{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,3]],"date-time":"2026-07-03T02:15:49Z","timestamp":1783044949838,"version":"3.54.6"},"reference-count":61,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62072112"],"award-info":[{"award-number":["62072112"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62576109"],"award-info":[{"award-number":["62576109"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Neural Networks"],"published-print":{"date-parts":[[2026,10]]},"DOI":"10.1016\/j.neunet.2026.109020","type":"journal-article","created":{"date-parts":[[2026,4,30]],"date-time":"2026-04-30T14:28:52Z","timestamp":1777559332000},"page":"109020","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["Delving into the adversarial robustness of semantic segmentation with decision-based black-box attacks"],"prefix":"10.1016","volume":"202","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7112-2596","authenticated-orcid":false,"given":"Zhaoyu","family":"Chen","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-9291-6416","authenticated-orcid":false,"given":"Zhengyang","family":"Shan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-0739-1231","authenticated-orcid":false,"given":"Jingwen","family":"Chang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2878-0497","authenticated-orcid":false,"given":"Kaixun","family":"Jiang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1829-5671","authenticated-orcid":false,"given":"Dingkang","family":"Yang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8331-9740","authenticated-orcid":false,"given":"Yiting","family":"Cheng","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-4930-6284","authenticated-orcid":false,"given":"Jinglun","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3339-8751","authenticated-orcid":false,"given":"Wenqiang","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.neunet.2026.109020_bib0001","series-title":"Proceedings of the 41st international conference on machine learning","first-page":"416","article-title":"CosPGD: An efficient white-box adversarial attack for pixel-wise prediction tasks","volume":"vol. 235","author":"Agnihotri","year":"2024"},{"key":"10.1016\/j.neunet.2026.109020_bib0002","series-title":"International conference on learning representations","article-title":"Sign bits are all you need for black-box attacks","author":"Al-Dujaili","year":"2019"},{"key":"10.1016\/j.neunet.2026.109020_bib0003","series-title":"European conference on computer vision","first-page":"484","article-title":"Square attack: A query-efficient black-box adversarial attack via random search","author":"Andriushchenko","year":"2020"},{"key":"10.1016\/j.neunet.2026.109020_bib0004","series-title":"International conference on machine learning","first-page":"560","article-title":"SignSGD: Compressed optimisation for non-convex problems","author":"Bernstein","year":"2018"},{"key":"10.1016\/j.neunet.2026.109020_bib0005","unstructured":"Chen, C., & Mo, J. (2022). IQA-PyTorch: Pytorch toolbox for image quality assessment. [Online]. Available:https:\/\/github.com\/chaofengc\/IQA-PyTorch."},{"key":"10.1016\/j.neunet.2026.109020_bib0006","first-page":"3486","article-title":"A frank-wolfe framework for efficient and effective adversarial attacks","author":"Chen","year":"2020"},{"key":"10.1016\/j.neunet.2026.109020_bib0007","unstructured":"Chen, L.-C., Papandreou, G., Schroff, F., & Adam, H. (2017). Rethinking atrous convolution for semantic image segmentation. arXiv: 1706.05587."},{"key":"10.1016\/j.neunet.2026.109020_bib0008","doi-asserted-by":"crossref","unstructured":"Chen, L.-C., Zhu, Y., Papandreou, G., Schroff, F., & Adam, H. (2018). Encoder-decoder with atrous separable convolution for semantic image segmentation. https:\/\/arxiv.org\/abs\/1802.02611.","DOI":"10.1007\/978-3-030-01234-2_49"},{"key":"10.1016\/j.neunet.2026.109020_bib0009","doi-asserted-by":"crossref","first-page":"5522","DOI":"10.1109\/TIFS.2023.3307908","article-title":"Query-efficient decision-based black-box patch attack","volume":"18","author":"Chen","year":"2023","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"10.1016\/j.neunet.2026.109020_bib0010","series-title":"Thirty-seventh conference on neural information processing systems","article-title":"Content-based unrestricted adversarial attack","author":"Chen","year":"2023"},{"key":"10.1016\/j.neunet.2026.109020_bib0011","series-title":"Computer vision\u2013ECCV 2022: 17th european conference, tel aviv, israel, october 23\u201327, 2022, proceedings, part IV","first-page":"529","article-title":"Shape matters: Deformable patch attack","author":"Chen","year":"2022"},{"key":"10.1016\/j.neunet.2026.109020_bib0012","series-title":"Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition","first-page":"15148","article-title":"Towards practical certifiable patch defense with vision transformer","author":"Chen","year":"2022"},{"key":"10.1016\/j.neunet.2026.109020_bib0013","series-title":"Cvpr","article-title":"Boundary IoU: Improving object-centric image segmentation evaluation","author":"Cheng","year":"2021"},{"key":"10.1016\/j.neunet.2026.109020_bib0014","series-title":"Advances in neural information processing systems 34: annual conference on neural information processing systems 2021, neurIPS 2021, december 6\u201314, 2021, virtual","first-page":"17864","article-title":"Per-pixel classification is not all you need for semantic segmentation","author":"Cheng","year":"2021"},{"key":"10.1016\/j.neunet.2026.109020_bib0015","series-title":"2016\u202fIEEE Conference on computer vision and pattern recognition, CVPR 2016, las vegas, nv, usa, june 27\u201330, 2016","first-page":"3213","article-title":"The cityscapes dataset for semantic urban scene understanding","author":"Cordts","year":"2016"},{"key":"10.1016\/j.neunet.2026.109020_bib0016","series-title":"9th international conference on learning representations, ICLR 2021, virtual event, austria, may 3\u20137, 2021","article-title":"An image is worth 16x16 words: Transformers for image recognition at scale","author":"Dosovitskiy","year":"2021"},{"key":"10.1016\/j.neunet.2026.109020_bib0017","series-title":"2024\u202fIEEE 6th international conference on civil aviation safety and information technology (ICCASIT)","first-page":"767","article-title":"Decision-based batch processing attack method","author":"Duan","year":"2024"},{"key":"10.1016\/j.neunet.2026.109020_bib0018","doi-asserted-by":"crossref","first-page":"98","DOI":"10.1007\/s11263-014-0733-5","article-title":"The pascal visual object classes challenge: A retrospective","volume":"111","author":"Everingham","year":"2015","journal-title":"International journal of computer vision"},{"key":"10.1016\/j.neunet.2026.109020_bib0019","series-title":"5th international conference on learning representations, ICLR 2017, toulon, france, april 24\u201326, 2017, workshop track proceedings","article-title":"Adversarial examples for semantic image segmentation","author":"Fischer","year":"2017"},{"issue":"9","key":"10.1016\/j.neunet.2026.109020_bib0020","doi-asserted-by":"crossref","first-page":"2538","DOI":"10.1109\/TBME.2012.2205687","article-title":"An ensemble classification-based approach applied to retinal blood vessel segmentation","volume":"59","author":"Fraz","year":"2012","journal-title":"IEEE Transactions on Biomedical Engineering"},{"key":"10.1016\/j.neunet.2026.109020_bib0021","series-title":"Proceedings of the IEEE\/CVF winter conference on applications of computer vision","first-page":"1220","article-title":"No-reference image quality assessment via transformers, relative ranking, and self-consistency","author":"Golestaneh","year":"2022"},{"key":"10.1016\/j.neunet.2026.109020_bib0022","series-title":"European conference on computer vision","first-page":"308","article-title":"Segpgd: An effective and efficient adversarial attack for evaluating and boosting segmentation robustness","author":"Gu","year":"2022"},{"key":"10.1016\/j.neunet.2026.109020_bib0023","series-title":"International conference on machine learning","first-page":"2484","article-title":"Simple black-box adversarial attacks","author":"Guo","year":"2019"},{"key":"10.1016\/j.neunet.2026.109020_bib0024","doi-asserted-by":"crossref","first-page":"7063","DOI":"10.1109\/TIP.2022.3219230","article-title":"Adaptive online mutual learning bi-decoders for video object segmentation","volume":"31","author":"Guo","year":"2022","journal-title":"IEEE Transactions on Image Processing"},{"key":"10.1016\/j.neunet.2026.109020_bib0025","doi-asserted-by":"crossref","first-page":"58","DOI":"10.1016\/j.neunet.2022.02.025","article-title":"Boosting the transferability of adversarial examples via stochastic serial attack","volume":"150","author":"Hao","year":"2022","journal-title":"Neural Networks"},{"key":"10.1016\/j.neunet.2026.109020_bib0026","unstructured":"Hong, L., Chen, W., Liu, Z., Zhang, W., Guo, P., Chen, Z., & Zhang, W. (2022). Lvos: A benchmark for long-term video object segmentation. arXiv: 2211.10181."},{"key":"10.1016\/j.neunet.2026.109020_bib0027","doi-asserted-by":"crossref","first-page":"1057","DOI":"10.1109\/TIP.2021.3137660","article-title":"Adaptive selection of reference frames for video object segmentation","volume":"31","author":"Hong","year":"2021","journal-title":"IEEE Transactions on Image Processing"},{"key":"10.1016\/j.neunet.2026.109020_bib0028","series-title":"Proceedings of the 35th international conference on machine learning, ICML 2018, stockholmsm\u00e4ssan, stockholm, sweden, july 10\u201315, 2018","first-page":"2142","article-title":"Black-box adversarial attacks with limited queries and information","volume":"vol. 80","author":"Ilyas","year":"2018"},{"key":"10.1016\/j.neunet.2026.109020_bib0029","series-title":"7th international conference on learning representations, ICLR 2019, new orleans, la, usa, may 6\u20139, 2019","article-title":"Prior convictions: Black-box adversarial attacks with bandits and priors","author":"Ilyas","year":"2019"},{"key":"10.1016\/j.neunet.2026.109020_bib0030","series-title":"Proceedings of the 31st ACM international conference on multimedia","first-page":"1443","article-title":"Towards decision-based sparse attacks on video recognition","author":"Jiang","year":"2023"},{"key":"10.1016\/j.neunet.2026.109020_bib0031","series-title":"Proceedings of the IEEE\/CVF international conference on computer vision","first-page":"5148","article-title":"Musiq: Multi-scale image quality transformer","author":"Ke","year":"2021"},{"key":"10.1016\/j.neunet.2026.109020_bib0032","series-title":"2020 IEEE\/CVF Conference on computer vision and pattern recognition, CVPR 2020, seattle, wa, usa, june 13\u201319, 2020","first-page":"1218","article-title":"QEBA: Query-efficient boundary-based blackbox attack","author":"Li","year":"2020"},{"key":"10.1016\/j.neunet.2026.109020_bib0033","doi-asserted-by":"crossref","first-page":"925","DOI":"10.1016\/j.neunet.2023.06.031","article-title":"Strengthening transferability of adversarial examples by adaptive inertia and amplitude spectrum dropout","volume":"165","author":"Li","year":"2023","journal-title":"Neural Networks"},{"key":"10.1016\/j.neunet.2026.109020_bib0034","doi-asserted-by":"crossref","first-page":"331","DOI":"10.1016\/j.future.2022.03.008","article-title":"Query-based black-box attack against medical image segmentation model","volume":"133","author":"Li","year":"2022","journal-title":"Future Generation Computer Systems"},{"key":"10.1016\/j.neunet.2026.109020_bib0035","doi-asserted-by":"crossref","first-page":"2387","DOI":"10.1109\/TIFS.2025.3542964","article-title":"On the importance of backbone to the adversarial robustness of object detectors","volume":"20","author":"Li","year":"2025","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"10.1016\/j.neunet.2026.109020_bib0036","series-title":"The thirteenth international conference on learning representations","article-title":"ADBM: Adversarial diffusion bridge model for reliable adversarial purification","author":"Li","year":"2025"},{"key":"10.1016\/j.neunet.2026.109020_bib0037","series-title":"Proceedings of the IEEE\/CVF international conference on computer vision","first-page":"24456","article-title":"Pbcat: Patch-based composite adversarial training against physically realizable attacks on object detection","author":"Li","year":"2025"},{"key":"10.1016\/j.neunet.2026.109020_bib0038","series-title":"7th international conference on learning representations, ICLR 2019, new orleans, la, usa, may 6\u20139, 2019","article-title":"SignSGD via zeroth-order oracle","author":"Liu","year":"2019"},{"key":"10.1016\/j.neunet.2026.109020_bib0039","doi-asserted-by":"crossref","first-page":"9861","DOI":"10.1109\/TMM.2025.3618533","article-title":"Towards invisible decision-based adversarial attacks against visual object tracking","volume":"27","author":"Liu","year":"2025","journal-title":"IEEE Transactions on Multimedia"},{"key":"10.1016\/j.neunet.2026.109020_bib0040","series-title":"IEEE Conference on computer vision and pattern recognition, CVPR 2015, boston, ma, usa, june 7\u201312, 2015","first-page":"3431","article-title":"Fully convolutional networks for semantic segmentation","author":"Long","year":"2015"},{"key":"10.1016\/j.neunet.2026.109020_bib0041","series-title":"Iclr","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2018"},{"key":"10.1016\/j.neunet.2026.109020_bib0042","series-title":"Proceedings of the 36th international conference on machine learning, ICML 2019, 9\u201315 june 2019, long beach, california, USA","first-page":"4636","article-title":"Parsimonious black-box adversarial attacks via efficient combinatorial optimization","volume":"vol. 97","author":"Moon","year":"2019"},{"key":"10.1016\/j.neunet.2026.109020_bib0043","series-title":"Computer vision\u2013ECCV 2020: 16th european conference, glasgow, UK, august 23\u201328, 2020, proceedings, part v 16","first-page":"611","article-title":"Indirect local attacks for context-aware semantic segmentation networks","author":"Nakka","year":"2020"},{"key":"10.1016\/j.neunet.2026.109020_bib0044","series-title":"International conference on machine learning (ICML)","article-title":"Diffusion models for adversarial purification","author":"Nie","year":"2022"},{"key":"10.1016\/j.neunet.2026.109020_bib0045","series-title":"International conference on medical image computing and computer-assisted intervention","first-page":"234","article-title":"U-Net: Convolutional networks for biomedical image segmentation","author":"Ronneberger","year":"2015"},{"key":"10.1016\/j.neunet.2026.109020_bib0046","series-title":"Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition","first-page":"20524","article-title":"Proximal splitting adversarial attack for semantic segmentation","author":"Rony","year":"2023"},{"key":"10.1016\/j.neunet.2026.109020_bib0047","article-title":"On the adversarial robustness of vision transformers","volume":"2022","author":"Shao","year":"2022","journal-title":"Transactions on Machine Learning Research"},{"key":"10.1016\/j.neunet.2026.109020_bib0048","series-title":"Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition","first-page":"3667","article-title":"Blindly assess image quality in the wild guided by a self-adaptive hyper network","author":"Su","year":"2020"},{"key":"10.1016\/j.neunet.2026.109020_bib0049","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013). Intriguing properties of neural networks. arXiv: 1312.6199."},{"key":"10.1016\/j.neunet.2026.109020_bib0050","series-title":"Iclr","article-title":"Ensemble adversarial training: Attacks and defenses","author":"Tram\u00e8r","year":"2018"},{"key":"10.1016\/j.neunet.2026.109020_bib0051","doi-asserted-by":"crossref","first-page":"6886","DOI":"10.1038\/s41598-026-38428-4","article-title":"Query-efficient decision-based adversarial attack with low query budget","volume":"16","author":"Tuo","year":"2026","journal-title":"Scientific Reports"},{"key":"10.1016\/j.neunet.2026.109020_bib0052","series-title":"Advances in neural information processing systems 30: Annual conference on neural information processing systems 2017, december 4\u20139, 2017, long beach, ca, USA","first-page":"5998","article-title":"Attention is all you need","author":"Vaswani","year":"2017"},{"key":"10.1016\/j.neunet.2026.109020_bib0053","series-title":"Aaai","article-title":"Exploring CLIP for assessing the look and feel of images","author":"Wang","year":"2023"},{"key":"10.1016\/j.neunet.2026.109020_bib0054","unstructured":"Wang, J., Sun, K., Cheng, T., Jiang, B., Deng, C., Zhao, Y., Liu, D., Mu, Y., Tan, M., Wang, X., Liu, W., & Xiao, B. (2020). Deep high-resolution representation learning for visual recognition. https:\/\/arxiv.org\/abs\/1908.07919."},{"key":"10.1016\/j.neunet.2026.109020_bib0055","series-title":"Proceedings of the neural information processing systems track on datasets and benchmarks","article-title":"LoveDA: A remote sensing land-cover dataset for domain adaptive semantic segmentation","volume":"vol. 1","author":"Wang","year":"2021"},{"key":"10.1016\/j.neunet.2026.109020_bib0056","series-title":"Iccv","article-title":"Dynamic divide-and-conquer adversarial training for robust semantic segmentation","author":"Xiaogang Xu","year":"2021"},{"key":"10.1016\/j.neunet.2026.109020_bib0057","series-title":"IEEE International conference on computer vision, ICCV 2017, venice, italy, october 22\u201329, 2017","first-page":"1378","article-title":"Adversarial examples for semantic segmentation and object detection","author":"Xie","year":"2017"},{"key":"10.1016\/j.neunet.2026.109020_bib0058","first-page":"12077","article-title":"Segformer: Simple and efficient design for semantic segmentation with transformers","volume":"34","author":"Xie","year":"2021","journal-title":"Advances in Neural Information Processing Systems"},{"issue":"1","key":"10.1016\/j.neunet.2026.109020_bib0059","doi-asserted-by":"crossref","first-page":"36","DOI":"10.1109\/TCSVT.2018.2886771","article-title":"Blind image quality assessment using a deep bilinear convolutional neural network","volume":"30","author":"Zhang","year":"2020","journal-title":"IEEE Transactions on Circuits and Systems for Video Technology"},{"key":"10.1016\/j.neunet.2026.109020_bib0060","series-title":"2017\u202fIEEE Conference on computer vision and pattern recognition, CVPR 2017, honolulu, hi, usa, july 21\u201326, 2017","first-page":"6230","article-title":"Pyramid scene parsing network","author":"Zhao","year":"2017"},{"key":"10.1016\/j.neunet.2026.109020_bib0061","series-title":"2017\u202fIEEE Conference on computer vision and pattern recognition, CVPR 2017, honolulu, hi, usa, july 21\u201326, 2017","first-page":"5122","article-title":"Scene parsing through ADE20K dataset","author":"Zhou","year":"2017"}],"container-title":["Neural Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0893608026004806?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0893608026004806?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,7,3]],"date-time":"2026-07-03T01:17:33Z","timestamp":1783041453000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0893608026004806"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,10]]},"references-count":61,"alternative-id":["S0893608026004806"],"URL":"https:\/\/doi.org\/10.1016\/j.neunet.2026.109020","relation":{},"ISSN":["0893-6080"],"issn-type":[{"value":"0893-6080","type":"print"}],"subject":[],"published":{"date-parts":[[2026,10]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Delving into the adversarial robustness of semantic segmentation with decision-based black-box attacks","name":"articletitle","label":"Article Title"},{"value":"Neural Networks","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.neunet.2026.109020","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier Ltd. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"109020"}}