@inproceedings{Wang2018,
    title = {{Adversarial distillation of Bayesian neural network posteriors}},
    year = {2018},
    booktitle = {ICML},
    author = {Wang, Kuan Chieh and Vicol, Paul and Lucas, James and Gu, Li and Grosse, Roger and Zemel, Richard},
    month = {6},
    pages = {8239--8248},
    volume = {12},
    url = {http://arxiv.org/abs/1806.10317},
    isbn = {9781510867963},
    arxivId = {1806.10317}
}

@article{Rawat2017,
    title = {{Adversarial Phenomenon in the Eyes of Bayesian Deep Learning}},
    year = {2017},
    author = {Rawat, Ambrish and Wistuba, Martin and Nicolae, Maria-Irina},
    month = {11},
    arxivId = {1711.08244}
}

@article{art2018,
    title = {{Adversarial Robustness Toolbox v1.2.0}},
    year = {2018},
    journal = {CoRR},
    author = {Nicolae, Maria-Irina and Sinn, Mathieu and Tran, Minh~Ngoc and Buesser, Beat and Rawat, Ambrish and Wistuba, Martin and Zantedeschi, Valentina and Baracaldo, Nathalie and Chen, Bryant and Ludwig, Heiko and Molloy, Ian and Edwards, Ben},
    volume = {1807.01069}
}

@inproceedings{Xie2017,
    title = {{Aggregated residual transformations for deep neural networks}},
    year = {2017},
    booktitle = {CVPR},
    author = {Xie, Saining and Girshick, Ross and Doll{\'{a}}r, Piotr and Tu, Zhuowen and He, Kaiming},
    month = {11},
    pages = {5987--5995}
}

@techreport{Guo2020a,
    title = {{Backpropagating Linearly Improves Transferability of Adversarial Examples}},
    year = {2020},
    booktitle = {NeurIPS},
    author = {Guo, Yiwen and Li, Qizhang and Chen, Hao},
    volume = {33},
    url = {https://github.com/qizhangli/linbp-attack.}
}

@article{Bekasov2018,
    title = {{Bayesian Adversarial Spheres: Bayesian Inference and Adversarial Examples in a Noiseless Setting}},
    year = {2018},
    author = {Bekasov, Artur and Murray, Iain},
    month = {11},
    arxivId = {1811.12335}
}

@inproceedings{Welling2011a,
    title = {{Bayesian learning via stochastic gradient langevin dynamics}},
    year = {2011},
    booktitle = {ICML 2011},
    author = {Welling, Max and Teh, Yee Whye},
    pages = {681--688},
    isbn = {9781450306195},
    keywords = {Bayesian learning, ICML, machine learning, online learning}
}

@inproceedings{Dong2018,
    title = {{Boosting Adversarial Attacks with Momentum}},
    year = {2018},
    booktitle = {CVPR},
    author = {Dong, Yinpeng and Liao, Fangzhou and Pang, Tianyu and Su, Hang and Zhu, Jun and Hu, Xiaolin and Li, Jianguo},
    month = {10},
    pages = {9185--9193},
    url = {http://arxiv.org/abs/1710.06081},
    isbn = {9781538664209},
    doi = {10.1109/CVPR.2018.00957},
    issn = {10636919},
    arxivId = {1710.06081}
}

@article{Zimmermann2019,
    title = {{Comment on "Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network"}},
    year = {2019},
    author = {Zimmermann, Roland S.},
    month = {7},
    url = {http://arxiv.org/abs/1907.00895}
}

@inproceedings{He2016,
    title = {{Deep residual learning for image recognition}},
    year = {2016},
    booktitle = {ICCV},
    author = {He, Kaiming and Zhang, Xiangyu and Ren, Shaoqing and Sun, Jian},
    month = {12},
    pages = {770--778},
    publisher = {IEEE Computer Society},
    isbn = {9781467388504},
    doi = {10.1109/CVPR.2016.90},
    issn = {10636919},
    arxivId = {1512.03385}
}

@article{Tan2019,
    title = {{EfficientNet: Rethinking Model Scaling for Convolutional Neural Networks}},
    year = {2019},
    journal = {ICML},
    author = {Tan, Mingxing and Le, Quoc V.},
    month = {5},
    pages = {10691--10700},
    publisher = {International Machine Learning Society (IMLS)},
    arxivId = {1905.11946}
}

@inproceedings{Dong2019,
    title = {{Evading defenses to transferable adversarial examples by translation-invariant attacks}},
    year = {2019},
    booktitle = {CVPR},
    author = {Dong, Yinpeng and Pang, Tianyu and Su, Hang and Zhu, Jun},
    month = {4},
    pages = {4307--4316},
    arxivId = {1904.02884},
    keywords = {Categorization, Deep Learning, Recognition: Detection, Retrieval}
}

@inproceedings{Biggio2013,
    title = {{Evasion attacks against machine learning at test time}},
    year = {2013},
    booktitle = {Lecture Notes in Computer Science},
    author = {Biggio, Battista and Corona, Igino and Maiorca, Davide and Nelson, Blaine and {\v{S}}rndi{\'{c}}, Nedim and Laskov, Pavel and Giacinto, Giorgio and Roli, Fabio},
    number = {PART 3},
    month = {8},
    pages = {387--402},
    doi = {10.1007/978-3-642-40994-3{\_}25},
    keywords = {adversarial machine learning, evasion attacks, neural networks, support vector machines}
}

@article{ILSVRC15,
    title = {{ImageNet Large Scale Visual Recognition Challenge}},
    year = {2015},
    journal = {IJCV},
    author = {Russakovsky, Olga and Deng, Jia and Su, Hao and Krause, Jonathan and Satheesh, Sanjeev and Ma, Sean and Huang, Zhiheng and Karpathy, Andrej and Khosla, Aditya and Bernstein, Michael and Berg, Alexander C and Fei-Fei, Li},
    number = {3},
    pages = {211--252},
    volume = {115}
}

@inproceedings{Xie2019,
    title = {{Improving transferability of adversarial examples with input diversity}},
    year = {2019},
    booktitle = {ICCV},
    author = {Xie, Cihang and Zhang, Zhishuai and Zhou, Yuyin and Bai, Song and Wang, Jianyu and Ren, Zhou and Yuille, Alan L.},
    month = {3},
    url = {http://arxiv.org/abs/1803.06978},
    isbn = {9781728132938},
    doi = {10.1109/CVPR.2019.00284},
    issn = {10636919},
    arxivId = {1803.06978},
    keywords = {Categorization, Deep Learning, Recognition: Detection, Retrieval, Statistical Learning}
}

@article{Szegedy2013,
    title = {{Intriguing properties of neural networks}},
    year = {2013},
    author = {Szegedy, Christian and Zaremba, Wojciech and Sutskever, Ilya and Bruna, Joan and Erhan, Dumitru and Goodfellow, Ian and Fergus, Rob},
    month = {12},
    arxivId = {1312.6199}
}

@article{Tan2018,
    title = {{MnasNet: Platform-Aware Neural Architecture Search for Mobile}},
    year = {2018},
    journal = {ICCV},
    author = {Tan, Mingxing and Chen, Bo and Pang, Ruoming and Vasudevan, Vijay and Sandler, Mark and Howard, Andrew and Le, Quoc V.},
    arxivId = {1807.11626},
    keywords = {Categorization, Deep Learning, Recognition: Detection, Retrieval}
}

@incollection{NEURIPS2019_9015,
    title = {{PyTorch: An Imperative Style, High-Performance Deep Learning Library}},
    year = {2019},
    booktitle = {NeurIPS},
    author = {Paszke, Adam and Gross, Sam and Massa, Francisco and Lerer, Adam and Bradbury, James and Chanan, Gregory and Killeen, Trevor and Lin, Zeming and Gimelshein, Natalia and Antiga, Luca and Desmaison, Alban and Kopf, Andreas and Yang, Edward and DeVito, Zachary and Raison, Martin and Tejani, Alykhan and Chilamkurthy, Sasank and Steiner, Benoit and Fang, Lu and Bai, Junjie and Chintala, Soumith},
    pages = {8024--8035},
    publisher = {Curran Associates, Inc.}
}

@inproceedings{Cardelli2019a,
    title = {{Statistical guarantees for the robustness of Bayesian neural networks}},
    year = {2019},
    booktitle = {IJCAI},
    author = {Cardelli, Luca and Kwiatkowska, Marta and Laurenti, Luca and Paoletti, Nicola and Patane, Andrea and Wicker, Matthew},
    month = {3},
    pages = {5693--5700},
    url = {http://arxiv.org/abs/1903.01980},
    isbn = {9780999241141},
    doi = {10.24963/ijcai.2019/789},
    issn = {10450823},
    arxivId = {1903.01980}
}

@inproceedings{Cardelli2019,
    title = {{Statistical guarantees for the robustness of Bayesian neural networks}},
    year = {2019},
    booktitle = {IJCAI},
    author = {Cardelli, Luca and Kwiatkowska, Marta and Laurenti, Luca and Paoletti, Nicola and Patane, Andrea and Wicker, Matthew},
    month = {3},
    pages = {5693--5700},
    url = {http://arxiv.org/abs/1903.01980},
    isbn = {9780999241141},
    doi = {10.24963/ijcai.2019/789},
    issn = {10450823},
    arxivId = {1903.01980}
}

@inproceedings{Grosse2018b,
    title = {{The Limitations of Model Uncertainty in Adversarial Settings}},
    year = {2018},
    booktitle = {NeurIPS Workshop},
    author = {Grosse, Kathrin and Pfaff, David and Smith, Michael Thomas and Backes, Michael},
    month = {12},
    arxivId = {1812.02606}
}

@article{Grosse2018,
    title = {{The Limitations of Model Uncertainty in Adversarial Settings}},
    year = {2018},
    journal = {NeurIPS Workshop},
    author = {Grosse, Kathrin and Pfaff, David and Smith, Michael Thomas and Backes, Michael},
    month = {12},
    arxivId = {1812.02606}
}

@article{Papernot2016,
    title = {{Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples}},
    year = {2016},
    author = {Papernot, Nicolas and McDaniel, Patrick and Goodfellow, Ian},
    month = {5},
    url = {http://arxiv.org/abs/1605.07277},
    arxivId = {1605.07277}
}

@inproceedings{Smith2018,
    title = {{Understanding measures of uncertainty for adversarial example detection}},
    year = {2018},
    booktitle = {UAI},
    author = {Smith, Lewis and Gal, Yarin},
    month = {3},
    pages = {560--569},
    volume = {2},
    url = {http://arxiv.org/abs/1803.08533},
    isbn = {9781510871601},
    arxivId = {1803.08533}
}

@inproceedings{Smith2018a,
    title = {{Understanding measures of uncertainty for adversarial example detection}},
    year = {2018},
    booktitle = {UAI},
    author = {Smith, Lewis and Gal, Yarin},
    month = {3},
    pages = {560--569},
    volume = {2},
    url = {http://arxiv.org/abs/1803.08533},
    isbn = {9781510871601},
    arxivId = {1803.08533}
}

@article{Che2020AMemories.,
    title = {{A New Ensemble Adversarial Attack Powered by Long-Term Gradient Memories.}},
    year = {2020},
    journal = {AAAI},
    author = {Che, Zhaohui},
    pages = {3405--3413}
}

@inproceedings{Maddox2019ALearning,
    title = {{A simple baseline for Bayesian uncertainty in deep learning}},
    year = {2019},
    booktitle = {NeurIPS},
    author = {Maddox, Wesley J. and Garipov, Timur and {Izmailov} and Vetrov, Dmitry and Wilson, Andrew Gordon},
    month = {2},
    volume = {32},
    publisher = {arXiv},
    url = {http://arxiv.org/abs/1902.02476},
    issn = {10495258},
    arxivId = {1902.02476}
}

@inproceedings{Maddox2019ALearningb,
    title = {{A simple baseline for Bayesian uncertainty in deep learning}},
    year = {2019},
    booktitle = {NeurIPS},
    author = {Maddox, Wesley J. and Garipov, Timur and {Izmailov} and Vetrov, Dmitry and Wilson, Andrew Gordon},
    month = {2},
    volume = {32},
    publisher = {arXiv},
    url = {http://arxiv.org/abs/1902.02476},
    issn = {10495258},
    arxivId = {1902.02476}
}

@article{Dargan2019ALearning,
    title = {{A Survey of Deep Learning and Its Applications: A New Paradigm to Machine Learning}},
    year = {2019},
    journal = {Archives of Computational Methods in Engineering},
    author = {Dargan, Shaveta and Kumar, Munish and Ayyagari, Maruthi Rohit and Kumar, Gulshan},
    number = {4},
    month = {9},
    pages = {1071--1092},
    volume = {27},
    publisher = {Springer Netherlands},
    keywords = {Mathematical and Computational Engineering}
}

@inproceedings{Kurakin2019AdversarialWorld,
    title = {{Adversarial examples in the physical world}},
    year = {2019},
    booktitle = {ICLR Workshop},
    author = {Kurakin, Alexey and Goodfellow, Ian J. and Bengio, Samy},
    month = {7},
    url = {http://arxiv.org/abs/1607.02533},
    arxivId = {1607.02533}
}

@inproceedings{Kurakin2017AdversarialWorld,
    title = {{Adversarial examples in the physical world}},
    year = {2017},
    booktitle = {ICLR},
    author = {Kurakin, Alexey and Goodfellow, Ian J. and Bengio, Samy},
    month = {7},
    arxivId = {1607.02533}
}

@techreport{MinkaThomasP.2002BayesianCombination,
    title = {{Bayesian model averaging is not model combination}},
    year = {2002},
    author = {{Minka Thomas P.}}
}

@article{Shukla2019Black-boxOptimization,
    title = {{Black-box Adversarial Attacks with Bayesian Optimization}},
    year = {2019},
    author = {Shukla, Satya Narayan and Sahu, Anit Kumar and Willmott, Devin and Kolter, J. Zico},
    month = {9},
    arxivId = {1909.13857}
}

@article{Mattingly2009ConvergenceEquations,
    title = {{Convergence of Numerical Time-Averaging and Stationary Measures via Poisson Equations}},
    year = {2009},
    journal = {SIAM Journal on Numerical Analysis},
    author = {Mattingly, Jonathan C. and Stuart, Andrew M. and Tretyakov, M. V.},
    number = {2},
    month = {8},
    pages = {552--577},
    volume = {48},
    doi = {10.1137/090770527},
    arxivId = {0908.4450},
    keywords = {Convergence of weak schemes, Ergodic limits, Poisson equation, Stochastic differential equations, Time averaging}
}

@article{Zhang2020CyclicalLearning,
    title = {{Cyclical Stochastic Gradient MCMC for Bayesian Deep Learning}},
    year = {2020},
    journal = {ICLR},
    author = {Zhang, Ruqi and Li, Chunyuan and Zhang, Jianyi and Chen, Changyou and Wilson, Andrew Gordon},
    month = {2},
    url = {http://arxiv.org/abs/1902.03932}
}

@inproceedings{Moosavi-Dezfooli2016DeepFool:Networks,
    title = {{DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks}},
    year = {2016},
    booktitle = {CVPR},
    author = {Moosavi-Dezfooli, Seyed Mohsen and Fawzi, Alhussein and Frossard, Pascal},
    month = {11},
    pages = {2574--2582},
    isbn = {9781467388504},
    doi = {10.1109/CVPR.2016.282},
    issn = {10636919},
    arxivId = {1511.04599}
}

@article{Liu2017DelvingAttacks,
    title = {{Delving into transferable adversarial examples and black-box attacks}},
    year = {2017},
    journal = {ICLR},
    author = {Liu, Yanpei and Chen, Xinyun and Liu, Chang and Song, Dawn},
    month = {11},
    url = {https://arxiv.org/abs/1611.02770},
    arxivId = {1611.02770}
}

@article{Huang2017DenselyNetworks,
    title = {{Densely Connected Convolutional Networks}},
    year = {2017},
    journal = {CVPR},
    author = {Huang, Gao and Liu, Zhuang and van der Maaten, Laurens and Weinberger, Kilian Q.},
    arxivId = {1608.06993}
}

@inproceedings{Huang2019EnhancingAttack,
    title = {{Enhancing adversarial example transferability with an intermediate level attack}},
    year = {2019},
    booktitle = {ICCV},
    author = {Huang, Qian and Katsman, Isay and Gu, Zeqi and He, Horace and Belongie, Serge and Lim, Ser Nam},
    month = {7},
    pages = {4732--4741},
    url = {http://arxiv.org/abs/1907.10823},
    doi = {10.1109/ICCV.2019.00483}
}

@article{Friel2012EstimatingReview,
    title = {{Estimating the evidence - a review}},
    year = {2012},
    journal = {Statistica Neerlandica},
    author = {Friel, Nial and Wyse, Jason},
    number = {3},
    month = {8},
    pages = {288--308},
    volume = {66},
    issn = {00390402},
    keywords = {Annealed importance sampling, Evidence, Harmonic mean estimator, Marginal likelihood, Markov chain Monte Carlo, Nested sampling, Power posteriors}
}

@article{Goodfellow2014ExplainingExamples,
    title = {{Explaining and Harnessing Adversarial Examples}},
    year = {2014},
    author = {Goodfellow, Ian J. and Shlens, Jonathon and Szegedy, Christian},
    month = {12},
    arxivId = {1412.6572}
}

@techreport{Vollmer2000ExplorationDynamics,
    title = {{Exploration of the (Non-)Asymptotic Bias and Variance of Stochastic Gradient Langevin Dynamics}},
    year = {2000},
    booktitle = {Journal of Machine Learning Research},
    author = {Vollmer, Sebastian J and Zygalakis, Konstantinos C and Teh, Yee Whye},
    pages = {1--48},
    volume = {1},
    doi = {10.5555/2946645},
    keywords = {Langevin dynamics, Markov Chain Monte Carlo, big data, fixed step size}
}

@inproceedings{Wong2020FastTraining,
    title = {{Fast is better than free: Revisiting adversarial training}},
    year = {2020},
    booktitle = {ICLR},
    author = {Wong, Eric and Rice, Leslie and Kolter, J. Zico},
    month = {1},
    arxivId = {2001.03994}
}

@article{He2016IdentityNetworks,
    title = {{Identity Mappings in Deep Residual Networks}},
    year = {2016},
    journal = {Lecture Notes in Computer Science},
    author = {He, Kaiming and Zhang, Xiangyu and Ren, Shaoqing and Sun, Jian},
    month = {3},
    pages = {630--645},
    volume = {9908 LNCS},
    publisher = {Springer Verlag},
    arxivId = {1603.05027}
}

@article{Mingard2020IsAlmost,
    title = {{Is SGD a Bayesian sampler? Well, almost}},
    year = {2020},
    journal = {Journal of Machine Learning Research},
    author = {Mingard, Chris and Valle-P{\'{e}}rez, Guillermo and Skalse, Joar and Louis, Ard A.},
    month = {6},
    volume = {22},
    publisher = {Microtome Publishing},
    issn = {15337928},
    arxivId = {2006.15191},
    keywords = {Bayesian neural networks, Deep learning, Gaussian processes, Generalisation, Stochastic gradient descent}
}

@article{Krizhevsky2009LearningImages,
    title = {{Learning Multiple Layers of Features from Tiny Images}},
    year = {2009},
    author = {Krizhevsky, Alex},
    isbn = {9788578110796},
    doi = {10.1.1.222.9220},
    issn = {1098-6596},
    pmid = {25246403},
    arxivId = {arXiv:1011.1669v3}
}

@article{Li2018LearningNetworks,
    title = {{Learning Transferable Adversarial Examples via Ghost Networks}},
    year = {2018},
    journal = {AAAI},
    author = {Li, Yingwei and Bai, Song and Zhou, Yuyin and Xie, Cihang and Zhang, Zhishuai and Yuille, Alan},
    number = {07},
    month = {12},
    volume = {34},
    url = {http://arxiv.org/abs/1812.03413},
    doi = {10.1609/aaai.v34i07.6810},
    issn = {2374-3468},
    arxivId = {1812.03413}
}

@article{Garipov2018LossDNNs,
    title = {{Loss Surfaces, Mode Connectivity, and Fast Ensembling of DNNs}},
    year = {2018},
    journal = {NeurIPS},
    author = {Garipov, Timur and Izmailov, Pavel and Podoprikhin, Dmitrii and Vetrov, Dmitry and Wilson, Andrew Gordon},
    month = {2},
    pages = {8789--8798},
    publisher = {Neural information processing systems foundation},
    arxivId = {1802.10026}
}

@article{Garipov2018LossDNNsb,
    title = {{Loss Surfaces, Mode Connectivity, and Fast Ensembling of DNNs}},
    year = {2018},
    journal = {NeurIPS},
    author = {Garipov, Timur and Izmailov, Pavel and Podoprikhin, Dmitrii and Vetrov, Dmitry and Wilson, Andrew Gordon},
    month = {2},
    arxivId = {1802.10026}
}

@inproceedings{Xie2018MitigatingRandomization,
    title = {{Mitigating adversarial effects through randomization}},
    year = {2018},
    booktitle = {ICLR},
    author = {Xie, Cihang and Zhang, Zhishuai and Yuille, Alan L. and Wang, Jianyu and Ren, Zhou},
    month = {11},
    publisher = {arXiv},
    arxivId = {1711.01991}
}

@inproceedings{Li2019NNetworks,
    title = {{N Attack: Learning the distributions of adversarial examples for an improved black-box attack on deep neural networks}},
    year = {2019},
    booktitle = {ICML},
    author = {Li, Yandong and Li, Lijun and Wang, Liqiang and Zhang, Tong and Gong, Boqing},
    pages = {6860--6870},
    isbn = {9781510886988}
}

@inproceedings{Lin2020NesterovAttacks,
    title = {{Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks}},
    year = {2020},
    booktitle = {ICLR},
    author = {Lin, Jiadong and Song, Chuanbiao and He, Kun and Wang, Liwei and Hopcroft, John E.},
    month = {8},
    arxivId = {1908.06281}
}

@article{Athalye2018ObfuscatedExamples,
    title = {{Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples}},
    year = {2018},
    journal = {ICML},
    author = {Athalye, Anish and Carlini, Nicholas and Wagner, David},
    month = {2},
    arxivId = {1802.00420}
}

@article{Ashukha2020PitfallsLearning,
    title = {{Pitfalls of In-Domain Uncertainty Estimation and Ensembling in Deep Learning}},
    year = {2020},
    journal = {ICLR},
    author = {Ashukha, Arsenii and Lyzhov, Alexander and Molchanov, Dmitry and Vetrov, Dmitry},
    month = {2},
    url = {http://arxiv.org/abs/2002.06470},
    issn = {2331-8422},
    arxivId = {2002.06470}
}

@inproceedings{Li2016PreconditionedNetworks,
    title = {{Preconditioned stochastic gradient langevin dynamics for deep neural networks}},
    year = {2016},
    booktitle = {AAAI},
    author = {Li, Chunyuan and Chen, Changyou and Carlson, David and Carin, Lawrence},
    month = {12},
    pages = {1788--1794},
    publisher = {AAAI press},
    isbn = {9781577357605},
    arxivId = {1512.07666}
}

@inproceedings{Croce2020ReliableAttacks,
    title = {{Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks}},
    year = {2020},
    booktitle = {ICML},
    author = {Croce, Francesco and Hein, Matthias},
    month = {3},
    pages = {2184--2194},
    volume = {PartF16814},
    isbn = {9781713821120},
    arxivId = {2003.01690}
}

@inproceedings{Carbone2020RobustnessAttacks,
    title = {{Robustness of Bayesian neural networks to gradient-based attacks}},
    year = {2020},
    booktitle = {NeurIPS},
    author = {Carbone, Ginevra and Wicker, Matthew and Laurenti, Luca and Patane, Andrea and Bortolussi, Luca and Sanguinetti, Guido},
    month = {2},
    publisher = {arXiv},
    issn = {10495258},
    arxivId = {2002.04359}
}

@article{Palacci2018ScalablePractice,
    title = {{Scalable Natural Gradient Langevin Dynamics in Practice}},
    year = {2018},
    author = {Palacci, Henri and Hess, Henry},
    month = {6},
    url = {http://arxiv.org/abs/1806.02855},
    arxivId = {1806.02855}
}

@article{Lakshminarayanan2016SimpleEnsembles,
    title = {{Simple and Scalable Predictive Uncertainty Estimation using Deep Ensembles}},
    year = {2016},
    journal = {NeurIPS},
    author = {Lakshminarayanan, Balaji and Pritzel, Alexander and Blundell, Charles},
    pages = {6403--6414},
    arxivId = {1612.01474}
}

@article{Wu2020SkipResNets,
    title = {{Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets}},
    year = {2020},
    journal = {ICLR},
    author = {Wu, Dongxian and Wang, Yisen and Xia, Shu-Tao and Bailey, James and Ma, Xingjun},
    month = {2},
    arxivId = {2002.05990}
}

@inproceedings{Huang2017SnapshotFree,
    title = {{Snapshot ensembles: Train 1, get M for free}},
    year = {2017},
    booktitle = {ICLR},
    author = {Huang, Gao and Li, Yixuan and Pleiss, Geoff and Liu, Zhuang and Hopcroft, John E. and Weinberger, Kilian Q.},
    month = {3},
    publisher = {International Conference on Learning Representations, ICLR},
    url = {http://arxiv.org/abs/1704.00109},
    arxivId = {1704.00109}
}

@article{Mandt2017StochasticInference,
    title = {{Stochastic Gradient Descent as Approximate Bayesian Inference}},
    year = {2017},
    journal = {Journal of Machine Learning Research},
    author = {Mandt, Stephan and Hof Fman, Matthew D. and Blei, David M.},
    month = {4},
    pages = {1--35},
    volume = {18},
    publisher = {Microtome Publishing},
    url = {https://arxiv.org/abs/1704.04289v2},
    issn = {15337928},
    arxivId = {1704.04289},
    keywords = {Approximate Bayesian inference, Stochastic differential equations, Stochastic gradient MCMC, Stochastic optimization, Variational inference}
}

@article{Frankle2019TheNetworks,
    title = {{The Lottery Ticket Hypothesis: Finding Sparse, Trainable Neural Networks}},
    year = {2019},
    journal = {ICLR},
    author = {Frankle, Jonathan and Carbin, Michael},
    arxivId = {1803.03635}
}

@inproceedings{Madry2018TowardsAttacks,
    title = {{Towards deep learning models resistant to adversarial attacks}},
    year = {2018},
    booktitle = {ICLR},
    author = {Madry, Aleksander and Makelov, Aleksandar and Schmidt, Ludwig and Tsipras, Dimitris and Vladu, Adrian},
    month = {6},
    url = {http://arxiv.org/abs/1706.06083},
    arxivId = {1706.06083}
}

@inproceedings{Simonyan2015VeryRecognition,
    title = {{Very deep convolutional networks for large-scale image recognition}},
    year = {2015},
    booktitle = {ICLR},
    author = {Simonyan, Karen and Zisserman, Andrew}
}

@article{Zagoruyko2016WideNetworks,
    title = {{Wide Residual Networks}},
    year = {2016},
    journal = {British Machine Vision Conference 2016, BMVC 2016},
    author = {Zagoruyko, Sergey and Komodakis, Nikos},
    month = {5},
    pages = {1--87},
    volume = {2016-Septe},
    publisher = {British Machine Vision Conference, BMVC},
    arxivId = {1605.07146}
}