{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,26]],"date-time":"2026-04-26T06:17:38Z","timestamp":1777184258290,"version":"3.51.4"},"reference-count":43,"publisher":"Springer Science and Business Media LLC","issue":"4","license":[{"start":{"date-parts":[[2022,10,14]],"date-time":"2022-10-14T00:00:00Z","timestamp":1665705600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2022,10,14]],"date-time":"2022-10-14T00:00:00Z","timestamp":1665705600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61972306"],"award-info":[{"award-number":["61972306"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Zhejiang Laboratory","award":["2021KD0AB03"],"award-info":[{"award-number":["2021KD0AB03"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Mach Learn"],"published-print":{"date-parts":[[2024,4]]},"DOI":"10.1007\/s10994-022-06251-3","type":"journal-article","created":{"date-parts":[[2022,10,14]],"date-time":"2022-10-14T16:13:17Z","timestamp":1665763997000},"page":"1511-1528","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":6,"title":["Black-box Bayesian adversarial attack with transferable priors"],"prefix":"10.1007","volume":"113","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7358-5543","authenticated-orcid":false,"given":"Shudong","family":"Zhang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Haichang","family":"Gao","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Chao","family":"Shu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiwen","family":"Cao","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yunyi","family":"Zhou","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jianping","family":"He","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2022,10,14]]},"reference":[{"key":"6251_CR1","doi-asserted-by":"crossref","unstructured":"Alzantot, M., Sharma, Y., Chakraborty, S., Zhang, H., Hsieh, C.-J., & Srivastava, M. B. (2019). Genattack: Practical black-box attacks with gradient-free optimization. In Proceedings of the genetic and evolutionary computation conference (pp. 1111\u20131119).","DOI":"10.1145\/3321707.3321749"},{"key":"6251_CR2","doi-asserted-by":"crossref","unstructured":"Andriushchenko, M., Croce, F., Flammarion, N., & Hein, M. (2020). Square attack: A query-efficient black-box adversarial attack via random search. In European conference on computer vision (pp. 484\u2013501). Springer.","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"6251_CR3","unstructured":"Athalye, A., Carlini, N., & Wagner, D. (2018). Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning (pp. 274\u2013283). PMLR."},{"key":"6251_CR4","unstructured":"Brendel, W., Rauber, J., & Bethge, M. (2017). Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprint arXiv:1712.04248"},{"key":"6251_CR5","doi-asserted-by":"crossref","unstructured":"Carlini, N., & Wagner, D. (2017). Towards evaluating the robustness of neural networks. In 2017 IEEE symposium on security and privacy (SP) (pp. 39\u201357). IEEE.","DOI":"10.1109\/SP.2017.49"},{"key":"6251_CR6","doi-asserted-by":"crossref","unstructured":"Chen, P.-Y., Zhang, H., Sharma, Y., Yi, J., & Hsieh, C.-J. (2017). Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM workshop on artificial intelligence and security (pp. 15\u201326).","DOI":"10.1145\/3128572.3140448"},{"key":"6251_CR7","unstructured":"Cheng, S., Dong, Y., Pang, T., Su, H., & Zhu, J. (2019). Improving black-box adversarial attacks with a transfer-based prior. arXiv preprint arXiv:1906.06919"},{"key":"6251_CR8","unstructured":"Cheng, M., Singh, S., Chen, P., Chen, P.-Y., Liu, S., & Hsieh, C.-J. (2019). Sign-opt: A query-efficient hard-label adversarial attack. arXiv preprint arXiv:1909.10773"},{"key":"6251_CR9","unstructured":"Croce, F., & Hein, M. (2020). Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning (pp. 2206\u20132216). PMLR."},{"key":"6251_CR10","doi-asserted-by":"crossref","unstructured":"Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., & Li, J. (2018). Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 9185\u20139193).","DOI":"10.1109\/CVPR.2018.00957"},{"key":"6251_CR11","doi-asserted-by":"crossref","unstructured":"Dong, Y., Pang, T., Su, H., & Zhu, J. (2019). Evading defenses to transferable adversarial examples by translation-invariant attacks. In Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (pp. 4312\u20134321).","DOI":"10.1109\/CVPR.2019.00444"},{"key":"6251_CR12","unstructured":"Du, J., Zhang, H., Zhou, J. T., Yang, Y., & Feng, J. (2019). Query-efficient meta attack to deep neural networks. arXiv preprint arXiv:1906.02398"},{"key":"6251_CR13","unstructured":"Frazier, P. I. (2018). A tutorial on Bayesian optimization. arXiv preprint arXiv:1807.02811"},{"key":"6251_CR14","unstructured":"Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572"},{"key":"6251_CR15","unstructured":"Guo, C., Gardner, J., You, Y., Wilson, A. G., & Weinberger, K. (2019). Simple black-box adversarial attacks. In International conference on machine learning (pp. 2484\u20132493). PMLR."},{"key":"6251_CR16","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., & Sun, J. (2016). Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 770\u2013778).","DOI":"10.1109\/CVPR.2016.90"},{"key":"6251_CR17","doi-asserted-by":"crossref","unstructured":"Hu, J., Shen, L., & Sun, G. (2018). Squeeze-and-excitation networks. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 7132\u20137141).","DOI":"10.1109\/CVPR.2018.00745"},{"key":"6251_CR18","unstructured":"Huang, Z., & Zhang, T. (2019). Black-box adversarial attack with transferable model-based embedding. arXiv preprint arXiv:1911.07140"},{"key":"6251_CR19","doi-asserted-by":"crossref","unstructured":"Huang, G., Liu, Z., Van Der\u00a0Maaten, L., & Weinberger, K. Q. (2017). Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 4700\u20134708).","DOI":"10.1109\/CVPR.2017.243"},{"key":"6251_CR20","unstructured":"Iandola, F. N., Han, S., Moskewicz, M. W., Ashraf, K., Dally, W. J., & Keutzer, K. (2016). SqueezeNet: AlexNet-level accuracy with 50$$\\times$$ fewer parameters and $$<$$ 0.5 MB model size. arXiv preprint arXiv:1602.07360"},{"key":"6251_CR21","unstructured":"Ilyas, A., Engstrom, L., & Madry, A. (2018a). Prior convictions: Black-box adversarial attacks with bandits and priors. arXiv preprint arXiv:1807.07978"},{"key":"6251_CR22","unstructured":"Ilyas, A., Engstrom, L., Athalye, A., & Lin, J. (2018b). Black-box adversarial attacks with limited queries and information. arXiv preprint arXiv:1804.08598"},{"key":"6251_CR23","unstructured":"Krizhevsky, A., & Hinton, G. (2009). Learning multiple layers of features from tiny images. Master\u2019s thesis, Department of Computer Science, University of Toronto."},{"key":"6251_CR24","unstructured":"Kuangliu: Pytorch-Cifar (2017). https:\/\/github.com\/kuangliu\/pytorch-cifar"},{"key":"6251_CR25","unstructured":"Kurakin, A., Goodfellow, I., & Bengio, S. (2016). Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533"},{"key":"6251_CR26","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017). Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083"},{"key":"6251_CR27","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z. B., & Swami, A. (2017). Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia conference on computer and communications security (pp. 506\u2013519).","DOI":"10.1145\/3052973.3053009"},{"key":"6251_CR28","doi-asserted-by":"crossref","unstructured":"Poursaeed, O., Katsman, I., Gao, B., & Belongie, S. (2018). Generative adversarial perturbations. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 4422\u20134431).","DOI":"10.1109\/CVPR.2018.00465"},{"issue":"13","key":"6251_CR29","doi-asserted-by":"publisher","first-page":"10327","DOI":"10.1109\/JIOT.2020.3048038","volume":"8","author":"H Qiu","year":"2020","unstructured":"Qiu, H., Dong, T., Zhang, T., Lu, J., Memmi, G., & Qiu, M. (2020). Adversarial attacks against network intrusion detection in IoT systems. IEEE Internet of Things Journal, 8(13), 10327\u201310335.","journal-title":"IEEE Internet of Things Journal"},{"key":"6251_CR30","unstructured":"Ru, B., Cobb, A., Blaas, A., & Gal, Y. (2019). Bayesopt adversarial attack. In International conference on learning representations."},{"key":"6251_CR31","doi-asserted-by":"crossref","unstructured":"Shukla, S. N., Sahu, A. K., Willmott, D., & Kolter, Z. (2021). Simple and efficient hard label black-box adversarial attacks in low query budget regimes. In Proceedings of the 27th ACM SIGKDD conference on knowledge discovery & data mining (pp. 1461\u20131469).","DOI":"10.1145\/3447548.3467386"},{"key":"6251_CR32","unstructured":"Simonyan, K., & Zisserman, A. (2014). Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556"},{"key":"6251_CR33","doi-asserted-by":"crossref","unstructured":"Szegedy, C., Liu, W., Jia, Y., Sermanet, P., Reed, S., Anguelov, D., Erhan, D., Vanhoucke, V., & Rabinovich, A. (2015). Going deeper with convolutions. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 1\u20139).","DOI":"10.1109\/CVPR.2015.7298594"},{"key":"6251_CR34","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013). Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199"},{"key":"6251_CR35","unstructured":"Tramer, F., Carlini, N., Brendel, W., & Madry, A. (2020). On adaptive attacks to adversarial example defenses. arXiv preprint arXiv:2002.08347"},{"key":"6251_CR36","doi-asserted-by":"crossref","unstructured":"Tu, C.-C., Ting, P., Chen, P.-Y., Liu, S., Zhang, H., Yi, J., Hsieh, C.-J., & Cheng, S.-M. (2019). Autozoom: Autoencoder-based zeroth order optimization method for attacking black-box neural networks. In Proceedings of the AAAI conference on artificial intelligence (Vol. 33, pp. 742\u2013749).","DOI":"10.1609\/aaai.v33i01.3301742"},{"key":"6251_CR37","doi-asserted-by":"crossref","unstructured":"Williams, C. K., & Rasmussen, C. E. (2006). Gaussian processes for machine learning. MIT Press.","DOI":"10.7551\/mitpress\/3206.001.0001"},{"key":"6251_CR38","doi-asserted-by":"crossref","unstructured":"Xie, C., Zhang, Z., Zhou, Y., Bai, S., Wang, J., Ren, Z., & Yuille, A. L. (2019). Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (pp. 2730\u20132739).","DOI":"10.1109\/CVPR.2019.00284"},{"key":"6251_CR39","unstructured":"Yan, Z., Guo, Y., & Zhang, C. (2019). Subspace attack: Exploiting promising subspaces for query-efficient black-box attacks. arXiv preprint arXiv:1906.04392"},{"key":"6251_CR40","doi-asserted-by":"crossref","unstructured":"Zagoruyko, S., & Komodakis, N. (2016). Wide residual networks. arXiv preprint arXiv:1605.07146","DOI":"10.5244\/C.30.87"},{"key":"6251_CR41","unstructured":"Zhang, S., Gao, H., Zhang, T., Zhou, Y., & Wu, Z. (2022). Alleviating robust overfitting of adversarial training with consistency regularization. arXiv preprint arXiv:2205.11744"},{"key":"6251_CR42","unstructured":"Zhang, H., Yu, Y., Jiao, J., Xing, E., El\u00a0Ghaoui, L., & Jordan, M. (2019). Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning (pp. 7472\u20137482). PMLR."},{"key":"6251_CR43","doi-asserted-by":"publisher","first-page":"6117","DOI":"10.1109\/TIP.2021.3092582","volume":"30","author":"S Zhang","year":"2021","unstructured":"Zhang, S., Gao, H., & Rao, Q. (2021). Defense against adversarial attacks by reconstructing images. IEEE Transactions on Image Processing, 30, 6117\u20136129.","journal-title":"IEEE Transactions on Image Processing"}],"container-title":["Machine Learning"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10994-022-06251-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10994-022-06251-3\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10994-022-06251-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,3,28]],"date-time":"2024-03-28T17:08:06Z","timestamp":1711645686000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10994-022-06251-3"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,10,14]]},"references-count":43,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2024,4]]}},"alternative-id":["6251"],"URL":"https:\/\/doi.org\/10.1007\/s10994-022-06251-3","relation":{},"ISSN":["0885-6125","1573-0565"],"issn-type":[{"value":"0885-6125","type":"print"},{"value":"1573-0565","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,10,14]]},"assertion":[{"value":"22 June 2022","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"20 July 2022","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"19 September 2022","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"14 October 2022","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"Not applicable.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethical approval"}},{"value":"Not applicable.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent to participate"}},{"value":"Not applicable.","order":5,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent for publication"}},{"value":"This content has been made available to all.","name":"free","label":"Free to read"}]}}