@String(PAMI = {IEEE Trans. Pattern Anal. Mach. Intell.})
@String(IJCV = {Int. J. Comput. Vis.})
@String(CVPR= {IEEE Conf. Comput. Vis. Pattern Recog.})
@String(ICCV= {Int. Conf. Comput. Vis.})
@String(ECCV= {Eur. Conf. Comput. Vis.})
@String(NIPS= {Adv. Neural Inform. Process. Syst.})
@String(ICPR = {Int. Conf. Pattern Recog.})
@String(BMVC= {Brit. Mach. Vis. Conf.})
@String(TOG= {ACM Trans. Graph.})
@String(TIP  = {IEEE Trans. Image Process.})
@String(TVCG  = {IEEE Trans. Vis. Comput. Graph.})
@String(TMM  = {IEEE Trans. Multimedia})
@String(ACMMM= {ACM Int. Conf. Multimedia})
@String(ICME = {Int. Conf. Multimedia and Expo})
@String(ICASSP=	{ICASSP})
@String(ICIP = {IEEE Int. Conf. Image Process.})
@String(ACCV  = {ACCV})
@String(ICLR = {Int. Conf. Learn. Represent.})
@String(IJCAI = {IJCAI})
@String(PR   = {Pattern Recognition})
@String(AAAI = {AAAI})
@String(CVPRW= {IEEE Conf. Comput. Vis. Pattern Recog. Worksh.})
@String(CSVT = {IEEE Trans. Circuit Syst. Video Technol.})

@String(SPL	= {IEEE Sign. Process. Letters})
@String(VR   = {Vis. Res.})
@String(JOV	 = {J. Vis.})
@String(TVC  = {The Vis. Comput.})
@String(JCST  = {J. Comput. Sci. Tech.})
@String(CGF  = {Comput. Graph. Forum})
@String(CVM = {Computational Visual Media})


@String(PAMI  = {IEEE TPAMI})
@String(IJCV  = {IJCV})
@String(CVPR  = {CVPR})
@String(ICCV  = {ICCV})
@String(ECCV  = {ECCV})
@String(NIPS  = {NeurIPS})
@String(ICPR  = {ICPR})
@String(BMVC  =	{BMVC})
@String(TOG   = {ACM TOG})
@String(TIP   = {IEEE TIP})
@String(TVCG  = {IEEE TVCG})
@String(TCSVT = {IEEE TCSVT})
@String(TMM   =	{IEEE TMM})
@String(ACMMM = {ACM MM})
@String(ICME  =	{ICME})
@String(ICASSP=	{ICASSP})
@String(ICIP  = {ICIP})
@String(ACCV  = {ACCV})
@String(ICLR  = {ICLR})
@String(IJCAI = {IJCAI})
@String(PR = {PR})
@String(AAAI = {AAAI})
@String(CVPRW= {CVPRW})
@String(CSVT = {IEEE TCSVT})


%Entries
@inproceedings{he2016deep,
  title={Deep residual learning for image recognition},
  author={He, Kaiming and Zhang, Xiangyu and Ren, Shaoqing and Sun, Jian},
  booktitle={Proceedings of the IEEE conference on computer vision and pattern recognition},
  pages={770--778},
  year={2016}
}
@article{bojarski2016end,
  title={End to end learning for self-driving cars},
  author={Bojarski, Mariusz and Del Testa, Davide and Dworakowski, Daniel and Firner, Bernhard and Flepp, Beat and Goyal, Prasoon and Jackel, Lawrence D and Monfort, Mathew and Muller, Urs and Zhang, Jiakai and others},
  journal={arXiv preprint arXiv:1604.07316},
  year={2016}
}
@article{chen2021transunet,
  title={Transunet: Transformers make strong encoders for medical image segmentation},
  author={Chen, Jieneng and Lu, Yongyi and Yu, Qihang and Luo, Xiangde and Adeli, Ehsan and Wang, Yan and Lu, Le and Yuille, Alan L and Zhou, Yuyin},
  journal={arXiv preprint arXiv:2102.04306},
  year={2021}
}
@article{hendrycks2016baseline,
  title={A baseline for detecting misclassified and out-of-distribution examples in neural networks},
  author={Hendrycks, Dan and Gimpel, Kevin},
  journal={arXiv preprint arXiv:1610.02136},
  year={2016}
}
@article{szegedy2013intriguing,
  title={Intriguing properties of neural networks},
  author={Szegedy, Christian and Zaremba, Wojciech and Sutskever, Ilya and Bruna, Joan and Erhan, Dumitru and Goodfellow, Ian and Fergus, Rob},
  journal={arXiv preprint arXiv:1312.6199},
  year={2013}
}
@article{goodfellow2014explaining,
  title={Explaining and harnessing adversarial examples},
  author={Goodfellow, Ian J and Shlens, Jonathon and Szegedy, Christian},
  journal={arXiv preprint arXiv:1412.6572},
  year={2014}
}
@inproceedings{athalye2018obfuscated,
  title={Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples},
  author={Athalye, Anish and Carlini, Nicholas and Wagner, David},
  booktitle={Proceedings of International Conference on Machine Learning (ICML)},
  pages={274--283},
  year={2018}
}@article{madry2017towards,
  title={Towards deep learning models resistant to adversarial attacks},
  author={Madry, Aleksander and Makelov, Aleksandar and Schmidt, Ludwig and Tsipras, Dimitris and Vladu, Adrian},
  journal={arXiv preprint arXiv:1706.06083},
  year={2017}
}
@inproceedings{zhang2019theoretically,
  title={Theoretically principled trade-off between robustness and accuracy},
  author={Zhang, Hongyang and Yu, Yaodong and Jiao, Jiantao and Xing, Eric and El Ghaoui, Laurent and Jordan, Michael},
  booktitle={Proceedings of International Conference on Machine Learning (ICML)},
  pages={7472--7482},
  year={2019}
}
@article{xu2017feature,
  title={Feature squeezing: Detecting adversarial examples in deep neural networks},
  author={Xu, Weilin and Evans, David and Qi, Yanjun},
  journal={arXiv preprint arXiv:1704.01155},
  year={2017}
}
@article{hendrycks2016early,
  title={Early methods for detecting adversarial images},
  author={Hendrycks, Dan and Gimpel, Kevin},
  journal={arXiv preprint arXiv:1608.00530},
  year={2016}
}
@article{feinman2017detecting,
  title={Detecting adversarial samples from artifacts},
  author={Feinman, Reuben and Curtin, Ryan R and Shintre, Saurabh and Gardner, Andrew B},
  journal={arXiv preprint arXiv:1703.00410},
  year={2017}
}
@article{ma2018characterizing,
  title={Characterizing adversarial subspaces using local intrinsic dimensionality},
  author={Ma, Xingjun and Li, Bo and Wang, Yisen and Erfani, Sarah M and Wijewickrema, Sudanthi and Schoenebeck, Grant and Song, Dawn and Houle, Michael E and Bailey, James},
  journal={arXiv preprint arXiv:1801.02613},
  year={2018}
}
@article{lee2018simple,
  title={A simple unified framework for detecting out-of-distribution samples and adversarial attacks},
  author={Lee, Kimin and Lee, Kibok and Lee, Honglak and Shin, Jinwoo},
  journal={Advances in neural information processing systems},
  volume={31},
  year={2018}
}
@article{yang2021class,
  title={Class-Disentanglement and Applications in Adversarial Detection and Defense},
  author={Yang, Kaiwen and Zhou, Tianyi and Zhang, Yonggang and Tian, Xinmei and Tao, Dacheng},
  journal={Advances in Neural Information Processing Systems},
  volume={34},
  pages={16051--16063},
  year={2021}
}
@article{gong2017adversarial,
  title={Adversarial and clean data are not twins},
  author={Gong, Zhitao and Wang, Wenlu and Ku, Wei-Shinn},
  journal={arXiv preprint arXiv:1704.04960},
  year={2017}
}
@article{metzen2017detecting,
  title={On detecting adversarial perturbations},
  author={Metzen, Jan Hendrik and Genewein, Tim and Fischer, Volker and Bischoff, Bastian},
  journal={arXiv preprint arXiv:1702.04267},
  year={2017}
}
@inproceedings{mohseni2020self,
  title={Self-supervised learning for generalizable out-of-distribution detection},
  author={Mohseni, Sina and Pitale, Mandar and Yadawa, JBS and Wang, Zhangyang},
  booktitle={Proceedings of the AAAI Conference on Artificial Intelligence},
  volume={34},
  number={04},
  pages={5216--5223},
  year={2020}
}
@inproceedings{hendrycks2018deep,
  title={Deep anomaly detection with outlier exposure},
  author={Hendrycks, Dan and Mazeika, Mantas and Dietterich, Thomas},
  booktitle={Proceedings of International Conference on Learning Representations (ICLR)},
  year={2018}
}
@inproceedings{hein2019relu,
  title={Why relu networks yield high-confidence predictions far away from the training data and how to mitigate the problem},
  author={Hein, Matthias and Andriushchenko, Maksym and Bitterwolf, Julian},
  booktitle={Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  pages={41--50},
  year={2019}
}
@inproceedings{sehwag2019analyzing,
  title={Analyzing the robustness of open-world machine learning},
  author={Sehwag, Vikash and Bhagoji, Arjun Nitin and Song, Liwei and Sitawarin, Chawin and Cullina, Daniel and Chiang, Mung and Mittal, Prateek},
  booktitle={Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security},
  pages={105--116},
  year={2019}
}
@inproceedings{carlini2017adversarial,
  title={Adversarial examples are not easily detected: Bypassing ten detection methods},
  author={Carlini, Nicholas and Wagner, David},
  booktitle={Proceedings of the 10th ACM workshop on artificial intelligence and security},
  pages={3--14},
  year={2017}
}
@article{xu2020adversarial,
  title={Adversarial attacks and defenses in images, graphs and text: A review},
  author={Xu, Han and Ma, Yao and Liu, Hao-Chen and Deb, Debayan and Liu, Hui and Tang, Ji-Liang and Jain, Anil K},
  journal={International Journal of Automation and Computing},
  volume={17},
  number={2},
  pages={151--178},
  year={2020},
  publisher={Springer}
}
@article{grosse2017statistical,
  title={On the (statistical) detection of adversarial examples},
  author={Grosse, Kathrin and Manoharan, Praveen and Papernot, Nicolas and Backes, Michael and McDaniel, Patrick},
  journal={arXiv preprint arXiv:1702.06280},
  year={2017}
}
@article{chen2021atom,
title={ATOM: Robustifying out-of-distribution detection using outlier mining},
author={Chen, Jiefeng and Li, Yixuan and Wu, Xi and Liang, Yingyu and Jha, Somesh},
journal={In Proceedings of European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases (ECML PKDD)},
year={2021}
}
@inproceedings{croce2020minimally,
  title={Minimally distorted adversarial examples with a fast adaptive boundary attack},
  author={Croce, Francesco and Hein, Matthias},
  booktitle={Proceedings of International Conference on Machine Learning (ICML)},
  pages={2196--2205},
  year={2020}
}
@inproceedings{andriushchenko2020square,
  title={Square attack: {A} query-efficient black-box adversarial attack via random search},
  author={Andriushchenko, Maksym and Croce, Francesco and Flammarion, Nicolas and Hein, Matthias},
  booktitle={Proceedings of European Conference on Computer Vision (ECCV)},
  pages={484--501},
  year={2020}
}
@article{MoosaviDezfooli2016DeepFoolAS,
  title={DeepFool: A simple and accurate method to fool deep neural networks},
  author={Seyed-Mohsen Moosavi-Dezfooli and Alhussein Fawzi and P. Frossard},
  journal={Proceedings of IEEE/CVF Computer Vision and Pattern Recognition (CVPR)},
  year={2016},
  pages={2574-2582}
}
@article{tramer2017ensemble,
  title={Ensemble adversarial training: Attacks and defenses},
  author={Tram{\`e}r, Florian and Kurakin, Alexey and Papernot, Nicolas and Goodfellow, Ian and Boneh, Dan and McDaniel, Patrick},
  journal={arXiv preprint arXiv:1705.07204},
  year={2017}
}
@inproceedings{papernot2016limitations,
  title={The limitations of deep learning in adversarial settings},
  author={Papernot, Nicolas and McDaniel, Patrick and Jha, Somesh and Fredrikson, Matt and Celik, Z Berkay and Swami, Ananthram},
  booktitle={2016 IEEE European symposium on security and privacy (EuroS\&P)},
  pages={372--387},
  year={2016},
  organization={IEEE}
}
@article{Kurakin2017AdversarialEI,
  title={Adversarial examples in the physical world},
  author={A. Kurakin and I. Goodfellow and Samy Bengio},
  journal={arXiv preprint arXiv:1607.02533},
  year={2017}
}
@article{kurakin2016adversarial,
  title={Adversarial machine learning at scale},
  author={Kurakin, Alexey and Goodfellow, Ian and Bengio, Samy},
  journal={arXiv preprint arXiv:1611.01236},
  year={2016}
}
@inproceedings{papernot2016distillation,
  title={Distillation as a defense to adversarial perturbations against deep neural networks},
  author={Papernot, Nicolas and McDaniel, Patrick and Wu, Xi and Jha, Somesh and Swami, Ananthram},
  booktitle={2016 IEEE symposium on security and privacy (SP)},
  pages={582--597},
  year={2016},
  organization={IEEE}
}
@inproceedings{carlini2017towards,
  title={Towards evaluating the robustness of neural networks},
  author={Carlini, Nicholas and Wagner, David},
  booktitle={Proceedings of Symposium on Security and Privacy (SP)},
  pages={39--57},
  year={2017}
}
@inproceedings{croce2020reliable,
  title={Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks},
  author={Croce, Francesco and Hein, Matthias},
  booktitle={Proceedings of International Conference on Machine Learning (ICML)},
  pages={2206--2216},
  year={2020}
}
@inproceedings{papernot2017practical,
  title={Practical black-box attacks against machine learning},
  author={Papernot, Nicolas and McDaniel, Patrick and Goodfellow, Ian and Jha, Somesh and Celik, Z Berkay and Swami, Ananthram},
  booktitle={Proceedings of the 2017 ACM on Asia conference on computer and communications security},
  pages={506--519},
  year={2017}
}
@inproceedings{xie2019improving,
  title={Improving transferability of adversarial examples with input diversity},
  author={Xie, Cihang and Zhang, Zhishuai and Zhou, Yuyin and Bai, Song and Wang, Jianyu and Ren, Zhou and Yuille, Alan L},
  booktitle={Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition},
  pages={2730--2739},
  year={2019}
}
@article{liu2016delving,
  title={Delving into transferable adversarial examples and black-box attacks},
  author={Liu, Yanpei and Chen, Xinyun and Liu, Chang and Song, Dawn},
  journal={arXiv preprint arXiv:1611.02770},
  year={2016}
}
@inproceedings{wu2020boosting,
  title={Boosting the transferability of adversarial samples via attention},
  author={Wu, Weibin and Su, Yuxin and Chen, Xixian and Zhao, Shenglin and King, Irwin and Lyu, Michael R and Tai, Yu-Wing},
  booktitle={Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition},
  pages={1161--1170},
  year={2020}
}
@inproceedings{moosavi2017universal,
  title={Universal adversarial perturbations},
  author={Moosavi-Dezfooli, Seyed-Mohsen and Fawzi, Alhussein and Fawzi, Omar and Frossard, Pascal},
  booktitle={Proceedings of the IEEE conference on computer vision and pattern recognition},
  pages={1765--1773},
  year={2017}
}
@inproceedings{bai2019hilbert,
  title={Hilbert-based generative defense for adversarial examples},
  author={Bai, Yang and Feng, Yan and Wang, Yisen and Dai, Tao and Xia, Shu-Tao and Jiang, Yong},
  booktitle={Proceedings of IEEE/CVF International Conference on Computer Vision (ICCV)},
  pages={4784--4793},
  year={2019}
}
@inproceedings{carmon2019unlabeled,
  title={Unlabeled data improves adversarial robustness},
  author={Carmon, Yair and Raghunathan, Aditi and Schmidt, Ludwig and Duchi, John C and Liang, Percy S},
  booktitle={Proceedings of Neural Information Processing Systems (NeurIPS)},
  pages={11192--11203},
  year={2019}
}
@inproceedings{alayrac2019labels,
  title={Are labels required for improving adversarial robustness?},
  author={Alayrac, Jean-Baptiste and Uesato, Jonathan and Huang, Po-Sen and Fawzi, Alhussein and Stanforth, Robert and Kohli, Pushmeet},
  booktitle={Proceedings of Neural Information Processing Systems (NeurIPS)},
  pages={12214--12223},
  year={2019}
}
@article{zhai2019adversarially,
  title={Adversarially robust generalization just requires more unlabeled data},
  author={Zhai, Runtian and Cai, Tianle and He, Di and Dan, Chen and He, Kun and Hopcroft, John and Wang, Liwei},
  journal={arXiv preprint arXiv:1906.00555},
  year={2019}
}
@inproceedings{he2016identity,
  title={Identity mappings in deep residual networks},
  author={He, Kaiming and Zhang, Xiangyu and Ren, Shaoqing and Sun, Jian},
  booktitle={European conference on computer vision},
  pages={630--645},
  year={2016},
  organization={Springer}
}
@article{netzer2011reading,
  title={Reading digits in natural images with unsupervised feature learning},
  author={Netzer, Yuval and Wang, Tao and Coates, Adam and Bissacco, Alessandro and Wu, Bo and Ng, Andrew Y},
  year={2011}
}
@article{krizhevsky2009learning,
  title={Learning multiple layers of features from tiny images},
  author={Krizhevsky, Alex and Hinton, Geoffrey and others},
  year={2009},
  publisher={Citeseer}
}
@article{geifman2017selective,
  title={Selective classification for deep neural networks},
  author={Geifman, Yonatan and El-Yaniv, Ran},
  journal={Advances in neural information processing systems},
  volume={30},
  year={2017}
}
@inproceedings{geifman2019selectivenet,
  title={Selectivenet: A deep neural network with an integrated reject option},
  author={Geifman, Yonatan and El-Yaniv, Ran},
  booktitle={International Conference on Machine Learning},
  pages={2151--2159},
  year={2019},
  organization={PMLR}
}
@inproceedings{wang2020dissector,
  title={Dissector: Input validation for deep learning applications by crossing-layer dissection},
  author={Wang, Huiyan and Xu, Jingwei and Xu, Chang and Ma, Xiaoxing and Lu, Jian},
  booktitle={2020 IEEE/ACM 42nd International Conference on Software Engineering (ICSE)},
  pages={727--738},
  year={2020},
  organization={IEEE}
}
@inproceedings{lee2018training,
  title={Training Confidence-calibrated Classifiers for Detecting Out-of-Distribution Samples},
  author={Lee, Kimin and Lee, Honglak and Lee, Kibok and Shin, Jinwoo},
  booktitle={International Conference on Learning Representations},
  year={2018}
}
@article{silver2016mastering,
  title={Mastering the game of Go with deep neural networks and tree search},
  author={Silver, David and Huang, Aja and Maddison, Chris J and Guez, Arthur and Sifre, Laurent and Van Den Driessche, George and Schrittwieser, Julian and Antonoglou, Ioannis and Panneershelvam, Veda and Lanctot, Marc and others},
  journal={nature},
  volume={529},
  number={7587},
  pages={484--489},
  year={2016},
  publisher={Nature Publishing Group}
}
@article{chalapathy2019deep,
  title={Deep learning for anomaly detection: A survey},
  author={Chalapathy, Raghavendra and Chawla, Sanjay},
  journal={arXiv preprint arXiv:1901.03407},
  year={2019}
}
@article{chen2020informative,
  title={Informative outlier matters: Robustifying out-of-distribution detection using outlier mining},
  author={Chen, Jiefeng and Li, Yixuan and Wu, Xi and Liang, Yingyu and Jha, Somesh},
  year={2020}
}
@article{gowal2020uncovering,
  title={Uncovering the limits of adversarial training against norm-bounded adversarial examples},
  author={Gowal, Sven and Qin, Chongli and Uesato, Jonathan and Mann, Timothy and Kohli, Pushmeet},
  journal={arXiv preprint arXiv:2010.03593},
  year={2020}
}
@article{pang2020bag,
  title={Bag of tricks for adversarial training},
  author={Pang, Tianyu and Yang, Xiao and Dong, Yinpeng and Su, Hang and Zhu, Jun},
  journal={arXiv preprint arXiv:2010.00467},
  year={2020}
}
@article{zagoruyko2016wide,
  title={Wide residual networks},
  author={Zagoruyko, Sergey and Komodakis, Nikos},
  journal={arXiv preprint arXiv:1605.07146},
  year={2016}
}
@inproceedings{huang2017densely,
  title={Densely connected convolutional networks},
  author={Huang, Gao and Liu, Zhuang and Van Der Maaten, Laurens and Weinberger, Kilian Q},
  booktitle={Proceedings of the IEEE conference on computer vision and pattern recognition (CVPR)},
  pages={4700--4708},
  year={2017}
}
@inproceedings{cimpoi2014describing,
  title={Describing textures in the wild},
  author={Cimpoi, Mircea and Maji, Subhransu and Kokkinos, Iasonas and Mohamed, Sammy and Vedaldi, Andrea},
  booktitle={Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)},
  pages={3606--3613},
  year={2014}
}
@article{zhou2017places,
  title={Places: A 10 million image database for scene recognition},
  author={Zhou, Bolei and Lapedriza, Agata and Khosla, Aditya and Oliva, Aude and Torralba, Antonio},
  journal={IEEE transactions on pattern analysis and machine intelligence},
  volume={40},
  number={6},
  pages={1452--1464},
  year={2017},
  publisher={IEEE}
}
@article{yu2015lsun,
  title={Lsun: Construction of a large-scale image dataset using deep learning with humans in the loop},
  author={Yu, Fisher and Seff, Ari and Zhang, Yinda and Song, Shuran and Funkhouser, Thomas and Xiao, Jianxiong},
  journal={arXiv preprint arXiv:1506.03365},
  year={2015}
}
@article{torralba200880,
  title={80 million tiny images: A large data set for nonparametric object and scene recognition},
  author={Torralba, Antonio and Fergus, Rob and Freeman, William T},
  journal={IEEE transactions on pattern analysis and machine intelligence},
  volume={30},
  number={11},
  pages={1958--1970},
  year={2008},
  publisher={IEEE}
}
@article{xu2015turkergaze,
  title={Turkergaze: Crowdsourcing saliency with webcam based eye tracking},
  author={Xu, Pingmei and Ehinger, Krista A and Zhang, Yinda and Finkelstein, Adam and Kulkarni, Sanjeev R and Xiao, Jianxiong},
  journal={arXiv preprint arXiv:1504.06755},
  year={2015}
}
@inproceedings{moosavi2016deepfool,
  title={Deepfool: a simple and accurate method to fool deep neural networks},
  author={Moosavi-Dezfooli, Seyed-Mohsen and Fawzi, Alhussein and Frossard, Pascal},
  booktitle={Proceedings of the IEEE conference on computer vision and pattern recognition},
  pages={2574--2582},
  year={2016}
}
@article{tian2021detecting,
  title={Detecting adversarial examples from sensitivity inconsistency of spatial-transform domain},
  author={Tian, Jinyu and Zhou, Jiantao and Li, Yuanman and Duan, Jia},
  journal={arXiv preprint arXiv:2103.04302},
  year={2021}
}
@inproceedings{augustin2020adversarial,
  title={Adversarial robustness on in-and out-distribution improves explainability},
  author={Augustin, Maximilian and Meinke, Alexander and Hein, Matthias},
  booktitle={European Conference on Computer Vision (ECCV)},
  pages={228--245},
  year={2020},
  organization={Springer}
}
@inproceedings{tsipras2019robustness,
  title={Robustness may be at odds with accuracy},
  author={Tsipras, Dimitris and Santurkar, Shibani and Engstrom, Logan and Turner, Alexander and Madry, Aleksander},
  booktitle={Proceedings of International Conference on Learning Representations (ICLR)},
  year={2019}
}
@inproceedings{xiao2021self,
  title={Self-checking deep neural networks in deployment},
  author={Xiao, Yan and Beschastnikh, Ivan and Rosenblum, David S and Sun, Changsheng and Elbaum, Sebastian and Lin, Yun and Dong, Jin Song},
  booktitle={2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE)},
  pages={372--384},
  year={2021},
  organization={IEEE}
}
@article{denouden2018improving,
  title={Improving reconstruction autoencoder out-of-distribution detection with mahalanobis distance},
  author={Denouden, Taylor and Salay, Rick and Czarnecki, Krzysztof and Abdelzad, Vahdat and Phan, Buu and Vernekar, Sachin},
  journal={arXiv preprint arXiv:1812.02765},
  year={2018}
}
@article{abdelzad2019detecting,
  title={Detecting out-of-distribution inputs in deep neural networks using an early-layer output},
  author={Abdelzad, Vahdat and Czarnecki, Krzysztof and Salay, Rick and Denounden, Taylor and Vernekar, Sachin and Phan, Buu},
  journal={arXiv preprint arXiv:1910.10307},
  year={2019}
}
@article{vernekar2019analysis,
  title={Analysis of confident-classifiers for out-of-distribution detection},
  author={Vernekar, Sachin and Gaurav, Ashish and Denouden, Taylor and Phan, Buu and Abdelzad, Vahdat and Salay, Rick and Czarnecki, Krzysztof},
  journal={arXiv preprint arXiv:1904.12220},
  year={2019}
}
@article{bitterwolf2020provable,
  title={Provable worst case guarantees for the detection of out-of-distribution data},
  author={Bitterwolf, Julian and Meinke, Alexander and Hein, Matthias},
  year={2020}
}
@article{hendrycks2019benchmarking,
  title={Benchmarking neural network robustness to common corruptions and perturbations},
  author={Hendrycks, Dan and Dietterich, Thomas},
  journal={arXiv preprint arXiv:1903.12261},
  year={2019}
}
@article{gowal2019alternative,
  title={An alternative surrogate loss for pgd-based adversarial testing},
  author={Gowal, Sven and Uesato, Jonathan and Qin, Chongli and Huang, Po-Sen and Mann, Timothy and Kohli, Pushmeet},
  journal={arXiv preprint arXiv:1910.09338},
  year={2019}
}
@article{tramer2020adaptive,
  title={On adaptive attacks to adversarial example defenses},
  author={Tramer, Florian and Carlini, Nicholas and Brendel, Wieland and Madry, Aleksander},
  journal={Advances in Neural Information Processing Systems},
  volume={33},
  pages={1633--1645},
  year={2020}
}
@inproceedings{ma2018deepgauge,
  title={Deepgauge: {Multi-granularity} testing criteria for deep learning systems},
  author={Ma, Lei and Juefei-Xu, Felix and Zhang, Fuyuan and Sun, Jiyuan and Xue, Minhui and Li, Bo and Chen, Chunyang and Su, Ting and Li, Li and Liu, Yang and others},
  booktitle={Proceedings of ACM/IEEE International Conference on
  Automated Software Engineering (ASE)},
  pages={120--131},
  year={2018}
}
@inproceedings{pei2017deepxplore,
  title={{DeepXplore}: {Automated} whitebox testing of deep learning systems},
  author={Pei, Kexin and Cao, Yinzhi and Yang, Junfeng and Jana, Suman},
  booktitle={Proceedings of USENIX Symposium on Operating
  Systems Principles (SOSP)},
  pages={1--18},
  year={2017}
}
@inproceedings{sun2018concolic,
  title={Concolic testing for deep neural networks},
  author={Sun, Youcheng and Wu, Min and Ruan, Wenjie and Huang, Xiaowei and Kwiatkowska, Marta and Kroening, Daniel},
  booktitle={Proceedings of ACM/IEEE International Conference on Automated Software Engineering},
  pages={109--119},
  year={2018},
  organization={ACM}
}
@inproceedings{tian2018deeptest,
  title={Deeptest: Automated testing of deep-neural-network-driven autonomous cars},
  author={Tian, Yuchi and Pei, Kexin and Jana, Suman and Ray, Baishakhi},
  booktitle={Proceedings of International Conference on Software Engineering},
  pages={303--314},
  year={2018},
}
@inproceedings{xie2019deephunter,
  title={DeepHunter: a coverage-guided fuzz testing framework for deep neural networks},
  author={Xie, Xiaofei and Ma, Lei and Juefei-Xu, Felix and Xue, Minhui and Chen, Hongxu and Liu, Yang and Zhao, Jianjun and Li, Bo and Yin, Jianxiong and See, Simon},
  booktitle={Proceedings of the ACM SIGSOFT International Symposium on Software Testing and Analysis},
  pages={146--157},
  year={2019}
}
@inproceedings{lee2020removing,
  title={Removing Undesirable Feature Contributions Using Out-of-Distribution Data},
  author={Lee, Saehyung and Park, Changhwa and Lee, Hyungyu and Yi, Jihun and Lee, Jonghyun and Yoon, Sungroh},
  booktitle={International Conference on Learning Representations},
  year={2020}
}
@article{chrabaszcz2017downsampled,
  title={A downsampled variant of imagenet as an alternative to the cifar datasets},
  author={Chrabaszcz, Patryk and Loshchilov, Ilya and Hutter, Frank},
  journal={arXiv preprint arXiv:1707.08819},
  year={2017}
}
@inproceedings{meinke2019towards,
  title={Towards neural networks that provably know when they don't know},
  author={Meinke, Alexander and Hein, Matthias},
  booktitle={International Conference on Learning Representations},
  year={2019}
}
@inproceedings{liang2018enhancing,
  title={Enhancing The Reliability of Out-of-distribution Image Detection in Neural Networks},
  author={Liang, Shiyu and Li, Yixuan and Srikant, R},
  booktitle={International Conference on Learning Representations},
  year={2018}
}
@inproceedings{rice2020overfitting,
  title={Overfitting in adversarially robust deep learning},
  author={Rice, Leslie and Wong, Eric and Kolter, Zico},
  booktitle={International Conference on Machine Learning},
  pages={8093--8104},
  year={2020},
  organization={PMLR}
}
@article{vaswani2017attention,
  title={Attention is all you need},
  author={Vaswani, Ashish and Shazeer, Noam and Parmar, Niki and Uszkoreit, Jakob and Jones, Llion and Gomez, Aidan N and Kaiser, {\L}ukasz and Polosukhin, Illia},
  journal={Advances in neural information processing systems},
  volume={30},
  year={2017}
}
@article{han2021transformer,
  title={Transformer in transformer},
  author={Han, Kai and Xiao, An and Wu, Enhua and Guo, Jianyuan and Xu, Chunjing and Wang, Yunhe},
  journal={Advances in Neural Information Processing Systems},
  volume={34},
  pages={15908--15919},
  year={2021}
}
@inproceedings{zhang2022delving,
  title={Delving deep into the generalization of vision transformers under distribution shifts},
  author={Zhang, Chongzhi and Zhang, Mingyuan and Zhang, Shanghang and Jin, Daisheng and Zhou, Qiang and Cai, Zhongang and Zhao, Haiyu and Liu, Xianglong and Liu, Ziwei},
  booktitle={Proceedings of the IEEE/CVF conference on Computer Vision and Pattern Recognition},
  pages={7277--7286},
  year={2022}
}
@inproceedings{dosovitskiy2020image,
  title={An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale},
  author={Dosovitskiy, Alexey and Beyer, Lucas and Kolesnikov, Alexander and Weissenborn, Dirk and Zhai, Xiaohua and Unterthiner, Thomas and Dehghani, Mostafa and Minderer, Matthias and Heigold, Georg and Gelly, Sylvain and others},
  booktitle={International Conference on Learning Representations},
  year={2020}
}
@inproceedings{croce2021robustbench,
  title     = {RobustBench: a standardized adversarial robustness benchmark},
  author    = {Croce, Francesco and Andriushchenko, Maksym and Sehwag, Vikash and Debenedetti, Edoardo and Flammarion, Nicolas and Chiang, Mung and Mittal, Prateek and Matthias Hein},
  booktitle = {Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track},
  year      = {2021},
  url       = {https://openreview.net/forum?id=SSKZPJCt7B}
}
@inproceedings{chen2022robust,
  title={Robust Out-of-distribution Detection for Neural Networks},
  author={Chen, Jiefeng and Li, Yixuan and Wu, Xi and Liang, Yingyu and Jha, Somesh},
  booktitle={The AAAI-22 Workshop on Adversarial Machine Learning and Beyond},
  year={2022}
}
@article{azizmalayeri2022your,
  title={Your Out-of-Distribution Detection Method is Not Robust!},
  author={Azizmalayeri, Mohammad and Soltani Moakhar, Arshia and Zarei, Arman and Zohrabi, Reihaneh and Manzuri, Mohammad and Rohban, Mohammad Hossein},
  journal={Advances in Neural Information Processing Systems},
  volume={35},
  pages={4887--4901},
  year={2022}
}
@inproceedings{mccoyd2018background,
  title={Background class defense against adversarial examples},
  author={McCoyd, Michael and Wagner, David},
  booktitle={2018 IEEE Security and Privacy Workshops (SPW)},
  pages={96--102},
  year={2018},
  organization={IEEE}
}
@inproceedings{radford2021learning,
  title={Learning transferable visual models from natural language supervision},
  author={Radford, Alec and Kim, Jong Wook and Hallacy, Chris and Ramesh, Aditya and Goh, Gabriel and Agarwal, Sandhini and Sastry, Girish and Askell, Amanda and Mishkin, Pamela and Clark, Jack and others},
  booktitle={International conference on machine learning},
  pages={8748--8763},
  year={2021},
  organization={PMLR}
}
@article{krishna1999genetic,
  title={Genetic K-means algorithm},
  author={Krishna, K and Murty, M Narasimha},
  journal={IEEE Transactions on Systems, Man, and Cybernetics, Part B (Cybernetics)},
  volume={29},
  number={3},
  pages={433--439},
  year={1999},
  publisher={IEEE}
}
@article{golan2018deep,
  title={Deep anomaly detection using geometric transformations},
  author={Golan, Izhak and El-Yaniv, Ran},
  journal={Advances in neural information processing systems},
  volume={31},
  year={2018}
}
@inproceedings{deng2009imagenet,
  title={Imagenet: A large-scale hierarchical image database},
  author={Deng, Jia and Dong, Wei and Socher, Richard and Li, Li-Jia and Li, Kai and Fei-Fei, Li},
  booktitle={2009 IEEE conference on computer vision and pattern recognition},
  pages={248--255},
  year={2009},
  organization={Ieee}
}
@article{russakovsky2015imagenet,
  title={Imagenet large scale visual recognition challenge},
  author={Russakovsky, Olga and Deng, Jia and Su, Hao and Krause, Jonathan and Satheesh, Sanjeev and Ma, Sean and Huang, Zhiheng and Karpathy, Andrej and Khosla, Aditya and Bernstein, Michael and others},
  journal={International journal of computer vision},
  volume={115},
  pages={211--252},
  year={2015},
  publisher={Springer}
}
@inproceedings{zhangdeeproad,
  title={Deeproad: Gan-based metamorphic testing and input validation framework for autonomous driving systems. In 2018 33rd IEEE},
  author={Zhang, Mengshi and Zhang, Yuqun and Zhang, Lingming and Liu, Cong and Khurshid, Sarfraz},
  booktitle={ACM International Conference on Automated Software Engineering (ASE)},
  pages={132--142}
}
@inproceedings{odena2019tensorfuzz,
  title={Tensorfuzz: Debugging neural networks with coverage-guided fuzzing},
  author={Odena, Augustus and Olsson, Catherine and Andersen, David and Goodfellow, Ian},
  booktitle={International Conference on Machine Learning},
  pages={4901--4911},
  year={2019},
  organization={PMLR}
}
@inproceedings{guo2018dlfuzz,
  title={Dlfuzz: Differential fuzzing testing of deep learning systems},
  author={Guo, Jianmin and Jiang, Yu and Zhao, Yue and Chen, Quan and Sun, Jiaguang},
  booktitle={Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering},
  pages={739--743},
  year={2018}
}
@article{gopinath2018symbolic,
  title={Symbolic execution for deep neural networks},
  author={Gopinath, Divya and Wang, Kaiyuan and Zhang, Mengshi and Pasareanu, Corina S and Khurshid, Sarfraz},
  journal={arXiv preprint arXiv:1807.10439},
  year={2018}
}
@inproceedings{zhou2021deepcon,
  title={Deepcon: Contribution coverage testing for deep learning systems},
  author={Zhou, Zhiyang and Dou, Wensheng and Liu, Jie and Zhang, Chenxin and Wei, Jun and Ye, Dan},
  booktitle={2021 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)},
  pages={189--200},
  year={2021},
  organization={IEEE}
}
@article{zhao2023attack,
  title={Attack as detection: Using adversarial attack methods to detect abnormal examples},
  author={Zhao, Zhe and Chen, Guangke and Liu, Tong and Li, Taishan and Song, Fu and Wang, Jingyi and Sun, Jun},
  journal={ACM Transactions on Software Engineering and Methodology},
  year={2023},
  publisher={ACM New York, NY}
}
@article{xia2022gan,
  title={GAN-based anomaly detection: A review},
  author={Xia, Xuan and Pan, Xizhou and Li, Nan and He, Xing and Ma, Lin and Zhang, Xiaoguang and Ding, Ning},
  journal={Neurocomputing},
  volume={493},
  pages={497--535},
  year={2022},
  publisher={Elsevier}
}
@article{xiao2022self,
  title={Self-checking deep neural networks for anomalies and adversaries in deployment},
  author={Xiao, Yan and Beschastnikh, Ivan and Lin, Yun and Hundal, Rajdeep Singh and Xie, Xiaofei and Rosenblum, David S and Dong, Jin Song},
  journal={IEEE Transactions on Dependable and Secure Computing},
  year={2022},
  publisher={IEEE}
}
@inproceedings{zhou2023fixing,
  title={Fixing Robust Out-of-distribution Detection for Deep Neural Networks},
  author={Zhou, Zhiyang and Liu, Jie and Dou, Wensheng and Li, Shuo and Kang, Liangyi and Qu, Muzi and Ye, Dan},
  booktitle={2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE)},
  pages={533--544},
  year={2023},
  organization={IEEE}
}
@article{chib2023recent,
  title={Recent advancements in end-to-end autonomous driving using deep learning: A survey},
  author={Chib, Pranav Singh and Singh, Pravendra},
  journal={IEEE Transactions on Intelligent Vehicles},
  year={2023},
  publisher={IEEE}
}
@article{chen2024end,
  title={End-to-end autonomous driving: Challenges and frontiers},
  author={Chen, Li and Wu, Penghao and Chitta, Kashyap and Jaeger, Bernhard and Geiger, Andreas and Li, Hongyang},
  journal={IEEE Transactions on Pattern Analysis and Machine Intelligence},
  year={2024},
  publisher={IEEE}
}