
@misc{Authors14,
 author = {Full Author Name},
 title = {The Frobnicatable Foo Filter},
 note = {Face and Gesture  submission ID 324. Supplied as additional material {\tt fg324.pdf}},
 year = 2014
}

@misc{Authors14b,
 author = {Full Author Name},
 title = {Frobnication Tutorial},
 note = {Supplied as additional material {\tt tr.pdf}},
 year = 2014
}

@article{Alpher02,
author = {Alvin Alpher},
title = {Frobnication},
journal = {Journal of Foo},
volume = 12, 
number = 1, 
pages = {234--778}, 
year = 2002
}

@article{Alpher03,
author = {Alvin Alpher and Ferris P.~N. Fotheringham-Smythe},
title = {Frobnication Revisited},
journal = {Journal of Foo},
volume = 13, 
number = 1, 
pages = {234--778}, 
year = 2003
}

@article{Alpher04,
author = {Alvin Alpher and Ferris P.~N. Fotheringham-Smythe and Gavin Gamow},
title = {Can a Machine Frobnicate?},
journal = {Journal of Foo},
volume = 14, 
number = 1, 
pages = {234--778}, 
year = 2004
}

@article{einstein,
author =       "Albert Einstein",
title =        "{Zur Elektrodynamik bewegter Körper}",
journal =      "Annalen der Physik",
volume =       "322",
number =       "10",
pages =        "891--921",
year =         "1905"}

@book{latexcompanion,
author    = "Michel Goossens and Frank Mittelbach and Alexander Samarin",
title     = "The \LaTeX\ Companion",
year      = "1993",
publisher = "Addison-Wesley"}

@inproceedings{rezende2014stochastic,
  title={Stochastic backpropagation and approximate inference in deep generative models},
  author={Rezende, Danilo Jimenez and Mohamed, Shakir and Wierstra, Daan},
  booktitle={International conference on machine learning},
  pages={1278--1286},
  year={2014},
  organization={PMLR}
}

@article{nalisnick2018deep,
  title={Do deep generative models know what they don't know?},
  author={Nalisnick, Eric and Matsukawa, Akihiro and Teh, Yee Whye and Gorur, Dilan and Lakshminarayanan, Balaji},
  journal={arXiv preprint arXiv:1810.09136},
  year={2018}
}

@inproceedings{blundell2015weight,
  title={Weight uncertainty in neural network},
  author={Blundell, Charles and Cornebise, Julien and Kavukcuoglu, Koray and Wierstra, Daan},
  booktitle={International conference on machine learning},
  pages={1613--1622},
  year={2015},
  organization={PMLR}
}

@misc{aleks2017deep,
    title={Towards Deep Learning Models Resistant to Adversarial Attacks},
    author={Aleksander Madry and Aleksandar Makelov and Ludwig Schmidt and Dimitris Tsipras and Adrian Vladu},
    year={2017},
    eprint={1706.06083},
    archivePrefix={arXiv},
    primaryClass={stat.ML}
}

@misc{li2018generative,
    title={Are Generative Classifiers More Robust to Adversarial Attacks?},
    author={Yingzhen Li and John Bradshaw and Yash Sharma},
    year={2018},
    eprint={1802.06552},
    archivePrefix={arXiv},
    primaryClass={cs.LG}
}

@misc{goodfellow2014explaining,
    title={Explaining and Harnessing Adversarial Examples},
    author={Ian J. Goodfellow and Jonathon Shlens and Christian Szegedy},
    year={2014},
    eprint={1412.6572},
    archivePrefix={arXiv},
    primaryClass={stat.ML}
}

@misc{papernot2016practical,
    title={Practical Black-Box Attacks against Machine Learning},
    author={Nicolas Papernot and Patrick McDaniel and Ian Goodfellow and Somesh Jha and Z. Berkay Celik and Ananthram Swami},
    year={2016},
    eprint={1602.02697},
    archivePrefix={arXiv},
    primaryClass={cs.CR}
}

@article{DBLP:journals/corr/abs-1805-06605,
  author    = {Pouya Samangouei and
               Maya Kabkab and
               Rama Chellappa},
  title     = {Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using
               Generative Models},
  journal   = {CoRR},
  volume    = {abs/1805.06605},
  year      = {2018},
  url       = {http://arxiv.org/abs/1805.06605},
  archivePrefix = {arXiv},
  eprint    = {1805.06605},
  timestamp = {Mon, 13 Aug 2018 16:46:17 +0200},
  biburl    = {https://dblp.org/rec/journals/corr/abs-1805-06605.bib},
  bibsource = {dblp computer science bibliography, https://dblp.org}
}

@inproceedings{inproceedings,
author = {Pol, Adrian and Berger, Victor and Germain, Cecile and Cerminara, Gianluca and Pierini, Maurizio},
year = {2019},
month = {12},
pages = {1651-1657},
title = {Anomaly Detection with Conditional Variational Autoencoders},
doi = {10.1109/ICMLA.2019.00270}
}

@misc{wang2020defending,
    title={Defending Adversarial Attacks via Semantic Feature Manipulation},
    author={Shuo Wang and Tianle Chen and Surya Nepal and Carsten Rudolph and Marthie Grobler and Shangyu Chen},
    year={2020},
    eprint={2002.02007},
    archivePrefix={arXiv},
    primaryClass={cs.LG}
}

@article{goodfellow2014generative,
  title={Generative adversarial nets},
  author={Goodfellow, Ian and Pouget-Abadie, Jean and Mirza, Mehdi and Xu, Bing and Warde-Farley, David and Ozair, Sherjil and Courville, Aaron and Bengio, Yoshua},
  journal={Advances in neural information processing systems},
  volume={27},
  year={2014}
}

@article{DBLP:journals/corr/EvtimovEFKLPRS17,
  author    = {Ivan Evtimov and
               Kevin Eykholt and
               Earlence Fernandes and
               Tadayoshi Kohno and
               Bo Li and
               Atul Prakash and
               Amir Rahmati and
               Dawn Song},
  title     = {Robust Physical-World Attacks on Machine Learning Models},
  journal   = {CoRR},
  volume    = {abs/1707.08945},
  year      = {2017},
  url       = {http://arxiv.org/abs/1707.08945},
  archivePrefix = {arXiv},
  eprint    = {1707.08945},
  timestamp = {Thu, 09 May 2019 13:10:56 +0200},
  biburl    = {https://dblp.org/rec/journals/corr/EvtimovEFKLPRS17.bib},
  bibsource = {dblp computer science bibliography, https://dblp.org}
}

@article{DBLP:journals/corr/abs-1810-08280,
  author    = {Octavian Suciu and
               Scott E. Coull and
               Jeffrey Johns},
  title     = {Exploring Adversarial Examples in Malware Detection},
  journal   = {CoRR},
  volume    = {abs/1810.08280},
  year      = {2018},
  url       = {http://arxiv.org/abs/1810.08280},
  archivePrefix = {arXiv},
  eprint    = {1810.08280},
  timestamp = {Wed, 31 Oct 2018 14:24:29 +0100},
  biburl    = {https://dblp.org/rec/journals/corr/abs-1810-08280.bib},
  bibsource = {dblp computer science bibliography, https://dblp.org}
}

@misc{li2018generative,
    title={Are Generative Classifiers More Robust to Adversarial Attacks?},
    author={Yingzhen Li and John Bradshaw and Yash Sharma},
    year={2018},
    eprint={1802.06552},
    archivePrefix={arXiv},
    primaryClass={cs.LG}
}

@inproceedings{10.1117/12.2559848,
    author = {Fatma Ben Aissa and Mahmoud Mejdoub and Mourad Zaied},
    title = {{A survey on generative adversarial networks and their variants methods}},
    volume = {11433},
    booktitle = {Twelfth International Conference on Machine Vision (ICMV 2019)},
    editor = {Wolfgang Osten and Dmitry P. Nikolaev},
    organization = {International Society for Optics and Photonics},
    publisher = {SPIE},
    pages = {1006 -- 1012},
    year = {2020},
    doi = {10.1117/12.2559848},
    URL = {https://doi.org/10.1117/12.2559848}
}

@article{daxberger2019bayesian,
  title={Bayesian variational autoencoders for unsupervised out-of-distribution detection},
  author={Daxberger, Erik and Hern{\'a}ndez-Lobato, Jos{\'e} Miguel},
  journal={arXiv preprint arXiv:1912.05651},
  year={2019}
}

@book{ProbabilisticGraphicalModels,
    author = {Koller, Daphne and Friedman, Nir},
    title = {Probabilistic Graphical Models: Principles and Techniques - Adaptive Computation and Machine Learning},
    year = {2009},
    isbn = {0262013193},
    publisher = {The MIT Press}
}

@article{Kingma_2019,
   title={An Introduction to Variational Autoencoders},
   volume={12},
   ISSN={1935-8245},
   url={http://dx.doi.org/10.1561/2200000056},
   DOI={10.1561/2200000056},
   number={4},
   journal={Foundations and Trends® in Machine Learning},
   publisher={Now Publishers},
   author={Kingma, Diederik P. and Welling, Max},
   year={2019},
   pages={307–392}
}

@misc{kingma2014semisupervised,
    title={Semi-Supervised Learning with Deep Generative Models},
    author={Diederik P. Kingma and Danilo J. Rezende and Shakir Mohamed and Max Welling},
    year={2014},
    eprint={1406.5298},
    archivePrefix={arXiv},
    primaryClass={cs.LG}
}

@misc{hwang2019puvae,
    title={PuVAE: A Variational Autoencoder to Purify Adversarial Examples},
    author={Uiwon Hwang and Jaewoo Park and Hyemi Jang and Sungroh Yoon and Nam Ik Cho},
    year={2019},
    eprint={1903.00585},
    archivePrefix={arXiv},
    primaryClass={cs.LG}
}

@article{DBLP:journals/corr/SzegedyLJSRAEVR14,
  author    = {Christian Szegedy and
               Wei Liu and
               Yangqing Jia and
               Pierre Sermanet and
               Scott E. Reed and
               Dragomir Anguelov and
               Dumitru Erhan and
               Vincent Vanhoucke and
               Andrew Rabinovich},
  title     = {Going Deeper with Convolutions},
  journal   = {CoRR},
  volume    = {abs/1409.4842},
  year      = {2014},
  url       = {http://arxiv.org/abs/1409.4842},
  archivePrefix = {arXiv},
  eprint    = {1409.4842},
  timestamp = {Mon, 13 Aug 2018 16:48:52 +0200},
  biburl    = {https://dblp.org/rec/journals/corr/SzegedyLJSRAEVR14.bib},
  bibsource = {dblp computer science bibliography, https://dblp.org}
}

@misc{carlini2016evaluating,
    title={Towards Evaluating the Robustness of Neural Networks},
    author={Nicholas Carlini and David Wagner},
    year={2016},
    eprint={1608.04644},
    archivePrefix={arXiv},
    primaryClass={cs.CR}
}

@misc{lecun-mnisthandwrittendigit-2010,
title = {{MNIST} handwritten digit database},
author = {LeCun, Yann and Cortes, Corinna},
howpublished = {\url{http://yann.lecun.com/exdb/mnist/}},
year = 2010
}

@misc{szegedy2013intriguing,
    title={Intriguing properties of neural networks},
    author={Christian Szegedy and Wojciech Zaremba and Ilya Sutskever and Joan Bruna and Dumitru Erhan and Ian Goodfellow and Rob Fergus},
    year={2013},
    eprint={1312.6199},
    archivePrefix={arXiv},
    primaryClass={cs.CV}
}


@misc{goodfellow2016nips,
    title={NIPS 2016 Tutorial: Generative Adversarial Networks},
    author={Ian Goodfellow},
    year={2016},
    eprint={1701.00160},
    archivePrefix={arXiv},
    primaryClass={cs.LG}
}

@article{lee2018simple,
  title={A simple unified framework for detecting out-of-distribution samples and adversarial attacks},
  author={Lee, Kimin and Lee, Kibok and Lee, Honglak and Shin, Jinwoo},
  journal={Advances in neural information processing systems},
  volume={31},
  year={2018}
}

@article{hendrycks2016baseline,
  title={A baseline for detecting misclassified and out-of-distribution examples in neural networks},
  author={Hendrycks, Dan and Gimpel, Kevin},
  journal={arXiv preprint arXiv:1610.02136},
  year={2016}
}

@article{hendrycks2018deep,
  title={Deep anomaly detection with outlier exposure},
  author={Hendrycks, Dan and Mazeika, Mantas and Dietterich, Thomas},
  journal={arXiv preprint arXiv:1812.04606},
  year={2018}
}

@article{liang2017enhancing,
  title={Enhancing the reliability of out-of-distribution image detection in neural networks},
  author={Liang, Shiyu and Li, Yixuan and Srikant, Rayadurgam},
  journal={arXiv preprint arXiv:1706.02690},
  year={2017}
}

@article{ren2019likelihood,
  title={Likelihood ratios for out-of-distribution detection},
  author={Ren, Jie and Liu, Peter J and Fertig, Emily and Snoek, Jasper and Poplin, Ryan and Depristo, Mark and Dillon, Joshua and Lakshminarayanan, Balaji},
  journal={Advances in neural information processing systems},
  volume={32},
  year={2019}
}

@misc{hess2020softmaxbased,
    title={Softmax-based Classification is k-means Clustering: Formal Proof, Consequences for Adversarial Attacks, and Improvement through Centroid Based Tailoring},
    author={Sibylle Hess and Wouter Duivesteijn and Decebal Mocanu},
    year={2020},
    eprint={2001.01987},
    archivePrefix={arXiv},
    primaryClass={cs.LG}
}

@inproceedings{oord2016conditional,
  title={Conditional image generation with pixelcnn decoders},
  author={Van den Oord, Aaron and Kalchbrenner, Nal and Espeholt, Lasse and Vinyals, Oriol and Graves, Alex and others},
  booktitle={Advances in neural information processing systems (NIPS)},
  year={2016}
}

@misc{song2017pixeldefend,
    title={PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples},
    author={Yang Song and Taesup Kim and Sebastian Nowozin and Stefano Ermon and Nate Kushman},
    year={2017},
    eprint={1710.10766},
    archivePrefix={arXiv},
    primaryClass={cs.LG}
}

@misc{rybkin2020simple,
    title={Simple and Effective VAE Training with Calibrated Decoders},
    author={Oleh Rybkin and Kostas Daniilidis and Sergey Levine},
    year={2020},
    eprint={2006.13202},
    archivePrefix={arXiv},
    primaryClass={cs.LG}
}

@article{papernot2018cleverhans,
  title={Technical Report on the CleverHans v2.1.0 Adversarial Examples Library},
  author={Nicolas Papernot and Fartash Faghri and Nicholas Carlini and
  Ian Goodfellow and Reuben Feinman and Alexey Kurakin and Cihang Xie and
  Yash Sharma and Tom Brown and Aurko Roy and Alexander Matyasko and
  Vahid Behzadan and Karen Hambardzumyan and Zhishuai Zhang and
  Yi-Lin Juang and Zhi Li and Ryan Sheatsley and Abhibhav Garg and
  Jonathan Uesato and Willi Gierke and Yinpeng Dong and David Berthelot and
  Paul Hendricks and Jonas Rauber and Rujun Long},
  journal={arXiv preprint arXiv:1610.00768},
  year={2018}
}
@book{heinbockel2007introduction,
  title={Introduction to the Variational Calculus},
  author={Heinbockel, J.H.},
  isbn={9781425103521},
  url={https://books.google.fr/books?id=Ty9zAgAACAAJ},
  year={2007},
  publisher={Trafford Publishing}
}

@misc{doersch2016tutorial,
    title={Tutorial on Variational Autoencoders},
    author={Carl Doersch},
    year={2016},
    eprint={1606.05908},
    archivePrefix={arXiv},
    primaryClass={stat.ML}
}

@article{DBLP:journals/corr/MengC17,
  author    = {Dongyu Meng and
               Hao Chen},
  title     = {MagNet: a Two-Pronged Defense against Adversarial Examples},
  journal   = {CoRR},
  volume    = {abs/1705.09064},
  year      = {2017},
  url       = {http://arxiv.org/abs/1705.09064},
  archivePrefix = {arXiv},
  eprint    = {1705.09064},
  timestamp = {Mon, 13 Aug 2018 16:49:03 +0200},
  biburl    = {https://dblp.org/rec/journals/corr/MengC17.bib},
  bibsource = {dblp computer science bibliography, https://dblp.org}
}

@inproceedings{NIPS2019_8441,
title={A new defense against adversarial images: Turning a weakness into a strength},
  author={Hu, Shengyuan and Yu, Tao and Guo, Chuan and Chao, Wei-Lun and Weinberger, Kilian Q},
  booktitle={Advances in Neural Information Processing Systems},
  pages={1635--1646},
  year={2019}
}

@inproceedings{NIPS2019_8459,
  title={Defense against adversarial attacks using feature scattering-based adversarial training},
  author={Zhang, Haichao and Wang, Jianyu},
  booktitle={Advances in Neural Information Processing Systems},
  pages={1831--1841},
  year={2019}
}


@misc{lee2017training,
    title={Training Confidence-calibrated Classifiers for Detecting Out-of-Distribution Samples},
    author={Kimin Lee and Honglak Lee and Kibok Lee and Jinwoo Shin},
    year={2017},
    eprint={1711.09325},
    archivePrefix={arXiv},
    primaryClass={stat.ML}
}

@misc{ahuja2019probabilistic,
    title={Probabilistic Modeling of Deep Features for Out-of-Distribution and Adversarial Detection},
    author={Nilesh A. Ahuja and Ibrahima Ndiour and Trushant Kalyanpur and Omesh Tickoo},
    year={2019},
    eprint={1909.11786},
    archivePrefix={arXiv},
    primaryClass={stat.ML}
}

@INPROCEEDINGS{7467366,
  author={N. {Papernot} and P. {McDaniel} and S. {Jha} and M. {Fredrikson} and Z. B. {Celik} and A. {Swami}},
  booktitle={2016 IEEE European Symposium on Security and Privacy (EuroS P)}, 
  title={The Limitations of Deep Learning in Adversarial Settings}, 
  year={2016},
  volume={},
  number={},
  pages={372-387},}
  
@article{doi:10.1063/1.1699114,
author = {Metropolis,Nicholas  and Rosenbluth,Arianna W.  and Rosenbluth,Marshall N.  and Teller,Augusta H.  and Teller,Edward },
title = {Equation of State Calculations by Fast Computing Machines},
journal = {The Journal of Chemical Physics},
volume = {21},
number = {6},
pages = {1087-1092},
year = {1953},
}

@article{metropolis1953equation,
  title={Equation of state calculations by fast computing machines},
  author={Metropolis, Nicholas and Rosenbluth, Arianna W and Rosenbluth, Marshall N and Teller, Augusta H and Teller, Edward},
  journal={The journal of chemical physics},
  volume={21},
  number={6},
  pages={1087--1092},
  year={1953},
  publisher={American Institute of Physics}
}


@article{10.2307/2334940,
 ISSN = {00063444},
 URL = {http://www.jstor.org/stable/2334940},
 abstract = {A generalization of the sampling method introduced by Metropolis et al. (1953) is presented along with an exposition of the relevant theory, techniques of application and methods and difficulties of assessing the error in Monte Carlo estimates. Examples of the methods, including the generation of random orthogonal matrices and potential applications of the methods to numerical problems arising in statistics, are discussed.},
 author = {W. K. Hastings},
 journal = {Biometrika},
 number = {1},
 pages = {97--109},
 publisher = {[Oxford University Press, Biometrika Trust]},
 title = {Monte Carlo Sampling Methods Using Markov Chains and Their Applications},
 volume = {57},
 year = {1970}
}

@article{hastings1970monte,
  title={Monte Carlo sampling methods using Markov chains and their applications},
  author={Hastings, W Keith},
  year={1970},
  journal = {Biometrika},
 number = {1},
 pages = {97--109},
 volume = {57},
  publisher={Oxford University Press}
}

@inbook{bc683edef1bb40f2b67db5f554927d53,  title     = "Latent Variable Models",  author    = "Bishop, {Christopher M.}",  year      = "1999",  month     = jan,  day       = "1",  language  = "English",  isbn      = "9780262600323",  series    = "Adaptive Computation and Machine Learning",  publisher = "MIT Press",  pages     = "371–403",  editor    = "Jordan, {Michael I.}",  booktitle = "Learning in Graphical Models", }



@article{xiao2017/online,
  title={Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms},
  author={Xiao, Han and Rasul, Kashif and Vollgraf, Roland},
  journal={arXiv preprint arXiv:1708.07747},
  year={2017}
}

@inproceedings{Netzer2011,
author = {Netzer, Yuval and Wang, Tao and Coates, Adam and Bissacco, Alessandro and Wu, Bo and Ng, Andrew Y},
booktitle = {Advances in neural information processing systems (NIPS)},
title = {Reading Digits in Natural Images with Unsupervised Feature Learning},
year = {2011}
}

@misc{CIFAR10,
  title={Cifar-10 (canadian institute for advanced research)},
  author={Krizhevsky, Alex and Nair, Vinod and Hinton, Geoffrey},
  howpublished={\url{http://www.cs.toronto.edu/kriz/cifar.html}},
  year={2010}
}

@misc{chollet2015keras,
  title={Keras},
  author={Chollet, Fran\c{c}ois and others},
  year={2015},
  howpublished={\url{https://keras.io}},
}

@misc{burgess2018understanding,
    title={Understanding disentangling in $\beta$-VAE},
    author={Christopher P. Burgess and Irina Higgins and Arka Pal and Loic Matthey and Nick Watters and Guillaume Desjardins and Alexander Lerchner},
    year={2018},
    eprint={1804.03599},
    archivePrefix={arXiv},
    primaryClass={stat.ML}
}

@misc{chen2018isolating,
    title={Isolating Sources of Disentanglement in Variational Autoencoders},
    author={Ricky T. Q. Chen and Xuechen Li and Roger Grosse and David Duvenaud},
    year={2018},
    eprint={1802.04942},
    archivePrefix={arXiv},
    primaryClass={cs.LG}
}

@article{10.1145/3234150,
author = {Pouyanfar, Samira and Sadiq, Saad and Yan, Yilin and Tian, Haiman and Tao, Yudong and Reyes, Maria Presa and Shyu, Mei-Ling and Chen, Shu-Ching and Iyengar, S. S.},
title = {A Survey on Deep Learning: Algorithms, Techniques, and Applications},
year = {2018},
issue_date = {January 2019},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
volume = {51},
number = {5},
issn = {0360-0300},
url = {https://doi.org/10.1145/3234150},
doi = {10.1145/3234150},
abstract = {The field of machine learning is witnessing its golden era as deep learning slowly becomes the leader in this domain. Deep learning uses multiple layers to represent the abstractions of data to build computational models. Some key enabler deep learning algorithms such as generative adversarial networks, convolutional neural networks, and model transfers have completely changed our perception of information processing. However, there exists an aperture of understanding behind this tremendously fast-paced domain, because it was never previously represented from a multiscope perspective. The lack of core understanding renders these powerful methods as black-box machines that inhibit development at a fundamental level. Moreover, deep learning has repeatedly been perceived as a silver bullet to all stumbling blocks in machine learning, which is far from the truth. This article presents a comprehensive review of historical and recent state-of-the-art approaches in visual, audio, and text processing; social network analysis; and natural language processing, followed by the in-depth analysis on pivoting and groundbreaking advances in deep learning applications. It was also undertaken to review the issues faced in deep learning such as unsupervised learning, black-box models, and online learning and to illustrate how these challenges can be transformed into prolific future research avenues.},
journal = {ACM Comput. Surv.},
month = sep,
articleno = {92},
numpages = {36},
keywords = {distributed processing, survey, Deep learning, neural networks, machine learning, big data}
}

@misc{krishnan2020improving,
      title={Improving model calibration with accuracy versus uncertainty optimization}, 
      author={Ranganath Krishnan and Omesh Tickoo},
      year={2020},
      eprint={2012.07923},
      archivePrefix={arXiv},
      primaryClass={cs.LG}
}

@inproceedings{springenberg2016bayesian,
  title={Bayesian optimization with robust Bayesian neural networks},
  author={Springenberg, Jost Tobias and Klein, Aaron and Falkner, Stefan and Hutter, Frank},
  booktitle={Advances in neural information processing systems (NIPS)},
  year={2016}
}

@misc{szegedy2015rethinking,
      title={Rethinking the Inception Architecture for Computer Vision}, 
      author={Christian Szegedy and Vincent Vanhoucke and Sergey Ioffe and Jonathon Shlens and Zbigniew Wojna},
      year={2015},
      eprint={1512.00567},
      archivePrefix={arXiv},
      primaryClass={cs.CV}
}

@inproceedings{nguyen2015deep,
  title={Deep neural networks are easily fooled: High confidence predictions for unrecognizable images},
  author={Nguyen, Anh and Yosinski, Jason and Clune, Jeff},
  booktitle={IEEE conference on computer vision and pattern recognition},
  pages={427--436},
  year={2015}
}

@article{nielsen2020survae,
  title={Survae flows: Surjections to bridge the gap between vaes and flows},
  author={Nielsen, Didrik and Jaini, Priyank and Hoogeboom, Emiel and Winther, Ole and Welling, Max},
  journal={Advances in Neural Information Processing Systems},
  volume={33},
  pages={12685--12696},
  year={2020}
}

@inproceedings{davis2006relationship,
  title={The relationship between Precision-Recall and ROC curves},
  author={Davis, Jesse and Goadrich, Mark},
  booktitle={Proceedings of the 23rd international conference on Machine learning},
  pages={233--240},
  year={2006}
}

@article{choi2018waic,
  title={Waic, but why? generative ensembles for robust anomaly detection},
  author={Choi, Hyunsun and Jang, Eric and Alemi, Alexander A},
  journal={arXiv preprint arXiv:1810.01392},
  year={2018}
}

@misc{keskar2017largebatch,
      title={On Large-Batch Training for Deep Learning: Generalization Gap and Sharp Minima}, 
      author={Nitish Shirish Keskar and Dheevatsa Mudigere and Jorge Nocedal and Mikhail Smelyanskiy and Ping Tak Peter Tang},
      year={2017},
      eprint={1609.04836},
      archivePrefix={arXiv},
      primaryClass={cs.LG}
}


@article{10.1162/neco.1997.9.1.1,
author = {Hochreiter, Sepp and Schmidhuber, J\"{u}rgen},
title = {Flat Minima},
year = {1997},
issue_date = {Jan. 1, 1997},
publisher = {MIT Press},
address = {Cambridge, MA, USA},
volume = {9},
number = {1},
issn = {0899-7667},
url = {https://doi.org/10.1162/neco.1997.9.1.1},
doi = {10.1162/neco.1997.9.1.1},
journal = {Neural Comput.},
month = jan,
pages = {1–42},
numpages = {42}
}

@article{maddox2019simple,
  title={A simple baseline for bayesian uncertainty in deep learning},
  author={Maddox, Wesley J and Izmailov, Pavel and Garipov, Timur and Vetrov, Dmitry P and Wilson, Andrew Gordon},
  journal={Advances in Neural Information Processing Systems},
  volume={32},
  year={2019}
}

@inproceedings{chen2014stochastic,
  title={Stochastic gradient hamiltonian monte carlo},
  author={Chen, Tianqi and Fox, Emily and Guestrin, Carlos},
  booktitle={International conference on machine learning},
  pages={1683--1691},
  year={2014},
  organization={PMLR}
}

@inproceedings{DBLP:conf/iclr/HigginsMPBGBML17,
  author    = {Irina Higgins and
               Lo{\"{\i}}c Matthey and
               Arka Pal and
               Christopher Burgess and
               Xavier Glorot and
               Matthew Botvinick and
               Shakir Mohamed and
               Alexander Lerchner},
  title     = {beta-VAE: Learning Basic Visual Concepts with a Constrained Variational
               Framework},
  booktitle = {5th International Conference on Learning Representations, {ICLR} 2017,
               Toulon, France, April 24-26, 2017, Conference Track Proceedings},
  publisher = {OpenReview.net},
  year      = {2017},
  url       = {https://openreview.net/forum?id=Sy2fzU9gl},
  timestamp = {Thu, 25 Jul 2019 14:25:41 +0200},
  biburl    = {https://dblp.org/rec/conf/iclr/HigginsMPBGBML17.bib},
  bibsource = {dblp computer science bibliography, https://dblp.org}
}

@article{metropolis1949monte,
  title={The monte carlo method},
  author={Metropolis, Nicholas and Ulam, Stanislaw},
  journal={Journal of the American statistical association},
  volume={44},
  number={247},
  pages={335--341},
  year={1949},
  publisher={Taylor \& Francis}
}

@misc{neal2012mcmc,
      title={MCMC using Hamiltonian dynamics}, 
      author={Radford M. Neal},
      year={2012},
      eprint={1206.1901},
      archivePrefix={arXiv},
      primaryClass={stat.CO}
}

@article{mandt2017stochastic,
  title={Stochastic gradient descent as approximate bayesian inference},
  author={Mandt, Stephan and Hoffman, Matthew D and Blei, David M},
  journal={arXiv preprint arXiv:1704.04289},
  year={2017}
}

@article{izmailov2018averaging,
  title={Averaging weights leads to wider optima and better generalization},
  author={Izmailov, Pavel and Podoprikhin, Dmitrii and Garipov, Timur and Vetrov, Dmitry and Wilson, Andrew Gordon},
  journal={arXiv preprint arXiv:1803.05407},
  year={2018}
}

@article{kingma2018glow,
  title={Glow: Generative flow with invertible 1x1 convolutions},
  author={Kingma, Durk P and Dhariwal, Prafulla},
  journal={Advances in neural information processing systems},
  volume={31},
  year={2018}
}

@article{kingma2016improved,
  title={Improved variational inference with inverse autoregressive flow},
  author={Kingma, Durk P and Salimans, Tim and Jozefowicz, Rafal and Chen, Xi and Sutskever, Ilya and Welling, Max},
  journal={Advances in neural information processing systems},
  volume={29},
  year={2016}
}

@article{kingma2013auto,
  title={Auto-encoding variational bayes},
  author={Kingma, Diederik P and Welling, Max},
  journal={arXiv preprint arXiv:1312.6114},
  year={2013}
}

@article{nalisnick2019detecting,
  title={Detecting out-of-distribution inputs to deep generative models using typicality},
  author={Nalisnick, Eric and Matsukawa, Akihiro and Teh, Yee Whye and Lakshminarayanan, Balaji},
  journal={arXiv preprint arXiv:1906.02994},
  year={2019}
}

@misc{krishnan2020bayesiantorch,
    author = {Krishnan, Ranganath and Esposito, Piero and Subedar, Mahesh},
    title = {Bayesian-Torch: Bayesian neural network layers for uncertainty estimation},
    year = {2020},
    publisher = {GitHub},
    howpublished = {\url{https://github.com/IntelLabs/bayesian-torch}}
}

@article{dinh2016density,
  title={Density estimation using real nvp},
  author={Dinh, Laurent and Sohl-Dickstein, Jascha and Bengio, Samy},
  journal={arXiv preprint arXiv:1605.08803},
  year={2016}
}

@article{duane1987hybrid,
  title={Hybrid monte carlo},
  author={Duane, Simon and Kennedy, Anthony D and Pendleton, Brian J and Roweth, Duncan},
  journal={Physics letters B},
  volume={195},
  number={2},
  pages={216--222},
  year={1987},
  publisher={Elsevier}
}