{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,11]],"date-time":"2025-09-11T19:17:08Z","timestamp":1757618228811,"version":"3.44.0"},"reference-count":39,"publisher":"Springer Science and Business Media LLC","issue":"7","license":[{"start":{"date-parts":[[2025,6,6]],"date-time":"2025-06-06T00:00:00Z","timestamp":1749168000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,6,6]],"date-time":"2025-06-06T00:00:00Z","timestamp":1749168000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["62250710682"],"award-info":[{"award-number":["62250710682"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Guangdong Provincial Key Laboratory","award":["2020B121201001"],"award-info":[{"award-number":["2020B121201001"]}]},{"name":"The Program for Guangdong Introducing Innovative and Entrepreneurial Teams","award":["2017ZT07X386"],"award-info":[{"award-number":["2017ZT07X386"]}]},{"DOI":"10.13039\/501100014736","name":"Lingnan University","doi-asserted-by":"crossref","id":[{"id":"10.13039\/501100014736","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Mach Learn"],"published-print":{"date-parts":[[2025,7]]},"abstract":"<jats:title>Abstract<\/jats:title>\n          <jats:p>Current explainable AI approaches to Deep Neural Networks (DNNs) primarily aim to understand network behavior by identifying key input features that influence predictions. However, these methods often fail to identify <jats:italic>vulnerable<\/jats:italic> regions in the input that are sensitive to minor perturbations and pose significant security risks. The vulnerability of DNNs is typically studied through adversarial examples, but traditional norm-based algorithms, lacking spatial constraints, distribute perturbations across the entire image, obscuring these critical areas. To overcome this limitation, we propose the Vulnerable Region Discovery Attack (VrdAttack), an efficient method that leverages Differential Evolution to generate diverse one-pixel perturbations, enabling the discovery of vulnerable regions and uncovering pixel-level vulnerabilities in Deep Neural Networks (DNNs). Our extensive experiments on CIFAR-10 and ImageNet demonstrate that our proposed VrdAttack outperforms existing methods in identifying diverse critical weak points in an input, highlighting model-specific vulnerabilities, and revealing the impact of adversarial training on these vulnerable regions.<\/jats:p>","DOI":"10.1007\/s10994-025-06788-z","type":"journal-article","created":{"date-parts":[[2025,6,6]],"date-time":"2025-06-06T10:35:35Z","timestamp":1749206135000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Revealing vulnerable regions through diverse adversarial examples"],"prefix":"10.1007","volume":"114","author":[{"given":"Yunce","family":"Zhao","sequence":"first","affiliation":[]},{"given":"Wei","family":"Huang","sequence":"additional","affiliation":[]},{"given":"Wei","family":"Liu","sequence":"additional","affiliation":[]},{"given":"Xin","family":"Yao","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2025,6,6]]},"reference":[{"key":"6788_CR1","doi-asserted-by":"publisher","unstructured":"Andriushchenko, M., Croce, F., Flammarion, N., spsampsps Hein, M. (2020). Square attack: A query-efficient black-box adversarial attack via random search. In: European conference on computer vision (pp. 484\u2013501). https:\/\/doi.org\/10.1007\/978-3-030-58592-1_29","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"6788_CR2","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2022.109037","volume":"133","author":"Y Bai","year":"2023","unstructured":"Bai, Y., Wang, Y., Zeng, Y., Jiang, Y., & Xia, S. T. (2023). Query efficient black-box adversarial attack on deep neural networks. Pattern Recognition, 133, Article 109037. https:\/\/doi.org\/10.1016\/j.patcog.2022.109037","journal-title":"Pattern Recognition"},{"key":"6788_CR3","doi-asserted-by":"publisher","unstructured":"Carlini, N., & Wagner, D. (2017). Towards evaluating the robustness of neural networks. In: 2017 IEEE symposium on security and privacy (SP) (pp. 39\u201357). https:\/\/doi.org\/10.1109\/SP.2017.49","DOI":"10.1109\/SP.2017.49"},{"key":"6788_CR4","doi-asserted-by":"publisher","unstructured":"Chen, P.-Y., Zhang, H., Sharma, Y., Yi, J., & Hsieh, C.-J. (2017). Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In: Proceedings of the 10th ACM workshop on artificial intelligence and security. AISec \u201917 (pp. 15\u201326). Association for Computing Machinery. https:\/\/doi.org\/10.1145\/3128572.3140448","DOI":"10.1145\/3128572.3140448"},{"issue":"4","key":"6788_CR5","doi-asserted-by":"publisher","first-page":"1794","DOI":"10.1109\/TPWRS.2004.835651","volume":"19","author":"J-P Chiou","year":"2004","unstructured":"Chiou, J.-P., Chang, C.-F., & Su, C.-T. (2004). Ant direction hybrid differential evolution for solving large capacitor placement problems. IEEE Transactions on Power Systems, 19(4), 1794\u20131800. https:\/\/doi.org\/10.1109\/TPWRS.2004.835651","journal-title":"IEEE Transactions on Power Systems"},{"key":"6788_CR6","doi-asserted-by":"crossref","unstructured":"Croce, F., Andriushchenko, M., Singh, N.D., Flammarion, N., & Hein, M. (2022). Sparse-rs: A versatile framework for query-efficient sparse black-box adversarial attacks. In: Proceedings of the AAAI conference on artificial intelligence (vol. 36, pp. 6437\u20136445).","DOI":"10.1609\/aaai.v36i6.20595"},{"key":"6788_CR7","doi-asserted-by":"publisher","first-page":"398","DOI":"10.1007\/3-540-61723-X_1004","volume-title":"Parallel problem solving from nature\u2014PPSN IV","author":"P Darwen","year":"1996","unstructured":"Darwen, P., & Yao, X. (1996). Every niching method has its niche: Fitness sharing and implicit sharing compared. In H.-M. Voigt, W. Ebeling, I. Rechenberg, & H.-P. Schwefel (Eds.), Parallel problem solving from nature\u2014PPSN IV (pp. 398\u2013407). Springer. https:\/\/doi.org\/10.1007\/3-540-61723-X_1004"},{"key":"6788_CR8","doi-asserted-by":"crossref","unstructured":"Fong, R., Patrick, M., & Vedaldi, A. (2019). Understanding deep networks via extremal perturbations and smooth masks. In: Proceedings of the IEEE\/CVF international conference on computer vision (pp. 2950\u20132958).","DOI":"10.1109\/ICCV.2019.00304"},{"key":"6788_CR9","unstructured":"Goldberg, D.E., & Richardson, J.(1987). Genetic algorithms with sharing for multimodal function optimization. In: Proceedings of the second international conference on genetic algorithms on genetic algorithms and their application (pp. 41\u201349)."},{"key":"6788_CR10","unstructured":"Goodfellow, I.J., Shlens, J., & Szegedy, C. (2014). Explaining and harnessing adversarial examples. Preprint retrieved from http:\/\/arxiv.org\/abs\/1412.6572"},{"key":"6788_CR11","unstructured":"Guo, C., Gardner, J., You, Y., Wilson, A.G., & Weinberger, K. (2019). Simple black-box adversarial attacks. In: International conference on machine learning (pp. 2484\u20132493). PMLR."},{"key":"6788_CR12","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., & Sun, J.(2016). Deep residual learning for image recognition. In: Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 770\u2013778).","DOI":"10.1109\/CVPR.2016.90"},{"key":"6788_CR13","unstructured":"Ilyas, A., Engstrom, L., Athalye, A., & Lin, J. (2018). Black-box adversarial attacks with limited queries and information. In: Proceedings of the 35th international conference on machine learning. Proceedings of machine learning research (vol. 80, pp. 2137\u20132146)."},{"key":"6788_CR14","doi-asserted-by":"crossref","unstructured":"Inkawhich, N., Wen, W., Li, H.H., & Chen, Y. (2019). Feature space perturbations yield more transferable adversarial examples. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (pp. 7066\u20137074).","DOI":"10.1109\/CVPR.2019.00723"},{"key":"6788_CR15","unstructured":"Kurakin, A., Goodfellow, I., & Bengio, S.(2016). Adversarial examples in the physical world. Preprint retrieved from http:\/\/arxiv.org\/abs\/1607.02533"},{"key":"6788_CR16","doi-asserted-by":"crossref","unstructured":"Liu, Z., Lin, Y., Cao, Y., Hu, H., Wei, Y., Zhang, Z., Lin, S., & Guo, B.(2021). Swin transformer: Hierarchical vision transformer using shifted windows. In: Proceedings of the IEEE\/CVF international conference on computer vision (ICCV) (pp. 10012\u201310022).","DOI":"10.1109\/ICCV48922.2021.00986"},{"key":"6788_CR17","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2018). Towards deep learning models resistant to adversarial attacks. In: International conference on learning representations. https:\/\/openreview.net\/forum?id=rJzIBfZAb"},{"key":"6788_CR18","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S.-M., Fawzi, A., Fawzi, O., & Frossard, P. (2017). Universal adversarial perturbations. In: Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 1765\u20131773).","DOI":"10.1109\/CVPR.2017.17"},{"key":"6788_CR19","doi-asserted-by":"publisher","first-page":"109","DOI":"10.1007\/978-3-642-29139-5_10","volume-title":"Genetic programming","author":"QU Nguyen","year":"2012","unstructured":"Nguyen, Q. U., Nguyen, X. H., O\u2019Neill, M., & Agapitos, A. (2012). An investigation of fitness sharing with semantic and syntactic distance metrics. In A. Moraglio, S. Silva, K. Krawiec, P. Machado, & C. Cotta (Eds.), Genetic programming (pp. 109\u2013120). Springer."},{"key":"6788_CR20","doi-asserted-by":"publisher","unstructured":"Pouyanfar, S., Chen, S.-C., & Shyu, M.-L.(2017). An efficient deep residual-inception network for multimedia classification. In: 2017 IEEE international conference on multimedia and expo (ICME) (pp. 373\u2013378). https:\/\/doi.org\/10.1109\/ICME.2017.8019447","DOI":"10.1109\/ICME.2017.8019447"},{"key":"6788_CR21","doi-asserted-by":"publisher","unstructured":"Rao, S., Stutz, D., spsampsps Schiele, B. (2020). Adversarial training against location-optimized adversarial patches. In: European conference on computer vision (pp. 429\u2013448). Springer. https:\/\/doi.org\/10.1007\/978-3-030-68238-5_32","DOI":"10.1007\/978-3-030-68238-5_32"},{"key":"6788_CR22","doi-asserted-by":"publisher","unstructured":"Ribeiro, M.T., Singh, S., & Guestrin, C. (2016). Why should i trust you? Explaining the predictions of any classifier. In: Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining (pp. 1135\u20131144). https:\/\/doi.org\/10.1145\/2939672.2939778","DOI":"10.1145\/2939672.2939778"},{"issue":"3","key":"6788_CR23","doi-asserted-by":"publisher","first-page":"309","DOI":"10.1145\/1015706.1015720","volume":"23","author":"C Rother","year":"2004","unstructured":"Rother, C., Kolmogorov, V., & Blake, A. (2004). Grabcut interactive foreground extraction using iterated graph cuts. ACM Transactions on Graphics (TOG), 23(3), 309\u2013314. https:\/\/doi.org\/10.1145\/1015706.1015720","journal-title":"ACM Transactions on Graphics (TOG)"},{"issue":"3","key":"6788_CR24","doi-asserted-by":"publisher","first-page":"97","DOI":"10.1109\/4235.735432","volume":"2","author":"B Sareni","year":"1998","unstructured":"Sareni, B., & Krahenbuhl, L. (1998). Fitness sharing and niching methods revisited. IEEE Transactions on Evolutionary Computation, 2(3), 97\u2013106. https:\/\/doi.org\/10.1109\/4235.735432","journal-title":"IEEE Transactions on Evolutionary Computation"},{"key":"6788_CR25","doi-asserted-by":"crossref","unstructured":"Selvaraju, R.R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., & Batra, D. (2017). Grad-cam: visual explanations from deep networks via gradient-based localization. In: Proceedings of the IEEE international conference on computer vision (pp. 618\u2013626).","DOI":"10.1109\/ICCV.2017.74"},{"issue":"2","key":"6788_CR26","doi-asserted-by":"publisher","first-page":"2226","DOI":"10.1109\/TPAMI.2022.3169802","volume":"45","author":"Y Shi","year":"2022","unstructured":"Shi, Y., Han, Y., Hu, Q., Yang, Y., & Tian, Q. (2022). Query-efficient black-box adversarial attack with customized iteration and sampling. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(2), 2226\u20132245. https:\/\/doi.org\/10.1109\/TPAMI.2022.3169802","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"key":"6788_CR27","unstructured":"Srinivas, S., & Fleuret, F.(2019). Full-gradient representation for neural network visualization. In: Wallach, H., Larochelle, H., Beygelzimer, A., Alch\u00e9-Buc, F., Fox, E., Garnett, R. (eds.) Advances in neural information processing systems (vol. 32). https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2019\/file\/80537a945c7aaa788ccfcdf1b99b5d8f-Paper.pdf"},{"key":"6788_CR28","doi-asserted-by":"publisher","first-page":"341","DOI":"10.1023\/A:1008202821328","volume":"11","author":"R Storn","year":"1997","unstructured":"Storn, R., & Price, K. (1997). Differential evolution\u2014a simple and efficient heuristic for global optimization over continuous spaces. Journal of Global Optimization, 11, 341\u2013359. https:\/\/doi.org\/10.1023\/A:1008202821328","journal-title":"Journal of Global Optimization"},{"issue":"5","key":"6788_CR29","doi-asserted-by":"publisher","first-page":"828","DOI":"10.1109\/TEVC.2019.2890858","volume":"23","author":"J Su","year":"2019","unstructured":"Su, J., Vargas, D. V., & Sakurai, K. (2019). One pixel attack for fooling deep neural networks. IEEE Transactions on Evolutionary Computation, 23(5), 828\u2013841. https:\/\/doi.org\/10.1109\/TEVC.2019.2890858","journal-title":"IEEE Transactions on Evolutionary Computation"},{"key":"6788_CR30","first-page":"19319","volume":"35","author":"C Sun","year":"2022","unstructured":"Sun, C., Zhang, Y., Chaoqun, W., Wang, Q., Li, Y., Liu, T., Han, B., & Tian, X. (2022). Towards lightweight black-box attack against deep neural networks. Advances in Neural Information Processing Systems, 35, 19319\u201319331.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"6788_CR31","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R.(2013). Intriguing properties of neural networks. Preprint retrieved from http:\/\/arxiv.org\/abs\/1312.6199"},{"key":"6788_CR32","doi-asserted-by":"crossref","unstructured":"Xie, C., Wu, Y., Maaten, L.v.d., Yuille, A.L., & He, K.(2019). Feature denoising for improving adversarial robustness. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (pp. 501\u2013509).","DOI":"10.1109\/CVPR.2019.00059"},{"key":"6788_CR33","unstructured":"Xu, K., Liu, S., Zhao, P., Chen, P.-Y., Zhang, H., Fan, Q., Erdogmus, D., Wang, Y., & Lin, X .(2018). Structured adversarial attack: Towards general implementation and better interpretability. Preprint retrieved from http:\/\/arxiv.org\/abs\/1808.01664"},{"key":"6788_CR34","doi-asserted-by":"crossref","unstructured":"Yang, Q., Zhu, X., Fwu, J.-K., Ye, Y., You, G., & Zhu, Y. (2021). Mfpp: Morphological fragmental perturbation pyramid for black-box model explanations. In: 2020 25th international conference on pattern recognition (ICPR) (pp. 1376\u20131383). IEEE.","DOI":"10.1109\/ICPR48806.2021.9413046"},{"key":"6788_CR35","doi-asserted-by":"publisher","unstructured":"Zeiler, M.D., spsampsps Fergus, R. (2014). Visualizing and understanding convolutional networks. In: European conference on computer vision) (pp. 818\u2013833). Springer. https:\/\/doi.org\/10.1007\/978-3-319-10590-1_53","DOI":"10.1007\/978-3-319-10590-1_53"},{"key":"6788_CR36","unstructured":"Zhang, H., Yu, Y., Jiao, J., Xing, E., El\u00a0Ghaoui, L., & Jordan, M.(2019). Theoretically principled trade-off between robustness and accuracy. In: International conference on machine learning (pp. 7472\u20137482). PMLR."},{"issue":"4","key":"6788_CR37","doi-asserted-by":"publisher","first-page":"1511","DOI":"10.1007\/s10994-022-06251-3","volume":"113","author":"S Zhang","year":"2024","unstructured":"Zhang, S., Gao, H., Shu, C., Cao, X., Zhou, Y., & He, J. (2024). Black-box Bayesian adversarial attack with transferable priors. Machine Learning, 113(4), 1511\u20131528. https:\/\/doi.org\/10.1007\/s10994-022-06251-3","journal-title":"Machine Learning"},{"key":"6788_CR38","doi-asserted-by":"crossref","unstructured":"Zhou, B., Khosla, A., Lapedriza, A., Oliva, A., & Torralba, A. (2016). Learning deep features for discriminative localization. In: Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 2921\u20132929)","DOI":"10.1109\/CVPR.2016.319"},{"issue":"10","key":"6788_CR39","doi-asserted-by":"publisher","first-page":"3851","DOI":"10.1007\/s10994-022-06203-x","volume":"112","author":"X Zhou","year":"2023","unstructured":"Zhou, X., Tsang, I. W., & Yin, J. (2023). Ladder: Latent boundary-guided adversarial training. Machine Learning, 112(10), 3851\u20133879. https:\/\/doi.org\/10.1007\/s10994-022-06203-x","journal-title":"Machine Learning"}],"container-title":["Machine Learning"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10994-025-06788-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10994-025-06788-z\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10994-025-06788-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,6]],"date-time":"2025-09-06T19:36:51Z","timestamp":1757187411000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10994-025-06788-z"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6,6]]},"references-count":39,"journal-issue":{"issue":"7","published-print":{"date-parts":[[2025,7]]}},"alternative-id":["6788"],"URL":"https:\/\/doi.org\/10.1007\/s10994-025-06788-z","relation":{},"ISSN":["0885-6125","1573-0565"],"issn-type":[{"type":"print","value":"0885-6125"},{"type":"electronic","value":"1573-0565"}],"subject":[],"published":{"date-parts":[[2025,6,6]]},"assertion":[{"value":"2 August 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"10 January 2025","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"23 April 2025","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"6 June 2025","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"Not applicable.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethical approval"}},{"value":"Not applicable.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Informed consent"}},{"value":"Not applicable.","order":5,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent for publication"}}],"article-number":"163"}}