%----- related works -----

@article{taori2020measuring,
  title={Measuring robustness to natural distribution shifts in image classification},
  author={Taori, Rohan and Dave, Achal and Shankar, Vaishaal and Carlini, Nicholas and Recht, Benjamin and Schmidt, Ludwig},
  journal={Advances in Neural Information Processing Systems},
  year={2020}
}

@article{ovadia2019can,
  title={{C}an you trust your model's uncertainty? {E}valuating predictive uncertainty under dataset shift},
  author={Ovadia, Yaniv and Fertig, Emily and Ren, Jie and Nado, Zachary and Sculley, David and Nowozin, Sebastian and Dillon, Joshua and Lakshminarayanan, Balaji and Snoek, Jasper},
  journal={Advances in Neural Information Processing Systems},
  year={2019}
}


@article{thulasidasan2021effective,
  title={{A}n effective baseline for robustness to distributional shift},
  author={Thulasidasan, Sunil and Thapa, Sushil and Dhaubhadel, Sayera and Chennupati, Gopinath and Bhattacharya, Tanmoy and Bilmes, Jeff},
  journal={IEEE International Conference on Machine Learning and Applications (ICMLA)},
  year={2021},
}


@article{moayeri2022explicit,
  title={{E}xplicit tradeoffs between adversarial and natural distributional robustness},
  author={Moayeri, Mazda and Banihashem, Kiarash and Feizi, Soheil},
  journal={Advances in Neural Information Processing Systems},
  year={2022}
}


@article{srinivas2018knowledge,
  title={Knowledge transfer with jacobian matching},
  author={Srinivas, Suraj and Fleuret, Fran{\c{c}}ois},
  journal={International Conference on Machine Learning},
  year={2018},
}

@article{srinivas2024models,
  title={{W}hich models have perceptually-aligned gradients? {A}n explanation via off-manifold robustness},
  author={Srinivas, Suraj and Bordt, Sebastian and Lakkaraju, Himabindu},
  journal={Advances in Neural Information Processing Systems},
  year={2024}
}

@misc{flops,
  title = {What’s the backward-forward {FLOP} ratio for Neural Networks?},
  howpublished = {\url{https://www.lesswrong.com/posts/fnjKpBoWJXcSDwhZk/what-s-the-backward-forward-flop-ratio-for-neural-networks}},
  note = {Accessed: 2024-04-04}
}

@article{ribeiro2016lime,
  title={{W}hy should {I} trust you? {E}xplaining the predictions of any classifier},
  author={Ribeiro, Marco Tulio and Singh, Sameer and Guestrin, Carlos},
  journal={International Conference on Knowledge Discovery and Data Mining},
  year={2016}
}

@article{han2022explanation,
  title={Which explanation should {I} choose? {A} function approximation perspective to characterizing post hoc explanations},
  author={Han, Tessa and Srinivas, Suraj and Lakkaraju, Himabindu},
  journal={Advances in Neural Information Processing Systems},
  year={2022}
}

@article{pawelczyk2022probabilistically,
  title={Probabilistically Robust Recourse: {N}avigating the Trade-offs between Costs and Robustness in Algorithmic Recourse},
  author={Pawelczyk, Martin and Datta, Teresa and van-den-Heuvel, Johannes and Kasneci, Gjergji and Lakkaraju, Himabindu},
  journal={International Conference on Learning Representations},
  year={2023}
}


@article{carlini2017towards,
  title={Towards evaluating the robustness of neural networks},
  author={Carlini, Nicholas and Wagner, David},
  journal={IEEE Symposium on Security and Privacy},
  year={2017},
}


@article{goodfellow2014explaining,
  title={Explaining and harnessing adversarial examples},
  author={Goodfellow, Ian J and Shlens, Jonathon and Szegedy, Christian},
  journal={International Conference on Learning Representations},
  year={2015}
}

@article{moosavi2016deepfool,
  title={Deep{F}ool: {A} simple and accurate method to fool deep neural networks},
  author={Moosavi-Dezfooli, Seyed-Mohsen and Fawzi, Alhussein and Frossard, Pascal},
  journal={IEEE Conference on Computer Vision and Pattern Recognition},
  year={2016}
}

@article{cohen2019certified,
  title={Certified adversarial robustness via randomized smoothing},
  author={Cohen, Jeremy and Rosenfeld, Elan and Kolter, Zico},
  Journal={International Conference on Machine Learning},
  year={2019}
}


@article{carlini2022certified,
  title={({C}ertified!!) Adversarial Robustness for Free!},
  author={Carlini, Nicholas and Tramer, Florian and Dvijotham, Krishnamurthy and Rice, Leslie and Sun, Mingjie  and Kolter, Zico},
  journal={International Conference on Learning Representations},
  year={2022}
}

@article{nanda2021fairness,
  title={Fairness through robustness: {I}nvestigating robustness disparity in deep learning},
  author={Nanda, Vedant and Dooley, Samuel and Singla, Sahil and Feizi, Soheil and Dickerson, John P},
  journal={ACM Conference on Fairness, Accountability, and Transparency},
  year={2021}
}


@article{guo2017calibration,
  title={On calibration of modern neural networks},
  author={Guo, Chuan and Pleiss, Geoff and Sun, Yu and Weinberger, Kilian Q},
  journal={International Conference on Machine Learning},
  year={2017},
}

@article{shafer2008tutorial,
  title={A Tutorial on Conformal Prediction.},
  author={Shafer, Glenn and Vovk, Vladimir},
  journal={Journal of Machine Learning Research},
  year={2008}
}

@article{kendall2017uncertainties,
  title={What uncertainties do we need in {B}ayesian deep learning for computer vision?},
  author={Kendall, Alex and Gal, Yarin},
  journal={Neural Information Processing Systems},
  year={2017}
}

@inproceedings{fazlyab2019probabilistic,
  title={Probabilistic verification and reachability analysis of neural networks via semidefinite programming},
  author={Fazlyab, Mahyar and Morari, Manfred and Pappas, George J},
  booktitle={2019 IEEE 58th Conference on Decision and Control (CDC)},
  pages={2726--2731},
  year={2019},
  organization={IEEE}
}

@inproceedings{robey2022probabilistically,
  title={Probabilistically robust learning: Balancing average and worst-case performance},
  author={Robey, Alexander and Chamon, Luiz and Pappas, George J and Hassani, Hamed},
  booktitle={International Conference on Machine Learning},
  pages={18667--18686},
  year={2022},
  organization={PMLR}
}

@inproceedings{mangal2019robustness,
  title={Robustness of neural networks: A probabilistic and practical approach},
  author={Mangal, Ravi and Nori, Aditya V and Orso, Alessandro},
  booktitle={2019 IEEE/ACM 41st International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)},
  pages={93--96},
  year={2019},
  organization={IEEE}
}

@inproceedings{weng2019proven,
  title={PROVEN: Verifying robustness of neural networks with a probabilistic approach},
  author={Weng, Lily and Chen, Pin-Yu and Nguyen, Lam and Squillante, Mark and Boopathy, Akhilan and Oseledets, Ivan and Daniel, Luca},
  booktitle={International Conference on Machine Learning},
  pages={6727--6736},
  year={2019},
  organization={PMLR}
}

@article{rice2021robustness,
  title={Robustness between the worst and average case},
  author={Rice, Leslie and Bair, Anna and Zhang, Huan and Kolter, J Zico},
  journal={Advances in Neural Information Processing Systems},
  volume={34},
  pages={27840--27851},
  year={2021}
}

@article{kumar2020certifying,
  title={Certifying confidence via randomized smoothing},
  author={Kumar, Aounon and Levine, Alexander and Feizi, Soheil and Goldstein, Tom},
  journal={Advances in Neural Information Processing Systems},
  volume={33},
  pages={5165--5177},
  year={2020}
}

@inproceedings{franceschi2018robustness,
  title={Robustness of classifiers to uniform lp and Gaussian noise},
  author={Franceschi, Jean-Yves and Fawzi, Alhussein and Fawzi, Omar},
  booktitle={International Conference on Artificial Intelligence and Statistics},
  pages={1280--1288},
  year={2018},
  organization={PMLR}
}

@article{srinivas2022efficient,
  title={Efficient training of low-curvature neural networks},
  author={Srinivas, Suraj and Matoba, Kyle and Lakkaraju, Himabindu and Fleuret, Fran{\c{c}}ois},
  journal={Advances in Neural Information Processing Systems},
  volume={35},
  pages={25951--25964},
  year={2022}
}

@inproceedings{moosavi2019robustness,
  title={Robustness via curvature regularization, and vice versa},
  author={Moosavi-Dezfooli, Seyed-Mohsen and Fawzi, Alhussein and Uesato, Jonathan and Frossard, Pascal},
  booktitle={Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition},
  pages={9078--9086},
  year={2019}
}

@article{patrick1995probability,
  title={Probability and measure},
  author={Patrick, Billingsley},
  journal={A Wiley-Interscience Publication, John Wiley},
  volume={118},
  pages={119},
  year={1995}
}

%%%%%% ----- methods -----
@book{vershynin2018high,
  title={High-dimensional probability: An introduction with applications in data science},
  author={Vershynin, Roman},
  year={2018},
  publisher={Cambridge University Press}
}

@article{botev2017normal,
  title={The normal law under linear restrictions: {S}imulation and estimation via minimax tilting},
  author={Botev, Zdravko I},
  journal={Journal of the Royal Statistical Society. Series B (Statistical Methodology)},
  year={2017},
}

@misc{SciPy,
  title = {Sci{P}y multivariate normal {CDF}},
  howpublished = {\url{https://docs.scipy.org/doc/scipy/reference/generated/scipy.stats.multivariate_normal.html}}
}


@article{smilkov2017smoothgrad,
  title={Smooth{G}rad: removing noise by adding noise},
  author={Smilkov, Daniel and Thorat, Nikhil and Kim, Been and Vi{\'e}gas, Fernanda and Wattenberg, Martin},
  journal={arXiv preprint arXiv:1706.03825},
  year={2017}
}

@article{agarwal2021towards,
  title={Towards the unification and robustness of perturbation and gradient based explanations},
  author={Agarwal, Sushant and Jabbari, Shahin and Agarwal, Chirag and Upadhyay, Sohini and Wu, Steven and Lakkaraju, Himabindu},
  journal={International Conference on Machine Learning},
  year={2021},
}

@article{hendrycks2016gaussian,
  title={Gaussian error linear units ({GELU}s)},
  author={Hendrycks, Dan and Gimpel, Kevin},
  journal={arXiv preprint arXiv:1606.08415},
  year={2016}
}

@inproceedings{croce2021robustbench,
  title={RobustBench: a standardized adversarial robustness benchmark},
  author={Croce, Francesco and Andriushchenko, Maksym and Sehwag, Vikash and Debenedetti, Edoardo and Flammarion, Nicolas and Chiang, Mung and Mittal, Prateek and Hein, Matthias},
  booktitle={Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2)},
  year={2021}
}


% ----- datasets and models -----
%mnist
@article{deng2012mnist,
  title={The {MNIST} database of handwritten digit images for machine learning research},
  author={Deng, Li},
  journal={IEEE Signal Processing Magazine},
  year={2012},
  publisher={IEEE}
}

%fashionmnist
@article{xiao2017fashion,
  title={Fashion-{MNIST}: {A} novel image dataset for benchmarking machine learning algorithms},
  author={Xiao, Han and Rasul, Kashif and Vollgraf, Roland},
  journal={arXiv preprint arXiv:1708.07747},
  year={2017}
}

%cifar10 and cifar100
@article{krizhevsky2009learning,
  title={Learning multiple layers of features from tiny images},
  author={Krizhevsky, Alex and Hinton, Geoffrey and others},
  journal={University of Toronto},
  year={2009},
}

%resnet18
@article{he2016deep,
  title={Deep residual learning for image recognition},
  author={He, Kaiming and Zhang, Xiangyu and Ren, Shaoqing and Sun, Jian},
  journal={IEEE Conference on Computer Vision and Pattern Recognition},
  year={2016}
}