“…Adversarial Attacks and Defenses. When presented with adversarial samples, which are maliciously designed by imperceptible perturbations [21,33,48], deep neural networks often suffer from severe performance deterioration, e.g., [62,21,4,11] for classification models and [39,38,47,46,72,69,77,1,57] for detection/segmentation models. To address this notorious vulnerability, numerous defense mechanisms [76,55,61,50,60,52] have been proposed, such as input transformation [73,40,22,16], randomization [45,44,15], and certified defense approaches [9,51].…”