{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T09:15:45Z","timestamp":1783156545533,"version":"3.54.6"},"reference-count":51,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U25B2031"],"award-info":[{"award-number":["U25B2031"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012659","name":"Foundation for Innovative Research Groups of the National Natural Science Foundation of China","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100012659","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2024YFB2906503"],"award-info":[{"award-number":["2024YFB2906503"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Journal of Information Security and Applications"],"published-print":{"date-parts":[[2026,7]]},"DOI":"10.1016\/j.jisa.2026.104459","type":"journal-article","created":{"date-parts":[[2026,4,20]],"date-time":"2026-04-20T09:14:11Z","timestamp":1776676451000},"page":"104459","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["Optimizing stealthiness in universal adversarial perturbations via class-selective and perceptual similarity metrics"],"prefix":"10.1016","volume":"100","author":[{"given":"Yibo","family":"Jiao","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4415-0126","authenticated-orcid":false,"given":"Haipeng","family":"Peng","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8541-308X","authenticated-orcid":false,"given":"Lixiang","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.jisa.2026.104459_bib0001","series-title":"Proc. IEEE conf. comput. vis. pattern recognit. (CVPR)","first-page":"1765","article-title":"Universal adversarial perturbations","author":"Moosavi-Dezfooli","year":"2017"},{"issue":"4","key":"10.1016\/j.jisa.2026.104459_bib0002","doi-asserted-by":"crossref","first-page":"3392","DOI":"10.1109\/TDSC.2022.3202544","article-title":"Interpreting universal adversarial example attacks on image classification models","volume":"20","author":"Ding","year":"2022","journal-title":"IEEE Trans Dependable Secure Comput"},{"key":"10.1016\/j.jisa.2026.104459_bib0003","doi-asserted-by":"crossref","unstructured":"Han D., Zheng S., Zhang C.. Segment anything meets universal adversarial perturbation. 2023. arXiv:231012431.","DOI":"10.2139\/ssrn.4786251"},{"key":"10.1016\/j.jisa.2026.104459_bib0004","series-title":"Proc. IEEE\/CVF conf. comput. vis. pattern recognit. (CVPR)","first-page":"13430","article-title":"Fingerprinting deep neural networks globally via universal adversarial perturbations","author":"Peng","year":"2022"},{"key":"10.1016\/j.jisa.2026.104459_bib0005","series-title":"Proc. IEEE int. conf. acoust., speech, signal process. (ICASSP)","first-page":"2754","article-title":"AdverFacial: privacy-preserving universal adversarial perturbation against facial micro-expression leakages","author":"Low","year":"2022"},{"key":"10.1016\/j.jisa.2026.104459_bib0006","unstructured":"Labaca-Castro R., Mu\u00f1oz-Gonz\u00e1lez L., Pendlebury F., Rodosek G.D., Pierazzi F., Cavallaro L.. Realizable universal adversarial perturbations for malware. 2021. arXiv:210206747."},{"key":"10.1016\/j.jisa.2026.104459_bib0007","doi-asserted-by":"crossref","first-page":"5856","DOI":"10.1109\/TIP.2022.3202366","article-title":"Frequency-tuned universal adversarial attacks on texture recognition","volume":"31","author":"Deng","year":"2022","journal-title":"IEEE Trans Image Process"},{"key":"10.1016\/j.jisa.2026.104459_bib0008","series-title":"Proc. IEEE int. conf. multimedia expo (ICME)","first-page":"1","article-title":"Universal adversarial perturbations generative network for speaker recognition","author":"Li","year":"2020"},{"key":"10.1016\/j.jisa.2026.104459_bib0009","series-title":"Proc. int. conf. learn. represent. (ICLR)","article-title":"A baseline for detecting misclassified and out-of-distribution examples in neural networks","author":"Hendrycks","year":"2017"},{"key":"10.1016\/j.jisa.2026.104459_bib0010","series-title":"Proc. 35th annu. comput. security appl. conf. (ACSAC)","first-page":"113","article-title":"STRIP: A defence against trojan attacks on deep neural networks","author":"Gao","year":"2019"},{"key":"10.1016\/j.jisa.2026.104459_bib0011","series-title":"Proc. IEEE conf. comput. vis. pattern recognit. (CVPR)","first-page":"586","article-title":"The unreasonable effectiveness of deep features as a perceptual metric","author":"Zhang","year":"2018"},{"key":"10.1016\/j.jisa.2026.104459_bib0012","series-title":"Proc. int. conf. learn. represent. (ICLR)","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2014"},{"key":"10.1016\/j.jisa.2026.104459_bib0013","series-title":"Proc. int. conf. learn. represent. (ICLR)","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2015"},{"key":"10.1016\/j.jisa.2026.104459_bib0014","series-title":"Proc. IEEE conf. comput. vis. pattern recognit. (CVPR)","first-page":"2574","article-title":"DeepFool: a simple and accurate method to fool deep neural networks","author":"Moosavi-Dezfooli","year":"2016"},{"key":"10.1016\/j.jisa.2026.104459_bib0015","series-title":"Proc. IEEE symp. security and privacy (SP)","first-page":"39","article-title":"Towards evaluating the robustness of neural networks","author":"Carlini","year":"2017"},{"key":"10.1016\/j.jisa.2026.104459_bib0016","series-title":"Proc. int. conf. learn. represent. (ICLR)","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2018"},{"issue":"5","key":"10.1016\/j.jisa.2026.104459_bib0017","doi-asserted-by":"crossref","first-page":"828","DOI":"10.1109\/TEVC.2019.2890858","article-title":"One pixel attack for fooling deep neural networks","volume":"23","author":"Su","year":"2019","journal-title":"IEEE Trans Evol Comput"},{"key":"10.1016\/j.jisa.2026.104459_bib0018","series-title":"Proc. IEEE\/CVF conf. comput. vis. pattern recognit. (CVPR)","first-page":"16415","article-title":"Transferable adversarial attacks on vision transformers with token gradient regularization","author":"Zhang","year":"2023"},{"issue":"4","key":"10.1016\/j.jisa.2026.104459_bib0019","first-page":"2188","article-title":"Universal adversarial attack on attention and the resulting dataset damagenet","volume":"44","author":"Chen","year":"2022","journal-title":"IEEE Trans Pattern Anal Mach Intell"},{"key":"10.1016\/j.jisa.2026.104459_bib0020","doi-asserted-by":"crossref","first-page":"109","DOI":"10.1016\/j.neucom.2020.09.052","article-title":"Fast-UAP: an algorithm for expediting universal adversarial perturbation generation using the orientations of perturbation vectors","volume":"422","author":"Dai","year":"2021","journal-title":"Neurocomputing"},{"issue":"1","key":"10.1016\/j.jisa.2026.104459_bib0021","doi-asserted-by":"crossref","first-page":"67","DOI":"10.1109\/LWC.2021.3120290","article-title":"Universal adversarial attacks on neural networks for power allocation in a massive MIMO system","volume":"11","author":"Santos","year":"2021","journal-title":"IEEE Wireless Commun Lett"},{"key":"10.1016\/j.jisa.2026.104459_bib0022","first-page":"18","article-title":"Analysis of dominant classes in universal adversarial perturbations","volume":"151","author":"Vadillo Jueguen","year":"2022","journal-title":"Neural Netw"},{"key":"10.1016\/j.jisa.2026.104459_bib0023","doi-asserted-by":"crossref","first-page":"598","DOI":"10.1109\/TIP.2021.3127849","article-title":"Universal adversarial patch attack for automatic checkout using perceptual and attentional bias","volume":"31","author":"Wang","year":"2021","journal-title":"IEEE Trans Image Process"},{"key":"10.1016\/j.jisa.2026.104459_bib0024","series-title":"Proc. AAAI conf. artif. intell.","first-page":"3371","article-title":"An adversarial framework for generating unseen images by activation maximization","volume":"vol. 36","author":"Zhang","year":"2022"},{"key":"10.1016\/j.jisa.2026.104459_bib0025","series-title":"Proc. IEEE int. conf. data mining (ICDM)","first-page":"1412","article-title":"Generalizing universal adversarial attacks beyond additive perturbations","author":"Zhang","year":"2020"},{"key":"10.1016\/j.jisa.2026.104459_bib0026","series-title":"Proc. IEEE\/CVF int. conf. comput. vis. (ICCV)","first-page":"4435","article-title":"Enhancing generalization of universal adversarial perturbation through gradient aggregation","author":"Liu","year":"2023"},{"key":"10.1016\/j.jisa.2026.104459_bib0027","series-title":"Proc. AAAI conf. artif. intell.","first-page":"2768","article-title":"Exploring non-target knowledge for improving ensemble universal adversarial attacks","volume":"vol. 37","author":"Weng","year":"2023"},{"key":"10.1016\/j.jisa.2026.104459_bib0028","series-title":"Proc. joint eur. conf. mach. learn. knowl. discov. databases (ECML PKDD)","first-page":"304","article-title":"Adversarial mask: real-world universal adversarial attack on face recognition models","author":"Zolfi","year":"2022"},{"key":"10.1016\/j.jisa.2026.104459_bib0029","series-title":"Proc. IEEE int. conf. acoust., speech, signal process. (ICASSP)","first-page":"7345","article-title":"Universal adversarial attacks on text classifiers","author":"Behjati","year":"2019"},{"key":"10.1016\/j.jisa.2026.104459_bib0030","doi-asserted-by":"crossref","DOI":"10.1016\/j.patcog.2020.107584","article-title":"Universal adversarial perturbations against object detection","volume":"110","author":"Li","year":"2021","journal-title":"Pattern Recognit"},{"key":"10.1016\/j.jisa.2026.104459_bib0031","doi-asserted-by":"crossref","first-page":"146","DOI":"10.1016\/j.patrec.2020.04.025","article-title":"Steganographic universal adversarial perturbations","volume":"135","author":"Din","year":"2020","journal-title":"Pattern Recognit Lett"},{"key":"10.1016\/j.jisa.2026.104459_bib0032","series-title":"Proc. int. conf. mach. learn. (ICML)","first-page":"1597","article-title":"A simple framework for contrastive learning of visual representations","author":"Chen","year":"2020"},{"key":"10.1016\/j.jisa.2026.104459_bib0033","series-title":"Proc. adv. neural inf. process. syst. (neurIPS)","first-page":"2983","article-title":"Adversarial self-supervised contrastive learning","volume":"vol. 33","author":"Kim","year":"2020"},{"key":"10.1016\/j.jisa.2026.104459_bib0034","series-title":"Proc. eur. conf. comput. vis. (ECCV)","first-page":"569","article-title":"Contrastive learning-based adversarial perturbations for black-box attacks","author":"Ho","year":"2022"},{"issue":"3","key":"10.1016\/j.jisa.2026.104459_bib0035","first-page":"2711","article-title":"Adversarial sticker: a stealthy attack method in the physical world","volume":"45","author":"Wei","year":"2023","journal-title":"IEEE Trans Pattern Anal Mach Intell"},{"key":"10.1016\/j.jisa.2026.104459_bib0036","series-title":"Proc. IEEE\/CVF conf. comput. vis. pattern recognit. (CVPR)","first-page":"15345","article-title":"Shadows can be dangerous: stealthy and effective physical-world adversarial attack by natural phenomenon","author":"Zhong","year":"2022"},{"key":"10.1016\/j.jisa.2026.104459_bib0037","series-title":"Proc. netw. distrib. syst. security symp. (NDSS)","article-title":"Enhance stealthiness and transferability of adversarial attacks with class activation mapping ensemble attack","author":"Xia","year":"2023"},{"key":"10.1016\/j.jisa.2026.104459_bib0038","series-title":"Proc. AAAI conf. artif. intell.","first-page":"5883","article-title":"Stealthy and efficient adversarial attacks against deep reinforcement learning","volume":"vol. 34","author":"Sun","year":"2020"},{"key":"10.1016\/j.jisa.2026.104459_bib0039","doi-asserted-by":"crossref","unstructured":"Wang Y., Wu S., Jiang W., Hao S., Tan Y.-a., Zhang Q.. Demiguise attack: crafting invisible semantic adversarial perturbations with perceptual similarity. 2021b. arXiv:210701396.","DOI":"10.24963\/ijcai.2021\/430"},{"key":"10.1016\/j.jisa.2026.104459_bib0040","series-title":"Proc. IEEE conf. comput. vis. pattern recognit. (CVPR)","first-page":"248","article-title":"ImageNet: a large-scale hierarchical image database","author":"Deng","year":"2009"},{"key":"10.1016\/j.jisa.2026.104459_bib0041","series-title":"Proc. IEEE\/CVF conf. comput. vis. pattern recognit. (CVPR)","first-page":"14521","article-title":"Understanding adversarial examples from the mutual influence of images and perturbations","author":"Zhang","year":"2020"},{"key":"10.1016\/j.jisa.2026.104459_bib0042","first-page":"8024","article-title":"PyTorch: an imperative style, high-performance deep learning library","volume":"32","author":"Paszke","year":"2019","journal-title":"Adv Neural Inf Process Syst"},{"key":"10.1016\/j.jisa.2026.104459_bib0043","series-title":"Proc. int. conf. learn. represent. (ICLR)","article-title":"SGDR: stochastic gradient descent with warm restarts","author":"Loshchilov","year":"2017"},{"key":"10.1016\/j.jisa.2026.104459_bib0044","series-title":"Proc. int. conf. learn. represent. (ICLR)","article-title":"Adam: a method for stochastic optimization","author":"Kingma","year":"2015"},{"key":"10.1016\/j.jisa.2026.104459_bib0045","series-title":"Proc. IEEE conf. comput. vis. pattern recognit. (CVPR)","first-page":"4422","article-title":"Generative adversarial perturbations","author":"Poursaeed","year":"2018"},{"key":"10.1016\/j.jisa.2026.104459_bib0046","series-title":"Proc. IEEE conf. comput. vis. pattern recognit. (CVPR)","first-page":"742","article-title":"NAG: network for adversary generation","author":"Mopuri","year":"2018"},{"key":"10.1016\/j.jisa.2026.104459_bib0047","doi-asserted-by":"crossref","unstructured":"Deng Y., Karam L.J.. Frequency-tuned universal adversarial attacks. 2020. arXiv:200305549.","DOI":"10.1007\/978-3-030-68238-5_36"},{"key":"10.1016\/j.jisa.2026.104459_bib0048","series-title":"Proc. IEEE\/CVF int. conf. comput. vis. (ICCV)","first-page":"7868","article-title":"Data-free universal adversarial perturbation and black-box attack","author":"Zhang","year":"2021"},{"key":"10.1016\/j.jisa.2026.104459_bib0049","series-title":"Proc. int. joint conf. neural netw. (IJCNN)","first-page":"1","article-title":"FG-UAP: feature-gathering universal adversarial perturbation","author":"Ye","year":"2023"},{"issue":"4","key":"10.1016\/j.jisa.2026.104459_bib0050","doi-asserted-by":"crossref","first-page":"600","DOI":"10.1109\/TIP.2003.819861","article-title":"Image quality assessment: from error visibility to structural similarity","volume":"13","author":"Wang","year":"2004","journal-title":"IEEE Trans Image Process"},{"key":"10.1016\/j.jisa.2026.104459_bib0051","series-title":"Proc. network distrib. syst. security symp. (NDSS)","article-title":"Feature squeezing: detecting adversarial examples in deep neural networks","author":"Xu","year":"2018"}],"container-title":["Journal of Information Security and Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S221421262600089X?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S221421262600089X?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T08:22:01Z","timestamp":1783153321000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S221421262600089X"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7]]},"references-count":51,"alternative-id":["S221421262600089X"],"URL":"https:\/\/doi.org\/10.1016\/j.jisa.2026.104459","relation":{},"ISSN":["2214-2126"],"issn-type":[{"value":"2214-2126","type":"print"}],"subject":[],"published":{"date-parts":[[2026,7]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Optimizing stealthiness in universal adversarial perturbations via class-selective and perceptual similarity metrics","name":"articletitle","label":"Article Title"},{"value":"Journal of Information Security and Applications","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.jisa.2026.104459","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier Ltd. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"104459"}}