1. Szegedy C, Zaremba W, Sutskever I, Bruna J, Erhan D, Goodfellow I, Fergus R(2013) Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199
2. Huang Y, Kong AW (2022) Transferable adversarial attack based on integrated gradients. In: The tenth international conference on learning representations, ICLR
3. Zou J, Duan Y, Li B, Zhang W, Pan Y, Pan Z (2022) Making adversarial examples more transferable and indistinguishable. In: Thirty-Sixth AAAI conference on artificial intelligence, AAAI, pp 3662–3670
4. Yuan X, He P, Zhu Q, Li X (2019) Adversarial examples: attacks and defenses for deep learning. IEEE Trans Neural Netw Learn Syst 30(9):2805–2824. https://doi.org/10.1109/TNNLS.2018.2886017
5. Fawzi A, Moosavi-Dezfooli S-M, Frossard P (2016) Robustness of classifiers: from adversarial to random noise. In: Proceedings of the 30th international conference on neural information processing systems, pp 1632–1640