{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,15]],"date-time":"2026-04-15T00:31:14Z","timestamp":1776213074474,"version":"3.50.1"},"reference-count":52,"publisher":"Springer Science and Business Media LLC","issue":"15","license":[{"start":{"date-parts":[[2024,2,25]],"date-time":"2024-02-25T00:00:00Z","timestamp":1708819200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2024,2,25]],"date-time":"2024-02-25T00:00:00Z","timestamp":1708819200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61771303"],"award-info":[{"award-number":["61771303"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62071292"],"award-info":[{"award-number":["62071292"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U21B2013"],"award-info":[{"award-number":["U21B2013"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100003399","name":"Science and Technology Commission of Shanghai Municipality","doi-asserted-by":"crossref","award":["18DZ2270700"],"award-info":[{"award-number":["18DZ2270700"]}],"id":[{"id":"10.13039\/501100003399","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Neural Comput & Applic"],"published-print":{"date-parts":[[2024,5]]},"DOI":"10.1007\/s00521-024-09543-y","type":"journal-article","created":{"date-parts":[[2024,2,25]],"date-time":"2024-02-25T21:26:48Z","timestamp":1708896408000},"page":"8549-8564","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Black-box attacks on face recognition via affine-invariant training"],"prefix":"10.1007","volume":"36","author":[{"given":"Bowen","family":"Sun","sequence":"first","affiliation":[]},{"given":"Hang","family":"Su","sequence":"additional","affiliation":[]},{"given":"Shibao","family":"Zheng","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2024,2,25]]},"reference":[{"key":"9543_CR1","doi-asserted-by":"crossref","unstructured":"Liu W, Wen Y, Yu Z, Li M, Raj B, Song L (2017) Sphereface: deep hypersphere embedding for face recognition. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 212\u2013220","DOI":"10.1109\/CVPR.2017.713"},{"key":"9543_CR2","doi-asserted-by":"crossref","unstructured":"Biggio B, Corona I, Maiorca D, Nelson B, \u0160rndi\u0107 N, Laskov P, Giacinto G, Roli F (2013) Evasion attacks against machine learning at test time. In: Joint European conference on machine learning and knowledge discovery in databases, pp 387\u2013402. Springer","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"9543_CR3","unstructured":"Szegedy C, Zaremba W, Sutskever I, Bruna J, Erhan D, Goodfellow I, Fergus R (2013) Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199"},{"key":"9543_CR4","doi-asserted-by":"crossref","unstructured":"Carlini N, Wagner D (2017) Toward evaluating the robustness of neural networks. In: 2017 IEEE symposium on security and privacy (sp), pp 39\u201357. IEEE","DOI":"10.1109\/SP.2017.49"},{"key":"9543_CR5","unstructured":"Wang B, Chen W, Pei H, Xie C, Kang M, Zhang C, Xu C, Xiong Z, Dutta R, Schaeffer R, et al (2023) Decodingtrust: a comprehensive assessment of trustworthiness in gpt models. arXiv preprint arXiv:2306.11698"},{"key":"9543_CR6","unstructured":"Wei A, Haghtalab N, Steinhardt J (2023) Jailbroken: how does llm safety training fail? arXiv preprint arXiv:2307.02483"},{"key":"9543_CR7","doi-asserted-by":"crossref","unstructured":"Chen P-Y, Zhang H, Sharma Y, Yi J, Hsieh C-J (2017) Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In: Proceedings of the 10th ACM workshop on artificial intelligence and security, pp 15\u201326","DOI":"10.1145\/3128572.3140448"},{"key":"9543_CR8","unstructured":"Cheng M, Le T, Chen P-Y, Yi J, Zhang H, Hsieh C-J (2018) Query-efficient hard-label black-box attack: An optimization-based approach. arXiv preprint arXiv:1807.04457"},{"key":"9543_CR9","doi-asserted-by":"crossref","unstructured":"Bhagoji AN, He W, Li B, Song D (2018) Practical black-box attacks on deep neural networks using efficient query mechanisms. In: Proceedings of the European conference on computer vision (ECCV), pp 154\u2013169","DOI":"10.1007\/978-3-030-01258-8_10"},{"key":"9543_CR10","doi-asserted-by":"crossref","unstructured":"Narodytska N, Kasiviswanathan SP (2016) Simple black-box adversarial perturbations for deep networks. arXiv preprint arXiv:1612.06299","DOI":"10.1109\/CVPRW.2017.172"},{"key":"9543_CR11","unstructured":"Brendel W, Rauber J, Bethge M (2017) Decision-based adversarial attacks: reliable attacks against black-box machine learning models. arXiv preprint arXiv:1712.04248"},{"key":"9543_CR12","doi-asserted-by":"crossref","unstructured":"Alzantot M, Sharma Y, Chakraborty S, Zhang H, Hsieh C-J, Srivastava MB (2019) Genattack: practical black-box attacks with gradient-free optimization. In: Proceedings of the genetic and evolutionary computation conference, pp 1111\u20131119","DOI":"10.1145\/3321707.3321749"},{"key":"9543_CR13","unstructured":"Guo C, Gardner J, You Y, Wilson AG, Weinberger K (2019) Simple black-box adversarial attacks. In: International conference on machine learning, pp 2484\u20132493. PMLR"},{"key":"9543_CR14","unstructured":"Cheng S, Dong Y, Pang T, Su H, Zhu J (2019) Improving black-box adversarial attacks with a transfer-based prior. arXiv preprint arXiv:1906.06919"},{"key":"9543_CR15","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Goodfellow I, Jha S, Celik ZB, Swami A (2017) Practical black-box attacks against machine learning. In: Proceedings of the 2017 ACM on Asia conference on computer and communications security, pp 506\u2013519","DOI":"10.1145\/3052973.3053009"},{"key":"9543_CR16","doi-asserted-by":"crossref","unstructured":"Dong Y, Pang T, Su H, Zhu J (2019) Evading defenses to transferable adversarial examples by translation-invariant attacks. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 4312\u20134321","DOI":"10.1109\/CVPR.2019.00444"},{"issue":"1","key":"9543_CR17","doi-asserted-by":"publisher","first-page":"71","DOI":"10.1162\/jocn.1991.3.1.71","volume":"3","author":"M Turk","year":"1991","unstructured":"Turk M, Pentland A (1991) Eigenfaces for recognition. J Cogn Neurosci 3(1):71\u201386","journal-title":"J Cogn Neurosci"},{"issue":"7","key":"9543_CR18","doi-asserted-by":"publisher","first-page":"711","DOI":"10.1109\/34.598228","volume":"19","author":"PN Belhumeur","year":"1997","unstructured":"Belhumeur PN, Hespanha JP, Kriegman DJ (1997) Eigenfaces vs. fisherfaces: recognition using class specific linear projection. IEEE Trans Pattern Anal Mach Intell 19(7):711\u2013720","journal-title":"IEEE Trans Pattern Anal Mach Intell"},{"key":"9543_CR19","doi-asserted-by":"publisher","first-page":"303","DOI":"10.1016\/j.patcog.2017.11.005","volume":"76","author":"Y Ruichek","year":"2018","unstructured":"Ruichek Y et al (2018) Local concave-and-convex micro-structure patterns for texture classification. Pattern Recogn 76:303\u2013322","journal-title":"Pattern Recogn"},{"key":"9543_CR20","doi-asserted-by":"publisher","first-page":"7691","DOI":"10.1007\/s00521-020-05512-3","volume":"33","author":"S Najafi Khanbebin","year":"2021","unstructured":"Najafi Khanbebin S, Mehrdad V (2021) Local improvement approach and linear discriminant analysis-based local binary pattern for face recognition. Neural Comput Appl 33:7691\u20137707","journal-title":"Neural Comput Appl"},{"issue":"6","key":"9543_CR21","doi-asserted-by":"publisher","first-page":"84","DOI":"10.1145\/3065386","volume":"60","author":"A Krizhevsky","year":"2017","unstructured":"Krizhevsky A, Sutskever I, Hinton GE (2017) Imagenet classification with deep convolutional neural networks. Commun ACM 60(6):84\u201390","journal-title":"Commun ACM"},{"key":"9543_CR22","doi-asserted-by":"crossref","unstructured":"Deng J, Dong W, Socher R, Li L-J, Li K, Fei-Fei L (2009) Imagenet: a large-scale hierarchical image database. In: 2009 IEEE conference on computer vision and pattern recognition, pp 248\u2013255. IEEE","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"9543_CR23","doi-asserted-by":"crossref","unstructured":"He K, Zhang X, Ren S, Sun J (2016) Identity mappings in deep residual networks. In: European conference on computer vision, pp 630\u2013645. Springer","DOI":"10.1007\/978-3-319-46493-0_38"},{"key":"9543_CR24","doi-asserted-by":"crossref","unstructured":"Huang G, Liu Z, Van Der Maaten L, Weinberger KQ (2017) Densely connected convolutional networks. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 4700\u20134708","DOI":"10.1109\/CVPR.2017.243"},{"key":"9543_CR25","doi-asserted-by":"crossref","unstructured":"Wang H, Wang Y, Zhou Z, Ji X, Gong D, Zhou J, Li Z, Liu W (2018) Cosface: Large margin cosine loss for deep face recognition. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 5265\u20135274","DOI":"10.1109\/CVPR.2018.00552"},{"key":"9543_CR26","doi-asserted-by":"crossref","unstructured":"Deng J, Guo J, Niannan X, Zafeiriou S (2019) Arcface: additive angular margin loss for deep face recognition. In: CVPR","DOI":"10.1109\/CVPR.2019.00482"},{"key":"9543_CR27","unstructured":"Howard AG, Zhu M, Chen B, Kalenichenko D, Wang W, Weyand T, Andreetto M, Adam H (2017) Mobilenets: efficient convolutional neural networks for mobile vision applications. arXiv preprint arXiv:1704.04861"},{"key":"9543_CR28","doi-asserted-by":"crossref","unstructured":"Chen S, Liu Y, Gao X, Han Z (2018) Mobilefacenets: Efficient cnns for accurate real-time face verification on mobile devices. In: Chinese conference on biometric recognition, pp 428\u2013438. Springer","DOI":"10.1007\/978-3-319-97909-0_46"},{"key":"9543_CR29","doi-asserted-by":"crossref","unstructured":"Zhang X, Zhou X, Lin M, Sun J (2018) Shufflenet: An extremely efficient convolutional neural network for mobile devices. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 6848\u20136856","DOI":"10.1109\/CVPR.2018.00716"},{"key":"9543_CR30","doi-asserted-by":"publisher","first-page":"283","DOI":"10.1016\/j.patcog.2019.04.027","volume":"93","author":"X Luo","year":"2019","unstructured":"Luo X, Xu Y, Yang J (2019) Multi-resolution dictionary learning for face recognition. Pattern Recogn 93:283\u2013292","journal-title":"Pattern Recogn"},{"key":"9543_CR31","first-page":"3","volume":"1","author":"Y-C Lee","year":"2016","unstructured":"Lee Y-C, Chen J, Tseng CW, Lai S-H (2016) Accurate and robust face recognition from RGB-d images with a deep learning approach. BMVC 1:3","journal-title":"BMVC"},{"key":"9543_CR32","doi-asserted-by":"crossref","unstructured":"Zulqarnain Gilani S, Mian A (2018) Learning from millions of 3d scans for large-scale 3d face recognition. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 1896\u20131905","DOI":"10.1109\/CVPR.2018.00203"},{"key":"9543_CR33","doi-asserted-by":"crossref","unstructured":"Mu G, Huang D, Hu G, Sun J, Wang Y (2019) Led3d: a lightweight and efficient deep approach to recognizing low-quality 3d faces. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 5773\u20135782","DOI":"10.1109\/CVPR.2019.00592"},{"key":"9543_CR34","doi-asserted-by":"crossref","unstructured":"Kim M, Jain AK, Liu X (2022) Adaface: quality adaptive margin for face recognition. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 18750\u201318759","DOI":"10.1109\/CVPR52688.2022.01819"},{"key":"9543_CR35","unstructured":"Yang X, Yang D, Dong Y, Yu W, Su H, Zhu J (2020) Delving into the adversarial robustness on face recognition. arXiv preprint arXiv:2007.04118"},{"key":"9543_CR36","doi-asserted-by":"crossref","unstructured":"Dong Y, Su H, Wu B, Li Z, Liu W, Zhang T, Zhu J (2019) Efficient decision-based black-box adversarial attacks on face recognition. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 7714\u20137722","DOI":"10.1109\/CVPR.2019.00790"},{"issue":"2","key":"9543_CR37","doi-asserted-by":"publisher","first-page":"527","DOI":"10.1007\/s10208-015-9296-2","volume":"17","author":"Y Nesterov","year":"2017","unstructured":"Nesterov Y, Spokoiny V (2017) Random gradient-free minimization of convex functions. Found Comput Math 17(2):527\u2013566","journal-title":"Found Comput Math"},{"key":"9543_CR38","unstructured":"Ilyas A, Engstrom L, Athalye A, Lin J (2018) Black-box adversarial attacks with limited queries and information. In: International conference on machine learning, pp 2137\u20132146. PMLR"},{"key":"9543_CR39","unstructured":"Ilyas A, Engstrom L, Madry A (2018) Prior convictions: black-box adversarial attacks with bandits and priors. arXiv preprint arXiv:1807.07978"},{"key":"9543_CR40","unstructured":"Goodfellow IJ, Shlens J, Szegedy C (2014) Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572"},{"key":"9543_CR41","unstructured":"Kurakin A, Goodfellow I, Bengio S (2016) Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533"},{"key":"9543_CR42","unstructured":"Madry A, Makelov A, Schmidt L, Tsipras D, Vladu A (2017) Toward deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083"},{"key":"9543_CR43","doi-asserted-by":"crossref","unstructured":"Dong Y, Liao F, Pang T, Su H, Zhu J, Hu X, Li J (2018) Boosting adversarial attacks with momentum. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 9185\u20139193","DOI":"10.1109\/CVPR.2018.00957"},{"key":"9543_CR44","unstructured":"Gildenblat J, contributors (2021) PyTorch library for CAM methods. GitHub"},{"key":"9543_CR45","doi-asserted-by":"crossref","unstructured":"Worrall DE, Garbin SJ, Turmukhambetov D, Brostow GJ (2017) Harmonic networks: deep translation and rotation equivariance. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 5028\u20135037","DOI":"10.1109\/CVPR.2017.758"},{"key":"9543_CR46","unstructured":"Kingma DP, Ba J (2014) Adam: a method for stochastic optimization. arXiv preprint arXiv:1412.6980"},{"key":"9543_CR47","doi-asserted-by":"crossref","unstructured":"Nirkin Y, Masi I, Tuan AT, Hassner T, Medioni G (2018) On face segmentation, face swapping, and face perception. In: 2018 13th IEEE international conference on automatic face & gesture recognition (FG 2018), pp 98\u2013105. IEEE","DOI":"10.1109\/FG.2018.00024"},{"key":"9543_CR48","unstructured":"Jaderberg M, Simonyan K, Zisserman A, et al (2015) Spatial transformer networks. In: Advances in neural information processing systems, pp 2017\u20132025"},{"key":"9543_CR49","unstructured":"Huang GB, Mattar M, Berg T, Learned-Miller E (2008) Labeled faces in the wild: a database for studying face recognition in unconstrained environments. In: In Workshop on faces in\u2019Real-Life\u2019Images: detection, alignment, and recognition"},{"key":"9543_CR50","doi-asserted-by":"crossref","unstructured":"Wolf L, Hassner T, Maoz I (2011) Face recognition in unconstrained videos with matched background similarity. In: CVPR 2011, pp 529\u2013534. IEEE","DOI":"10.1109\/CVPR.2011.5995566"},{"key":"9543_CR51","doi-asserted-by":"crossref","unstructured":"Moschoglou S, Papaioannou A, Sagonas C, Deng J, Kotsia I, Zafeiriou S (2017) Agedb: the first manually collected, in-the-wild age database. In: Proceedings of the IEEE conference on computer vision and pattern recognition workshops, pp 51\u201359","DOI":"10.1109\/CVPRW.2017.250"},{"key":"9543_CR52","doi-asserted-by":"crossref","unstructured":"Sengupta S, Chen J-C, Castillo C, Patel VM, Chellappa R, Jacobs DW (2016) Frontal to profile face verification in the wild. In: 2016 IEEE winter conference on applications of computer vision (WACV), pp 1\u20139. IEEE","DOI":"10.1109\/WACV.2016.7477558"}],"container-title":["Neural Computing and Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s00521-024-09543-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s00521-024-09543-y\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s00521-024-09543-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,4,16]],"date-time":"2024-04-16T15:24:23Z","timestamp":1713281063000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s00521-024-09543-y"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,2,25]]},"references-count":52,"journal-issue":{"issue":"15","published-print":{"date-parts":[[2024,5]]}},"alternative-id":["9543"],"URL":"https:\/\/doi.org\/10.1007\/s00521-024-09543-y","relation":{},"ISSN":["0941-0643","1433-3058"],"issn-type":[{"value":"0941-0643","type":"print"},{"value":"1433-3058","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,2,25]]},"assertion":[{"value":"5 June 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"22 January 2024","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"25 February 2024","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors have no competing interests to declare that are relevant to the content of this article.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}]}}