021}
}
@inproceedings{yin2019fourier,
  title={A fourier perspective on model robustness in computer vision},
  author={Yin, Dong and Lopes, Raphael Gontijo and Shlens, Jonathon and Cubuk, Ekin D and Gilmer, Justin},
  booktitle={NeurIPS},
  year={2019}
}
@inproceedings{hendrycks2019benchmarking,
  title={Benchmarking neural network robustness to common corruptions and perturbations},
  author={Hendrycks, Dan and Dietterich, Thomas},
  booktitle={ICLR},
  year={2019}
}
@article{croce2020robustbench,
  title={RobustBench: a standardized adversarial robustness benchmark},
  author={Croce, Francesco and Andriushchenko, Maksym and Sehwag, Vikash and Flammarion, Nicolas and Chiang, Mung and Mittal, Prateek and Hein, Matthias},
  journal={arXiv preprint arXiv:2010.09670},
  year={2020}
}
@book {bental_robust_opt_book,
    AUTHOR = {Ben-Tal, Aharon and El Ghaoui, Laurent and Nemirovski, Arkadi},
     TITLE = {Robust optimization},
    SERIES = {Princeton Series in Applied Mathematics},
 PUBLISHER = {Princeton University Press, Princeton, NJ},
      YEAR = {2009},
     PAGES = {xxii+542}
}
@book {huber_robust_statistic,
    AUTHOR = {Huber, Peter J.},
     TITLE = {Robust statistics},
 PUBLISHER = {John Wiley \& Sons, Inc., New York},
      YEAR = {1981},
     PAGES = {ix+308}
}
@inproceedings{szegedy2013intriguing,
	title={Intriguing properties of neural networks},
	author={Szegedy, Christian and Zaremba, Wojciech and Sutskever, Ilya and Bruna, Joan and Erhan, Dumitru and Goodfellow, Ian and Fergus, Rob},
	booktitle={ICLR},
	year={2014}
}
@inproceedings{dodge2017study,
  title={A study and comparison of human and deep learning recognition performance under visual distortions},
  author={Dodge, Samuel and Karam, Lina},
  booktitle={ICCCN},
  year={2017}
}
@inproceedings{geirhos2018generalisation,
  title={Generalisation in humans and deep neural networks},
  author={Geirhos, Robert and Temme, Carlos R Medina and Rauber, Jonas and Sch{\"u}tt, Heiko H and Bethge, Matthias and Wichmann, Felix A},
  booktitle={NeurIPS},
  year={2018}
}
@article{goodfellow2014explaining,
	title={Explaining and Harnessing Adversarial Examples},
	author={Goodfellow, Ian J and Shlens, Jonathon and Szegedy, Christian},
	journal={ICLR},
	year={2015},
}
@inproceedings{hendrycks2019using,
  title={Using pre-training can improve model robustness and uncertainty},
  author={Hendrycks, Dan and Lee, Kimin and Mazeika, Mantas},
  booktitle={ICML},
  year={2019}
}
@article{hendrycks2020pretrained,
  title={Pretrained transformers improve out-of-distribution robustness},
  author={Hendrycks, Dan and Liu, Xiaoyuan and Wallace, Eric and Dziedzic, Adam and Krishnan, Rishabh and Song, Dawn},
  journal={arXiv preprint arXiv:2004.06100},
  year={2020}
}
@inproceedings{laidlaw2021perceptual,
    title={Perceptual Adversarial Robustness: Generalizable Defenses Against Unforeseen Threat Models},
    author={Cassidy Laidlaw and Sahil Singla and Soheil Feizi},
    booktitle={ICLR},
    year={2021}
}
@inproceedings{zhang2018unreasonable,
  title={The unreasonable effectiveness of deep features as a perceptual metric},
  author={Zhang, Richard and Isola, Phillip and Efros, Alexei A and Shechtman, Eli and Wang, Oliver},
  booktitle={CVPR},
  year={2018}
}
@inproceedings{xie2020adversarial,
  title={Adversarial examples improve image recognition},
  author={Xie, Cihang and Tan, Mingxing and Gong, Boqing and Wang, Jiang and Yuille, Alan L and Le, Quoc V},
  booktitle={CVPR},
  year={2020}
}
@inproceedings{andriushchenko2020understanding,
  title={Understanding and Improving Fast Adversarial Training},
  author={Andriushchenko, Maksym and Flammarion, Nicolas},
  booktitle={NeurIPS},
  year={2020}
}
@inproceedings{
    wong2021learning,
    title={Learning perturbation sets for robust machine learning},
    author={Eric Wong and J Zico Kolter},
    booktitle={ICLR},
    year={2021}
}
@inproceedings{xu2016automatically,
  title={Automatically evading classifiers},
  author={Xu, Weilin and Qi, Yanjun and Evans, David},
  booktitle={Proceedings of the 2016 Network and Distributed Systems Symposium},
  pages={21--24},
  year={2016}
}

@inproceedings{croce2019sparse,
  title={Sparse and Imperceivable Adversarial Attacks},
  author={Croce, Francesco and Hein, Matthias},
  booktitle={ICCV},
  year={2019}
}

@inproceedings{cheng2018query,
  title={Query-efficient hard-label black-box attack: An optimization-based approach},
  author={Cheng, M. and Le, T. and Chen, P.-Y. and Yi, J. and Zhang, H. and Hsieh, C.-J.},
  booktitle={ICLR},
  year={2019}
}

@inproceedings{guo2018low,
  title={Low frequency adversarial perturbation},
  author={Guo, C. and Frank, J. S and Weinberger, K. Q},
  booktitle={UAI},
  year={2019}
}

@Book{BoyVan2004,
  author =   {S. Boyd and L. Vandenberghe},
  title =    {Convex Optimization},
  publisher ={Cambridge University Press},
  ADDRESS = {Cambridge},
  year =     {2004}
}

@inproceedings{CroHei2019,
	author    = {Francesco Croce and Matthias Hein},
	title     = {Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack},
	booktitle = {ICML},
	year      = {2020}
}
@inproceedings{fawzi2016measuring,
  title={Measuring the effect of nuisance variables on classifiers},
  author={Fawzi, Alhussein and Frossard, Pascal},
  booktitle={British Machine Vision Conference (BMVC)},
  year={2016}
}
@inproceedings{chen2017zoo,
   title={ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models},
   ISBN={9781450352024},
   booktitle={10th ACM Workshop on Artificial Intelligence and Security - AISec  ’17},
   publisher={ACM Press},
   author={Chen, Pin-Yu and Zhang, Huan and Sharma, Yash and Yi, Jinfeng and Hsieh, Cho-Jui},
   year={2017}
}
@inproceedings{
        liu2018signsgd,
        title={sign{SGD} via Zeroth-Order Oracle},
        author={Sijia Liu and Pin-Yu Chen and Xiangyi Chen and Mingyi Hong},
        booktitle={International Conference on Learning Representations},
        year={2019},
        url={https://openreview.net/forum?id=BJe-DsC5Fm},
}
@unpublished{suya2019hybrid,
    title={Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queries},
    author={Fnu Suya and Jianfeng Chi and David Evans and Yuan Tian},
    year={2019},
    note={arXiv preprint, arXiv:1908.07000},
}
@article{zabinsky2010random,
  title={Random search algorithms},
  author={Zabinsky, Zelda B},
  journal={Wiley encyclopedia of operations research and management science},
  year={2010},
  publisher={Wiley Online Library}
}
@inproceedings{croce2020reliable,
  title={Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks},
  author={Croce, Francesco and Hein, Matthias},
  booktitle={ICML},
  year={2020}
}
@inproceedings{karmon2018lavan,
  title={Lavan: Localized and visible adversarial noise},
  author={Karmon, Danny and Zoran, Daniel and Goldberg, Yoav},
  booktitle={ICML},
  year={2018}
}
@inproceedings{yu2017dilated,
  title={Dilated residual networks},
  author={Yu, Fisher and Koltun, Vladlen and Funkhouser, Thomas},
  booktitle={CVPR},
  year={2017}
}

@inproceedings{
	wong2020fast,
	title={Fast is better than free: Revisiting adversarial training},
	author={Eric Wong and Leslie Rice and J. Zico Kolter},
	booktitle={ICLR},
	year={2020}
}

@inproceedings{chen2020adversarial,
  title={Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuning},
  author={Chen, Tianlong and Liu, Sijia and Chang, Shiyu and Cheng, Yu and Amini, Lisa and Wang, Zhangyang},
  booktitle={Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition},
  pages={699--708},
  year={2020}
}

@inproceedings{tramer2020adaptive,
  title={On adaptive attacks to adversarial example defenses},
  author={Tram{\`e}r, Florian and Carlini, Nicholas and Brendel, Wieland and Madry, Aleksander},
  booktitle={NeurIPS},
  year={2020}
}

@article{papernot2018cleverhans,
  title={Technical Report on the CleverHans v2.1.0 Adversarial Examples Library},
  author={Nicolas Papernot and Fartash Faghri and Nicholas Carlini and
  Ian Goodfellow and Reuben Feinman and Alexey Kurakin and Cihang Xie and
  Yash Sharma and Tom Brown and Aurko Roy and Alexander Matyasko and
  Vahid Behzadan and Karen Hambardzumyan and Zhishuai Zhang and
  Yi-Lin Juang and Zhi Li and Ryan Sheatsley and Abhibhav Garg and
  Jonathan Uesato and Willi Gierke and Yinpeng Dong and David Berthelot and
  Paul Hendricks and Jonas Rauber and Rujun Long},
  journal={arXiv preprint arXiv:1610.00768},
  year={2018}
}

@article{goodman2020advbox,
  title={Advbox: a toolbox to generate adversarial examples that fool neural networks},
  author={Goodman, Dou and Xin, Hao and Yang, Wang and Yuesheng, Wu and Junfeng, Xiong and Huan, Zhang},
  journal={arXiv preprint arXiv:2001.05574},
  year={2020}
}
@article{ding2019advertorch,
  title={{AdverTorch} v0.1: An Adversarial Robustness Toolbox based on PyTorch},
  author={Ding, Gavin Weiguang and Wang, Luyu and Jin, Xiaomeng},
  journal={arXiv preprint arXiv:1902.07623},
  year={2019}
}

@article{art2018,
    title = {Adversarial Robustness Toolbox v1.2.0},
    author = {Nicolae, Maria-Irina and Sinn, Mathieu and Tran, Minh~Ngoc and Buesser, Beat and Rawat, Ambrish and Wistuba, Martin and Zantedeschi, Valentina and Baracaldo, Nathalie and Chen, Bryant and Ludwig, Heiko and Molloy, Ian and Edwards, Ben},
    journal = {arXiv preprint arXiv:1807.01069},
    year = {2018}
}

@article{melis2019secml,
  title={secml: A Python Library for Secure and Explainable Machine Learning},
  author={Melis, Marco and Demontis, Ambra and Pintor, Maura and Sotgiu, Angelo and Biggio, Battista},
  journal={arXiv preprint arXiv:1912.10013},
  year={2019}
}

@inproceedings{dong2020benchmarking,
  title={Benchmarking Adversarial Robustness on Image Classification},
  author={Dong, Yinpeng and Fu, Qi-An and Yang, Xiao and Pang, Tianyu and Su, Hang and Xiao, Zihao and Zhu, Jun},
  booktitle={CVPR},
  year={2020}
}

@inproceedings{kurakin2018adversarial,
  title={Adversarial attacks and defences competition},
  author={Kurakin, Alexey and Goodfellow, Ian and Bengio, Samy and Dong, Yinpeng and Liao, Fangzhou and Liang, Ming and Pang, Tianyu and Zhu, Jun and Hu, Xiaolin and Xie, Cihang and others},
  booktitle={NeurIPS Competition Track},
  year={2018}
}

@inproceedings{brendel2018adversarial,
  title={Adversarial vision challenge},
  author={Brendel, Wieland and Rauber, Jonas and Kurakin, Alexey and Papernot, Nicolas and Veliqi, Behar and Salath{\'e}, Marcel and Mohanty, Sharada P and Bethge, Matthias},
  booktitle={NeurIPS Competition Track},
  year={2018}
}

@article{carlini2019critique,
  title={A critique of the deepsec platform for security analysis of deep learning models},
  author={Carlini, Nicholas},
  journal={arXiv preprint arXiv:1905.07112},
  year={2019}
}

@inproceedings{ling2019deepsec,
  title={Deepsec: A uniform platform for security analysis of deep learning model},
  author={Ling, Xiang and Ji, Shouling and Zou, Jiaxu and Wang, Jiannan and Wu, Chunming and Li, Bo and Wang, Ting},
  booktitle={IEEE S\&P},
  year={2019}
}

@article{shaham2015understanding,
	title={Understanding adversarial training: Increasing local stability of supervised models through robust optimization},
	author={Shaham, Uri and Yamada, Yutaro and Negahban, Sahand},
	journal={Neurocomputing},
	volume_hide={307},
	pages_hide={195--204},
	year={2018},
	publisher={Elsevier}
}

@article{wong2017provable,
	title={Provable defenses against adversarial examples via the convex outer adversarial polytope},
	author={Wong, Eric and Kolter, Zico},
	journal={ICML},
	pages_hide={5283--5292},
	year={2018},
}

@article{raghunathan2018certified,
	title={Certified defenses against adversarial examples},
	author={Raghunathan, Aditi and Steinhardt, Jacob and Liang, Percy},
	journal={ICLR},
	year={2018},
}
@article{carlini2019evaluating,
  title={On evaluating adversarial robustness},
  author={Carlini, Nicholas and Athalye, Anish and Papernot, Nicolas and Brendel, Wieland and Rauber, Jonas and Tsipras, Dimitris and Goodfellow, Ian and Madry, Aleksander and Kurakin, Alexey},
  journal={arXiv preprint arXiv:1902.06705},
  year={2019}
}

@inproceedings{katz2017reluplex,
	title={Reluplex: an efficient SMT solver for verifying deep neural networks},
	author={Katz, Guy and Barrett, Clark and Dill, David L and Julian, Kyle and Kochenderfer, Mykel J},
	booktitle={ICCAV},
	pages_hide={97--117},
	year={2017}
}

@inproceedings{weng2018towards,
	title={Towards Fast Computation of Certified Robustness for ReLU Networks},
	author={Weng, Tsui-Wei and Zhang, Huan and Chen, Hongge and Song, Zhao and Hsieh, Cho-Jui and Boning, Duane and Dhillon, Inderjit S. and Daniel, Luca},	
	booktitle={ICML},
	year={2018},
}

@inproceedings{lecuyer2019certified,
  title={Certified robustness to adversarial examples with differential privacy},
  author={Lecuyer, Mathias and Atlidakis, Vaggelis and Geambasu, Roxana and Hsu, Daniel and Jana, Suman},
  booktitle={2019 IEEE S\&P},
  year={2019}
}

@inproceedings{hendrycks2016baselineOOD,
  title={A baseline for detecting misclassified and out-of-distribution examples in neural networks},
  author={Hendrycks, Dan and Gimpel, Kevin},
  booktitle={ICLR},
  year={2017}
}
@article{gilmer2018motivating,
  title={Motivating the rules of the game for adversarial example research},
  author={Gilmer, Justin and Adams, Ryan P and Goodfellow, Ian and Andersen, David and Dahl, George E},
  journal={arXiv preprint arXiv:1807.06732},
  year={2018}
}
@article{jordan2019quantifying,
  title={Quantifying perceptual distortion of adversarial examples},
  author={Jordan, Matt and Manoj, Naren and Goel, Surbhi and Dimakis, Alexandros G},
  journal={arXiv preprint arXiv:1902.08265},
  year={2019}
}
@inproceedings{wong2019wasserstein,
  title={Wasserstein adversarial examples via projected sinkhorn iterations},
  author={Wong, Eric and Schmidt, Frank R and Kolter, J Zico},
  booktitle={ICML},
  year={2019}
}
@article{wong2020learning,
  title={Learning perturbation sets for robust machine learning},
  author={Wong, Eric and Kolter, J Zico},
  journal={arXiv preprint arXiv:2007.08450},
  year={2020}
}
@inproceedings{
    engstrom2019exploring,
    title={Exploring the Landscape of Spatial Robustness},
    author={Logan Engstrom and Brandon Tran and Dimitris Tsipras and Ludwig Schmidt and Aleksander Madry},
    booktitle={ICML},
    year={2019}
}
@inproceedings{fawzi2015manitest,
  title={Manitest: Are classifiers really invariant?},
  author={Fawzi, Alhussein and Frossard, Pascal},
  booktitle={BMVC},
  year={2015}
}
@article{hu2020improved,
  title={Improved Image Wasserstein Attacks and Defenses},
  author={Hu, J Edward and Swaminathan, Adith and Salman, Hadi and Yang, Greg},
  journal={ICLR Workshop: Towards Trustworthy ML: Rethinking Security and Privacy for ML},
  year={2020}
}
@inproceedings{stutz2019disentangling,
  title={Disentangling adversarial robustness and generalization},
  author={Stutz, David and Hein, Matthias and Schiele, Bernt},
  booktitle={CVPR},
  year={2019}
}
@inproceedings{laidlaw2019functional,
  title={Functional adversarial attacks},
  author={Laidlaw, Cassidy and Feizi, Soheil},
  booktitle={NeurIPS},
  year={2019}
}

@inproceedings{he2016deep,
  title={Deep residual learning for image recognition},
  author={He, Kaiming and Zhang, Xiangyu and Ren, Shaoqing and Sun, Jian},
  booktitle={CVPR},
  year={2016}
}

@inproceedings{zagoruyko2016wide,
  title={Wide residual networks},
  author={Zagoruyko, Sergey and Komodakis, Nikos},
  booktitle={BMVC},
  year={2016}
}



@article{salman2020adversarially,
  title={Do Adversarially Robust ImageNet Models Transfer Better?},
  author={Salman, Hadi and Ilyas, Andrew and Engstrom, Logan and Kapoor, Ashish and Madry, Aleksander},
  journal={NeurIPS},
  year={2020}
}
@article{utrera2020adversarially,
  title={Adversarially-Trained Deep Nets Transfer Better},
  author={Utrera, Francisco and Kravitz, Evan and Erichson, N Benjamin and Khanna, Rajiv and Mahoney, Michael W},
  journal={ICLR},
  year={2021}
}
@inproceedings{tsipras2018robustness,
  title={Robustness may be at odds with accuracy},
  author={Tsipras, Dimitris and Santurkar, Shibani and Engstrom, Logan and Turner, Alexander and Madry, Aleksander},
  booktitle={ICLR},
  year={2019}
}
@inproceedings{kaur2019perceptually,
  title={Are Perceptually-Aligned Gradients a General Property of Robust Classifiers?},
  author={Kaur, Simran and Cohen, Jeremy and Lipton, Zachary C},
  booktitle={NeurIPS Workshop: Science Meets Engineering of Deep Learning},
  year={2019}
}
@article{engstrom2019adversarial,
  title={Adversarial robustness as a prior for learned representations},
  author={Engstrom, Logan and Ilyas, Andrew and Santurkar, Shibani and Tsipras, Dimitris and Tran, Brandon and Madry, Aleksander},
  journal={arXiv preprint arXiv:1906.00945},
  year={2019}
}
@inproceedings{tramer2019adversarial,
  title={AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learning},
  author={Tram{\`e}r, Florian and Dupr{\'e}, Pascal and Rusak, Gili and Pellegrino, Giancarlo and Boneh, Dan},
  booktitle={ACM SIGSAC CCS},
  year={2019}
}
@inproceedings{saadatpanah2019adversarial,
  title={Adversarial attacks on copyright detection systems},
  author={Saadatpanah, Parsa and Shafahi, Ali and Goldstein, Tom},
  booktitle={ICML},
  year={2020}
}
@inproceedings{zhu2019freelb,
  title={Freelb: Enhanced adversarial training for natural language understanding},
  author={Zhu, Chen and Cheng, Yu and Gan, Zhe and Sun, Siqi and Goldstein, Tom and Liu, Jingjing},
  booktitle={ICLR},
  year={2019}
}
@article{bochkovskiy2020yolov4,
  title={YOLOv4: Optimal Speed and Accuracy of Object Detection},
  author={Bochkovskiy, Alexey and Wang, Chien-Yao and Liao, Hong-Yuan Mark},
  journal={arXiv preprint arXiv:2004.10934},
  year={2020}
}
@article{kang2019transfer,
  title={Transfer of adversarial robustness between perturbation types},
  author={Kang, Daniel and Sun, Yi and Brown, Tom and Hendrycks, Dan and Steinhardt, Jacob},
  journal={arXiv preprint arXiv:1905.01034},
  year={2019}
}
@article{zhong2020improving,
  title={Improving the Speed and Quality of GAN by Adversarial Training},
  author={Zhong, Jiachen and Liu, Xuanqing and Hsieh, Cho-Jui},
  journal={arXiv preprint arXiv:2008.03364},
  year={2020}
}

@article{li2020sok,
  title={SoK: Certified Robustness for Deep Neural Networks},
  author={Li, Linyi and Qi, Xiangyu and Xie, Tao and Li, Bo},
  journal={arXiv preprint arXiv:2009.04131},
  year={2020}
}

@article{blalock2020state,
  title={What is the state of neural network pruning?},
  author={Blalock, Davis and Ortiz, Jose Javier Gonzalez and Frankle, Jonathan and Guttag, John},
  journal={arXiv preprint arXiv:2003.03033},
  year={2020}
}

@article{recht2018cifar101,
  title={Do CIFAR-10 classifiers generalize to CIFAR-10?},
  author={Recht, Benjamin and Roelofs, Rebecca and Schmidt, Ludwig and Shankar, Vaishaal},
  journal={arXiv preprint arXiv:1806.00451},
  year={2018}
}

@article{darlow2018cinic,
  title={CINIC-10 is not ImageNet or CIFAR-10},
  author={Darlow, Luke N and Crowley, Elliot J and Antoniou, Antreas and Storkey, Amos J},
  journal={arXiv preprint arXiv:1810.03505},
  year={2018}
}

@inproceedings{augustin2020advoodexplain,
  title={Adversarial Robustness on In-and Out-Distribution Improves Explainability},
  author={Augustin, Maximilian and Meinke, Alexander and Hein, Matthias},
  booktitle={ECCV},
  year={2020}
}

@inproceedings{sehwag2019oodrobust,
  title={Analyzing the robustness of open-world machine learning},
  author={Sehwag, Vikash and Bhagoji, Arjun Nitin and Song, Liwei and Sitawarin, Chawin and Cullina, Daniel and Chiang, Mung and Mittal, Prateek},
  booktitle={12th ACM Workshop on Artificial Intelligence and Security},
  year={2019}
}


@article{song2020oodcritical,
  title={A Critical Evaluation of Open-World Machine Learning},
  author={Song, Liwei and Sehwag, Vikash and Bhagoji, Arjun Nitin and Mittal, Prateek},
  journal={arXiv preprint arXiv:2007.04391},
  year={2020}
}

@article{netzer2011svhn,
  title={Reading digits in natural images with unsupervised feature learning},
  author={Netzer, Yuval and Wang, Tao and Coates, Adam and Bissacco, Alessandro and Wu, Bo and Ng, Andrew Y},
  journal={Technical Report},
  year={2011}
}

@InProceedings{cimpoi14dtd,
  Author    = {Cimpoi, Mircea and Maji, Subhransu and Kokkinos, Iasonas and Mohamed, Sammy and Vedaldi, Andrea},
  Title     = {Describing Textures in the Wild},
  Booktitle = {CVPR},
  Year      = {2014}
}

@inproceedings{
    buckman2018thermometer,
    title={Thermometer Encoding: One Hot Way To Resist Adversarial Examples},
    author={Jacob Buckman and Aurko Roy and Colin Raffel and Ian Goodfellow},
    booktitle={ICLR},
    year={2018}
}
@inproceedings{
    guo2018countering,
    title={Countering Adversarial Images using Input Transformations},
    author={Chuan Guo and Mayank Rana and Moustapha Cisse and Laurens van der Maaten},
    booktitle={ICLR},
    year={2018}
}
@inproceedings{
    samangouei2018defensegan,
    title={Defense-{GAN}: Protecting Classifiers Against Adversarial Attacks Using Generative Models},
    author={Pouya Samangouei and Maya Kabkab and Rama Chellappa},
    booktitle={ICLR},
    year={2018}
}
@inproceedings{li2019generative,
  title={Are generative classifiers more robust to adversarial attacks?},
  author={Li, Yingzhen and Bradshaw, John and Sharma, Yash},
  booktitle={ICML},
  year={2019}
}
@inproceedings{verma2019error,
  title={Error correcting output codes improve probability estimation and adversarial robustness of deep neural networks},
  author={Verma, Gunjan and Swami, Ananthram},
  booktitle={Advances in Neural Information Processing Systems},
  pages={8646--8656},
  year={2019}
}
@inproceedings{
    pang2020mixup,
    title={Mixup Inference: Better Exploiting Mixup to Defend Adversarial Attacks},
    author={Tianyu Pang and Kun Xu and Jun Zhu},
    booktitle={ICLR},
    year={2020}
}
@inproceedings{yang2019me,
  title={Me-net: Towards effective adversarial robustness with matrix estimation},
  author={Yang, Yuzhe and Zhang, Guo and Katabi, Dina and Xu, Zhi},
  booktitle={ICML},
  year={2019}
}
@inproceedings{
    schott2018towards,
    title={Towards the first adversarially robust neural network model on {MNIST}},
    author={Lukas Schott and Jonas Rauber and Matthias Bethge and Wieland Brendel},
    booktitle={ICLR},
    year={2019}
}
@article{brown2018unrestricted,
  title={Unrestricted adversarial examples},
  author={Brown, Tom B and Carlini, Nicholas and Zhang, Chiyuan and Olsson, Catherine and Christiano, Paul and Goodfellow, Ian},
  journal={arXiv preprint arXiv:1809.08352},
  year={2018}
}
@misc{engstrom2019robustness,
   title={Robustness (Python Library)},
   author={Logan Engstrom and Andrew Ilyas and Hadi Salman and Shibani Santurkar and Dimitris Tsipras},
   year={2019},
   url={https://github.com/MadryLab/robustness}
}
@inproceedings{zhang2019theoretically, 
	author = {Hongyang Zhang and Yaodong Yu and Jiantao Jiao and Eric P. Xing and Laurent El Ghaoui and Michael I. Jordan}, 
	title = {Theoretically Principled Trade-off between Robustness and Accuracy}, 
	booktitle = {ICML},
	year = {2019}
}
@inproceedings{carmon2019unlabeled,
  title={Unlabeled data improves adversarial robustness},
  author={Carmon, Yair and Raghunathan, Aditi and Schmidt, Ludwig and Duchi, John C and Liang, Percy S},
  booktitle={NeurIPS},
  year={2019}
}
@article{gowal2019alternative,
  title={An alternative surrogate loss for pgd-based adversarial testing},
  author={Gowal, Sven and Uesato, Jonathan and Qin, Chongli and Huang, Po-Sen and Mann, Timothy and Kohli, Pushmeet},
  journal={arXiv preprint arXiv:1910.09338},
  year={2019}
}
@article{krizhevsky2009learning,
  title={Learning multiple layers of features from tiny images},
  author={Krizhevsky, Alex and Hinton, Geoffrey},
  journal={Technical Report},
  year={2009}
}
@article{kang2019testing,
  title={Testing robustness against unforeseen adversaries},
  author={Kang, Daniel and Sun, Yi and Hendrycks, Dan and Brown, Tom and Steinhardt, Jacob},
  journal={arXiv preprint arXiv:1908.08016},
  year={2019}
}
@inproceedings{tramer2019multiple,
  title={Adversarial training and robustness for multiple perturbations},
  author={Tram{\`e}r, Florian and Boneh, Dan},
  booktitle={NeurIPS},
  year={2019}
}
@inproceedings{maini2019adversarial,
  title={Adversarial robustness against the union of multiple perturbation models},
  author={Maini, Pratyush and Wong, Eric and Kolter, J Zico},
  booktitle={ICML},
  year={2020}
}
@inproceedings{croce2020sparse,
  title={Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attacks},
  author={Croce, Francesco and Andriushchenko, Maksym and Singh, Naman D and Flammarion, Nicolas and Hein, Matthias},
  booktitle={ECCV Workshop on Adversarial Robustness in the Real World},
  year={2020}
}
@inproceedings{modas2019sparsefool,
  title={Sparsefool: a few pixels make a big difference},
  author={Modas, Apostolos and Moosavi-Dezfooli, Seyed-Mohsen and Frossard, Pascal},
  booktitle={CVPR},
  year={2019}
}

@article{sehwag2020pruning,
  title={On pruning adversarially robust neural networks},
  author={Sehwag, Vikash and Wang, Shiqi and Mittal, Prateek and Jana, Suman},
  journal={NeurIPS},
  year={2020}
}

@inproceedings{Ding2020MMA,
    title={MMA Training: Direct Input Space Margin Maximization through Adversarial Training},
    author={Gavin Weiguang Ding and Yash Sharma and Kry Yik Chau Lui and Ruitong Huang},
    booktitle={ICLR},
    year={2020}
}
@article{paszke2017automatic,
  title={Automatic differentiation in PyTorch},
  author={Paszke, Adam and Gross, Sam and Chintala, Soumith and Chanan, Gregory and Yang, Edward and DeVito, Zachary and Lin, Zeming and Desmaison, Alban and Antiga, Luca and Lerer, Adam},
  journal={Technical Report},
  year={2017}
}
@inproceedings{raghunathan2020understanding,
  title={Understanding and mitigating the tradeoff between robustness and accuracy},
  author={Raghunathan, Aditi and Xie, Sang Michael and Yang, Fanny and Duchi, John and Liang, Percy},
  booktitle={ICML},
  year={2020}
}
@inproceedings{rice2020overfitting,
  title={Overfitting in adversarially robust deep learning},
  author={Rice, Leslie and Wong, Eric and Kolter, J Zico},
  booktitle={ICML},
  year={2020}
}
@inproceedings{recht2019imagenet,
  title={Do imagenet classifiers generalize to imagenet?},
  author={Recht, Benjamin and Roelofs, Rebecca and Schmidt, Ludwig and Shankar, Vaishaal},
  booktitle={ICML},
  year={2019}
}
@inproceedings{ACFH2020square,
  title={Square Attack: a query-efficient black-box adversarial attack via random search},
  author={Andriushchenko, Maksym and Croce, Francesco and Flammarion, Nicolas and Hein, Matthias},
  booktitle={ECCV},
  year={2020}
}
@inproceedings{hein2019relu,
  title={Why ReLU networks yield high-confidence predictions far away from the training data and how to mitigate the problem},
  author={Hein, Matthias and Andriushchenko, Maksym and Bitterwolf, Julian},
  booktitle={CVPR},
  year={2019}
}
@article{engstrom2018evaluating,
  title={Evaluating and understanding the robustness of adversarial logit pairing},
  author={Engstrom, Logan and Ilyas, Andrew and Athalye, Anish},
  journal={NeurIPS 2018 Workshop on Security in Machine Learning},
  year={2018}
}






@article{nakkiran2019deep,
  title={Deep double descent: Where bigger models and more data hurt},
  author={Nakkiran, Preetum and Kaplun, Gal and Bansal, Yamini and Yang, Tristan and Barak, Boaz and Sutskever, Ilya},
  journal={arXiv preprint arXiv:1912.02292},
  year={2019}
}
@inproceedings{neyshabur2017exploring,
  title={Exploring generalization in deep learning},
  author={Neyshabur, Behnam and Bhojanapalli, Srinadh and McAllester, David and Srebro, Nati},
  booktitle={Advances in neural information processing systems},
  pages={5947--5956},
  year={2017}
}
@article{geman1992neural,
  title={Neural networks and the bias/variance dilemma},
  author={Geman, Stuart and Bienenstock, Elie and Doursat, Ren{\'e}},
  journal={Neural computation},
  volume={4},
  number={1},
  pages={1--58},
  year={1992},
  publisher={MIT Press}
}
@article{neal2018modern,
  title={A modern take on the bias-variance tradeoff in neural networks},
  author={Neal, Brady and Mittal, Sarthak and Baratin, Aristide and Tantia, Vinayak and Scicluna, Matthew and Lacoste-Julien, Simon and Mitliagkas, Ioannis},
  journal={arXiv preprint arXiv:1810.08591},
  year={2018}
}
@article{belkin2018reconciling,
  title={Reconciling modern machine learning practice and the bias-variance trade-off},
  author={Belkin, Mikhail and Hsu, Daniel and Ma, Siyuan and Mandal, Soumik},
  journal={arXiv preprint arXiv:1812.11118},
  year={2018}
}
@article{nakkiran2019more,
  title={More data can hurt for linear regression: Sample-wise double descent},
  author={Nakkiran, Preetum},
  journal={arXiv preprint arXiv:1912.07242},
  year={2019}
}
@article{opper1995statistical,
  title={Statistical mechanics of learning: Generalization},
  author={Opper, Manfred},
  journal={The handbook of brain theory and neural networks},
  pages={922--925},
  year={1995}
}
@article{yang2020closer,
  title={A Closer Look at Accuracy vs. Robustness},
  author={Yang, Yao-Yuan and Rashtchian, Cyrus and Zhang, Hongyang and Salakhutdinov, Ruslan and Chaudhuri, Kamalika},
  journal={arXiv preprint arXiv:2003.02460},
  year={2020}
}
@article{balaji2019instance,
  title={Instance adaptive adversarial training: Improved accuracy tradeoffs in neural nets},
  author={Balaji, Yogesh and Goldstein, Tom and Hoffman, Judy},
  journal={arXiv preprint arXiv:1910.08051},
  year={2019}
}
@article{sanyal2020benign,
  title={How benign is benign overfitting?},
  author={Sanyal, Amartya and Dokania, Puneet K and Kanade, Varun and Torr, Philip HS},
  journal={arXiv preprint arXiv:2007.04028},
  year={2020}
}
@article{chen2020multiple,
  title={Multiple Descent: Design Your Own Generalization Curve},
  author={Chen, Lin and Min, Yifei and Belkin, Mikhail and Karbasi, Amin},
  journal={arXiv preprint arXiv:2008.01036},
  year={2020}
}
@article{chen2020more,
  title={More data can expand the generalization gap between adversarially robust and standard models},
  author={Chen, Lin and Min, Yifei and Zhang, Mingrui and Karbasi, Amin},
  journal={arXiv preprint arXiv:2002.04725},
  year={2020}
}
@article{min2020curious,
  title={The curious case of adversarially robust models: More data can help, double descend, or hurt generalization},
  author={Min, Yifei and Chen, Lin and Karbasi, Amin},
  journal={arXiv preprint arXiv:2002.11080},
  year={2020}
}
@inproceedings{schmidt2018adversarially,
  title={Adversarially robust generalization requires more data},
  author={Schmidt, Ludwig and Santurkar, Shibani and Tsipras, Dimitris and Talwar, Kunal and Madry, Aleksander},
  booktitle={Advances in Neural Information Processing Systems},
  pages={5014--5026},
  year={2018}
}
@article{dobriban2020provable,
  title={Provable tradeoffs in adversarially robust classification},
  author={Dobriban, Edgar and Hassani, Hamed and Hong, David and Robey, Alexander},
  journal={arXiv preprint arXiv:2006.05161},
  year={2020}
}
@article{montasser2020efficiently,
  title={Efficiently Learning Adversarially Robust Halfspaces with Noise},
  author={Montasser, Omar and Goel, Surbhi and Diakonikolas, Ilias and Srebro, Nathan},
  journal={arXiv preprint arXiv:2005.07652},
  year={2020}
}
@article{mei2019generalization,
  title={The generalization error of random features regression: Precise asymptotics and double descent curve},
  author={Mei, Song and Montanari, Andrea},
  journal={arXiv preprint arXiv:1908.05355},
  year={2019}
}
@article{nakkiran2019sgd,
  title={Sgd on neural networks learns functions of increasing complexity},
  author={Nakkiran, Preetum and Kaplun, Gal and Kalimeris, Dimitris and Yang, Tristan and Edelman, Benjamin L and Zhang, Fred and Barak, Boaz},
  journal={arXiv preprint arXiv:1905.11604},
  year={2019}
}
@article{bartlett2020benign,
  title={Benign overfitting in linear regression},
  author={Bartlett, Peter L and Long, Philip M and Lugosi, G{\'a}bor and Tsigler, Alexander},
  journal={Proceedings of the National Academy of Sciences},
  year={2020},
  publisher={National Acad Sciences}
}
@article{geiger2019jamming,
  title={Jamming transition as a paradigm to understand the loss landscape of deep neural networks},
  author={Geiger, Mario and Spigler, Stefano and d'Ascoli, St{\'e}phane and Sagun, Levent and Baity-Jesi, Marco and Biroli, Giulio and Wyart, Matthieu},
  journal={Physical Review E},
  volume={100},
  number={1},
  pages={012115},
  year={2019},
  publisher={APS}
}
@inproceedings{
    anonymous2021robust,
    title={Robust Overfitting may be mitigated by properly learned smoothening},
    author={Anonymous},
    booktitle={Submitted to International Conference on Learning Representations},
    year={2021},
    url={https://openreview.net/forum?id=qZzy5urZw9},
    note={under review}
}
@article{breiman1996bagging,
  title={Bagging predictors},
  author={Breiman, Leo},
  journal={Machine learning},
  volume={24},
  number={2},
  pages={123--140},
  year={1996},
  publisher={Springer}
}
@article{song2020robust,
  title={Robust and On-the-fly Dataset Denoising for Image Classification},
  author={Song, Jiaming and Hu, Lunjia and Dauphin, Yann and Auli, Michael and Ma, Tengyu},
  journal={arXiv preprint arXiv:2003.10647},
  year={2020}
}
@article{raskutti2014early,
  title={Early stopping and non-parametric regression: an optimal data-dependent stopping rule},
  author={Raskutti, Garvesh and Wainwright, Martin J and Yu, Bin},
  journal={The Journal of Machine Learning Research},
  volume={15},
  number={1},
  pages={335--366},
  year={2014},
  publisher={JMLR. org}
}
@article{yao2007early,
  title={On early stopping in gradient descent learning},
  author={Yao, Yuan and Rosasco, Lorenzo and Caponnetto, Andrea},
  journal={Constructive Approximation},
  volume={26},
  number={2},
  pages={289--315},
  year={2007},
  publisher={Springer}
}
@inproceedings{li2019towards,
  title={Towards explaining the regularization effect of initial large learning rate in training neural networks},
  author={Li, Yuanzhi and Wei, Colin and Ma, Tengyu},
  booktitle={Advances in Neural Information Processing Systems},
  pages={11674--11685},
  year={2019}
}
@article{shah2020pitfalls,
  title={The Pitfalls of Simplicity Bias in Neural Networks},
  author={Shah, Harshay and Tamuly, Kaustav and Raghunathan, Aditi and Jain, Prateek and Netrapalli, Praneeth},
  journal={arXiv preprint arXiv:2006.07710},
  year={2020}
}
@article{ren2018learning,
  title={Learning to reweight examples for robust deep learning},
  author={Ren, Mengye and Zeng, Wenyuan and Yang, Bin and Urtasun, Raquel},
  journal={arXiv preprint arXiv:1803.09050},
  year={2018}
}
@article{nakkiran2019adversarial,
  title={Adversarial robustness may be at odds with simplicity},
  author={Nakkiran, Preetum},
  journal={arXiv preprint arXiv:1901.00532},
  year={2019}
}
@inproceedings{gourdeau2019hardness,
  title={On the hardness of robust classification},
  author={Gourdeau, Pascale and Kanade, Varun and Kwiatkowska, Marta and Worrell, James},
  booktitle={Advances in Neural Information Processing Systems},
  pages={7446--7455},
  year={2019}
}
@article{advani2017high,
  title={High-dimensional dynamics of generalization error in neural networks},
  author={Advani, Madhu S and Saxe, Andrew M},
  journal={arXiv preprint arXiv:1710.03667},
  year={2017}
}
@article{feldman2020neural,
  title={What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimation},
  author={Feldman, Vitaly and Zhang, Chiyuan},
  journal={arXiv preprint arXiv:2008.03703},
  year={2020}
}
@inproceedings{gidel2019implicit,
  title={Implicit regularization of discrete gradient dynamics in linear neural networks},
  author={Gidel, Gauthier and Bach, Francis and Lacoste-Julien, Simon},
  booktitle={Advances in Neural Information Processing Systems},
  pages={3202--3211},
  year={2019}
}
@article{arpit2017closer,
  title={A closer look at memorization in deep networks},
  author={Arpit, Devansh and Jastrzebski, Stanislaw and Ballas, Nicolas and Krueger, David and Bengio, Emmanuel and Kanwal, Maxinder S and Maharaj, Tegan and Fischer, Asja and Courville, Aaron and Bengio, Yoshua and others},
  journal={arXiv preprint arXiv:1706.05394},
  year={2017}
}
@article{beyer2020we,
  title={Are we done with ImageNet?},
  author={Beyer, Lucas and H{\'e}naff, Olivier J and Kolesnikov, Alexander and Zhai, Xiaohua and Oord, A{\"a}ron van den},
  journal={arXiv preprint arXiv:2006.07159},
  year={2020}
}
@misc{ljung1991overtraining,
  title={Overtraining, regularization and searching for minimum in neural networks},
  author={Ljung, Lennart and Sjoberg, Jonas},
  year={1991},
  publisher={Linkoping University}
}
@article{pang2020bag,
  title={Bag of Tricks for Adversarial Training},
  author={Pang, Tianyu and Yang, Xiao and Dong, Yinpeng and Su, Hang and Zhu, Jun},
  journal={arXiv preprint arXiv:2010.00467},
  year={2020}
}
@article{huang2020self,
  title={Self-Adaptive Training: beyond Empirical Risk Minimization},
  author={Huang, Lang and Zhang, Chao and Zhang, Hongyang},
  journal={arXiv preprint arXiv:2002.10319},
  year={2020}
}
@inproceedings{li2020gradient,
  title={Gradient descent with early stopping is provably robust to label noise for overparameterized neural networks},
  author={Li, Mingchen and Soltanolkotabi, Mahdi and Oymak, Samet},
  booktitle={International Conference on Artificial Intelligence and Statistics},
  pages={4313--4324},
  year={2020},
  organization={PMLR}
}
@article{song2019prestopping,
  title={Prestopping: How does early stopping help generalization against label noise?},
  author={Song, Hwanjun and Kim, Minseok and Park, Dongmin and Lee, Jae-Gil},
  journal={arXiv preprint arXiv:1911.08059},
  year={2019}
}
@article{lukasik2020does,
  title={Does label smoothing mitigate label noise?},
  author={Lukasik, Michal and Bhojanapalli, Srinadh and Menon, Aditya Krishna and Kumar, Sanjiv},
  journal={arXiv preprint arXiv:2003.02819},
  year={2020}
}
@inproceedings{yang2020robustness,
  title={Robustness for non-parametric classification: A generic attack and defense},
  author={Yang, Yao-Yuan and Rashtchian, Cyrus and Wang, Yizhen and Chaudhuri, Kamalika},
  booktitle={International Conference on Artificial Intelligence and Statistics},
  pages={941--951},
  year={2020},
  organization={PMLR}
}
@article{javanmard2020precise_tradeoffs,
  title={Precise tradeoffs in adversarial training for linear regression},
  author={Javanmard, Adel and Soltanolkotabi, Mahdi and Hassani, Hamed},
  journal={arXiv preprint arXiv:2002.10477},
  year={2020}
}
@article{luo2019simple,
  title={A simple yet effective baseline for robust deep learning with noisy labels},
  author={Luo, Yucen and Zhu, Jun and Pfister, Tomas},
  journal={arXiv preprint arXiv:1909.09338},
  year={2019}
}
@article{haochen2020shape,
  title={Shape matters: Understanding the implicit bias of the noise covariance},
  author={HaoChen, Jeff Z and Wei, Colin and Lee, Jason D and Ma, Tengyu},
  journal={arXiv preprint arXiv:2006.08680},
  year={2020}
}


@article{varga2017gradient,
  title={Gradient regularization improves accuracy of discriminative models},
  author={Varga, D{\'a}niel and Csisz{\'a}rik, Adri{\'a}n and Zombori, Zsolt},
  journal={arXiv preprint arXiv:1712.09936},
  year={2017}
}
@inproceedings{bartlett2017spectrally,
  title={Spectrally-normalized margin bounds for neural networks},
  author={Bartlett, Peter L and Foster, Dylan J and Telgarsky, Matus J},
  booktitle={Advances in Neural Information Processing Systems},
  pages={6240--6249},
  year={2017}
}

@inproceedings{menon2019can,
  title={Can gradient clipping mitigate label noise?},
  author={Menon, Aditya Krishna and Rawat, Ankit Singh and Reddi, Sashank J and Kumar, Sanjiv},
  booktitle={International Conference on Learning Representations},
  year={2019}
}
@article{javanmard2020precise_statistical,
  title={Precise statistical analysis of classification accuracies for adversarial training},
  author={Javanmard, Adel and Soltanolkotabi, Mahdi},
  journal={arXiv preprint arXiv:2010.11213},
  year={2020}
}

@article{liu2020early,
  title={Early-learning regularization prevents memorization of noisy labels},
  author={Liu, Sheng and Niles-Weed, Jonathan and Razavian, Narges and Fernandez-Granda, Carlos},
  journal={Advances in Neural Information Processing Systems},
  volume={33},
  year={2020}
}

@article{ferrari2010maximum,
  title={Maximum Lq-likelihood estimation},
  author={Ferrari, Davide and Yang, Yuhong and others},
  journal={The Annals of Statistics},
  volume={38},
  number={2},
  pages={753--783},
  year={2010},
  publisher={Institute of Mathematical Statistics}
}
@article{ghosh2017robust,
  title={Robust loss functions under label noise for deep neural networks},
  author={Ghosh, Aritra and Kumar, Himanshu and Sastry, PS},
  journal={AAAI},
  year={2017}
}
@article{bertsimas2019robust,
  title={Robust classification},
  author={Bertsimas, Dimitris and Dunn, Jack and Pawlowski, Colin and Zhuo, Ying Daisy},
  journal={INFORMS Journal on Optimization},
  volume={1},
  number={1},
  pages={2--34},
  year={2019},
  publisher={INFORMS}
}
@article{xu2009robustness,
  title={Robustness and Regularization of Support Vector Machines.},
  author={Xu, Huan and Caramanis, Constantine and Mannor, Shie},
  journal={Journal of machine learning research},
  volume={10},
  number={7},
  year={2009}
}
@article{foret2020sharpness,
  title={Sharpness-Aware Minimization for Efficiently Improving Generalization},
  author={Foret, Pierre and Kleiner, Ariel and Mobahi, Hossein and Neyshabur, Behnam},
  journal={arXiv preprint arXiv:2010.01412},
  year={2020}
}
@article{zhang2018generalized,
  title={Generalized cross entropy loss for training deep neural networks with noisy labels},
  author={Zhang, Zhilu and Sabuncu, Mert},
  journal={Advances in neural information processing systems},
  volume={31},
  pages={8778--8788},
  year={2018}
}
@article{li2020towards,
  title={Towards Understanding Fast Adversarial Training},
  author={Li, Bai and Wang, Shiqi and Jana, Suman and Carin, Lawrence},
  journal={arXiv preprint arXiv:2006.03089},
  year={2020}
}
@book {huber_robust_stats,
    AUTHOR = {Huber, Peter J.},
     TITLE = {Robust statistics},
 PUBLISHER = {John Wiley \& Sons, Inc., New York},
      YEAR = {1981},
     PAGES = {ix+308}
}
@book {bental_robust_opt,
    AUTHOR = {Ben-Tal, Aharon and El Ghaoui, Laurent and Nemirovski, Arkadi},
     TITLE = {Robust optimization},
    SERIES = {Princeton Series in Applied Mathematics},
 PUBLISHER = {Princeton University Press, Princeton, NJ},
      YEAR = {2009},
     PAGES = {xxii+542}
}
@inproceedings{
    tramer2018ensemble,
    title={Ensemble Adversarial Training: Attacks and Defenses},
    author={Florian Tramèr and Alexey Kurakin and Nicolas Papernot and Ian Goodfellow and Dan Boneh and Patrick McDaniel},
    booktitle={ICLR},
    year={2018}
}
@inproceedings{
    madry2018towards,
    title={Towards Deep Learning Models Resistant to Adversarial Attacks},
    author={Aleksander Madry and Aleksandar Makelov and Ludwig Schmidt and Dimitris Tsipras and Adrian Vladu},
    booktitle={ICLR},
    year={2018}
}
@article{Nakkiran2019SGD,
  author    = {Preetum Nakkiran and
               Gal Kaplun and
               Dimitris Kalimeris and
               Tristan Yang and
               Benjamin L. Edelman and
               Fred Zhang and
               Boaz Barak},
  title     = {{SGD} on Neural Networks Learns Functions of Increasing Complexity},
  journal   = {NeurIPS},
  year      = {2019}
}

@inproceedings{moosavi2019robustness,
  title={Robustness via curvature regularization, and vice versa},
  author={Moosavi-Dezfooli, Seyed-Mohsen and Fawzi, Alhussein and Uesato, Jonathan and Frossard, Pascal},
  booktitle={CVPR},
  year={2019}
}
@article{amos2017input,
  title={Input convex neural networks},
  author={Amos, Brandon and Xu, Lei and Kolter, J Zico},
  journal={Proceedings of the 34th ICML-Volume 70},
  pages={146--155},
  year={2017},
  organization={JMLR.org}
}
@article{yao2018hessian,
  title={Hessian-based analysis of large batch training and robustness to adversaries},
  author={Yao, Zhewei and Gholami, Amir and Lei, Qi and Keutzer, Kurt and Mahoney, Michael W},
  journal={NeurIPS},
  pages={4949--4959},
  year={2018}
}
@article{
    xiao2018training,
    title={Training for Faster Adversarial Robustness Verification via Inducing Re{LU} Stability},
    author={Kai Y. Xiao and Vincent Tjeng and Nur Muhammad (Mahi) Shafiullah and Aleksander Madry},
    journal={ICLR},
    year={2019},
    url={https://openreview.net/forum?id=BJfIVjAcKm},
}
@article{croce19provable,
  title = 	 {Provable Robustness of ReLU networks via Maximization of Linear Regions},
  author = 	 {Croce, Francesco and Andriushchenko, Maksym and Hein, Matthias},
  booktitle = 	 {Proceedings of Machine Learning Research},
  pages = 	 {2057--2066},
  year = 	 {2019},
  editor = 	 {Chaudhuri, Kamalika and Sugiyama, Masashi},
  volume = 	 {89},
  series = 	 {Proceedings of Machine Learning Research},
  address = 	 {},
  month = 	 {16--18 Apr},
  publisher = 	 {PMLR},
  pdf = 	 {http://proceedings.mlr.press/v89/croce19a/croce19a.pdf},
  url = 	 {http://proceedings.mlr.press/v89/croce19a.html},
  abstract = 	 {It has been shown that neural network classifiers are not robust. This raises concerns about their usage in safety-critical systems. We propose in this paper a regularization scheme for ReLU networks which provably improves the robustness of the classifier by maximizing the linear regions of the classifier as well as the distance to the decision boundary. Using our regularization we can even find the minimal adversarial perturbation for a certain fraction of test points for large networks. In the experiments we show that our approach improves upon pure adversarial training both in terms of lower and upper bounds on the robustness and is comparable or better than the state of the art in terms of test error and robustness.}
}
@article{kurakin2016adversarial,
    title={Adversarial Machine Learning at Scale},
    author={Alexey Kurakin and Ian Goodfellow and Samy Bengio},
    year={2016},
    eprint={1611.01236},
    archivePrefix={arXiv},
    primaryClass={cs.CV}
}
@article{wang2019bilateral,
   title={Bilateral Adversarial Training: Towards Fast Training of More Robust Models Against Adversarial Attacks},
   ISBN={9781728148038},
   url={http://dx.doi.org/10.1109/ICCV.2019.00673},
   DOI={10.1109/iccv.2019.00673},
   journal={2019 IEEE/CVF International Conference on Computer Vision (ICCV)},
   publisher={IEEE},
   author={Wang, Jianyu and Zhang, Haichao},
   year={2019},
   month={Oct}
}
@article{qin2019adversarial,
    title={Adversarial Robustness through Local Linearization},
    author={Chongli Qin and James Martens and Sven Gowal and Dilip Krishnan and Krishnamurthy Dvijotham and Alhussein Fawzi and Soham De and Robert Stanforth and Pushmeet Kohli},
    year={2019},
    journal={NeurIPS}
}
@article{rice2020overfitting,
    title={Overfitting in adversarially robust deep learning},
    author={Leslie Rice and Eric Wong and J. Zico Kolter},
    year={2020},
    journal={ICML}
}
@article{ghorbani2019interpretation,
   title={Interpretation of Neural Networks Is Fragile},
   volume={33},
   ISSN={2159-5399},
   url={http://dx.doi.org/10.1609/aaai.v33i01.33013681},
   DOI={10.1609/aaai.v33i01.33013681},
   journal={Proceedings of the AAAI Conference on Artificial Intelligence},
   publisher={Association for the Advancement of Artificial Intelligence (AAAI)},
   author={Ghorbani, Amirata and Abid, Abubakar and Zou, James},
   year={2019},
   month={Jul},
   pages={3681–3688}
}
@article{zhang19theoretically,
  title = 	 {Theoretically Principled Trade-off between Robustness and Accuracy},
  author = 	 {Zhang, Hongyang and Yu, Yaodong and Jiao, Jiantao and Xing, Eric and Ghaoui, Laurent El and Jordan, Michael},
  journal = 	 {ICML},
  year = 	 {2019}
}
@article{hermann2019exploring,
    title={Exploring the Origins and Prevalence of Texture Bias in Convolutional Neural Networks},
    author={Katherine L. Hermann and Simon Kornblith},
    year={2019},
    eprint={1911.09071},
    archivePrefix={arXiv},
    primaryClass={cs.CV}
}
@article{
    geirhos2018imagenettrained,
    title={ImageNet-trained {CNN}s are biased towards texture; increasing shape bias improves accuracy and robustness.},
    author={Robert Geirhos and Patricia Rubisch and Claudio Michaelis and Matthias Bethge and Felix A. Wichmann and Wieland Brendel},
    journal={ICLR},
    year={2019}
}
@article{zhang2019propagate,
    title={You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle},
    author={Dinghuai Zhang and Tianyuan Zhang and Yiping Lu and Zhanxing Zhu and Bin Dong},
    year={2019},
    journal={NeurIPS}
}
@inproceedings{shafahi2019adversarial,
    title={Adversarial Training for Free!},
    author={Ali Shafahi and Mahyar Najibi and Amin Ghiasi and Zheng Xu and John Dickerson and Christoph Studer and Larry S. Davis and Gavin Taylor and Tom Goldstein},
    year={2019},
    booktitle={NeurIPS}
}
@inproceedings{
    xie2020intriguing,
    title={Intriguing Properties of Adversarial Training at Scale},
    author={Cihang Xie and Alan Yuille},
    booktitle={ICLR},
    year={2020}
}
@article{gu2014deep,
    title={Towards Deep Neural Network Architectures Robust to Adversarial Examples},
    author={Shixiang Gu and Luca Rigazio},
    year={2015},
    eprint={1412.5068},
    archivePrefix={arXiv},
    primaryClass={cs.LG},
    journal={ICLR workshops}
}
@article{ross2018improving,
  title={Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients},
  author={Ross, Andrew Slavin and Doshi-Velez, Finale},
  journal={AAAI},
  year={2018}
}
@article{simon2019first,
  title={First-order adversarial vulnerability of neural networks and input dimension},
  author={Simon-Gabriel, Carl-Johann and Ollivier, Yann and Bottou, Leon and Sch{\"o}lkopf, Bernhard and Lopez-Paz, David},
  journal={ICML},
  year={2019}
}
@article{alayrac2019arelabels,
  author    = {Jean{-}Baptiste Alayrac and
               Jonathan Uesato and
               Po{-}Sen Huang and
               Robert Stanforth and
               Alhussein Fawzi and
               Pushmeet Kohli},
  title     = {Are Labels Required for Improving Adversarial Robustness?},
  journal   = {NeurIPS},
  year      = {2019}
}
@article{kannan2018adversarial,
  author    = {Harini Kannan and
               Alexey Kurakin and
               Ian J. Goodfellow},
  title     = {Adversarial Logit Pairing},
  journal   = {CoRR},
  volume    = {abs/1803.06373},
  year      = {2018},
  archivePrefix = {arXiv},
  eprint    = {1803.06373},
  timestamp = {Mon, 13 Aug 2018 16:47:15 +0200},
  biburl    = {https://dblp.org/rec/journals/corr/abs-1803-06373.bib},
  bibsource = {dblp computer science bibliography, https://dblp.org}
}
@article{katz2017reluplex,
	title={Reluplex: an efficient SMT solver for verifying deep neural networks},
	author={Katz, Guy and Barrett, Clark and Dill, David L and Julian, Kyle and Kochenderfer, Mykel J},
	journal={ICCAV},
	pages_hide={97--117},
	year={2017}
}
@article{weng2018towards,
	title={Towards Fast Computation of Certified Robustness for ReLU Networks},
	author={Weng, Tsui-Wei and Zhang, Huan and Chen, Hongge and Song, Zhao and Hsieh, Cho-Jui and Boning, Duane and Dhillon, Inderjit S. and Daniel, Luca},	
	journal={ICML},
	year={2018},
}
@article{biggio2018wild,
	title={Wild patterns: ten years after the rise of adversarial machine learning},
	author={Biggio, Battista and Roli, Fabio},
	journal={Pattern Recognition},
	year={2018}
}
@article{santurkar2019image,
    title={Image Synthesis with a Single (Robust) Classifier},
    author={Shibani Santurkar and Dimitris Tsipras and Brandon Tran and Andrew Ilyas and Logan Engstrom and Aleksander Madry},
    year={2019},
    journal={NeurIPS}
}
@book{bental2009robust,
  title={Robust optimization},
  author={Ben-Tal, Aharon and El Ghaoui, Laurent and Nemirovski, Arkadi},
  volume={28},
  year={2009},
  publisher={Princeton University Press}
}
@book{zhou1998essentials,
  title={Essentials of robust control},
  author={Zhou, Kemin and Doyle, John Comstock},
  volume={104},
  year={1998},
  publisher={Prentice hall Upper Saddle River, NJ}
}
@article{schmidhuber2015deep,
  title={Deep learning in neural networks: An overview},
  author={Schmidhuber, J{\"u}rgen},
  journal={Neural networks},
  volume={61},
  pages={85--117},
  year={2015},
  publisher={Elsevier}
}
@article{lecun2015deep,
  title={Deep learning},
  author={LeCun, Yann and Bengio, Yoshua and Hinton, Geoffrey},
  journal={Nature},
  volume={521},
  number={7553},
  year={2015},
  publisher={Nature Publishing Group}
}
@article{wong2017provable,
	title={Provable defenses against adversarial examples via the convex outer adversarial polytope},
	author={Wong, Eric and Kolter, Zico},
	journal={ICML},
	pages_hide={5283--5292},
	year={2018},
}
@article{cohen2019certified,
	title={Certified adversarial robustness via randomized smoothing},
	author={Cohen, Jeremy M and Rosenfeld, Elan and Kolter, J Zico},
	journal={ICML},
	year={2019}
}
@article{gowal2018effectiveness,
	title={On the effectiveness of interval bound propagation for training verifiably robust models},
	author={Gowal, Sven and Dvijotham, Krishnamurthy and Stanforth, Robert and Bunel, Rudy and Qin, Chongli and Uesato, Jonathan and Mann, Timothy and Kohli, Pushmeet},
	journal={NeurIPS Workshop on Security in Machine Learning},
	year={2018}
}
@article{salman2019convex,
  title={A convex relaxation barrier to tight robustness verification of neural networks},
  author={Salman, Hadi and Yang, Greg and Zhang, Huan and Hsieh, Cho-Jui and Zhang, Pengchuan},
  journal={NeurIPS},
  pages={9832--9842},
  year={2019}
}
@article{raghunathan2018certified,
	title={Certified defenses against adversarial examples},
	author={Raghunathan, Aditi and Steinhardt, Jacob and Liang, Percy},
	journal={ICLR},
	year={2018},
}
@article{shaeiri2020towards,
  title={Towards Deep Learning Models Resistant to Large Perturbations},
  author={Shaeiri, Amirreza and Nobahari, Rozhin and Rohban, Mohammad Hossein},
  journal={arXiv preprint arXiv:2003.13370},
  year={2020}
}
@book{gonzales2002digital,
  title={Digital image processing (2nd edition)},
  author={Gonzales, Rafael C and Woods, Richard E},
  year={2002},
  publisher={Prentice Hall New Jersey}
}
@article{wang2019resnets,
  title={ResNets Ensemble via the Feynman-Kac Formalism to Improve Natural and Robust Accuracies},
  author={Wang, Bao and Shi, Zuoqiang and Osher, Stanley},
  journal={NeurIPS},
  pages={1655--1665},
  year={2019}
}
@article{saligrama2020revisiting,
  title={Revisiting Ensembles in an Adversarial Context: Improving Natural Accuracy},
  author={Saligrama, Aditya and Leclerc, Guillaume},
  journal={arXiv preprint arXiv:2002.11572},
  year={2020}
}
@article{wang2019convergence,
  title={On the convergence and robustness of adversarial training},
  author={Wang, Yisen and Ma, Xingjun and Bailey, James and Yi, Jinfeng and Zhou, Bowen and Gu, Quanquan},
  journal={ICML},
  year={2019}
}
@article{mosbach2018logit,
  title={Logit pairing methods can fool gradient-based attacks},
  author={Mosbach, Marius and Andriushchenko, Maksym and Trost, Thomas and Hein, Matthias and Klakow, Dietrich},
  journal={NeurIPS 2018 Workshop on Security in Machine Learning},
  year={2018}
}
@article{andriushchenko2019square,
  title={Square Attack: a query-efficient black-box adversarial attack via random search},
  author={Andriushchenko, Maksym and Croce, Francesco and Flammarion, Nicolas and Hein, Matthias},
  journal={arXiv preprint arXiv:1912.00049},
  year={2019}
}
@article{athalye2018obfuscated,
    title={Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples},
    author={Anish Athalye and Nicholas Carlini and David Wagner},
    year={2018},
    eprint={1802.00420},
    archivePrefix={arXiv},
    primaryClass={cs.LG}
}
@article{
    lee2019towards,
    title={Towards Robust, Locally Linear Deep Networks},
    author={Guang-He Lee and David Alvarez-Melis and Tommi S. Jaakkola},
    journal={ICLR},
    year={2019},
    url={https://openreview.net/forum?id=SylCrnCcFX},
}
@article{pang2019improving,
  title={Improving adversarial robustness via promoting ensemble diversity},
  author={Pang, Tianyu and Xu, Kun and Du, Chao and Chen, Ning and Zhu, Jun},
  journal={arXiv preprint arXiv:1901.08846},
  year={2019}
}
@article{babu2020single,
  title={Single-step Adversarial training with Dropout Scheduling},
  author={B. S. Vivek and R. Venkatesh Babu},
  journal={CVPR},
  year={2020}
}
@article{globerson2006nightmare,
  title={Nightmare at test time: robust learning by feature deletion},
  author={Globerson, Amir and Roweis, Sam},
  journal={ICML},
  year={2006}
}
@article{carlini2017provably,
  title={Provably minimally-distorted adversarial examples},
  author={Carlini, Nicholas and Katz, Guy and Barrett, Clark and Dill, David L},
  journal={arXiv preprint arXiv:1709.10207},
  year={2017}
}
@article{tjeng2017evaluating,
  title={Evaluating robustness of neural networks with mixed integer programming},
  author={Tjeng, Vincent and Xiao, Kai and Tedrake, Russ},
  journal={ICLR},
  year={2019}
}
@article{he2015delving,
  title={Delving deep into rectifiers: Surpassing human-level performance on imagenet classification},
  author={He, Kaiming and Zhang, Xiangyu and Ren, Shaoqing and Sun, Jian},
  journal={ICCV},
  year={2015}
}
@article{smith2017cyclical,
  title={Cyclical learning rates for training neural networks},
  author={Smith, Leslie N},
  journal={WACV},
  year={2017}
}
@article{micikevicius2018mixed,
  title={Mixed precision training},
  author={Micikevicius, Paulius and Narang, Sharan and Alben, Jonah and Diamos, Gregory and Elsen, Erich and Garcia, David and Ginsburg, Boris and Houston, Michael and Kuchaiev, Oleksii and Venkatesh, Ganesh and others},
  journal={ICLR},
  year={2018}
}

@article {juditsky2011solving,
    AUTHOR = {Juditsky, Anatoli and Nemirovski, Arkadi and Tauvel, Claire},
     TITLE = {Solving variational inequalities with stochastic mirror-prox algorithm},
   JOURNAL = {Stochastic Systems},
  FJOURNAL = {Stochastic Systems},
      YEAR = {2011}
}

@article{he2016identity,
  title={Identity mappings in deep residual networks},
  author={He, Kaiming and Zhang, Xiangyu and Ren, Shaoqing and Sun, Jian},
  journal={ECCV},
  year={2016}
}

@article{etmann2019closer,
    title={A Closer Look at Double Backpropagation},
    author={Christian Etmann},
    year={2019},
    eprint={1906.06637},
    journal={arXiv preprint ArXiv:1906.06637},
    primaryClass={cs.LG}
}
@article{NIPS2017_6821,
	title = {Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation},
	author = {Hein, Matthias and Andriushchenko, Maksym},
	journal = {NeurIPS},
	year = {2017}
}
@article{gowal2019alternative,
  title={An alternative surrogate loss for pgd-based adversarial testing},
  author={Gowal, Sven and Uesato, Jonathan and Qin, Chongli and Huang, Po-Sen and Mann, Timothy and Kohli, Pushmeet},
  journal={arXiv preprint arXiv:1910.09338},
  year={2019}
}
@article{papernot2017practical,
  title={Practical black-box attacks against machine learning},
  author={Papernot, Nicolas and McDaniel, Patrick and Goodfellow, Ian and Jha, Somesh and Celik, Z Berkay and Swami, Ananthram},
  journal={ASIA CCS'17},
  year={2017}
}
@article{taori2020measuring,
  title={Measuring Robustness to Natural Distribution Shifts in Image Classification},
  author={Taori, Rohan and Dave, Achal and Shankar, Vaishaal and Carlini, Nicholas and Recht, Benjamin and Schmidt, Ludwig},
  journal={NeurIPS},
  year={2020}
}
@inproceedings{
    nakkiran2020deep,
    title={Deep Double Descent: Where Bigger Models and More Data Hurt},
    author={Preetum Nakkiran and Gal Kaplun and Yamini Bansal and Tristan Yang and Boaz Barak and Ilya Sutskever},
    booktitle={ICLR},
    year={2020}
}
@article{sokolic2017robust,
  title={Robust large margin deep neural networks},
  author={Sokoli{\'c}, Jure and Giryes, Raja and Sapiro, Guillermo and Rodrigues, Miguel RD},
  journal={IEEE Transactions on Signal Processing},
  volume={65},
  number={16},
  pages={4265--4280},
  year={2017},
  publisher={IEEE}
}
@inproceedings{su2018robustness,
  title={Is Robustness the Cost of Accuracy?--A Comprehensive Study on the Robustness of 18 Deep Image Classification Models},
  author={Su, Dong and Zhang, Huan and Chen, Hongge and Yi, Jinfeng and Chen, Pin-Yu and Gao, Yupeng},
  booktitle={Proceedings of the European Conference on Computer Vision (ECCV)},
  pages={631--648},
  year={2018}
}
@inproceedings{jiang2018mentornet,
  title={Mentornet: Learning data-driven curriculum for very deep neural networks on corrupted labels},
  author={Jiang, Lu and Zhou, Zhengyuan and Leung, Thomas and Li, Li-Jia and Fei-Fei, Li},
  booktitle={International Conference on Machine Learning},
  pages={2304--2313},
  year={2018},
  organization={PMLR}
}
@article{hoffman2019robust,
  title={Robust learning with jacobian regularization},
  author={Hoffman, Judy and Roberts, Daniel A and Yaida, Sho},
  journal={arXiv preprint arXiv:1908.02729},
  year={2019}
}
@inproceedings{foret2021sharpnessaware,
    title={Sharpness-aware Minimization for Efficiently Improving Generalization},
    author={Pierre Foret and Ariel Kleiner and Hossein Mobahi and Behnam Neyshabur},
    booktitle={International Conference on Learning Representations},
    year={2021},
    url={https://openreview.net/forum?id=6Tm1mposlrM}
}
@article{azulay2019deep,
  author  = {Aharon Azulay and Yair Weiss},
  title   = {Why do deep convolutional networks generalize so poorly to small image transformations?},
  journal = {JMLR},
  year    = {2019},
  volume  = {20},
  number  = {184},
  pages   = {1-25},
}
@article{radford2021learning,
  title={Learning Transferable Visual Models From Natural Language Supervision},
  author={Radford, Alec and Kim, Jong Wook and Hallacy, Chris and Ramesh, Aditya and Goh, Gabriel and Agarwal, Sandhini and Sastry, Girish and Askell, Amanda and Mishkin, Pamela and Clark, Jack and others},
  year={2021}
}
@inproceedings{sharif2018suitability,
  title={On the suitability of Lp-norms for creating and preventing adversarial examples},
  author={Sharif, Mahmood and Bauer, Lujo and Reiter, Michael K},
  booktitle={CVPR Workshops},
  year={2018}
}

@article{robey2020model,
  title={Model-based robust deep learning},
  author={Robey, Alexander and Hassani, Hamed and Pappas, George J},
  journal={arXiv preprint arXiv:2005.10247},
  year={2020}
}
@inproceedings{laermann2019achieving,
  title={Achieving generalizable robustness of deep neural networks by stability training},
  author={Laermann, Jan and Samek, Wojciech and Strodthoff, Nils},
  booktitle={GCPR},
  year={2019}
}

@article{bishop1995training, 
    author = {Bishop, Chris M.}, 
    title = {Training with Noise is Equivalent to {T}ikhonov Regularization}, 
    year = {1995}, issue_date = {Jan. 1995}, 
    publisher = {MIT Press}, 
    address = {Cambridge, MA, USA}, 
    volume = {7},
     number = {1}, 
    journal = {Neural Computation}, 
    month = jan, pages = {108–116}, 
    numpages = {9} 
}

@inproceedings{ilyas2019adversarial,
  title={Adversarial examples are not bugs, they are features},
  author={Ilyas, Andrew and Santurkar, Shibani and Tsipras, Dimitris and Engstrom, Logan and Tran, Brandon and Madry, Aleksander},
  booktitle={NeurIPS},
  year={2019}
}
@inproceedings{ortiz2020hold,
  title={Hold me tight! Influence of discriminative features on deep network boundaries},
  author={Ortiz-Jimenez, Guillermo and Modas, Apostolos and Moosavi-Dezfooli, Seyed-Mohsen and Frossard, Pascal},
  booktitle={NeurIPS},
  year={2020}
}
@inproceedings{jetley2018friends,
  title={With friends like these, who needs adversaries?},
  author={Jetley, Saumya and Lord, Nicholas A and Torr, Philip HS},
  booktitle={NeurIPS},
  year={2018}
}




@inproceedings{volpi2018generalizing,
 author = {Volpi, Riccardo and Namkoong, Hongseok and Sener, Ozan and Duchi, John C and Murino, Vittorio and Savarese, Silvio},
 booktitle = {NeurIPS},
 title = {Generalizing to Unseen Domains via Adversarial Data Augmentation},
 year = {2018}
}


@inproceedings{wei2020improved,
    title={Improved Sample Complexities for Deep Neural Networks and Robust Classification via an All-Layer Margin},
    author={Colin Wei and Tengyu Ma},
    booktitle={ICLR},
    year={2020}
}

@article{russakovsky2015imagenet,
  title={Imagenet large scale visual recognition challenge},
  author={Russakovsky, Olga and Deng, Jia and Su, Hao and Krause, Jonathan and Satheesh, Sanjeev and Ma, Sean and Huang, Zhiheng and Karpathy, Andrej and Khosla, Aditya and Bernstein, Michael and others},
  journal={IJCV},
  year={2015}
}

@inproceedings{kumari2019harnessing,
  title     = {Harnessing the Vulnerability of Latent Layers in Adversarially Trained Models},
  author    = {Kumari, Nupur and Singh, Mayank and Sinha, Abhishek and Machiraju, Harshitha and Krishnamurthy, Balaji and Balasubramanian, Vineeth N},
  booktitle = {Proceedings of the Twenty-Eighth International Joint Conference on
               Artificial Intelligence, {IJCAI-19}},
  publisher = {International Joint Conferences on Artificial Intelligence Organization},             
  pages     = {2779--2785},
  year      = {2019},
  month     = {7}
}

@inproceedings{croce2019provable,
  title={Provable robustness against all adversarial $ l\_p $-perturbations for p>=1},
  author={Croce, Francesco and Hein, Matthias},
  booktitle={ICLR},
  year={2020}
}
@inproceedings{zhang2018mixup,
  title={mixup: Beyond empirical risk minimization},
  author={Zhang, Hongyi and Cisse, Moustapha and Dauphin, Yann N and Lopez-Paz, David},
  booktitle={ICLR},
  year={2018}
}
@inproceedings{xie2019feature,
  title={Feature denoising for improving adversarial robustness},
  author={Xie, Cihang and Wu, Yuxin and Maaten, Laurens van der and Yuille, Alan L and He, Kaiming},
  booktitle={CVPR},
  year={2019}
}
@inproceedings{shafahi2020universal,
  title={Universal adversarial training},
  author={Shafahi, Ali and Najibi, Mahyar and Xu, Zheng and Dickerson, John and Davis, Larry S and Goldstein, Tom},
  booktitle={AAAI},
  year={2020}
}
@article{hendrycks2019natural,
  title={Natural adversarial examples},
  author={Hendrycks, Dan and Zhao, Kevin and Basart, Steven and Steinhardt, Jacob and Song, Dawn},
  journal={arXiv preprint arXiv:1907.07174},
  year={2019}
}
@inproceedings{krizhevsky2012imagenet,
  title={Imagenet classification with deep convolutional neural networks},
  author={Krizhevsky, Alex and Sutskever, Ilya and Hinton, Geoffrey},
  booktitle={NeurIPS},
  year={2012}
}
@article{gowal2020uncovering,
  title={Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples},
  author={Gowal, Sven and Qin, Chongli and Uesato, Jonathan and Mann, Timothy and Kohli, Pushmeet},
  journal={arXiv preprint arXiv:2010.03593},
  year={2020}
}
@article{huang2020bridging,
  title={Bridging the Performance Gap between FGSM and PGD Adversarial Training},
  author={Huang, Tianjin and Menkovski, Vlado and Pei, Yulong and Pechenizkiy, Mykola},
  journal={arXiv preprint arXiv:2011.05157},
  year={2020}
}
@inproceedings{guo2017calibration,
  title={On calibration of modern neural networks},
  author={Guo, Chuan and Pleiss, Geoff and Sun, Yu and Weinberger, Kilian Q},
  booktitle={International Conference on Machine Learning},
  pages={1321--1330},
  year={2017},
  organization={PMLR}
}
@article{mintun2021interaction,
  title={On Interaction Between Augmentations and Corruptions in Natural Corruption Robustness},
  author={Mintun, Eric and Kirillov, Alexander and Xie, Saining},
  journal={arXiv preprint arXiv:2102.11273},
  year={2021}
}
@article{yu2021understanding,
  title={Understanding Generalization in Adversarial Training via the Bias-Variance Decomposition},
  author={Yu, Yaodong and Yang, Zitong and Dobriban, Edgar and Steinhardt, Jacob and Ma, Yi},
  journal={arXiv preprint arXiv:2103.09947},
  year={2021}
}
@article{ovadia2019can,
  title={Can you trust your model's uncertainty? Evaluating predictive uncertainty under dataset shift},
  author={Ovadia, Yaniv and Fertig, Emily and Ren, Jie and Nado, Zachary and Sculley, David and Nowozin, Sebastian and Dillon, Joshua V and Lakshminarayanan, Balaji and Snoek, Jasper},
  journal={arXiv preprint arXiv:1906.02530},
  year={2019}
}

@article{rebuffi2021Fixing,
  title={Fixing Data Augmentation to Improve Adversarial Robustness},
  author={Rebuffi, Sylvestre-Alvise and Gowal, Sven and Calian, Dan A. and Stimberg, Florian and Wiles, Olivia and Mann, Timothy},
  journal={arXiv preprint arXiv:2103.01946},
  year={2021},
}

@inproceedings{schneider2020improving,
  title={Improving robustness against common corruptions by covariate shift adaptation},
  author={Schneider, Steffen and Rusak, Evgenia and Eck, Luisa and Bringmann, Oliver and Brendel, Wieland and Bethge, Matthias},
  booktitle={NeurIPS},
  year={2020}
}
@article{nandy2021adversarially,
  title={Adversarially trained models with test-time covariate shift adaptation},
  author={Nandy, Jay and Saha, Sudipan and Hsu, Wynne and Lee, Mong Li and Zhu, Xiao Xiang},
  journal={arXiv},
  year={2021}
}

