1. Averaging weights leads to wider optima and better generalization;izmailov;UAI,2018
2. Identity mappings in deep residual networks;he;ECCV,2016
3. Understanding adversarial attacks on deep learning based medical image analysis systems;ma;Pattern Recognition,2020
4. Attacks which do not kill training make adversarial learning stronger;zhang;ICML,2020