@inproceedings {281210,
	author = {Lukas Bieringer and Kathrin Grosse and Michael Backes and Battista Biggio and Katharina Krombholz},
	title = {Industrial practitioners{\textquoteright} mental models of adversarial machine learning},
	booktitle = {Eighteenth Symposium on Usable Privacy and Security (SOUPS 2022)},
	year = {2022},
	isbn = {978-1-939133-30-4},
	address = {Boston, MA},
	pages = {97--116},
	url = {https://www.usenix.org/conference/soups2022/presentation/bieringer},
	publisher = {USENIX Association},
	month = aug
}
@inproceedings {236234,
	author = {Ambra Demontis and Marco Melis and Maura Pintor and Matthew Jagielski and Battista Biggio and Alina Oprea and Cristina Nita-Rotaru and Fabio Roli},
	title = {Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning Attacks},
	booktitle = {28th USENIX Security Symposium (USENIX Security 19)},
	year = {2019},
	isbn = {978-1-939133-06-9},
	address = {Santa Clara, CA},
	pages = {321--338},
	url = {https://www.usenix.org/conference/usenixsecurity19/presentation/demontis},
	publisher = {USENIX Association},
	month = aug
}
