{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,11]],"date-time":"2026-06-11T15:55:05Z","timestamp":1781193305923,"version":"3.54.1"},"reference-count":106,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"3","license":[{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"National Key Research and Development Program of China","award":["2022YFA1004100"],"award-info":[{"award-number":["2022YFA1004100"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Circuits Syst. Video Technol."],"published-print":{"date-parts":[[2026,3]]},"DOI":"10.1109\/tcsvt.2025.3609284","type":"journal-article","created":{"date-parts":[[2025,9,19]],"date-time":"2025-09-19T17:39:04Z","timestamp":1758303544000},"page":"3834-3847","source":"Crossref","is-referenced-by-count":1,"title":["Improving Transferability of Adversarial Examples via Bayesian Attacks"],"prefix":"10.1109","volume":"36","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3977-345X","authenticated-orcid":false,"given":"Qizhang","family":"Li","sequence":"first","affiliation":[{"name":"School of Computer Science and Technology, Harbin Institute of Technology, Harbin, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0709-4877","authenticated-orcid":false,"given":"Yiwen","family":"Guo","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Harbin Institute of Technology, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9299-5951","authenticated-orcid":false,"given":"Xiaochen","family":"Yang","sequence":"additional","affiliation":[{"name":"School of Mathematics and Statistics, University of Glasgow, Glasgow, U.K."}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3330-783X","authenticated-orcid":false,"given":"Wangmeng","family":"Zuo","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Harbin Institute of Technology, Harbin, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4072-0710","authenticated-orcid":false,"given":"Hao","family":"Chen","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of California at Davis, Davis, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3065386"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/1390156.1390177"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TASLP.2014.2339736"},{"key":"ref4","first-page":"1","article-title":"Intriguing properties of neural networks","volume-title":"Proc. ICLR","author":"Szegedy"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2023.3307150"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2024.3351680"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2024.3435865"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2023.3276442"},{"key":"ref9","article-title":"Universal and transferable adversarial attacks on aligned language models","author":"Zou","year":"2023","journal-title":"arXiv:2307.15043"},{"key":"ref10","article-title":"Transferability in machine learning: From phenomena to black-box attacks using adversarial samples","author":"Papernot","year":"2016","journal-title":"arXiv:1605.07277"},{"key":"ref11","first-page":"1","article-title":"Delving into transferable adversarial examples and black-box attacks","volume-title":"Proc. ICLR","author":"Liu"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6810"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01456"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00483"},{"key":"ref15","first-page":"241","article-title":"Yet another intermediate-leve attack","volume-title":"Proc. ECCV","author":"Li"},{"key":"ref16","first-page":"1","article-title":"Rethinking the security of skip connections in resnet-like neural networks","volume-title":"Proc. ICLR","author":"Wu"},{"key":"ref17","first-page":"85","article-title":"Backpropagating linearly improves transferability of adversarial examples","volume-title":"Proc. NeurIPS","author":"Guo"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"ref19","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01585"},{"key":"ref23","article-title":"Nesterov accelerated gradient and scale invariance for adversarial attacks","author":"Lin","year":"2019","journal-title":"arXiv:1908.06281"},{"key":"ref24","first-page":"1","article-title":"Making substitute models more Bayesian can enhance transferability of adversarial examples","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Li"},{"key":"ref25","article-title":"Adversarial patch","author":"Brown","year":"2017","journal-title":"arXiv:1712.09665"},{"key":"ref26","first-page":"1","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. ICLR","author":"Goodfellow"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2025.3546702"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/ICPR48806.2021.9412236"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00790"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58558-7_39"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref32","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang"},{"key":"ref33","article-title":"Countering adversarial images using input transformations","author":"Guo","year":"2017","journal-title":"arXiv:1711.00117"},{"key":"ref34","article-title":"Mitigating adversarial effects through randomization","author":"Xie","year":"2017","journal-title":"arXiv:1711.01991"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2024.3487761"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2024.3502693"},{"key":"ref37","first-page":"1","article-title":"Adversarial machine learning at scale","volume-title":"Proc. ICLR","author":"Kurakin"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref39","article-title":"Transferable adversarial attack based on integrated gradients","author":"Huang","year":"2022","journal-title":"arXiv:2205.13152"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3188044"},{"key":"ref41","first-page":"9759","article-title":"A little robustness goes a long way: Leveraging robust features for targeted transfer attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Springer"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2022.3211736"},{"key":"ref43","article-title":"Deterministic variational inference for robust Bayesian neural networks","author":"Wu","year":"2018","journal-title":"arXiv:1810.03958"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00425"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00437"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02297"},{"key":"ref47","first-page":"738","article-title":"Efficient and transferable adversarial examples from Bayesian neural networks","volume-title":"Proc. Uncertainty Artif. Intell.","author":"Gubri"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19772-7_35"},{"key":"ref49","article-title":"Understanding and enhancing the transferability of adversarial examples","author":"Wu","year":"2018","journal-title":"arXiv:1802.09707"},{"key":"ref50","first-page":"315","article-title":"Accelerating stochastic gradient descent using predictive variance reduction","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"26","author":"Johnson"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.5555\/2986459.2986721"},{"key":"ref52","first-page":"1613","article-title":"Weight uncertainty in neural network","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Blundell"},{"key":"ref53","first-page":"2575","article-title":"Variational dropout and the local reparameterization trick","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"28","author":"Kingma"},{"key":"ref54","first-page":"2611","article-title":"Fast and scalable Bayesian deep learning by weight-perturbation in Adam","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Khan"},{"key":"ref55","first-page":"5852","article-title":"Noisy natural gradient as variational inference","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2022.3199496"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2022.3232112"},{"key":"ref58","first-page":"4287","article-title":"Practical deep learning with Bayesian principles","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Osawa"},{"key":"ref59","first-page":"2782","article-title":"Efficient and scalable Bayesian neural nets with rank-1 factors","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Dusenberry"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.5555\/3045390.3045502"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.5555\/3295222.3295309"},{"key":"ref62","first-page":"3581","article-title":"Concrete dropout","volume-title":"Proc. Adv. neural Inf. Process. Syst.","volume":"30","author":"Gal"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.1611835114"},{"key":"ref64","first-page":"1","article-title":"A scalable Laplace approximation for neural networks","volume-title":"Proc. 6th Int. Conf. Learn. Represent.","author":"Ritter"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.3905\/jfi.2000.319253"},{"key":"ref66","article-title":"Stochastic gradient descent as approximate Bayesian inference","author":"Mandt","year":"2017","journal-title":"arXiv:1704.04289"},{"key":"ref67","first-page":"13132","article-title":"A simple baseline for Bayesian uncertainty in deep learning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Maddox"},{"key":"ref68","first-page":"2737","article-title":"Fast adaptation with linearized neural networks","volume-title":"Proc. Int. Conf. Artif. Intell. Statist.","author":"Maddox"},{"key":"ref69","first-page":"4697","article-title":"Bayesian deep learning and a probabilistic perspective of generalization","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Wilson"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/789"},{"key":"ref71","first-page":"1198","article-title":"Probabilistic safety for Bayesian neural networks","volume-title":"Proc. Conf. Uncertainty Artif. Intell.","author":"Wicker"},{"key":"ref72","article-title":"Adv-BNN: Improved adversarial defense through robust Bayesian neural network","author":"Liu","year":"2018","journal-title":"arXiv:1810.01279"},{"key":"ref73","article-title":"Gradient-free adversarial attacks for Bayesian neural networks","author":"Yuan","year":"2020","journal-title":"arXiv:2012.12640"},{"key":"ref74","first-page":"15602","article-title":"Robustness of Bayesian neural networks to gradient-based attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Carbone"},{"key":"ref75","first-page":"3804","article-title":"Are generative classifiers more robust to adversarial attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Li"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2022.3172845"},{"key":"ref77","article-title":"Sharpness-aware minimization for efficiently improving generalization","author":"Foret","year":"2020","journal-title":"arXiv:2010.01412"},{"key":"ref78","first-page":"1","article-title":"Very deep convolutional networks for large-scale image recognition","volume-title":"Proc. ICLR","author":"Simonyan"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.243"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01167"},{"key":"ref83","article-title":"An image is worth 16\u00d716 words: Transformers for image recognition at scale","author":"Dosovitskiy","year":"2020","journal-title":"arXiv:2010.11929"},{"key":"ref84","first-page":"10347","article-title":"Training data-efficient image transformers & distillation through attention","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Touvron"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00986"},{"key":"ref86","first-page":"1","article-title":"BEiT: BERT pre-training of image transformers","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Bao"},{"key":"ref87","first-page":"24261","article-title":"MLP-mixer: An all-MLP architecture for vision","volume-title":"Proc. 35th Conf. Neural Inf. Process. Syst.","volume":"34","author":"Tolstikhin"},{"key":"ref88","article-title":"Averaging weights leads to wider optima and better generalization","author":"Izmailov","year":"2018","journal-title":"arXiv:1803.05407"},{"key":"ref89","volume-title":"Pytorch Image Models","author":"Wightman","year":"2019"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.5244\/C.30.87"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.634"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.668"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00186"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01457"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.52202\/075280-3073"},{"key":"ref96","first-page":"32900","article-title":"Improving adversarial transferability via intermediate-level perturbation decay","volume-title":"Proc. 37th Conf. Neural Inf. Process. Syst.","author":"Li"},{"key":"ref97","article-title":"Towards good practices in evaluating transfer adversarial attacks","author":"Zhao","year":"2022","journal-title":"arXiv:2211.09565"},{"key":"ref98","article-title":"RobustBench: A standardized adversarial robustness benchmark","author":"Croce","year":"2020","journal-title":"arXiv:2010.09670"},{"key":"ref99","article-title":"Fast is better than free: Revisiting adversarial training","author":"Wong","year":"2020","journal-title":"arXiv:2001.03994"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00090"},{"key":"ref101","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. ICML","author":"Croce"},{"key":"ref102","article-title":"A comprehensive study on robustness of image classification models: Benchmarking and rethinking","author":"Liu","year":"2023","journal-title":"arXiv:2302.14301"},{"key":"ref103","article-title":"Revisiting adversarial training for ImageNet: Architectures, training and generalization across threat models","author":"Singh","year":"2023","journal-title":"arXiv:2303.01870"},{"key":"ref104","first-page":"26831","article-title":"Are transformers more robust than CNNs","volume-title":"Proc. 35th Conf. Neural Inf. Process. Syst.","author":"Bai"},{"key":"ref105","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Cohen"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00034"}],"container-title":["IEEE Transactions on Circuits and Systems for Video Technology"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/76\/11424237\/11174104.pdf?arnumber=11174104","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,9]],"date-time":"2026-03-09T20:00:56Z","timestamp":1773086456000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11174104\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3]]},"references-count":106,"journal-issue":{"issue":"3"},"URL":"https:\/\/doi.org\/10.1109\/tcsvt.2025.3609284","relation":{},"ISSN":["1051-8215","1558-2205"],"issn-type":[{"value":"1051-8215","type":"print"},{"value":"1558-2205","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3]]}}}