{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,25]],"date-time":"2026-05-25T07:05:43Z","timestamp":1779692743492,"version":"3.53.1"},"reference-count":59,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U21B2001"],"award-info":[{"award-number":["U21B2001"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Neural Networks"],"published-print":{"date-parts":[[2026,8]]},"DOI":"10.1016\/j.neunet.2026.108857","type":"journal-article","created":{"date-parts":[[2026,3,15]],"date-time":"2026-03-15T06:39:25Z","timestamp":1773556765000},"page":"108857","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["DesInsert: Strategic descriptive term insertion fools text-to-image generation"],"prefix":"10.1016","volume":"200","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-4407-527X","authenticated-orcid":false,"given":"Fanyu","family":"Bu","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-8219-1392","authenticated-orcid":false,"given":"Kai","family":"Ye","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-0448-1218","authenticated-orcid":false,"given":"Jianan","family":"Ma","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5829-051X","authenticated-orcid":false,"given":"Tianyi","family":"Chen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3399-5281","authenticated-orcid":false,"given":"Zhen","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.neunet.2026.108857_bib0001","series-title":"European conference on computer vision","first-page":"484","article-title":"Square attack: A query-efficient black-box adversarial attack via random search","author":"Andriushchenko","year":"2020"},{"key":"10.1016\/j.neunet.2026.108857_bib0002","unstructured":"Bengio, Y., L\u00e9onard, N., & Courville, A. (2013). Estimating or propagating gradients through stochastic neurons for conditional computation. arXiv preprint arXiv: 1308.3432."},{"key":"10.1016\/j.neunet.2026.108857_bib0003","unstructured":"Brendel, W., Rauber, J., & Bethge, M. (2017). Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprint arXiv: 1712.04248."},{"key":"10.1016\/j.neunet.2026.108857_bib0004","article-title":"Language models are few-shot learners","author":"Brown","year":"2020","journal-title":"NeurIPS"},{"key":"10.1016\/j.neunet.2026.108857_bib0005","series-title":"2017\u202fIEEE Symposium on security and privacy (s&p)","first-page":"39","article-title":"Towards evaluating the robustness of neural networks","author":"Carlini","year":"2017"},{"key":"10.1016\/j.neunet.2026.108857_bib0006","series-title":"Proceedings of the 10th ACM workshop on artificial intelligence and security","first-page":"15","article-title":"Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models","author":"Chen","year":"2017"},{"key":"10.1016\/j.neunet.2026.108857_bib0007","doi-asserted-by":"crossref","DOI":"10.1016\/j.neunet.2024.106971","article-title":"Strongly concealed adversarial attack against text classification models with limited queries","volume":"183","author":"Cheng","year":"2025","journal-title":"Neural Networks"},{"key":"10.1016\/j.neunet.2026.108857_bib0008","unstructured":"Dathathri, S., Zheng, S., Yin, T., Murray, R. M., & Yue, Y. (2018). Detecting adversarial examples via neural fingerprinting. arXiv preprint arXiv: 1803.03870."},{"key":"10.1016\/j.neunet.2026.108857_bib0009","series-title":"Cvpr","article-title":"Imagenet: A large-scale hierarchical image database","author":"Deng","year":"2009"},{"key":"10.1016\/j.neunet.2026.108857_bib0010","article-title":"Stable diffusion is unstable","volume":"36","author":"Du","year":"2024","journal-title":"Advances in Neural Information Processing Systems"},{"key":"10.1016\/j.neunet.2026.108857_bib0011","series-title":"Proceedings of the 56th annual meeting of the association for computational linguistics (volume 2: Short papers)","first-page":"31","article-title":"Hotflip: White-box adversarial examples for text classification","author":"Ebrahimi","year":"2018"},{"key":"10.1016\/j.neunet.2026.108857_bib0012","unstructured":"Gao, H., Zhang, H., Dong, Y., & Deng, Z. (2023). Evaluating the robustness of text-to-image diffusion models against real-world attacks. arXiv preprint arXiv: 2306.13103."},{"key":"10.1016\/j.neunet.2026.108857_bib0013","series-title":"2018\u202fIEEE Security and privacy workshops (SPW)","first-page":"50","article-title":"Black-box generation of adversarial text sequences to evade deep learning classifiers","author":"Gao","year":"2018"},{"key":"10.1016\/j.neunet.2026.108857_bib0014","unstructured":"Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv preprint arXiv: 1412.6572."},{"key":"10.1016\/j.neunet.2026.108857_bib0015","unstructured":"Gu, T., Dolan-Gavitt, B., & Garg, S. (2017). Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv: 1708.06733."},{"key":"10.1016\/j.neunet.2026.108857_bib0016","series-title":"International conference on machine learning","first-page":"2484","article-title":"Simple black-box adversarial attacks","author":"Guo","year":"2019"},{"key":"10.1016\/j.neunet.2026.108857_bib0017","doi-asserted-by":"crossref","unstructured":"Guo, C., Sablayrolles, A., J\u00e9gou, H., & Kiela, D. (2021). Gradient-based adversarial attacks against text transformers. arXiv preprint arXiv: 2104.13733.","DOI":"10.18653\/v1\/2021.emnlp-main.464"},{"key":"10.1016\/j.neunet.2026.108857_bib0018","series-title":"2024\u202fIEEE Conference on virtual reality and 3d user interfaces abstracts and workshops (VRW)","first-page":"975","article-title":"Diffusion attack: Leveraging stable diffusion for naturalistic image attacking","author":"Guo","year":"2024"},{"key":"10.1016\/j.neunet.2026.108857_bib0019","series-title":"Proceedings of the IEEE\/CVF international conference on computer vision","first-page":"7462","article-title":"Improving sample quality of diffusion models using self-attention guidance","author":"Hong","year":"2023"},{"key":"10.1016\/j.neunet.2026.108857_bib0020","unstructured":"Ibitoye, O., Abou-Khamis, R., Shehaby, M. e., Matrawy, A., & Shafiq, M. O. (2019). The threat of adversarial attacks on machine learning in network security\u2013a survey. arXiv preprint arXiv: 1911.02621."},{"key":"10.1016\/j.neunet.2026.108857_bib0021","doi-asserted-by":"crossref","unstructured":"Jia, R., & Liang, P. (2017). Adversarial examples for evaluating reading comprehension systems. arXiv preprint arXiv: 1707.07328.","DOI":"10.18653\/v1\/D17-1215"},{"key":"10.1016\/j.neunet.2026.108857_bib0022","series-title":"Artificial intelligence safety and security","first-page":"99","article-title":"Adversarial examples in the physical world","author":"Kurakin","year":"2018"},{"key":"10.1016\/j.neunet.2026.108857_bib0023","series-title":"Proceedings of the 59th annual meeting of the association for computational linguistics and the 11th international joint conference on natural language processing (volume 1: Long papers)","first-page":"3831","article-title":"A sweet rabbit hole by DARCY: Using honeypots to detect universal trigger\u2019s adversarial attacks","author":"Le","year":"2021"},{"key":"10.1016\/j.neunet.2026.108857_bib0024","series-title":"Proceedings of the 61st annual meeting of the association for computational linguistics (volume 1: Long papers)","first-page":"338","article-title":"Text adversarial purification as defense against adversarial attacks","author":"Li","year":"2023"},{"key":"10.1016\/j.neunet.2026.108857_bib0025","unstructured":"Lin, Y., Zhang, J., Chen, Y., & Li, H. (2023). Sd-nae: Generating natural adversarial examples with stable diffusion. arXiv preprint arXiv: 2311.12981."},{"key":"10.1016\/j.neunet.2026.108857_bib0026","series-title":"Proceedings of the 2022 conference on empirical methods in natural language processing","first-page":"7664","article-title":"Character-level white-box adversarial attacks against transformers via attachable subwords substitution","author":"Liu","year":"2022"},{"key":"10.1016\/j.neunet.2026.108857_bib0027","series-title":"Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition","first-page":"7817","article-title":"Towards understanding cross and self-attention in stable diffusion for text-guided image editing","author":"Liu","year":"2024"},{"key":"10.1016\/j.neunet.2026.108857_bib0028","series-title":"Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition","first-page":"20585","article-title":"Riatig: Reliable and imperceptible adversarial text-to-image generation with natural prompts","author":"Liu","year":"2023"},{"key":"10.1016\/j.neunet.2026.108857_bib0029","unstructured":"Madry, A. (2017). Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv: 1706.06083."},{"key":"10.1016\/j.neunet.2026.108857_bib0030","unstructured":"Minervini, P., Demeester, T., Rockt\u00e4schel, T., & Riedel, S. (2017). Adversarial sets for regularising neural link predictors. arXiv preprint arXiv: 1707.07596."},{"key":"10.1016\/j.neunet.2026.108857_bib0031","unstructured":"Miyato, T., Dai, A. M., & Goodfellow, I. (2016). Adversarial training methods for semi-supervised text classification. arXiv preprint arXiv: 1605.07725,."},{"key":"10.1016\/j.neunet.2026.108857_bib0032","doi-asserted-by":"crossref","unstructured":"Niven, T., & Kao, H.-Y. (2019). Probing neural network comprehension of natural language arguments. arXiv preprint arXiv: 1907.07355.","DOI":"10.18653\/v1\/P19-1459"},{"key":"10.1016\/j.neunet.2026.108857_bib0033","series-title":"Proceedings of the 2017\u202fACM on asia conference on computer and communications security","first-page":"506","article-title":"Practical black-box attacks against machine learning","author":"Papernot","year":"2017"},{"key":"10.1016\/j.neunet.2026.108857_bib0034","series-title":"2016\u202fIEEE European symposium on security and privacy (euros&p)","first-page":"372","article-title":"The limitations of deep learning in adversarial settings","author":"Papernot","year":"2016"},{"key":"10.1016\/j.neunet.2026.108857_bib0035","unstructured":"Pittala, T. S. S. R., Meleti, U. M. R., & Puligundla, G. (2024). A novel approach to guard from adversarial attacks using stable diffusion. arXiv preprint arXiv: 2405.01838."},{"key":"10.1016\/j.neunet.2026.108857_bib0036","series-title":"Proceedings of the 57th annual meeting of the association for computational linguistics","first-page":"5582","article-title":"Combating adversarial misspellings with robust word recognition","author":"Pruthi","year":"2019"},{"key":"10.1016\/j.neunet.2026.108857_bib0037","series-title":"Icml","article-title":"Learning transferable visual models from natural language supervision","author":"Radford","year":"2021"},{"key":"10.1016\/j.neunet.2026.108857_bib0038","unstructured":"Ramesh, A., Dhariwal, P., Nichol, A., Chu, C., & Chen, M. (2022). Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv: 2204.06125, 1(2), 3."},{"key":"10.1016\/j.neunet.2026.108857_bib0039","series-title":"International conference on machine learning","first-page":"8821","article-title":"Zero-shot text-to-image generation","author":"Ramesh","year":"2021"},{"key":"10.1016\/j.neunet.2026.108857_bib0040","series-title":"Proceedings of the 57th annual meeting of the association for computational linguistics","first-page":"1085","article-title":"Generating natural language adversarial examples through probability weighted word saliency","author":"Ren","year":"2019"},{"key":"10.1016\/j.neunet.2026.108857_bib0041","series-title":"Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition","first-page":"10684","article-title":"High-resolution image synthesis with latent diffusion models","author":"Rombach","year":"2022"},{"key":"10.1016\/j.neunet.2026.108857_bib0042","series-title":"Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition","first-page":"22500","article-title":"Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation","author":"Ruiz","year":"2023"},{"key":"10.1016\/j.neunet.2026.108857_bib0043","doi-asserted-by":"crossref","unstructured":"Sampson, J. R. (1976). Adaptation in natural and artificial systems (john h. holland).","DOI":"10.1137\/1018105"},{"key":"10.1016\/j.neunet.2026.108857_bib0044","unstructured":"Shen, L., Zhang, Z., Jiang, H., & Chen, Y. (2023). Textshield: Beyond successfully detecting adversarial sentences in text classification. arXiv preprint arXiv: 2302.02023."},{"key":"10.1016\/j.neunet.2026.108857_bib0045","series-title":"Findings of the association for computational linguistics: ACL 2023","first-page":"129","article-title":"Layerwise universal adversarial attack on NLP models","author":"Tsymboi","year":"2023"},{"key":"10.1016\/j.neunet.2026.108857_bib0046","doi-asserted-by":"crossref","first-page":"875","DOI":"10.1016\/j.neunet.2023.08.022","article-title":"Adversarial attacks and defenses using feature-space stochasticity","volume":"167","author":"Ukita","year":"2023","journal-title":"Neural Networks"},{"key":"10.1016\/j.neunet.2026.108857_bib0047","doi-asserted-by":"crossref","first-page":"168","DOI":"10.1016\/j.neunet.2020.04.015","article-title":"Vulnerability of classifiers to evolutionary generated adversarial examples","volume":"127","author":"Vidnerov\u00e1","year":"2020","journal-title":"Neural Networks"},{"key":"10.1016\/j.neunet.2026.108857_bib0048","series-title":"Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition","first-page":"7416","article-title":"Stereodiffusion: Training-free stereo image generation using latent diffusion models","author":"Wang","year":"2024"},{"key":"10.1016\/j.neunet.2026.108857_bib0049","unstructured":"Wang, R., Liu, T., Hsieh, C.-J., & Gong, B. (2024b). On discrete prompt optimization for diffusion models. arXiv preprint arXiv: 2407.01606."},{"key":"10.1016\/j.neunet.2026.108857_bib0050","doi-asserted-by":"crossref","DOI":"10.1016\/j.neunet.2024.106698","article-title":"Sample selection of adversarial attacks against traffic signs","volume":"180","author":"Wang","year":"2024","journal-title":"Neural Networks"},{"key":"10.1016\/j.neunet.2026.108857_bib0051","series-title":"Proceedings of the 29th ACM SIGKDD conference on knowledge discovery and data mining","first-page":"3093","article-title":"Pat: Geometry-aware hard-label black-box adversarial attacks on text","author":"Ye","year":"2023"},{"key":"10.1016\/j.neunet.2026.108857_bib0052","series-title":"Proceedings of the 28th ACM SIGKDD conference on knowledge discovery and data mining","first-page":"2307","article-title":"Leapattack: Hard-label adversarial attack on text via gradient-based optimization","author":"Ye","year":"2022"},{"key":"10.1016\/j.neunet.2026.108857_bib0053","series-title":"Proceedings of the AAAI conference on artificial intelligence","first-page":"3877","article-title":"Texthoaxer: Budgeted hard-label adversarial attacks on text","volume":"vol. 36","author":"Ye","year":"2022"},{"key":"10.1016\/j.neunet.2026.108857_bib0054","series-title":"Acm siggraph 2024 conference papers","first-page":"1","article-title":"Dilightnet: Fine-grained lighting control for diffusion-based image generation","author":"Zeng","year":"2024"},{"key":"10.1016\/j.neunet.2026.108857_bib0055","doi-asserted-by":"crossref","first-page":"730","DOI":"10.1016\/j.neunet.2023.08.048","article-title":"Adv-BDPM: Adversarial attack based on boundary diffusion probability model","volume":"167","author":"Zhang","year":"2023","journal-title":"Neural Networks"},{"key":"10.1016\/j.neunet.2026.108857_bib0056","series-title":"Cvpr","article-title":"The unreasonable effectiveness of deep features as a perceptual metric","author":"Zhang","year":"2018"},{"key":"10.1016\/j.neunet.2026.108857_bib0057","series-title":"Proceedings of the 59th annual meeting of the association for computational linguistics and the 11th international joint conference on natural language processing (volume 1: Long papers)","first-page":"1967","article-title":"Crafting adversarial examples for neural machine translation","author":"Zhang","year":"2021"},{"key":"10.1016\/j.neunet.2026.108857_bib0058","unstructured":"Zhu, C., Cheng, Y., Gan, Z., Sun, S., Goldstein, T., & Liu, J. (2019). Freelb: Enhanced adversarial training for natural language understanding. arXiv preprint arXiv: 1909.11764."},{"key":"10.1016\/j.neunet.2026.108857_bib0059","series-title":"Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition","first-page":"2385","article-title":"A pilot study of query-free adversarial attack against stable diffusion","author":"Zhuang","year":"2023"}],"container-title":["Neural Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0893608026003187?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0893608026003187?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,5,25]],"date-time":"2026-05-25T06:46:28Z","timestamp":1779691588000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0893608026003187"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8]]},"references-count":59,"alternative-id":["S0893608026003187"],"URL":"https:\/\/doi.org\/10.1016\/j.neunet.2026.108857","relation":{},"ISSN":["0893-6080"],"issn-type":[{"value":"0893-6080","type":"print"}],"subject":[],"published":{"date-parts":[[2026,8]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"DesInsert: Strategic descriptive term insertion fools text-to-image generation","name":"articletitle","label":"Article Title"},{"value":"Neural Networks","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.neunet.2026.108857","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier Ltd. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"108857"}}