{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,11]],"date-time":"2025-12-11T07:40:32Z","timestamp":1765438832422,"version":"3.44.0"},"reference-count":78,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2024,2,1]],"date-time":"2024-02-01T00:00:00Z","timestamp":1706745600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2024,2,1]],"date-time":"2024-02-01T00:00:00Z","timestamp":1706745600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2024,2,1]],"date-time":"2024-02-01T00:00:00Z","timestamp":1706745600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61977046"],"award-info":[{"award-number":["61977046"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Shanghai Science and Technology Program","award":["22511105600"],"award-info":[{"award-number":["22511105600"]}]},{"name":"Shanghai Municipal Science and Technology Major Project","award":["2021SHZDZX0102"],"award-info":[{"award-number":["2021SHZDZX0102"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Artif. Intell."],"published-print":{"date-parts":[[2024,2]]},"DOI":"10.1109\/tai.2023.3257276","type":"journal-article","created":{"date-parts":[[2023,3,15]],"date-time":"2023-03-15T13:54:28Z","timestamp":1678888468000},"page":"684-697","source":"Crossref","is-referenced-by-count":3,"title":["Query Attack by Multi-Identity Surrogates"],"prefix":"10.1109","volume":"5","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3274-6926","authenticated-orcid":false,"given":"Sizhe","family":"Chen","sequence":"first","affiliation":[{"name":"Department of Automation and Institute of Medical Robotics, Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0739-7528","authenticated-orcid":false,"given":"Zhehao","family":"Huang","sequence":"additional","affiliation":[{"name":"Department of Automation and Institute of Medical Robotics, Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9705-7748","authenticated-orcid":false,"given":"Qinghua","family":"Tao","sequence":"additional","affiliation":[{"name":"ESAT-STADIUS, Katholieke Universiteit Leuven, Leuven, Belgium"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4285-6520","authenticated-orcid":false,"given":"Xiaolin","family":"Huang","sequence":"additional","affiliation":[{"name":"Department of Automation and Institute of Medical Robotics, Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2019.2940533"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2020.3025404"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2021.3118977"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2021.3086596"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2021.3092582"},{"key":"ref6","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Goodfellow","year":"2015"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2019.2936378"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2020.2975918"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2021.3127849"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2021.3050303"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2021.3092822"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2021.3106807"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"ref18","article-title":"Prior convictions: Black-box adversarial attacks with bandits and priors","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Ilyas","year":"2019"},{"key":"ref19","first-page":"10934","article-title":"Improving black-box adversarial attacks with a transfer-based prior","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Cheng","year":"2019"},{"key":"ref20","article-title":"Sign bits are all you need for black-box attacks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Al-Dujaili","year":"2019"},{"key":"ref21","first-page":"2484","article-title":"Simple black-box adversarial attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Guo","year":"2019"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref25","first-page":"3820","article-title":"Subspace attack: Exploiting promising subspaces for query-efficient black-box attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Guo","year":"2019"},{"key":"ref26","article-title":"Query-efficient meta attack to deep neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Du","year":"2019"},{"key":"ref27","first-page":"12288","article-title":"Learning black-box attackers with transferable priors and query feedback","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Yang","year":"2020"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2020.3033291"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2021.108491"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01166"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00031"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"year":"2019","key":"ref33","article-title":"EasyDL: A zero-threshold AI development platform"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.5244\/C.30.87"},{"key":"ref35","article-title":"MNIST handwritten digit database","volume":"2","author":"LeCun","year":"2010"},{"article-title":"Learning multiple layers of features from tiny images","year":"2009","author":"Krizhevsky","key":"ref36"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00293"},{"key":"ref38","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Szegedy","year":"2014"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"ref40","first-page":"85","article-title":"Backpropagating linearly improves transferability of adversarial examples","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Guo","year":"2020"},{"key":"ref41","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Brendel","year":"2018"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00045"},{"key":"ref43","article-title":"Sign-opt: A query-efficient hard-label adversarial attack","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Cheng","year":"2019"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_10"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00044"},{"article-title":"Switching gradient directions for query-efficient black-box adversarial attacks","year":"2020","author":"Ma","key":"ref46"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr52688.2022.01467"},{"key":"ref48","article-title":"Neural architecture search with reinforcement learning","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Zoph","year":"2017"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00907"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33014780"},{"key":"ref51","article-title":"Darts: Differentiable architecture search","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Liu","year":"2019"},{"key":"ref52","article-title":"PC-darts: Partial channel connections for memory-efficient architecture search","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Xu","year":"2020"},{"article-title":"Selection of source images heavily influences the effectiveness of adversarial attacks","year":"2021","author":"Ozbulak","key":"ref53"},{"article-title":"Distilling the knowledge in a neural network","year":"2015","author":"Hinton","key":"ref54"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241142"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00509"},{"key":"ref57","first-page":"2142","article-title":"Black-box adversarial attacks with limited queries and information","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Ilyas","year":"2018"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1007\/s10208-015-9296-2"},{"key":"ref59","first-page":"11163","article-title":"Dual-path distillation: A unified framework to improve black-box attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang","year":"2020"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.243"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46493-0_38"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00186"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.668"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.634"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.5555\/3454287.3455008"},{"year":"2017","key":"ref67","article-title":"Github reposity for image classification by PyTorch"},{"article-title":"Black-box adversarial attacks with Bayesian optimization","year":"2019","author":"Shukla","key":"ref68"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"article-title":"Blacklight: Defending black-box adversarial attacks on deep neural networks","year":"2020","author":"Li","key":"ref70"},{"key":"ref71","first-page":"7650","article-title":"Random noise defense against query-based black-box attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Qin","year":"2021"},{"key":"ref72","first-page":"2023","article-title":"Adversarial attack on attackers: Post-process to mitigate black-box score-based query attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Chen"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/3617895"},{"key":"ref74","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Athalye","year":"2018"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_39"},{"article-title":"Going far boosts attack transferability, but do not do it","year":"2021","author":"Chen","key":"ref76"},{"key":"ref77","first-page":"2314","article-title":"Global optimization of Lipschitz functions","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Malherbe","year":"2017"},{"article-title":"DeepGuiser: Learning to disguise neural architectures for impeding adversarial transfer attacks","year":"2023","author":"Cai","key":"ref78"}],"container-title":["IEEE Transactions on Artificial Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9078688\/10433275\/10070787.pdf?arnumber=10070787","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,23]],"date-time":"2025-08-23T01:08:46Z","timestamp":1755911326000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10070787\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,2]]},"references-count":78,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tai.2023.3257276","relation":{},"ISSN":["2691-4581"],"issn-type":[{"type":"electronic","value":"2691-4581"}],"subject":[],"published":{"date-parts":[[2024,2]]}}}