@article{caldas2018expanding,
  title={Expanding the reach of federated learning by reducing client resource requirements},
  author={Caldas, Sebastian and Kone{\v{c}}ny, Jakub and McMahan, H Brendan and Talwalkar, Ameet},
  journal={arXiv preprint arXiv:1812.07210},
  year={2018}
}


@inproceedings{gubri2022lgv,
  title={Lgv: Boosting adversarial example transferability from large geometric vicinity},
  author={Gubri, Martin and Cordy, Maxime and Papadakis, Mike and Traon, Yves Le and Sen, Koushik},
  booktitle={Computer Vision--ECCV 2022: 17th European Conference, Tel Aviv, Israel, October 23--27, 2022, Proceedings, Part IV},
  pages={603--618},
  year={2022},
  organization={Springer}
}

@article{wu2018understanding,
  title={Understanding and enhancing the transferability of adversarial examples},
  author={Wu, Lei and Zhu, Zhanxing and Tai, Cheng and others},
  journal={arXiv preprint arXiv:1802.09707},
  year={2018}
}

@article{qin2022boosting,
  title={Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbation},
  author={Qin, Zeyu and Fan, Yanbo and Liu, Yi and Shen, Li and Zhang, Yong and Wang, Jue and Wu, Baoyuan},
  journal={arXiv preprint arXiv:2210.05968},
  year={2022}
}

@inproceedings{benz2021batch,
  title={Batch normalization increases adversarial vulnerability and decreases adversarial transferability: A non-robust feature perspective},
  author={Benz, Philipp and Zhang, Chaoning and Kweon, In So},
  booktitle={Proceedings of the IEEE/CVF International Conference on Computer Vision},
  pages={7818--7827},
  year={2021}
}


@article{zhang2021causaladv,
  title={CausalAdv: Adversarial Robustness through the Lens of Causality},
  author={Zhang, Yonggang and Gong, Mingming and Liu, Tongliang and Niu, Gang and Tian, Xinmei and Han, Bo and Sch{\"o}lkopf, Bernhard and Zhang, Kun},
  journal={arXiv preprint arXiv:2106.06196},
  year={2021}
}

@article{tsuzuku2018lipschitz,
  title={Lipschitz-margin training: Scalable certification of perturbation invariance for deep neural networks},
  author={Tsuzuku, Yusuke and Sato, Issei and Sugiyama, Masashi},
  journal={Advances in neural information processing systems},
  volume={31},
  year={2018}
}

@inproceedings{farnia2020gans,
  title={Do GANs always have Nash equilibria?},
  author={Farnia, Farzan and Ozdaglar, Asuman},
  booktitle={International Conference on Machine Learning},
  pages={3029--3039},
  year={2020},
  organization={PMLR}
}

@inproceedings{deng2013recent,
  title={Recent advances in deep learning for speech research at Microsoft},
  author={Deng, Li and Li, Jinyu and Huang, Jui-Ting and Yao, Kaisheng and Yu, Dong and Seide, Frank and Seltzer, Michael and Zweig, Geoff and He, Xiaodong and Williams, Jason and others},
  booktitle={2013 IEEE international conference on acoustics, speech and signal processing},
  pages={8604--8608},
  year={2013},
  organization={IEEE}
}

@article{bartlett2002rademacher,
  title={Rademacher and Gaussian complexities: Risk bounds and structural results},
  author={Bartlett, Peter L and Mendelson, Shahar},
  journal={Journal of Machine Learning Research},
  volume={3},
  number={Nov},
  pages={463--482},
  year={2002}
}

@article{sinha2017certifying,
  title={Certifying some distributional robustness with principled adversarial training},
  author={Sinha, Aman and Namkoong, Hongseok and Volpi, Riccardo and Duchi, John},
  journal={arXiv preprint arXiv:1710.10571},
  year={2017}
}

@inproceedings{farnia2021train,
  title={Train simultaneously, generalize better: Stability of gradient-based minimax learners},
  author={Farnia, Farzan and Ozdaglar, Asuman},
  booktitle={International Conference on Machine Learning},
  pages={3174--3185},
  year={2021},
  organization={PMLR}
}

@inproceedings{lei2021stability,
  title={Stability and generalization of stochastic gradient methods for minimax problems},
  author={Lei, Yunwen and Yang, Zhenhuan and Yang, Tianbao and Ying, Yiming},
  booktitle={International Conference on Machine Learning},
  pages={6175--6186},
  year={2021},
  organization={PMLR}
}

@inproceedings{xing2021generalization,
  title={On the generalization properties of adversarial training},
  author={Xing, Yue and Song, Qifan and Cheng, Guang},
  booktitle={International Conference on Artificial Intelligence and Statistics},
  pages={505--513},
  year={2021},
  organization={PMLR}
}

@article{zhang2017discrimination,
  title={On the discrimination-generalization tradeoff in GANs},
  author={Zhang, Pengchuan and Liu, Qiang and Zhou, Dengyong and Xu, Tao and He, Xiaodong},
  journal={arXiv preprint arXiv:1711.02771},
  year={2017}
}

@inproceedings{arora2017generalization,
  title={Generalization and equilibrium in generative adversarial nets (gans)},
  author={Arora, Sanjeev and Ge, Rong and Liang, Yingyu and Ma, Tengyu and Zhang, Yi},
  booktitle={International Conference on Machine Learning},
  pages={224--232},
  year={2017},
  organization={PMLR}
}


@article{wei2019improved,
  title={Improved sample complexities for deep networks and robust classification via an all-layer margin},
  author={Wei, Colin and Ma, Tengyu},
  journal={arXiv preprint arXiv:1910.04284},
  year={2019}
}

@article{pal2020game,
  title={A game theoretic analysis of additive adversarial attacks and defenses},
  author={Pal, Ambar and Vidal, Ren{\'e}},
  journal={Advances in Neural Information Processing Systems},
  volume={33},
  pages={1345--1355},
  year={2020}
}

@article{bose2020adversarial,
  title={Adversarial example games},
  author={Bose, Joey and Gidel, Gauthier and Berard, Hugo and Cianflone, Andre and Vincent, Pascal and Lacoste-Julien, Simon and Hamilton, Will},
  journal={Advances in neural information processing systems},
  volume={33},
  pages={8921--8934},
  year={2020}
}

@article{tramer2017space,
  title={The space of transferable adversarial examples},
  author={Tram{\`e}r, Florian and Papernot, Nicolas and Goodfellow, Ian and Boneh, Dan and McDaniel, Patrick},
  journal={arXiv preprint arXiv:1704.03453},
  year={2017}
}

@inproceedings{zhou2018transferable,
  title={Transferable adversarial perturbations},
  author={Zhou, Wen and Hou, Xin and Chen, Yongjun and Tang, Mengyun and Huang, Xiangqi and Gan, Xiang and Yang, Yong},
  booktitle={Proceedings of the European Conference on Computer Vision (ECCV)},
  pages={452--467},
  year={2018}
}


@article{ilyas2019adversarial,
  title={Adversarial examples are not bugs, they are features},
  author={Ilyas, Andrew and Santurkar, Shibani and Tsipras, Dimitris and Engstrom, Logan and Tran, Brandon and Madry, Aleksander},
  journal={Advances in neural information processing systems},
  volume={32},
  year={2019}
}

@inproceedings{ilyas2018black,
  title={Black-box adversarial attacks with limited queries and information},
  author={Ilyas, Andrew and Engstrom, Logan and Athalye, Anish and Lin, Jessy},
  booktitle={International Conference on Machine Learning},
  pages={2137--2146},
  year={2018},
  organization={PMLR}
}


@inproceedings{moon2019parsimonious,
  title={Parsimonious black-box adversarial attacks via efficient combinatorial optimization},
  author={Moon, Seungyong and An, Gaon and Song, Hyun Oh},
  booktitle={International Conference on Machine Learning},
  pages={4636--4645},
  year={2019},
  organization={PMLR}
}

@inproceedings{alzantot2019genattack,
  title={Genattack: Practical black-box attacks with gradient-free optimization},
  author={Alzantot, Moustafa and Sharma, Yash and Chakraborty, Supriyo and Zhang, Huan and Hsieh, Cho-Jui and Srivastava, Mani B},
  booktitle={Proceedings of the Genetic and Evolutionary Computation Conference},
  pages={1111--1119},
  year={2019}
}

@inproceedings{bhagoji2018practical,
  title={Practical black-box attacks on deep neural networks using efficient query mechanisms},
  author={Bhagoji, Arjun Nitin and He, Warren and Li, Bo and Song, Dawn},
  booktitle={Proceedings of the European Conference on Computer Vision (ECCV)},
  pages={154--169},
  year={2018}
}


@inproceedings{rice2020overfitting,
  title={Overfitting in adversarially robust deep learning},
  author={Rice, Leslie and Wong, Eric and Kolter, Zico},
  booktitle={International Conference on Machine Learning},
  pages={8093--8104},
  year={2020},
  organization={PMLR}
}

@inproceedings{attias2019improved,
  title={Improved generalization bounds for robust learning},
  author={Attias, Idan and Kontorovich, Aryeh and Mansour, Yishay},
  booktitle={Algorithmic Learning Theory},
  pages={162--183},
  year={2019},
  organization={PMLR}
}

@article{raghunathan2019adversarial,
  title={Adversarial training can hurt generalization},
  author={Raghunathan, Aditi and Xie, Sang Michael and Yang, Fanny and Duchi, John C and Liang, Percy},
  journal={arXiv preprint arXiv:1906.06032},
  year={2019}
}

@article{wu2020adversarial,
  title={Adversarial weight perturbation helps robust generalization},
  author={Wu, Dongxian and Xia, Shu-Tao and Wang, Yisen},
  journal={Advances in Neural Information Processing Systems},
  volume={33},
  pages={2958--2969},
  year={2020}
}

@article{yao2007early,
  title={On early stopping in gradient descent learning},
  author={Yao, Yuan and Rosasco, Lorenzo and Caponnetto, Andrea},
  journal={Constructive Approximation},
  volume={26},
  number={2},
  pages={289--315},
  year={2007},
  publisher={Springer}
}

@inproceedings{cisse2017parseval,
  title={Parseval networks: Improving robustness to adversarial examples},
  author={Cisse, Moustapha and Bojanowski, Piotr and Grave, Edouard and Dauphin, Yann and Usunier, Nicolas},
  booktitle={International Conference on Machine Learning},
  pages={854--863},
  year={2017},
  organization={PMLR}
}

@article{yoshida2017spectral,
  title={Spectral norm regularization for improving the generalizability of deep learning},
  author={Yoshida, Yuichi and Miyato, Takeru},
  journal={arXiv preprint arXiv:1705.10941},
  year={2017}
}

@article{miyato2018spectral,
  title={Spectral normalization for generative adversarial networks},
  author={Miyato, Takeru and Kataoka, Toshiki and Koyama, Masanori and Yoshida, Yuichi},
  journal={arXiv preprint arXiv:1802.05957},
  year={2018}
}

@article{schmidt2018adversarially,
  title={Adversarially robust generalization requires more data},
  author={Schmidt, Ludwig and Santurkar, Shibani and Tsipras, Dimitris and Talwar, Kunal and Madry, Aleksander},
  journal={Advances in neural information processing systems},
  volume={31},
  year={2018}
}

@inproceedings{awasthi2020adversarial,
  title={Adversarial learning guarantees for linear hypotheses and neural networks},
  author={Awasthi, Pranjal and Frank, Natalie and Mohri, Mehryar},
  booktitle={International Conference on Machine Learning},
  pages={431--441},
  year={2020},
  organization={PMLR}
}

@inproceedings{yin2019rademacher,
  title={Rademacher complexity for adversarially robust generalization},
  author={Yin, Dong and Kannan, Ramchandran and Bartlett, Peter},
  booktitle={International conference on machine learning},
  pages={7085--7094},
  year={2019},
  organization={PMLR}
}

@inproceedings{meunier2021mixed,
  title={Mixed Nash equilibria in the adversarial examples game},
  author={Meunier, Laurent and Scetbon, Meyer and Pinot, Rafael B and Atif, Jamal and Chevaleyre, Yann},
  booktitle={International Conference on Machine Learning},
  pages={7677--7687},
  year={2021},
  organization={PMLR}
}

@inproceedings{wang2020amora,
  title={Amora: Black-box adversarial morphing attack},
  author={Wang, Run and Juefei-Xu, Felix and Guo, Qing and Huang, Yihao and Xie, Xiaofei and Ma, Lei and Liu, Yang},
  booktitle={Proceedings of the 28th ACM International Conference on Multimedia},
  pages={1376--1385},
  year={2020}
}

@article{li2020blacklight,
  title={Blacklight: Defending black-box adversarial attacks on deep neural networks},
  author={Li, Huiying and Shan, Shawn and Wenger, Emily and Zhang, Jiayun and Zheng, Haitao and Zhao, Ben Y},
  journal={arXiv preprint arXiv:2006.14042},
  year={2020}
}

@article{salman2020denoised,
  title={Denoised smoothing: A provable defense for pretrained classifiers},
  author={Salman, Hadi and Sun, Mingjie and Yang, Greg and Kapoor, Ashish and Kolter, J Zico},
  journal={Advances in Neural Information Processing Systems},
  volume={33},
  pages={21945--21957},
  year={2020}
}

@inproceedings{singla2020second,
  title={Second-order provable defenses against adversarial attacks},
  author={Singla, Sahil and Feizi, Soheil},
  booktitle={International conference on machine learning},
  pages={8981--8991},
  year={2020},
  organization={PMLR}
}

@article{mohaghegh2020advflow,
  title={AdvFlow: Inconspicuous black-box adversarial attacks using normalizing flows},
  author={Mohaghegh Dolatabadi, Hadi and Erfani, Sarah and Leckie, Christopher},
  journal={Advances in Neural Information Processing Systems},
  volume={33},
  pages={15871--15884},
  year={2020}
}

@inproceedings{levine2020robustness,
  title={Robustness certificates for sparse adversarial attacks by randomized ablation},
  author={Levine, Alexander and Feizi, Soheil},
  booktitle={Proceedings of the AAAI Conference on Artificial Intelligence},
  volume={34},
  number={04},
  pages={4585--4593},
  year={2020}
}

@inproceedings{guo2019simple,
  title={Simple black-box adversarial attacks},
  author={Guo, Chuan and Gardner, Jacob and You, Yurong and Wilson, Andrew Gordon and Weinberger, Kilian},
  booktitle={International Conference on Machine Learning},
  pages={2484--2493},
  year={2019},
  organization={PMLR}
}


@inproceedings{biggio2013evasion,
  title={Evasion attacks against machine learning at test time},
  author={Biggio, Battista and Corona, Igino and Maiorca, Davide and Nelson, Blaine and {\v{S}}rndi{\'c}, Nedim and Laskov, Pavel and Giacinto, Giorgio and Roli, Fabio},
  booktitle={Joint European conference on machine learning and knowledge discovery in databases},
  pages={387--402},
  year={2013},
  organization={Springer}
}

@inproceedings{inkawhich2019feature,
  title={Feature space perturbations yield more transferable adversarial examples},
  author={Inkawhich, Nathan and Wen, Wei and Li, Hai Helen and Chen, Yiran},
  booktitle={Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition},
  pages={7066--7074},
  year={2019}
}

@article{cheng2018query,
  title={Query-efficient hard-label black-box attack: An optimization-based approach},
  author={Cheng, Minhao and Le, Thong and Chen, Pin-Yu and Yi, Jinfeng and Zhang, Huan and Hsieh, Cho-Jui},
  journal={arXiv preprint arXiv:1807.04457},
  year={2018}
}

@article{szegedy2013intriguing,
  title={Intriguing properties of neural networks},
  author={Szegedy, Christian and Zaremba, Wojciech and Sutskever, Ilya and Bruna, Joan and Erhan, Dumitru and Goodfellow, Ian and Fergus, Rob},
  journal={arXiv preprint arXiv:1312.6199},
  year={2013}
}

@article{cheng2019improving,
  title={Improving black-box adversarial attacks with a transfer-based prior},
  author={Cheng, Shuyu and Dong, Yinpeng and Pang, Tianyu and Su, Hang and Zhu, Jun},
  journal={Advances in neural information processing systems},
  volume={32},
  year={2019}
}

@article{tramer2017ensemble,
  title={Ensemble adversarial training: Attacks and defenses},
  author={Tram{\`e}r, Florian and Kurakin, Alexey and Papernot, Nicolas and Goodfellow, Ian and Boneh, Dan and McDaniel, Patrick},
  journal={arXiv preprint arXiv:1705.07204},
  year={2017}
}

@article{alipanahi2015predicting,
  title={Predicting the sequence specificities of DNA-and RNA-binding proteins by deep learning},
  author={Alipanahi, Babak and Delong, Andrew and Weirauch, Matthew T and Frey, Brendan J},
  journal={Nature biotechnology},
  volume={33},
  number={8},
  pages={831--838},
  year={2015},
  publisher={Nature Publishing Group}
}

@article{konevcny2016federated,
  title={Federated learning: Strategies for improving communication efficiency},
  author={Kone{\v{c}}n{\`y}, Jakub and McMahan, H Brendan and Yu, Felix X and Richt{\'a}rik, Peter and Suresh, Ananda Theertha and Bacon, Dave},
  journal={arXiv preprint arXiv:1610.05492},
  year={2016}
}

@article{thakkar2019differentially,
  title={Differentially private learning with adaptive clipping},
  author={Thakkar, Om and Andrew, Galen and McMahan, H Brendan},
  journal={arXiv preprint arXiv:1905.03871},
  year={2019}
}

@article{li2019differentially,
  title={Differentially private meta-learning},
  author={Li, Jeffrey and Khodak, Mikhail and Caldas, Sebastian and Talwalkar, Ameet},
  journal={arXiv preprint arXiv:1909.05830},
  year={2019}
}

@article{geyer2017differentially,
  title={Differentially private federated learning: A client level perspective},
  author={Geyer, Robin C and Klein, Tassilo and Nabi, Moin},
  journal={arXiv preprint arXiv:1712.07557},
  year={2017}
}

@article{bhowmick2018protection,
  title={Protection against reconstruction and its applications in private federated learning},
  author={Bhowmick, Abhishek and Duchi, John and Freudiger, Julien and Kapoor, Gaurav and Rogers, Ryan},
  journal={arXiv preprint arXiv:1812.00984},
  year={2018}
}

@article{robey2020model,
  title={Model-Based Robust Deep Learning},
  author={Robey, Alexander and Hassani, Hamed and Pappas, George J},
  journal={arXiv preprint arXiv:2005.10247},
  year={2020}
}

@article{kairouz2019advances,
  title={Advances and open problems in federated learning},
  author={Kairouz, Peter and McMahan, H Brendan and Avent, Brendan and Bellet, Aur{\'e}lien and Bennis, Mehdi and Bhagoji, Arjun Nitin and Bonawitz, Keith and Charles, Zachary and Cormode, Graham and Cummings, Rachel and others},
  journal={arXiv preprint arXiv:1912.04977},
  year={2019}
}

@inproceedings{bartlett2017spectrally,
  title={Spectrally-normalized margin bounds for neural networks},
  author={Bartlett, Peter L and Foster, Dylan J and Telgarsky, Matus J},
  booktitle={Advances in Neural Information Processing Systems},
  pages={6240--6249},
  year={2017}
}

@inproceedings{pei2017deepxplore,
  title={Deepxplore: Automated whitebox testing of deep learning systems},
  author={Pei, Kexin and Cao, Yinzhi and Yang, Junfeng and Jana, Suman},
  booktitle={proceedings of the 26th Symposium on Operating Systems Principles},
  pages={1--18},
  year={2017}
}

@article{shafieezadeh2019regularization,
  title={Regularization via mass transportation},
  author={Shafieezadeh-Abadeh, Soroosh and Kuhn, Daniel and Esfahani, Peyman Mohajerin},
  journal={Journal of Machine Learning Research},
  volume={20},
  number={103},
  pages={1--68},
  year={2019}
}

@article{wiesemann2014distributionally,
  title={Distributionally robust convex optimization},
  author={Wiesemann, Wolfram and Kuhn, Daniel and Sim, Melvyn},
  journal={Operations Research},
  volume={62},
  number={6},
  pages={1358--1376},
  year={2014},
  publisher={INFORMS}
}

@article{farnia2018generalizable,
  title={Generalizable adversarial training via spectral normalization},
  author={Farnia, Farzan and Zhang, Jesse M and Tse, David},
  journal={arXiv preprint arXiv:1811.07457},
  year={2018}
}

@article{neyshabur2017pac,
  title={A pac-bayesian approach to spectrally-normalized margin bounds for neural networks},
  author={Neyshabur, Behnam and Bhojanapalli, Srinadh and Srebro, Nathan},
  journal={arXiv preprint arXiv:1707.09564},
  year={2017}
}

@inproceedings{mcallester1999pac,
  title={PAC-Bayesian model averaging},
  author={McAllester, David A},
  booktitle={Proceedings of the twelfth annual conference on Computational learning theory},
  pages={164--170},
  year={1999}
}

@article{goodfellow2014explaining,
  title={Explaining and harnessing adversarial examples},
  author={Goodfellow, Ian J and Shlens, Jonathon and Szegedy, Christian},
  journal={arXiv preprint arXiv:1412.6572},
  year={2014}
}

@article{kingma2014adam,
  title={Adam: A method for stochastic optimization},
  author={Kingma, Diederik P and Ba, Jimmy},
  journal={arXiv preprint arXiv:1412.6980},
  year={2014}
}

@article{ioffe2015batch,
  title={Batch normalization: Accelerating deep network training by reducing internal covariate shift},
  author={Ioffe, Sergey and Szegedy, Christian},
  journal={arXiv preprint arXiv:1502.03167},
  year={2015}
}

@inproceedings{he2016deep,
  title={Deep residual learning for image recognition},
  author={He, Kaiming and Zhang, Xiangyu and Ren, Shaoqing and Sun, Jian},
  booktitle={Proceedings of the IEEE conference on computer vision and pattern recognition},
  pages={770--778},
  year={2016}
}

@inproceedings{szegedy2015going,
  title={Going deeper with convolutions},
  author={Szegedy, Christian and Liu, Wei and Jia, Yangqing and Sermanet, Pierre and Reed, Scott and Anguelov, Dragomir and Erhan, Dumitru and Vanhoucke, Vincent and Rabinovich, Andrew},
  booktitle={Proceedings of the IEEE conference on computer vision and pattern recognition},
  pages={1--9},
  year={2015}
}

@inproceedings{krizhevsky2012imagenet,
  title={Imagenet classification with deep convolutional neural networks},
  author={Krizhevsky, Alex and Sutskever, Ilya and Hinton, Geoffrey E},
  booktitle={Advances in neural information processing systems},
  pages={1097--1105},
  year={2012}
}

@article{krizhevsky2009learning,
  title={Learning multiple layers of features from tiny images},
  author={Krizhevsky, Alex and Hinton, Geoffrey and others},
  year={2009},
  publisher={Citeseer}
}

@article{lecun1998mnist,
  title={The MNIST database of handwritten digits},
  author={LeCun, Yann},
  journal={http://yann. lecun. com/exdb/mnist/},
  year={1998}
}

@article{abadi2016tensorflow,
  title={Tensorflow: Large-scale machine learning on heterogeneous distributed systems},
  author={Abadi, Mart{\'\i}n and Agarwal, Ashish and Barham, Paul and Brevdo, Eugene and Chen, Zhifeng and Citro, Craig and Corrado, Greg S and Davis, Andy and Dean, Jeffrey and Devin, Matthieu and others},
  journal={arXiv preprint arXiv:1603.04467},
  year={2016}
}

@article{hendrycks2019benchmarking,
  title={Benchmarking neural network robustness to common corruptions and perturbations},
  author={Hendrycks, Dan and Dietterich, Thomas},
  journal={arXiv preprint arXiv:1903.12261},
  year={2019}
}

@article{stich2018local,
  title={Local SGD converges fast and communicates little},
  author={Stich, Sebastian U},
  journal={arXiv preprint arXiv:1805.09767},
  year={2018}
}

@article{koloskova2019decentralized,
  title={Decentralized Stochastic Optimization and Gossip Algorithms with Compressed Communication},
  author={Koloskova, Anastasia and Stich, Sebastian U and Jaggi, Martin},
  year={2019}
}

@article{li2019convergence,
  title={On the convergence of fedavg on non-iid data},
  author={Li, Xiang and Huang, Kaixuan and Yang, Wenhao and Wang, Shusen and Zhang, Zhihua},
  journal={arXiv preprint arXiv:1907.02189},
  year={2019}
}

@inproceedings{mohri2019agnostic,
  title={Agnostic Federated Learning},
  author={Mohri, Mehryar and Sivek, Gary and Suresh, Ananda Theertha},
  booktitle={International Conference on Machine Learning},
  pages={4615--4625},
  year={2019}
}

@article{li2019federated,
  title={Federated learning: Challenges, methods, and future directions},
  author={Li, Tian and Sahu, Anit Kumar and Talwalkar, Ameet and Smith, Virginia},
  journal={arXiv preprint arXiv:1908.07873},
  year={2019}
}

@article{karimireddy2019scaffold,
  title={SCAFFOLD: Stochastic controlled averaging for on-device federated learning},
  author={Karimireddy, Sai Praneeth and Kale, Satyen and Mohri, Mehryar and Reddi, Sashank J and Stich, Sebastian U and Suresh, Ananda Theertha},
  journal={arXiv preprint arXiv:1910.06378},
  year={2019}
}

@inproceedings{khaled2020tighter,
  title={Tighter theory for local SGD on identical and heterogeneous data},
  author={Khaled, A and Mishchenko, K and Richt{\'a}rik, P},
  booktitle={The 23rd International Conference on Artificial Intelligence and Statistics (AISTATS 2020)},
  year={2020}
}

@inproceedings{nouiehed2019solving,
  title={Solving a class of non-convex min-max games using iterative first order methods},
  author={Nouiehed, Maher and Sanjabi, Maziar and Huang, Tianjian and Lee, Jason D and Razaviyayn, Meisam},
  booktitle={Advances in Neural Information Processing Systems},
  pages={14905--14916},
  year={2019}
}

@inproceedings{moosavi2017universal,
  title={Universal adversarial perturbations},
  author={Moosavi-Dezfooli, Seyed-Mohsen and Fawzi, Alhussein and Fawzi, Omar and Frossard, Pascal},
  booktitle={Proceedings of the IEEE conference on computer vision and pattern recognition},
  pages={1765--1773},
  year={2017}
}

@article{reisizadeh2019fedpaq,
  title={Fedpaq: A communication-efficient federated learning method with periodic averaging and quantization},
  author={Reisizadeh, Amirhossein and Mokhtari, Aryan and Hassani, Hamed and Jadbabaie, Ali and Pedarsani, Ramtin},
  journal={arXiv preprint arXiv:1909.13014},
  year={2019}
}

@article{wang2018adaptive,
  title={Adaptive communication strategies to achieve the best error-runtime trade-off in local-update SGD},
  author={Wang, Jianyu and Joshi, Gauri},
  journal={arXiv preprint arXiv:1810.08313},
  year={2018}
}

@article{haddadpour2019convergence,
  title={On the Convergence of Local Descent Methods in Federated Learning},
  author={Haddadpour, Farzin and Mahdavi, Mehrdad},
  journal={arXiv preprint arXiv:1910.14425},
  year={2019}
}

@inproceedings{laidlaw2019functional,
  title={Functional adversarial attacks},
  author={Laidlaw, Cassidy and Feizi, Soheil},
  booktitle={Advances in Neural Information Processing Systems},
  pages={10408--10418},
  year={2019}
}

@article{madry2017towards,
  title={Towards deep learning models resistant to adversarial attacks},
  author={Madry, Aleksander and Makelov, Aleksandar and Schmidt, Ludwig and Tsipras, Dimitris and Vladu, Adrian},
  journal={arXiv preprint arXiv:1706.06083},
  year={2017}
}

@article{shafahi2018universal,
  title={Universal adversarial training},
  author={Shafahi, Ali and Najibi, Mahyar and Xu, Zheng and Dickerson, John and Davis, Larry S and Goldstein, Tom},
  journal={arXiv preprint arXiv:1811.11304},
  year={2018}
}

@article{mcmahan2016communication,
  title={Communication-efficient learning of deep networks from decentralized data},
  author={McMahan, H Brendan and Moore, Eider and Ramage, Daniel and Hampson, Seth and others},
  journal={arXiv preprint arXiv:1602.05629},
  year={2016}
}

@article{lin2019gradient,
  title={On gradient descent ascent for nonconvex-concave minimax problems},
  author={Lin, Tianyi and Jin, Chi and Jordan, Michael I},
  journal={arXiv preprint arXiv:1906.00331},
  year={2019}
}

@article{yang2020global,
  title={Global Convergence and Variance-Reduced Optimization for a Class of Nonconvex-Nonconcave Minimax Problems},
  author={Yang, Junchi and Kiyavash, Negar and He, Niao},
  journal={arXiv preprint arXiv:2002.09621},
  year={2020}
}

@article{yu2019linear,
  title={On the linear speedup analysis of communication efficient momentum sgd for distributed non-convex optimization},
  author={Yu, Hao and Jin, Rong and Yang, Sen},
  journal={arXiv preprint arXiv:1905.03817},
  year={2019}
}

@article{polyak1963gradient,
  title={Gradient methods for minimizing functionals},
  author={Polyak, Boris Teodorovich},
  journal={Zhurnal Vychislitel'noi Matematiki i Matematicheskoi Fiziki},
  volume={3},
  number={4},
  pages={643--653},
  year={1963},
  publisher={Russian Academy of Sciences, Branch of Mathematical Sciences}
}




@inproceedings{VGG,
  author    = {Karen Simonyan and
               Andrew Zisserman},
  editor    = {Yoshua Bengio and
               Yann LeCun},
  title     = {Very Deep Convolutional Networks for Large-Scale Image Recognition},
  booktitle = {International Conference on Learning Representations, {ICLR}},
  year      = {2015},
}




@article{cifar,
  title={Learning multiple layers of features from tiny images},
  author={Krizhevsky, Alex and Hinton, Geoffrey and others},
  year={2009},
  publisher={Citeseer}
}

@inproceedings{inceptionv1,
  author    = {Christian Szegedy and
               Wei Liu and
               Yangqing Jia and
               Pierre Sermanet and
               Scott E. Reed and
               Dragomir Anguelov and
               Dumitru Erhan and
               Vincent Vanhoucke and
               Andrew Rabinovich},
  title     = {Going deeper with convolutions},
  booktitle = {Conference on Computer Vision and Pattern Recognition, {CVPR}},
  pages     = {1--9},
  year      = {2015},
}

@inproceedings{inceptionv2v3,
  author    = {Christian Szegedy and
               Vincent Vanhoucke and
               Sergey Ioffe and
               Jonathon Shlens and
               Zbigniew Wojna},
  title     = {Rethinking the Inception Architecture for Computer Vision},
  booktitle = {{IEEE} Conference on Computer Vision and Pattern Recognition,
               {CVPR}},
  pages     = {2818--2826},
  year      = {2016},
}

@article{SVHN,
  title={Reading Digits in Natural Images with Unsupervised Feature Learning},
  author={Y Netzer and  Wang, T.  and  Coates, A.  and  Bissacco, A.  and  Ng, A. Y. },
  year={2011},
}






@inproceedings{PGD,
  author    = {Aleksander Madry and
               Aleksandar Makelov and
               Ludwig Schmidt and
               Dimitris Tsipras and
               Adrian Vladu},
  title     = {Towards Deep Learning Models Resistant to Adversarial Attacks},
  booktitle = {6th International Conference on Learning Representations, {ICLR} 2018,
               Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings},
  publisher = {OpenReview.net},
  year      = {2018},
  url       = {https://openreview.net/forum?id=rJzIBfZAb},
  timestamp = {Thu, 25 Jul 2019 14:25:44 +0200},
  biburl    = {https://dblp.org/rec/conf/iclr/MadryMSTV18.bib},
  bibsource = {dblp computer science bibliography, https://dblp.org}
}
