{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,13]],"date-time":"2026-01-13T14:33:56Z","timestamp":1768314836763,"version":"3.49.0"},"reference-count":46,"publisher":"Springer Science and Business Media LLC","issue":"4","license":[{"start":{"date-parts":[[2025,3,4]],"date-time":"2025-03-04T00:00:00Z","timestamp":1741046400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,3,4]],"date-time":"2025-03-04T00:00:00Z","timestamp":1741046400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"University Stability Support Program of Shenzhen","award":["GXWD20231130113127003"],"award-info":[{"award-number":["GXWD20231130113127003"]}]},{"name":"the Major Key Project of PCL","award":["PCL2022A03"],"award-info":[{"award-number":["PCL2022A03"]}]},{"name":"Shenzhen Science and Technology Program","award":["ZDSYS20210623091809029"],"award-info":[{"award-number":["ZDSYS20210623091809029"]}]},{"name":"Guangdong Provincial Key Laboratory of Novel Security Intelligence Technologies","award":["2022B1212010005"],"award-info":[{"award-number":["2022B1212010005"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Complex Intell. Syst."],"published-print":{"date-parts":[[2025,4]]},"abstract":"<jats:title>Abstract<\/jats:title>\n          <jats:p>Adversarial examples generated by perturbing raw data with carefully designed, imperceptible noise have emerged as a primary security threat to artificial intelligence systems. In particular, black-box adversarial attack algorithms, which only rely on model input and output to generate adversarial examples, are easy to implement in real scenarios. However, previous research on black-box attacks has primarily focused on multi-class classification models, with relatively few studies on black-box attack algorithms for multi-label classification models. Multi-label classification models exhibit significant differences from multi-class classification models in terms of structure and output. The former can assign multiple labels to a single sample, with these labels often exhibiting correlations, while the latter classifies a sample as the class with the highest confidence. Therefore, existing multi-class attack algorithms cannot directly attack multi-label classification models. In this paper, we study the transplantation methods of multi-class black-box attack algorithms to multi-label classification models and propose the multi-label versions for eight classic black-box attack algorithms, which include three score-based attacks and five decision-based (label-only) attacks, for the first time. Experimental results indicate that the transplanted black-box attack algorithms demonstrate effective attack performance across various attack types, except for extreme attacks. Especially, most transplanted attack algorithms achieve more than 60% success rate on the ML-GCN model and more than 30% on the ML-LIW model under the hiding all attack type. However, the performance of these transplanted attack algorithms shows variation among different attack types due to the correlations between labels.<\/jats:p>","DOI":"10.1007\/s40747-025-01805-z","type":"journal-article","created":{"date-parts":[[2025,3,4]],"date-time":"2025-03-04T03:34:15Z","timestamp":1741059255000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["A comprehensive transplanting of black-box adversarial attacks from multi-class to multi-label models"],"prefix":"10.1007","volume":"11","author":[{"given":"Zhijian","family":"Chen","sequence":"first","affiliation":[]},{"given":"Qi","family":"Zhou","sequence":"additional","affiliation":[]},{"given":"Yujiang","family":"Liu","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8357-1655","authenticated-orcid":false,"given":"Wenjian","family":"Luo","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2025,3,4]]},"reference":[{"issue":"2","key":"1805_CR1","doi-asserted-by":"crossref","first-page":"342","DOI":"10.3390\/s20020342","volume":"20","author":"Y Kortli","year":"2020","unstructured":"Kortli Y, Jridi M, Al Falou A, Atri M (2020) Face recognition systems: a survey. Sensors 20(2):342","journal-title":"Sensors"},{"key":"1805_CR2","unstructured":"Huang K, Shi B, Li X, Li X, Huang S, Li Y (2022) Multi-modal sensor fusion for auto driving perception: a survey. arXiv preprint. arXiv:2202.02703"},{"key":"1805_CR3","doi-asserted-by":"crossref","DOI":"10.1016\/j.dsp.2020.102672","volume":"101","author":"Z Meng","year":"2020","unstructured":"Meng Z, Altaf MUB, Juang B-HF (2020) Active voice authentication. Digit Signal Process 101:102672","journal-title":"Digit Signal Process"},{"issue":"8","key":"1805_CR4","doi-asserted-by":"crossref","first-page":"1283","DOI":"10.3390\/electronics11081283","volume":"11","author":"H Liang","year":"2022","unstructured":"Liang H, He E, Zhao Y, Jia Z, Li H (2022) Adversarial attack and defense: a survey. Electronics 11(8):1283","journal-title":"Electronics"},{"key":"1805_CR5","doi-asserted-by":"crossref","first-page":"155161","DOI":"10.1109\/ACCESS.2021.3127960","volume":"9","author":"N Akhtar","year":"2021","unstructured":"Akhtar N, Mian A, Kardan N, Shah M (2021) Advances in adversarial attacks and defenses in computer vision: a survey. IEEE Access 9:155161\u2013155196","journal-title":"IEEE Access"},{"key":"1805_CR6","unstructured":"Szegedy C, Zaremba W, Sutskever I, Bruna J, Erhan D, Goodfellow I, Fergus R (2014) Intriguing properties of neural networks. In: Proceedings of the 2nd international conference on learning representations (ICLR), OpenReview.net, Banff, Canada, pp 1\u20139"},{"issue":"1","key":"1805_CR7","doi-asserted-by":"crossref","first-page":"25","DOI":"10.1049\/cit2.12028","volume":"6","author":"A Chakraborty","year":"2021","unstructured":"Chakraborty A, Alam M, Dey V, Chattopadhyay A, Mukhopadhyay D (2021) A survey on adversarial attacks and defences. CAAI Trans Intell Technol 6(1):25\u201345","journal-title":"CAAI Trans Intell Technol"},{"key":"1805_CR8","unstructured":"Chen Y, Liu W (2023) A theory of transfer-based black-box attacks: explanation and implications. Adv Neural Inf Process Syst 36, Curran Associates, New Orleans, LA, USA, pp 13887\u201313907"},{"key":"1805_CR9","doi-asserted-by":"crossref","unstructured":"Li H, Xu X, Zhang X, Yang S, Li B (2020) QEBA: query-efficient boundary-based black-box attack. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition. IEEE, Washington, DC, USA, pp 1221\u20131230","DOI":"10.1109\/CVPR42600.2020.00130"},{"key":"1805_CR10","doi-asserted-by":"crossref","unstructured":"Chen P-Y, Zhang H, Sharma Y, Yi J, Hsieh C-J (2017) ZOO: zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In: Proceedings of the 10th ACM workshop on artificial intelligence and security, ACM, Dallas, TX, USA, pp 15\u201326","DOI":"10.1145\/3128572.3140448"},{"key":"1805_CR11","doi-asserted-by":"crossref","unstructured":"Chen J, Jordan MI, Wainwright MJ (2020) HopSkipJumpAttack: a query-efficient decision-based attack. In: 2020 IEEE symposium on security and privacy (SP). IEEE, San Francisco, CA, USA, pp 1277\u20131294","DOI":"10.1109\/SP40000.2020.00045"},{"key":"1805_CR12","doi-asserted-by":"crossref","unstructured":"Rahmati A, Moosavi-Dezfooli S-M, Frossard P, Dai H (2020) GeoDA: a geometric framework for black-box adversarial attacks. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, IEEE, Seattle, WA, USA, pp 8446\u20138455","DOI":"10.1109\/CVPR42600.2020.00847"},{"key":"1805_CR13","unstructured":"Guo C, Gardner J, You Y, Wilson AG, Weinberger K (2019) Simple black-box adversarial attacks. In: International conference on machine learning. PMLR, Long Beach, CA, USA, pp 2484\u20132493"},{"key":"1805_CR14","doi-asserted-by":"crossref","unstructured":"Andriushchenko M, Croce F, Flammarion N, Hein M (2020) Square attack: a query-efficient black-box adversarial attack via random search. In: European conference on computer vision. Springer, Berlin, pp 484\u2013501","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"1805_CR15","unstructured":"Brendel W, Rauber J, Bethge M (2018) Decision-based adversarial attacks: reliable attacks against black-box machine learning models. In: Proceedings of the 6th international conference on learning representations (ICLR), OpenReview.net, Vancouver, Canada, pp 1\u201315"},{"key":"1805_CR16","doi-asserted-by":"crossref","unstructured":"Maho T, Furon T, Le Merrer E (2021) SurFree: a fast surrogate-free black-box attack. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, IEEE, Nashville, TN, USA, pp 10430\u201310439","DOI":"10.1109\/CVPR46437.2021.01029"},{"key":"1805_CR17","doi-asserted-by":"crossref","unstructured":"Hu S, Ke L, Wang X, Lyu S (2021) TkML-AP: adversarial attacks to top-k multi-label learning. In: Proceedings of the IEEE\/CVF international conference on computer vision, IEEE, Montreal, Canada, pp 7649\u20137657","DOI":"10.1109\/ICCV48922.2021.00755"},{"key":"1805_CR18","doi-asserted-by":"crossref","unstructured":"Zhou N, Luo W, Lin X, Xu P, Zhang Z (2020) Generating multi-label adversarial examples by linear programming. In: 2020 international joint conference on neural networks (IJCNN). IEEE, Glasgow, Scotland, pp 1\u20138","DOI":"10.1109\/IJCNN48605.2020.9206614"},{"key":"1805_CR19","doi-asserted-by":"publisher","unstructured":"Song Q, Jin H, Huang X, Hu X (2018) Multi-label adversarial perturbations. In: 2018 IEEE international conference on data mining (ICDM), pp 1242\u20131247. https:\/\/doi.org\/10.1109\/ICDM.2018.00166","DOI":"10.1109\/ICDM.2018.00166"},{"key":"1805_CR20","doi-asserted-by":"crossref","unstructured":"Kong L, Luo W, Zhang H, Liu Y, Shi Y (2022) Evolutionary multi-label adversarial examples: an effective black-box attack. IEEE Trans Artif Intell 4 (3) 562\u2013572","DOI":"10.1109\/TAI.2022.3198629"},{"key":"1805_CR21","unstructured":"Goodfellow IJ, Shlens J, Szegedy C (2015) Explaining and harnessing adversarial examples. In: International Conference on Learning Representations (ICLR), OpenReview.net, San Diego, CA, USA, pp 1\u201311"},{"key":"1805_CR22","doi-asserted-by":"crossref","unstructured":"Kurakin A, Goodfellow IJ, Bengio S (2018) Adversarial examples in the physical world. In: Artificial Intelligence Safety and Security. Chapman and Hall\/CRC, Boca Raton, FL, USA, pp 99\u2013112","DOI":"10.1201\/9781351251389-8"},{"key":"1805_CR23","unstructured":"Madry A, Makelov A, Schmidt L, Tsipras D, Vladu A (2018) Towards deep learning models resistant to adversarial attacks. In: Proceedings of the 6th international conference on learning representations (ICLR), OpenReview.net, Vancouver, Canada, pp 1\u201323"},{"key":"1805_CR24","doi-asserted-by":"crossref","unstructured":"Dong Y, Liao F, Pang T, Su H, Zhu J, Hu X, Li J (2018) Boosting adversarial attacks with momentum. In: Proceedings of the IEEE conference on computer vision and pattern recognition, IEEE, Salt Lake City, UT, USA, pp 9185\u20139193","DOI":"10.1109\/CVPR.2018.00957"},{"key":"1805_CR25","first-page":"103227","volume":"68","author":"Y Wang","year":"2022","unstructured":"Wang Y, Liu J, Chang X, Wang J, Rodr\u00edguez RJ (2022) AB-FGSM: AdaBelief optimizer and FGSM-based approach to generate adversarial examples. J Inf Secur Appl 68:103227","journal-title":"J Inf Secur Appl"},{"key":"1805_CR26","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Jha S, Fredrikson M, Celik ZB, Swami A (2016) The limitations of deep learning in adversarial settings. In: 2016 IEEE European symposium on security and privacy (EuroS &P). IEEE, London, UK, pp 372\u2013387","DOI":"10.1109\/EuroSP.2016.36"},{"issue":"08","key":"1805_CR27","first-page":"1395","volume":"46","author":"Q Liu","year":"2024","unstructured":"Liu Q, Li M, Wu X, Wang Y (2024) S-JSMA: a fast JSMA adversarial example generation method with low disturbance redundancy. Comput Eng Sci 46(08):1395","journal-title":"Comput Eng Sci"},{"key":"1805_CR28","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli S-M, Fawzi A, Frossard P (2016) DeepFool: a simple and accurate method to fool deep neural networks. In: Proceedings of the IEEE conference on computer vision and pattern recognition, IEEE, Las Vegas, NV, USA, pp 2574\u20132582","DOI":"10.1109\/CVPR.2016.282"},{"key":"1805_CR29","doi-asserted-by":"crossref","unstructured":"Carlini N, Wagner D (2017) Towards evaluating the robustness of neural networks. In: 2017 IEEE symposium on security and privacy (SP). IEEE, San Jose, CA, USA, pp 39\u201357","DOI":"10.1109\/SP.2017.49"},{"key":"1805_CR30","unstructured":"Luo W, Wu C, Zhou N, Ni L (2019) Random directional attack for fooling deep neural networks. arXiv preprint. arXiv:1908.02658"},{"key":"1805_CR31","doi-asserted-by":"crossref","unstructured":"Wang X, He K (2021) Enhancing the transferability of adversarial attacks through variance tuning. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, IEEE, Nashville, TN, USA, pp 1924\u20131933","DOI":"10.1109\/CVPR46437.2021.00196"},{"key":"1805_CR32","unstructured":"Wu D, Wang Y, Xia S-T, Bailey J, Ma X (2020) Skip connections matter: on the transferability of adversarial examples generated with ResNets. In: Proceedings of the 8th international conference on learning representations (ICLR), OpenReview.net, Addis Ababa, Ethiopia, pp 1\u201315"},{"key":"1805_CR33","unstructured":"Kong L (2022) Research on evolutionary generation algorithms of multi-label adversarial examples. Master\u2019s thesis, Harbin Institute of Technology, Shenzhen"},{"issue":"2","key":"1805_CR34","doi-asserted-by":"crossref","first-page":"303","DOI":"10.1007\/s11263-009-0275-4","volume":"88","author":"M Everingham","year":"2010","unstructured":"Everingham M, Van Gool L, Williams CK, Winn J, Zisserman A (2010) The pascal visual object classes (VOC) challenge. Int J Comput Vis 88(2):303\u2013338","journal-title":"Int J Comput Vis"},{"issue":"1","key":"1805_CR35","doi-asserted-by":"crossref","first-page":"98","DOI":"10.1007\/s11263-014-0733-5","volume":"111","author":"M Everingham","year":"2015","unstructured":"Everingham M, Eslami S, Van Gool L, Williams CK, Winn J, Zisserman A (2015) The pascal visual object classes challenge: a retrospective. Int J Comput Vis 111(1):98\u2013136","journal-title":"Int J Comput Vis"},{"key":"1805_CR36","doi-asserted-by":"crossref","unstructured":"Lin T-Y, Maire M, Belongie S, Hays J, Perona P, Ramanan D, Doll\u00e1r P, Zitnick CL (2014) Microsoft COCO: common objects in context. In: Computer vision\u2014ECCV 2014: 13th European conference, Zurich, Switzerland, September 6\u201312, 2014, proceedings, part V 13. Springer, Berlin, pp 740\u2013755","DOI":"10.1007\/978-3-319-10602-1_48"},{"key":"1805_CR37","doi-asserted-by":"crossref","unstructured":"Chua T-S, Tang J, Hong R, Li H, Luo Z, Zheng Y (2009) NUS-WIDE: a real-world web image database from the National University of Singapore. In: Proceedings of the ACM International Conference on Image and Video Retrieval, ACM, New York, NY, USA, pp 1\u20139","DOI":"10.1145\/1646396.1646452"},{"key":"1805_CR38","doi-asserted-by":"publisher","unstructured":"Chen Z-M, Wei X-S, Wang P, Guo Y (2019) Multi-label image recognition with graph convolutional networks. In: 2019 IEEE\/CVF conference on computer vision and pattern recognition (CVPR), IEEE, Long Beach, CA, USA, pp 5172\u20135181. https:\/\/doi.org\/10.1109\/CVPR.2019.00532","DOI":"10.1109\/CVPR.2019.00532"},{"key":"1805_CR39","doi-asserted-by":"crossref","unstructured":"Szegedy C, Vanhoucke V, Ioffe S, Shlens J, Wojna Z (2016) Rethinking the inception architecture for computer vision. In: Proceedings of the IEEE conference on computer vision and pattern recognition, IEEE, Las Vegas, NV, USA, pp 2818\u20132826","DOI":"10.1109\/CVPR.2016.308"},{"key":"1805_CR40","doi-asserted-by":"crossref","unstructured":"Zhou N, Luo W, Zhang J, Kong L, Zhang H (2021) Hiding all labels for multi-label images: an empirical study of adversarial examples. In: 2021 international joint conference on neural networks (IJCNN). IEEE, Quebec City, Canada, pp 1\u20138","DOI":"10.1109\/IJCNN52387.2021.9534067"},{"key":"1805_CR41","volume":"54","author":"S Li","year":"2024","unstructured":"Li S, Fang X, Liao J, Ghadamyari M, Khayatnezhad M, Ghadimi N (2024) Evaluating the efficiency of CCHP systems in Xinjiang Uygur Autonomous Region: an optimal strategy based on improved mother optimization algorithm. Case Stud Therm Eng 54:104005","journal-title":"Case Stud Therm Eng"},{"key":"1805_CR42","doi-asserted-by":"crossref","unstructured":"Jiang W, Wang X, Huang H, Zhang D, Ghadimi N (2022) Optimal economic scheduling of microgrids considering renewable energy sources based on energy hub model using demand response and improved water wave optimization algorithm. J Energy Storage 55:105311","DOI":"10.1016\/j.est.2022.105311"},{"issue":"2","key":"1805_CR43","doi-asserted-by":"crossref","first-page":"4296","DOI":"10.1080\/15567036.2022.2074174","volume":"44","author":"L Chen","year":"2022","unstructured":"Chen L, Huang H, Tang P, Yao D, Yang H, Ghadimi N (2022) Optimal modeling of combined cooling, heating, and power systems using developed African vulture optimization: a case study in watersport complex. Energy Sources Part A: Recov Util Environ Eff 44(2):4296\u20134317","journal-title":"Energy Sources Part A: Recov Util Environ Eff"},{"key":"1805_CR44","volume":"52","author":"E Han","year":"2022","unstructured":"Han E, Ghadimi N (2022) Model identification of proton-exchange membrane fuel cells based on a hybrid convolutional neural network and extreme learning machine optimized by improved honey badger algorithm. Sustain Energy Technol Assess 52:102005","journal-title":"Sustain Energy Technol Assess"},{"issue":"3","key":"1805_CR45","doi-asserted-by":"crossref","first-page":"7109","DOI":"10.1080\/15567036.2022.2105453","volume":"44","author":"B Gao","year":"2022","unstructured":"Gao B, Peng C, Kong D, Wang X, Li C, Gao M, Ghadimi N (2022) Optimum structure of a combined wind\/photovoltaic\/fuel cell-based on amended dragon fly optimization algorithm: a case study. Energy Sources Part A: Recov Util Environ Effects 44(3):7109\u20137131","journal-title":"Energy Sources Part A: Recov Util Environ Effects"},{"issue":"1","key":"1805_CR46","doi-asserted-by":"crossref","first-page":"86","DOI":"10.1049\/stg2.12095","volume":"6","author":"M Ghiasi","year":"2023","unstructured":"Ghiasi M, Wang Z, Mehrandezh M, Jalilian S, Ghadimi N (2023) Evolution of smart grids towards the internet of energy: concept and essential components for deep decarbonisation. IET Smart Grid 6(1):86\u2013102","journal-title":"IET Smart Grid"}],"container-title":["Complex &amp; Intelligent Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s40747-025-01805-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s40747-025-01805-z\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s40747-025-01805-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,3,30]],"date-time":"2025-03-30T21:19:37Z","timestamp":1743369577000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s40747-025-01805-z"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,3,4]]},"references-count":46,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2025,4]]}},"alternative-id":["1805"],"URL":"https:\/\/doi.org\/10.1007\/s40747-025-01805-z","relation":{},"ISSN":["2199-4536","2198-6053"],"issn-type":[{"value":"2199-4536","type":"print"},{"value":"2198-6053","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,3,4]]},"assertion":[{"value":"5 June 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"5 January 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"4 March 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}],"article-number":"201"}}