{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,18]],"date-time":"2025-12-18T14:22:25Z","timestamp":1766067745175,"version":"3.37.3"},"reference-count":51,"publisher":"Springer Science and Business Media LLC","issue":"5","license":[{"start":{"date-parts":[[2023,4,24]],"date-time":"2023-04-24T00:00:00Z","timestamp":1682294400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2023,4,24]],"date-time":"2023-04-24T00:00:00Z","timestamp":1682294400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62073263"],"award-info":[{"award-number":["62073263"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Complex Intell. Syst."],"published-print":{"date-parts":[[2023,10]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Deep learning models are easily deceived by adversarial examples, and transferable attacks are crucial because of the inaccessibility of model information. Existing SOTA attack approaches tend to destroy important features of objects to generate adversarial examples. This paper proposes the split grid mask attack (SGMA), which reduces the intensity of model-specific features by split grid mask transformation, effectively highlighting the important features of the input image. Perturbing these important features can guide the development of adversarial examples in a more transferable direction. Specifically, we introduce the split grid mask transformation into the input image. Due to the vulnerability of model-specific features to image transformations, the intensity of model-specific features decreases after aggregation while the intensities of important features remain. The generated adversarial examples guided by destroying important features have excellent transferability. Extensive experimental results demonstrate the effectiveness of the proposed SGMA. Compared to the SOTA attack approaches, our method improves the black-box attack success rates by an average of 6.4% and 8.2% against the normally trained models and the defense ones respectively.<\/jats:p>","DOI":"10.1007\/s40747-023-01060-0","type":"journal-article","created":{"date-parts":[[2023,4,24]],"date-time":"2023-04-24T17:02:49Z","timestamp":1682355769000},"page":"6051-6063","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":15,"title":["SGMA: a novel adversarial attack approach with improved transferability"],"prefix":"10.1007","volume":"9","author":[{"given":"Peican","family":"Zhu","sequence":"first","affiliation":[]},{"given":"Jinbang","family":"Hong","sequence":"additional","affiliation":[]},{"given":"Xingyu","family":"Li","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0377-1022","authenticated-orcid":false,"given":"Keke","family":"Tang","sequence":"additional","affiliation":[]},{"given":"Zhen","family":"Wang","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2023,4,24]]},"reference":[{"key":"1060_CR1","doi-asserted-by":"crossref","unstructured":"Girshick R (2015) Fast R-CNN. In: Proceedings of the IEEE international conference on computer vision (ICCV), pp 1440\u20131448","DOI":"10.1109\/ICCV.2015.169"},{"key":"1060_CR2","doi-asserted-by":"crossref","unstructured":"Shi L, Wang L, Long C, Zhou S, Zhou M, Niu Z, Hua G (2021) SGCN: Sparse graph convolution network for pedestrian trajectory prediction. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR), pp 8994\u20139003","DOI":"10.1109\/CVPR46437.2021.00888"},{"key":"1060_CR3","first-page":"1","volume":"1","author":"K Tang","year":"2022","unstructured":"Tang K, Ma Y, Miao D, Song P, Gu Z, Tian Z, Wang W (2022) Decision fusion networks for image classification. IEEE Trans Neural Netw Learn Syst 1:1","journal-title":"IEEE Trans Neural Netw Learn Syst"},{"key":"1060_CR4","doi-asserted-by":"crossref","unstructured":"Li W, Guo T, Li P, Chen B, Wang B, Zuo W, Zhang L (2021) Enhancing face recognition via unlabeled shallow data. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR), pp 14729\u201314738","DOI":"10.1109\/CVPR46437.2021.01449"},{"issue":"6","key":"1060_CR5","doi-asserted-by":"publisher","first-page":"4753","DOI":"10.1007\/s40747-022-00722-9","volume":"8","author":"J Li","year":"2022","unstructured":"Li J, Li B, Jiang Y, Cai W (2022) MSAt-GAN: a generative adversarial network based on multi-scale and deep attention mechanism for infrared and visible light image fusion. Complex Intell Syst 8(6):4753\u20134781","journal-title":"Complex Intell Syst"},{"issue":"5","key":"1060_CR6","doi-asserted-by":"publisher","first-page":"2437","DOI":"10.1007\/s40747-021-00426-6","volume":"7","author":"EU Haq","year":"2021","unstructured":"Haq EU, Jianjun H, Huarong X, Li K (2021) Block-based compressed sensing of MR images using multi-rate deep learning approach. Complex Intell Syst 7(5):2437\u20132451","journal-title":"Complex Intell Syst"},{"key":"1060_CR7","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2023.110388","volume":"265","author":"S Guo","year":"2023","unstructured":"Guo S, Li X, Zhu P, Mu Z (2023) Ads-detector: an attention-based dual stream adversarial example detection method. Knowl Based Syst 265:110388","journal-title":"Knowl Based Syst"},{"issue":"7","key":"1060_CR8","doi-asserted-by":"publisher","first-page":"9755","DOI":"10.1109\/TITS.2021.3108520","volume":"23","author":"K Wang","year":"2021","unstructured":"Wang K, Li F, Chen C-M, Hassan MM, Long J, Kumar N (2021) Interpreting adversarial examples and robustness for deep learning-based auto-driving systems. IEEE Trans Intell Transp Syst 23(7):9755\u20139764","journal-title":"IEEE Trans Intell Transp Syst"},{"key":"1060_CR9","doi-asserted-by":"publisher","first-page":"4804","DOI":"10.1109\/TIP.2020.2975918","volume":"29","author":"Y Zhang","year":"2020","unstructured":"Zhang Y, Tian X, Li Y, Wang X, Tao D (2020) Principal component adversarial example. IEEE Trans Image Process 29:4804\u20134815","journal-title":"IEEE Trans Image Process"},{"key":"1060_CR10","doi-asserted-by":"publisher","first-page":"175","DOI":"10.1016\/j.neucom.2021.10.089","volume":"471","author":"H Gao","year":"2022","unstructured":"Gao H, Zhang H, Yang X, Li W, Gao F, Wen Q (2022) Generating natural adversarial examples with universal perturbations for text classification. Neurocomputing 471:175\u2013182","journal-title":"Neurocomputing"},{"key":"1060_CR11","first-page":"1","volume":"6","author":"K Tang","year":"2022","unstructured":"Tang K, Shi Y, Wu J, Peng W, Khan A, Zhu P, Gu Z (2022) Normalattack: curvature-aware shape deformation along normals for imperceptible point cloud attack. Secur Commun Netw 6:1\u201311","journal-title":"Secur Commun Netw"},{"key":"1060_CR12","doi-asserted-by":"publisher","first-page":"413","DOI":"10.1016\/j.neucom.2021.12.015","volume":"490","author":"R Zhang","year":"2022","unstructured":"Zhang R, Luo S, Pan L, Hao J, Zhang J (2022) Generating adversarial examples via enhancing latent spatial features of benign traffic and preserving malicious functions. Neurocomputing 490:413\u2013430","journal-title":"Neurocomputing"},{"key":"1060_CR13","unstructured":"Liu Y, Chen X, Liu C, Song D (2017) Delving into transferable adversarial examples and black-box attacks. In: International conference on learning representations (ICLR)"},{"key":"1060_CR14","unstructured":"Goodfellow IJ, Shlens J, Szegedy C (2015) Explaining and harnessing adversarial examples. In: Proceedings of international conference on learning representations (ICLR)"},{"key":"1060_CR15","unstructured":"Lin J, Song C, He K, Wang L, Hopcroft JE (2020) Nesterov accelerated gradient and scale invariance for adversarial attacks. In: International conference on learning representations (ICLR)"},{"key":"1060_CR16","doi-asserted-by":"crossref","unstructured":"Dong Y, Liao F, Pang T, Su H, Zhu J, Hu X, Li J (2019) Boosting adversarial attacks with momentum. In: Proceedings of the IEEE conference on computer vision and pattern recognition (CVPR), pp 9185\u20139193","DOI":"10.1109\/CVPR.2018.00957"},{"key":"1060_CR17","doi-asserted-by":"crossref","unstructured":"Xie C, Zhang Z, Zhou Y, Bai S, Wang J, Ren Z, Alan Y (2019) Improving transferability of adversarial examples with input diversity. In: Proceedings of the IEEE conference on computer vision and pattern recognition (CVPR), pp 2730\u20132739","DOI":"10.1109\/CVPR.2019.00284"},{"key":"1060_CR18","doi-asserted-by":"crossref","unstructured":"Dong Y, Pang T, Su H, Zhu J (2019) Evading defenses to transferable adversarial examples by translation-invariant attacks. In: Proceedings of the IEEE conference on computer vision and pattern recognition (CVPR), pp 4312\u20134321","DOI":"10.1109\/CVPR.2019.00444"},{"key":"1060_CR19","doi-asserted-by":"crossref","unstructured":"Wang X, He X, Wang J, He K (2021) Admix: enhancing the transferability of adversarial attacks. In: Proceedings of the IEEE international conference on computer vision (ICCV), pp 16138\u201316147","DOI":"10.1109\/ICCV48922.2021.01585"},{"key":"1060_CR20","doi-asserted-by":"crossref","unstructured":"Zou J, Pan Z, Qiu J, Liu X, Rui T, Li W (2020) Improving the transferability of adversarial examples with resized-diverse-inputs, diversity-ensemble and region fitting. In: European conference on computer vision (ECCV)","DOI":"10.1007\/978-3-030-58542-6_34"},{"key":"1060_CR21","doi-asserted-by":"crossref","unstructured":"Li Y, Bai S, Zhou Y, Xie C, Zhang Z, Yuille A (2020) Learning transferable adversarial examples via ghost networks. In: the 34th AAAI conference on artificial intelligence, pp 11458\u201311465","DOI":"10.1609\/aaai.v34i07.6810"},{"key":"1060_CR22","doi-asserted-by":"publisher","first-page":"58","DOI":"10.1016\/j.neunet.2022.02.025","volume":"150","author":"L Hao","year":"2022","unstructured":"Hao L, Hao K, Wei B, Tang X-S (2022) Boosting the transferability of adversarial examples via stochastic serial attack. Neural Netw 150:58\u201367","journal-title":"Neural Netw"},{"key":"1060_CR23","doi-asserted-by":"publisher","DOI":"10.1016\/j.nahs.2021.101088","volume":"42","author":"Z Xu","year":"2021","unstructured":"Xu Z, Li X, Stojanovic V (2021) Exponential stability of nonlinear state-dependent delayed impulsive systems with applications. Nonlinear Anal Hybrid Syst 42:101088","journal-title":"Nonlinear Anal Hybrid Syst"},{"key":"1060_CR24","doi-asserted-by":"publisher","first-page":"1733","DOI":"10.1007\/s11071-021-06208-6","volume":"103","author":"T Wei","year":"2021","unstructured":"Wei T, Li X, Stojanovic V (2021) Input-to-state stability of impulsive reaction-diffusion neural networks with infinite distributed delays. Nonlinear Dyn 103:1733\u20131755","journal-title":"Nonlinear Dyn"},{"issue":"9","key":"1060_CR25","doi-asserted-by":"publisher","first-page":"4138","DOI":"10.1016\/j.jfranklin.2022.04.003","volume":"359","author":"X Song","year":"2022","unstructured":"Song X, Sun P, Song S, Stojanovic V (2022) Event-driven NN adaptive fixed-time control for nonlinear systems with guaranteed performance. J Frankl Inst 359(9):4138\u20134159","journal-title":"J Frankl Inst"},{"key":"1060_CR26","unstructured":"Tram\u00e9r F, Kurakin A, Papernot N, Goodfellow I, Boneh D, McDaniel P (2018) Ensemble adversarial training: attacks and defenses. In: International conference on learning representations (ICLR)"},{"key":"1060_CR27","doi-asserted-by":"crossref","unstructured":"Zi B, Zhao S, Ma X, Jiang Y-G (2021) Revisiting adversarial robustness distillation: robust soft labels make student better. In: Proceedings of IEEE conference on computer vision and pattern recognition (CVPR), pp 16443\u201316452","DOI":"10.1109\/ICCV48922.2021.01613"},{"key":"1060_CR28","doi-asserted-by":"crossref","unstructured":"Liao F, Liang M, Dong Y, Pang T, Hu X, Zhu J (2018) Defense against adversarial attacks using high-level representation guided denoiser. In: Proceedings of the IEEE conference on computer vision and pattern recognition (CVPR), pp 1778\u20131787","DOI":"10.1109\/CVPR.2018.00191"},{"key":"1060_CR29","unstructured":"Cohen JM, Rosenfeld E, Kolter JZ (2019) Certified adversarial robustness via randomized smoothing. In: International conference on machine learning (ICML), pp 1310\u20131320"},{"key":"1060_CR30","doi-asserted-by":"publisher","first-page":"182","DOI":"10.1016\/j.ins.2019.05.084","volume":"501","author":"F Guo","year":"2019","unstructured":"Guo F, Zhao Q, Li X, Kuang X, Zhang J, Han Y, Tan Y-A (2019) Detecting adversarial examples via prediction difference for deep neural networks. Inf Sci 501:182\u2013192","journal-title":"Inf Sci"},{"key":"1060_CR31","doi-asserted-by":"crossref","unstructured":"Wang Z, Guo H, Zhang Z, Liu W, Qin Z, Ren K (2021) Feature importance-aware transferable adversarial attacks. In: Proceedings of the IEEE international conference on computer vision (ICCV), pp 7619\u20137628","DOI":"10.1109\/ICCV48922.2021.00754"},{"key":"1060_CR32","unstructured":"Szegedy C, Zaremba W, Sutskever I, Bruna J, Erhan D, Goodfellow I, Fergus R (2014) Intriguing properties of neural networks. In: International conference on learning representations (ICLR)"},{"key":"1060_CR33","first-page":"1","volume":"2022","author":"X Zhang","year":"2022","unstructured":"Zhang X, Zhang X, Sun M, Zou X, Chen K, Yu N (2022) Imperceptible black-box waveform-level adversarial attack towards automatic speaker recognition. Complex Intell Syst 2022:1\u201315","journal-title":"Complex Intell Syst"},{"key":"1060_CR34","doi-asserted-by":"publisher","first-page":"67","DOI":"10.1016\/j.ins.2020.04.019","volume":"536","author":"J Chen","year":"2020","unstructured":"Chen J, Zheng H, Xiong H, Shen S, Su M (2020) MAG-GAN: massive attack generator via gan. Inf Sci 536:67\u201390","journal-title":"Inf Sci"},{"issue":"9","key":"1060_CR35","doi-asserted-by":"publisher","first-page":"2805","DOI":"10.1109\/TNNLS.2018.2886017","volume":"30","author":"X Yuan","year":"2019","unstructured":"Yuan X, He P, Zhu Q, Li X (2019) Adversarial examples: attacks and defenses for deep learning. IEEE Trans Neural Netw Learn Syst 30(9):2805\u20132824","journal-title":"IEEE Trans Neural Netw Learn Syst"},{"key":"1060_CR36","doi-asserted-by":"crossref","unstructured":"Kurakin A, Goodfellow IJ, Bengio S (2017) Adversarial examples in the physical world. In: Proceedings of international conference on learning representations (ICLR)","DOI":"10.1201\/9781351251389-8"},{"key":"1060_CR37","doi-asserted-by":"crossref","unstructured":"Wang X, He K (2021) Enhancing the transferability of adversarial attacks through variance tuning. In: Proceedings of the IEEE conference on computer vision and pattern recognition (CVPR), pp 1924\u20131933","DOI":"10.1109\/CVPR46437.2021.00196"},{"key":"1060_CR38","doi-asserted-by":"crossref","unstructured":"Hong J, Tang K, Gao C, Wang S, Guo S, Zhu P (2022) GM-Attack: improving the transferability of adversarial attacks. In: 2022 international conference on knowledge science, engineering and management (KSEM), pp 489\u2013500","DOI":"10.1007\/978-3-031-10989-8_39"},{"key":"1060_CR39","doi-asserted-by":"publisher","first-page":"68","DOI":"10.1016\/j.ins.2022.11.156","volume":"622","author":"P Zhu","year":"2023","unstructured":"Zhu P, Hou X, Tang K, Liu Y, Zhao Y, Wang Z (2023) Unsupervised feature selection through combining graph learning and $$\\ell _{2,0}$$-norm constraint. Inf Sci 622:68\u201382","journal-title":"Inf Sci"},{"key":"1060_CR40","first-page":"1","volume":"1","author":"K Tang","year":"2022","unstructured":"Tang K, Shi Y, Lou T, Peng W, He X, Zhu P, Gu Z, Tian Z (2022) Rethinking perturbation directions for imperceptible adversarial attacks on point clouds. IEEE Internet Things J 1:1","journal-title":"IEEE Internet Things J"},{"key":"1060_CR41","doi-asserted-by":"crossref","unstructured":"Zhou W, Hou X, Chen Y, Tang M, Huang X, Gan X, Yang Y (2018) Transferable adversarial perturbations. In: Proceedings of European conference on computer vision (ECCV), pp 471\u2013486","DOI":"10.1007\/978-3-030-01264-9_28"},{"key":"1060_CR42","doi-asserted-by":"crossref","unstructured":"Ganeshan A, Vivek BS, Radhakrishnan VB (2019) FDA: feature disruptive attack. In: Proceedings of IEEE international conference on computer vision (ICCV), pp 8068\u20138078","DOI":"10.1109\/ICCV.2019.00816"},{"key":"1060_CR43","doi-asserted-by":"crossref","unstructured":"Inkawhich N, Wen W, Li H, Chen Y (2019) Feature space perturbations yield more transferable adversarial examples. In: Proceedings of IEEE conference on computer vision and pattern recognition (CVPR), pp 7066\u20137074","DOI":"10.1109\/CVPR.2019.00723"},{"key":"1060_CR44","doi-asserted-by":"crossref","unstructured":"Huang Q, Katsman I, He H, Gu Z, Belongie S, Lim S-N (2019) Enhancing adversarial example transferability with an intermediate level attack. In: Proceedings of the IEEE international conference on computer vision (ICCV), pp 4732\u20134741","DOI":"10.1109\/ICCV.2019.00483"},{"key":"1060_CR45","doi-asserted-by":"crossref","unstructured":"Zhang Y, Tan Y-A, Chen T, Liu X, Zhang Q, Li Y (2022) Enhancing the transferability of adversarial examples with random patch. In: Proceedings of the 31th international joint conference on artificial intelligence (IJCAI), pp 1672\u20131678","DOI":"10.24963\/ijcai.2022\/233"},{"key":"1060_CR46","unstructured":"Nips17 Adversarial Attacks and Defenses Competition. https:\/\/github.com\/cleverhans-lab\/cleverhans\/tree\/master\/cleverhans_v3.1.0\/examples\/nips17_adversarial_competition\/dataset"},{"key":"1060_CR47","doi-asserted-by":"crossref","unstructured":"Szegedy C, Vanhoucke V, Sergey I, Jon S, Wojna Z (2016) Rethinking the inception architecture for computer vision. In: Proceedings of IEEE conference on computer vision and pattern recognition (CVPR), pp 2818\u20132826","DOI":"10.1109\/CVPR.2016.308"},{"key":"1060_CR48","doi-asserted-by":"crossref","unstructured":"Szegedy C, Ioffe S, Vanhoucke V, Alemi AA (2017) Inception-v4, inception-resnet and the impact of residual connections on learning. In: Proceedings of AAAI conference on artificial intelligence, pp 4278\u20134284","DOI":"10.1609\/aaai.v31i1.11231"},{"key":"1060_CR49","doi-asserted-by":"crossref","unstructured":"He K, Zhang X, Ren S, Sun J (2016) Deep residual learning for image recognition. In: Proceedings of the IEEE conference on computer vision and pattern recognition (CVPR), pp 770\u2013778","DOI":"10.1109\/CVPR.2016.90"},{"key":"1060_CR50","unstructured":"Simonyan K, Zisserman A (2015) Very deep convolutional networks for large-scale image recognition. In: International conference on learning representations (ICLR)"},{"key":"1060_CR51","unstructured":"Inkawhich N, Liang KJ, Carin L, Chen Y (2020) Transferable perturbations of deep feature distributions. In: International conference on learning representations (ICLR)"}],"container-title":["Complex &amp; Intelligent Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s40747-023-01060-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s40747-023-01060-0\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s40747-023-01060-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,9,22]],"date-time":"2023-09-22T17:02:49Z","timestamp":1695402169000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s40747-023-01060-0"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,4,24]]},"references-count":51,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2023,10]]}},"alternative-id":["1060"],"URL":"https:\/\/doi.org\/10.1007\/s40747-023-01060-0","relation":{},"ISSN":["2199-4536","2198-6053"],"issn-type":[{"type":"print","value":"2199-4536"},{"type":"electronic","value":"2198-6053"}],"subject":[],"published":{"date-parts":[[2023,4,24]]},"assertion":[{"value":"6 October 2022","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"20 March 2023","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"24 April 2023","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"On behalf of all authors, the corresponding author states that there is no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}]}}