{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T06:20:55Z","timestamp":1783146055084,"version":"3.54.6"},"reference-count":46,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/100018910","name":"National Computer Network Emergency Response Technical Team Coordination Center of China","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100018910","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100006579","name":"Ministry of Industry and Information Technology of the People's Republic of China","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100006579","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Information Fusion"],"published-print":{"date-parts":[[2026,12]]},"DOI":"10.1016\/j.inffus.2026.104547","type":"journal-article","created":{"date-parts":[[2026,6,14]],"date-time":"2026-06-14T18:18:58Z","timestamp":1781461138000},"page":"104547","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["A surrogate ensemble fusion framework for robust watermark extraction in black-box models"],"prefix":"10.1016","volume":"136","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-4907-7036","authenticated-orcid":false,"given":"Zhao","family":"Zhang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7729-5439","authenticated-orcid":false,"given":"Senlin","family":"Luo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fengtong","family":"Xing","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8850-8380","authenticated-orcid":false,"given":"Limin","family":"Pan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.inffus.2026.104547_sbref0001","series-title":"Adv. Neural Inf. Process. Syst., NIPS","first-page":"38480","article-title":"Attack-resilient image watermarking using stable diffusion","author":"Zhang","year":"2024"},{"key":"10.1016\/j.inffus.2026.104547_bib0002","doi-asserted-by":"crossref","first-page":"6022","DOI":"10.1109\/TIP.2019.2924172","article-title":"DeepCorrect: correcting DNN models against image distortions","volume":"28","author":"Borkar","year":"2019","journal-title":"IEEE Trans. Image Process."},{"key":"10.1016\/j.inffus.2026.104547_bib0003","doi-asserted-by":"crossref","first-page":"5866","DOI":"10.1109\/TPAMI.2020.3046647","article-title":"Weakly supervised object localization and detection: a survey","volume":"44","author":"Zhang","year":"2022","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"10.1016\/j.inffus.2026.104547_bib0004","doi-asserted-by":"crossref","first-page":"14484","DOI":"10.1109\/TMC.2024.3443057","article-title":"Patching in order: efficient on-device model fine-tuning for multi-DNN vision applications","volume":"23","author":"Cao","year":"2024","journal-title":"IEEE Trans. Mobile Comput."},{"key":"10.1016\/j.inffus.2026.104547_bib0005","doi-asserted-by":"crossref","DOI":"10.1016\/j.aei.2024.102484","article-title":"Integrating object detection and natural language processing models to build a personalized attraction recommendation agent in a smart product service system","volume":"61","author":"Chiu","year":"2024","journal-title":"Adv. Eng. Inf."},{"key":"10.1016\/j.inffus.2026.104547_bib0006","doi-asserted-by":"crossref","DOI":"10.1016\/j.aei.2024.102749","article-title":"Contrastive learning of defect prototypes under natural language supervision","volume":"62","author":"Cheng","year":"2024","journal-title":"Adv. Eng. Inf."},{"key":"10.1016\/j.inffus.2026.104547_bib0007","first-page":"3159","article-title":"Towards a robust deep neural network against adversarial texts: a survey","volume":"35","author":"Wang","year":"2023","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"10.1016\/j.inffus.2026.104547_bib0008","doi-asserted-by":"crossref","first-page":"106","DOI":"10.1109\/TASLP.2020.3036783","article-title":"A cross-entropy-guided measure (CEGM) for assessing speech recognition performance and optimizing DNN-based speech enhancement","volume":"29","author":"Chai","year":"2021","journal-title":"IEEE\/ACM Trans. Audio Speech Lang. Process."},{"key":"10.1016\/j.inffus.2026.104547_bib0009","doi-asserted-by":"crossref","first-page":"1129","DOI":"10.1109\/TASLP.2016.2544660","article-title":"Improving short utterance speaker recognition by modeling speech unit classes","volume":"24","author":"Li","year":"2021","journal-title":"IEEE\/ACM Trans. Audio Speech Lang. Process."},{"key":"10.1016\/j.inffus.2026.104547_bib0010","doi-asserted-by":"crossref","first-page":"1424","DOI":"10.1109\/TASLP.2016.2558822","article-title":"A regression approach to single-channel speech separation via high-resolution deep neural networks","volume":"24","author":"Du","year":"2016","journal-title":"IEEE\/ACM Trans. Audio Speech Lang. Process."},{"key":"10.1016\/j.inffus.2026.104547_bib0011","doi-asserted-by":"crossref","DOI":"10.1016\/j.aei.2021.101374","article-title":"Applying incremental deep neural networks-based posture recognition model for ergonomics risk assessment in construction","volume":"50","author":"Zhao","year":"2021","journal-title":"Adv. Eng. Inf."},{"key":"10.1016\/j.inffus.2026.104547_bib0012","doi-asserted-by":"crossref","first-page":"1791","DOI":"10.1109\/TCSS.2022.3231701","article-title":"Deep-learning-based drug recommendation and ADR detection healthcare model on social media","volume":"10","author":"Dongre","year":"2023","journal-title":"IEEE Trans. Comp. Soc. Syst."},{"key":"10.1016\/j.inffus.2026.104547_bib0013","doi-asserted-by":"crossref","first-page":"6329","DOI":"10.1109\/JBHI.2023.3278538","article-title":"Self-supervised medical image denoising based on WISTA-net for human healthcare in metaverse","volume":"28","author":"Huang","year":"2024","journal-title":"IEEE J. Biomed. Health Inf."},{"key":"10.1016\/j.inffus.2026.104547_bib0014","doi-asserted-by":"crossref","DOI":"10.1016\/j.aei.2024.102355","article-title":"Backdoor attacks with wavelet embedding: revealing and enhancing the insights of vulnerabilities in visual object detection models on transformers within digital twin systems","volume":"60","author":"Shen","year":"2024","journal-title":"Adv. Eng. Inf."},{"key":"10.1016\/j.inffus.2026.104547_bib0015","doi-asserted-by":"crossref","first-page":"9175","DOI":"10.1109\/TITS.2025.3547879","article-title":"Traffic scene-informed attribution of autonomous driving decisions","volume":"26","author":"Shi","year":"2025","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"10.1016\/j.inffus.2026.104547_bib0016","doi-asserted-by":"crossref","first-page":"3257","DOI":"10.1109\/LRA.2022.3145493","article-title":"DNN patching: progressive fixing and augmenting the functionalities of DNNs for autonomous vehicles","volume":"7","author":"Saridena","year":"2022","journal-title":"IEEE Robot. Autom. Lett."},{"key":"10.1016\/j.inffus.2026.104547_bib0017","doi-asserted-by":"crossref","DOI":"10.1016\/j.aei.2024.102685","article-title":"Advancing network security in industrial IoT: a deep dive into AI-enabled intrusion detection systems","volume":"62","author":"Shahin","year":"2024","journal-title":"Adv. Eng. Inf."},{"key":"10.1016\/j.inffus.2026.104547_bib0018","doi-asserted-by":"crossref","first-page":"2977","DOI":"10.1109\/TIFS.2022.3198267","article-title":"A DNN fingerprint for non-repudiable model ownership identification and piracy detection","volume":"17","author":"Zheng","year":"2022","journal-title":"IEEE Trans. Inf. Forens. Secur."},{"key":"10.1016\/j.inffus.2026.104547_bib0019","doi-asserted-by":"crossref","first-page":"2758","DOI":"10.1109\/TNSE.2025.3553673","article-title":"DeepAW: a customized DNN watermarking scheme against unreliable participants","volume":"12","author":"Lin","year":"2025","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"10.1016\/j.inffus.2026.104547_bib0020","doi-asserted-by":"crossref","first-page":"1767","DOI":"10.1109\/TIFS.2025.3530691","article-title":"Modelshield: adaptive and robust watermark against model extraction attack","volume":"20","author":"Pang","year":"2025","journal-title":"IEEE Trans. Inf. Forens. Secur."},{"key":"10.1016\/j.inffus.2026.104547_bib0021","series-title":"IEEE Int. Conf. Commun., ICC","first-page":"57","article-title":"Making watermark survive model extraction attacks in graph neural networks","author":"Wang","year":"2023"},{"key":"10.1016\/j.inffus.2026.104547_bib0022","series-title":"Int. Conf. Mach. Learn. Nat. Lang. Process. (MLNLP)","first-page":"377","article-title":"Watermark removal scheme based on neural network model pruning","author":"Gu","year":"2023"},{"key":"10.1016\/j.inffus.2026.104547_bib0023","article-title":"Using deep learning for image watermarking attack","volume":"90","author":"Hatoum","year":"2021","journal-title":"Signal Process.: Image Commun."},{"key":"10.1016\/j.inffus.2026.104547_bib0024","series-title":"RD-IWAN: residual dense based imperceptible watermark attack network","first-page":"7460","volume":"32","author":"Wang","year":"2022"},{"key":"10.1016\/j.inffus.2026.104547_bib0025","doi-asserted-by":"crossref","DOI":"10.1016\/j.jvcir.2023.103875","article-title":"Wavelet-FCWAN: fast and covert watermarking attack network in wavelet domain","volume":"95","author":"Wang","year":"2023","journal-title":"J. Vis. Commun. Image Representat."},{"key":"10.1016\/j.inffus.2026.104547_bib0026","article-title":"HIWANet: a high imperceptibility watermarking attack network","volume":"133","author":"Wang","year":"2024","journal-title":"Eng. Appl. Artif. Intell."},{"key":"10.1016\/j.inffus.2026.104547_bib0027","doi-asserted-by":"crossref","first-page":"83","DOI":"10.1109\/MMUL.2024.3498856","article-title":"Feature-attention-mechanism-based attack for deep robust watermarking","volume":"32","author":"Chen","year":"2025","journal-title":"IEEE Multimed."},{"key":"10.1016\/j.inffus.2026.104547_bib0028","doi-asserted-by":"crossref","DOI":"10.1016\/j.sigpro.2024.109840","article-title":"Highly applicable and imperceptible watermark attack network","volume":"230","author":"Wang","year":"2025","journal-title":"Signal Process."},{"key":"10.1016\/j.inffus.2026.104547_bib0029","doi-asserted-by":"crossref","first-page":"5695","DOI":"10.1109\/TCSVT.2021.3138795","article-title":"Concealed attack for robust watermarking based on generative model and perceptual loss","volume":"32","author":"Li","year":"2022","journal-title":"IEEE Trans. Circuits Syst. Video Technol."},{"key":"10.1016\/j.inffus.2026.104547_bib0030","doi-asserted-by":"crossref","DOI":"10.1016\/j.asoc.2023.110777","article-title":"MISPSO-Attack: an efficient adversarial watermarking attack based on multiple initial solution particle swarm optimization","volume":"147","author":"Zuo","year":"2023","journal-title":"Appl. Soft Comput."},{"key":"10.1016\/j.inffus.2026.104547_bib0031","series-title":"26th Eur. Signal Process. Conf., EUSIPCO","first-page":"519","article-title":"Adversarial machine learning against digital watermarking","author":"Quiring","year":"2018"},{"key":"10.1016\/j.inffus.2026.104547_bib0032","doi-asserted-by":"crossref","first-page":"32769","DOI":"10.1007\/s11042-020-09555-5","article-title":"A robust hybrid digital watermarking technique against a powerful CNN-based adversarial attack","volume":"78","author":"Sharma","year":"2020","journal-title":"Multimed Tools Appl."},{"key":"10.1016\/j.inffus.2026.104547_bib0033","series-title":"Int. Conf. Intell. Comp. Autom. Syst. (ICICAS)","first-page":"401","article-title":"Universal watermark attack in image classification","author":"Wu","year":"2021"},{"key":"10.1016\/j.inffus.2026.104547_bib0034","doi-asserted-by":"crossref","first-page":"301","DOI":"10.1109\/TC.2021.3065172","article-title":"FAWA: fast adversarial watermark attack","volume":"73","author":"Jiang","year":"2024","journal-title":"IEEE Trans. Comp."},{"key":"10.1016\/j.inffus.2026.104547_bib0035","first-page":"631","article-title":"Real-time attacks on robust watermarking tools in the wild by CNN","volume":"17","author":"Geng","year":"2020","journal-title":"Multimed. Tools Appl."},{"key":"10.1016\/j.inffus.2026.104547_sbref0036","series-title":"Int. Conf. Learn. Represent., ICLR","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014"},{"key":"10.1016\/j.inffus.2026.104547_bib0037","series-title":"Proc. ACM SIGMOD Int. Conf. Manage. Data","first-page":"49","article-title":"OPTICS: ordering points to identify the clustering structure","author":"Ankerst","year":"1999"},{"issue":"11","key":"10.1016\/j.inffus.2026.104547_bib0038","doi-asserted-by":"crossref","first-page":"2278","DOI":"10.1109\/5.726791","article-title":"Gradient-based learning applied to document recognition","volume":"86","author":"Lecun","year":"1998","journal-title":"Proc. IEEE"},{"key":"10.1016\/j.inffus.2026.104547_bib0039","unstructured":"A. Krizhevsky, Learning multiple layers of features from tiny images, 2009."},{"key":"10.1016\/j.inffus.2026.104547_bib0040","doi-asserted-by":"crossref","DOI":"10.1016\/j.engappai.2021.104267","article-title":"Building and benchmarking an arabic speech commands dataset for small-footprint keyword spotting","volume":"102","author":"Ghandoura","year":"2021","journal-title":"Eng. Appl. Artif. Intell."},{"key":"10.1016\/j.inffus.2026.104547_bib0041","doi-asserted-by":"crossref","first-page":"141","DOI":"10.1016\/j.ins.2018.03.040","article-title":"Quaternion polar harmonic Fourier moments for color images","volume":"450","author":"Wang","year":"2018","journal-title":"Inf. Sci."},{"key":"10.1016\/j.inffus.2026.104547_bib0042","series-title":"Int. Conf. Comp. Appl. Ind. Electron., ICCAIE","first-page":"155","article-title":"Digital watermarking algorithm using LSB","author":"Bamatraf","year":"2010"},{"key":"10.1016\/j.inffus.2026.104547_bib0043","doi-asserted-by":"crossref","first-page":"121","DOI":"10.1109\/6046.985560","article-title":"An SVD-based watermarking scheme for protecting rightful ownership","volume":"4","author":"Liu","year":"2002","journal-title":"IEEE Trans. Multimed."},{"key":"10.1016\/j.inffus.2026.104547_bib0044","series-title":"IEEE Conference on Computer Vision and Pattern Recognition (CVPR)","first-page":"770","article-title":"Deep residual learning for image recognition","author":"He","year":"2016"},{"key":"10.1016\/j.inffus.2026.104547_bib0045","unstructured":"A. Van Den Oord et al., WaveNet: a generative model for raw audio(2016). https:\/\/arxiv.org\/abs\/1609.03499."},{"issue":"8","key":"10.1016\/j.inffus.2026.104547_bib0046","doi-asserted-by":"crossref","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","article-title":"Long short-term memory","volume":"9","author":"Hochreiter","year":"1997","journal-title":"Neural Comput."}],"container-title":["Information Fusion"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1566253526004252?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1566253526004252?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T06:00:56Z","timestamp":1783144856000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S1566253526004252"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,12]]},"references-count":46,"alternative-id":["S1566253526004252"],"URL":"https:\/\/doi.org\/10.1016\/j.inffus.2026.104547","relation":{},"ISSN":["1566-2535"],"issn-type":[{"value":"1566-2535","type":"print"}],"subject":[],"published":{"date-parts":[[2026,12]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"A surrogate ensemble fusion framework for robust watermark extraction in black-box models","name":"articletitle","label":"Article Title"},{"value":"Information Fusion","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.inffus.2026.104547","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier B.V. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"104547"}}