{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,15]],"date-time":"2026-05-15T05:56:40Z","timestamp":1778824600539,"version":"3.51.4"},"reference-count":48,"publisher":"Springer Science and Business Media LLC","issue":"11","license":[{"start":{"date-parts":[[2021,1,12]],"date-time":"2021-01-12T00:00:00Z","timestamp":1610409600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2021,1,12]],"date-time":"2021-01-12T00:00:00Z","timestamp":1610409600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int. J. Mach. Learn. & Cyber."],"published-print":{"date-parts":[[2021,11]]},"DOI":"10.1007\/s13042-020-01240-1","type":"journal-article","created":{"date-parts":[[2021,1,13]],"date-time":"2021-01-13T14:22:16Z","timestamp":1610547736000},"page":"3295-3307","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":8,"title":["Generating transferable adversarial examples based on perceptually-aligned perturbation"],"prefix":"10.1007","volume":"12","author":[{"given":"Hongqiao","family":"Chen","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Keda","family":"Lu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xianmin","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jin","family":"Li","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2021,1,12]]},"reference":[{"key":"1240_CR1","unstructured":"Athalye A, Carlini N, Wagner D (2018) Obfuscated gradients give a false sense of security: circumventing defenses to adversarial examples. arXiv:1802.00420"},{"key":"1240_CR2","unstructured":"Balduzzi D, Frean M, Leary L, Lewis JP, Ma KW, Mcwilliams B (2017) The shattered gradients problem: if resnets are the answer, then what is the question?. Neural and evolutionary computing. arXiv:1702.08591"},{"key":"1240_CR3","unstructured":"Brendel W, Rauber J, Bethge M (2017) Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. Machine learning. arXiv:1712.04248"},{"key":"1240_CR4","doi-asserted-by":"crossref","unstructured":"Carlini N, Wagner D (2017) Towards evaluating the robustness of neural networks. In: 2017 ieee symposium on security and privacy (sp). IEEE, pp 39\u201357","DOI":"10.1109\/SP.2017.49"},{"key":"1240_CR5","unstructured":"Chan A, Tay Y, Ong YS, Fu J (2019) Jacobian adversarially regularized networks for robustness"},{"key":"1240_CR6","doi-asserted-by":"publisher","first-page":"89","DOI":"10.1016\/j.cose.2019.04.014","volume":"85","author":"J Chen","year":"2019","unstructured":"Chen J, Su M, Shen S, Xiong H, Zheng H (2019) POBA-GA: perturbation optimized black-box adversarial attacks via genetic algorithm. Comput Secur 85:89\u2013106","journal-title":"Comput Secur"},{"key":"1240_CR7","doi-asserted-by":"publisher","unstructured":"Chen PY, Zhang H, Yi J, Hsieh CJ (2017) Zoo: zeroth order optimization based black-box attacks to deep neural networks without training substitute models, pp 15\u201326. https:\/\/doi.org\/10.1145\/3128572.3140448","DOI":"10.1145\/3128572.3140448"},{"key":"1240_CR8","unstructured":"Dhillon GS, Azizzadenesheli K, Lipton ZC et al (2018) Stochastic activation pruning for robust adversarial defense. arXiv preprint arXiv:1803.01442"},{"key":"1240_CR9","doi-asserted-by":"crossref","unstructured":"Dong Y, Liao F, Pang T et al (2018) Boosting adversarial attacks with momentum. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 9185\u20139193","DOI":"10.1109\/CVPR.2018.00957"},{"key":"1240_CR10","doi-asserted-by":"crossref","unstructured":"Dong Y, Pang T, Su H et al (2019) Evading defenses to transferable adversarial examples by translation-invariant attacks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp 4312\u20134321","DOI":"10.1109\/CVPR.2019.00444"},{"key":"1240_CR11","unstructured":"Feng W, Chen Z, Gursoy MC, Velipasalar S (2020) Defense strategies against adversarial jamming attacks via deep reinforcement learning. In: 2020 54th annual conference on information sciences and systems (CISS)"},{"key":"1240_CR12","unstructured":"Goodfellow I, Shlens J, Szegedy C (2014) Explaining and harnessing adversarial examples. Machine learning. arXiv"},{"key":"1240_CR13","unstructured":"Grosse K, Manoharan P, Papernot N, Backes M, Mcdaniel P (2017) On the (statistical) detection of adversarial examples. Cryptography and security. arXiv"},{"issue":"6","key":"1240_CR14","doi-asserted-by":"publisher","first-page":"923","DOI":"10.1002\/int.22230","volume":"35","author":"X Gu","year":"2020","unstructured":"Gu X, Angelov PP, Soares EA (2020) A self-adaptive synthetic over-sampling technique for imbalanced classification. Int J Intell Syst 35(6):923\u2013943","journal-title":"Int J Intell Syst"},{"key":"1240_CR15","unstructured":"Guo C, Rana M, Cisse M, Der\u00a0Maaten LV (2017) Countering adversarial images using input transformations. Computer vision and pattern recognition. arXiv:1711.00117"},{"key":"1240_CR16","first-page":"630","volume-title":"European conference on computer vision","author":"K He","year":"2016","unstructured":"He K, Zhang X, Ren S et al (2016) Identity mappings in deep residual networks. In: European conference on computer vision. Springer, Cham, pp 630\u2013645"},{"key":"1240_CR17","doi-asserted-by":"publisher","first-page":"127","DOI":"10.1007\/978-3-030-47436-2_10","volume-title":"Pacific-Asia conference on knowledge discovery and data mining","author":"Z Huan","year":"2020","unstructured":"Huan Z, Wang Y, Zhang X et al (2020) Data-free adversarial perturbations for practical black-box attack. In: Pacific-Asia conference on knowledge discovery and data mining. Springer, Cham, pp 127\u2013138"},{"key":"1240_CR18","doi-asserted-by":"crossref","unstructured":"Iyyer M, Wieting J, Gimpel K, Zettlemoyer L (2018) Adversarial example generation with syntactically controlled paraphrase networks, vol 1, pp 1875\u20131885. arXiv:1804.06059","DOI":"10.18653\/v1\/N18-1170"},{"key":"1240_CR19","unstructured":"Kurakin A, Goodfellow I, Bengio S (2016) Adversarial examples in the physical world. Computer vision and pattern recognition. arXiv:1607.02533"},{"key":"1240_CR20","doi-asserted-by":"publisher","first-page":"166","DOI":"10.1016\/j.ins.2020.03.041","volume":"526","author":"J Li","year":"2020","unstructured":"Li J, Kuang X, Lin S, Ma X, Tang Y (2020) Privacy preservation for machine learning training and classification based on homomorphic encryption schemes. Inf Sci 526:166\u2013179. https:\/\/doi.org\/10.1016\/j.ins.2020.03.041","journal-title":"Inf Sci"},{"key":"1240_CR21","doi-asserted-by":"crossref","unstructured":"Li X, Li F (2017) Adversarial examples detection in deep networks with convolutional filter statistics. In: Proceedings of the IEEE international conference on computer vision, pp 5764\u20135772","DOI":"10.1109\/ICCV.2017.615"},{"key":"1240_CR22","unstructured":"Li Y, Li L, Wang L et al (2019) Nattack: learning the distributions of adversarial examples for an improved black-box attack on deep neural networks. arXiv preprint arXiv:1905.00441"},{"key":"1240_CR23","doi-asserted-by":"crossref","unstructured":"Liu X, Cheng M, Zhang H et al (2018) Towards robust neural networks via random self-ensemble. In: Proceedings of the european conference on computer vision (ECCV), pp 369\u2013385","DOI":"10.1007\/978-3-030-01234-2_23"},{"key":"1240_CR24","unstructured":"Liu Y, Chen X, Liu C, Song D (2016) Delving into transferable adversarial examples and black-box attacks. Learning. arXiv:1611.02770"},{"key":"1240_CR25","unstructured":"Madry A, Makelov A, Schmidt L, Tsipras D, Vladu A (2017) Towards deep learning models resistant to adversarial attacks. Machine learning. arXiv:1706.06083"},{"key":"1240_CR26","doi-asserted-by":"publisher","first-page":"476","DOI":"10.1007\/978-3-030-36708-4_39","volume-title":"International conference on neural information processing","author":"L Meng","year":"2019","unstructured":"Meng L, Lin C T, Jung T P et al (2019) White-box target attack for EEG-based BCI regression problems. In: International conference on neural information processing. Springer, Cham, pp 476\u2013488"},{"key":"1240_CR27","unstructured":"Metzen JH, Genewein T, Fischer V, Bischoff B (2017) On detecting adversarial perturbations. arXiv:1702.04267"},{"key":"1240_CR28","doi-asserted-by":"crossref","unstructured":"Moosavidezfooli S, Fawzi A, Fawzi O, Frossard P, Soatto S (2017) Analysis of universal adversarial perturbations. Computer vision and pattern recognition. arXiv:1705.09554","DOI":"10.1109\/CVPR.2017.17"},{"key":"1240_CR29","unstructured":"Mopuri KR, Garg U, Babu RV (2017) Fast feature fool: a data independent approach to universal adversarial perturbations. Computer vision and pattern recognition. arXiv:1707.05572"},{"key":"1240_CR30","unstructured":"Nazemi A, Fieguth P (2019) Potential adversarial samples for white-box attacks. arXiv:1912.06409"},{"key":"1240_CR31","unstructured":"Papernot N, Mcdaniel P, Goodfellow I (2016) Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. Cryptography and security. arXiv:1605.0727"},{"key":"1240_CR32","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Wu X et al (2016) Distillation as a defense to adversarial perturbations against deep neural networks. In: 2016 IEEE symposium on security and privacy (SP). IEEE, pp 582\u2013597","DOI":"10.1109\/SP.2016.41"},{"issue":"3","key":"1240_CR33","doi-asserted-by":"publisher","first-page":"328","DOI":"10.1109\/TPAMI.2005.55","volume":"27","author":"X He","year":"2005","unstructured":"He X, Yan S, Hu Y et al (2005) Face recognition using laplacianfaces. IEEE Trans Pattern Anal Mach Intell 27(3):328\u2013340","journal-title":"IEEE Trans Pattern Anal Mach Intell"},{"key":"1240_CR34","unstructured":"Smilkov D, Thorat N, Kim B, Viegas FB, Wattenberg M (2017) Smoothgrad: removing noise by adding noise. Learning. arXiv:1706.03825"},{"key":"1240_CR35","unstructured":"Sun L, Wang J, Yu PS, Li B (2018) Adversarial attack and defense on graph data: a survey. Cryptography and security. arXiv:1812.10528"},{"key":"1240_CR36","doi-asserted-by":"publisher","first-page":"519","DOI":"10.1007\/978-981-15-1465-4_51","volume-title":"Information science and applications","author":"RE Sutanto","year":"2020","unstructured":"Sutanto RE, Lee S (2020) Adversarial attack defense based on the deep image prior network. In: Information science and applications. Springer, Singapore, pp 519\u2013526"},{"key":"1240_CR37","unstructured":"Szegedy C, Ioffe S, Vanhoucke V, Alemi AA (2016) Inception-v4, inception-resnet and the impact of residual connections on learning, pp 4278\u20134284. arXiv:1602.07261"},{"key":"1240_CR38","doi-asserted-by":"crossref","unstructured":"Szegedy C, Vanhoucke V, Ioffe S et al (2016) Rethinking the inception architecture for computer vision. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 2818\u20132826","DOI":"10.1109\/CVPR.2016.308"},{"issue":"5","key":"1240_CR39","doi-asserted-by":"publisher","first-page":"1272","DOI":"10.1109\/TPAMI.2019.2910529","volume":"42","author":"P Tang","year":"2019","unstructured":"Tang P, Wang C, Wenyu X, Wenjun L, Jingdong Z (2019) Object detection in videos by high quality object linking. IEEE Trans Pattern Anal Mach Intel 42(5):1272\u20131278","journal-title":"IEEE Trans Pattern Anal Mach Intel"},{"key":"1240_CR40","unstructured":"Tramer F, Kurakin A, Papernot N, Goodfellow I, Boneh D, Mcdaniel P (2017) Ensemble adversarial training: attacks and defenses. Machine learning. arXiv:1705.07204"},{"key":"1240_CR41","doi-asserted-by":"crossref","unstructured":"Wang X, Kuang X, Li J et al (2020) Oblivious transfer for privacy-preserving in VANET's feature matching. IEEE transactions on intelligent transportation systems","DOI":"10.1109\/TITS.2020.2973738"},{"key":"1240_CR42","doi-asserted-by":"publisher","first-page":"12","DOI":"10.1016\/j.jpdc.2019.03.003","volume":"130","author":"X Wang","year":"2019","unstructured":"Wang X, Li J, Kuang X, Tan Y, Li J (2019) The security of machine learning in an adversarial setting: a survey. J Parallel Distrib Comput 130:12\u201323","journal-title":"J Parallel Distrib Comput"},{"issue":"3","key":"1240_CR43","doi-asserted-by":"publisher","first-page":"398","DOI":"10.1109\/83.661190","volume":"7","author":"J Weickert","year":"1998","unstructured":"Weickert J, Romeny BTH, Viergever M et al (1998) Efficient and reliable schemes for nonlinear diffusion filtering. IEEE Trans Image Process 7(3):398\u2013410","journal-title":"IEEE Trans Image Process"},{"key":"1240_CR44","unstructured":"Wu L, Zhu Z, Tai C, Weinan E (2018) Understanding and enhancing the transferability of adversarial examples. Machine learning. arXiv:1802.09707"},{"key":"1240_CR45","doi-asserted-by":"crossref","unstructured":"Xie C, Zhang Z, Zhou Y et al (2019) Improving transferability of adversarial examples with input diversity. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp 2730\u20132739","DOI":"10.1109\/CVPR.2019.00284"},{"key":"1240_CR46","doi-asserted-by":"crossref","unstructured":"Zhang F, Chen Y, Li Z, Hong Z, Liu J, Ma F, Han J, Ding E (2019) Acfnet: attentional class feature network for semantic segmentation. In: 2019 IEEE international conference on image processing (ICIP)","DOI":"10.1109\/ICCV.2019.00690"},{"key":"1240_CR47","unstructured":"Zhang Y, Liang P (2019) Defending against whitebox adversarial attacks via randomized discretization. arXiv:1903.10586"},{"key":"1240_CR48","doi-asserted-by":"crossref","unstructured":"Zhao Q, Zhao C, Cui S et al (2020) PrivateDL: privacy\u2010preserving collaborative deep learning against leakage from gradient sharing. Int J Intell Syst","DOI":"10.1002\/int.22241"}],"container-title":["International Journal of Machine Learning and Cybernetics"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s13042-020-01240-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s13042-020-01240-1\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s13042-020-01240-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,12,11]],"date-time":"2022-12-11T12:14:53Z","timestamp":1670760893000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s13042-020-01240-1"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,1,12]]},"references-count":48,"journal-issue":{"issue":"11","published-print":{"date-parts":[[2021,11]]}},"alternative-id":["1240"],"URL":"https:\/\/doi.org\/10.1007\/s13042-020-01240-1","relation":{},"ISSN":["1868-8071","1868-808X"],"issn-type":[{"value":"1868-8071","type":"print"},{"value":"1868-808X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,1,12]]},"assertion":[{"value":"8 July 2020","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"19 November 2020","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"12 January 2021","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}