{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T16:49:49Z","timestamp":1778258989973,"version":"3.51.4"},"reference-count":56,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62472047"],"award-info":[{"award-number":["62472047"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62572068"],"award-info":[{"award-number":["62572068"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62502042"],"award-info":[{"award-number":["62502042"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62572073"],"award-info":[{"award-number":["62572073"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62172055"],"award-info":[{"award-number":["62172055"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"BUPT Excellent Ph.D. Students Foundation","award":["CX2023219"],"award-info":[{"award-number":["CX2023219"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3615475","type":"journal-article","created":{"date-parts":[[2025,9,29]],"date-time":"2025-09-29T17:52:23Z","timestamp":1759168343000},"page":"10495-10510","source":"Crossref","is-referenced-by-count":1,"title":["F2Attack: Two-Factors Scoring Method for Query-Efficient Hard-Label Black-Box Textual Adversarial Attacks"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2552-0726","authenticated-orcid":false,"given":"Jiahui","family":"Wang","sequence":"first","affiliation":[{"name":"State Key Laboratory of Networking and Switching Technology, National Engineering Research Center of Disaster Backup and Recovery, Beijing University of Posts and Telecommunications, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0532-9783","authenticated-orcid":false,"given":"Hua","family":"Zhang","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Networking and Switching Technology, National Engineering Research Center of Disaster Backup and Recovery, Beijing University of Posts and Telecommunications, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yongji","family":"Wang","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Networking and Switching Technology, National Engineering Research Center of Disaster Backup and Recovery, Beijing University of Posts and Telecommunications, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9596-3066","authenticated-orcid":false,"given":"Haoran","family":"Gao","sequence":"additional","affiliation":[{"name":"Artificial Intelligence and Intelligent Operation Center, China Mobile Research Institute, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9855-6119","authenticated-orcid":false,"given":"Qi","family":"Li","sequence":"additional","affiliation":[{"name":"Beijing University of Posts and Telecommunications, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1634-9840","authenticated-orcid":false,"given":"Huiyu","family":"Zhou","sequence":"additional","affiliation":[{"name":"School of Computing and Mathematical Sciences, University of Leicester, Leicester, U.K."}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","first-page":"1","article-title":"Intriguing properties of neural networks","volume-title":"Proc. ICLR","author":"Szegedy"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i4.20303"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1007\/s10462-023-10442-2"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/6631768"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3567592"},{"key":"ref6","article-title":"Towards a robust deep neural network in texts: A survey","author":"Wang","year":"2019","journal-title":"arXiv:1902.07285"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23138"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P19-1103"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i05.6311"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.emnlp-main.771"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i15.17595"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.findings-emnlp.44"},{"key":"ref13","first-page":"51347","article-title":"HQA-attack: Toward high quality black-box hard-label adversarial attack on text","volume-title":"Proc. NeurIPS","author":"Liu"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i11.26553"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i17.29950"},{"key":"ref16","first-page":"4891","article-title":"Towards more practical threat models in artificial intelligence security","volume-title":"Proc. USENIX","author":"Grosse"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.249"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3485832.3485837"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.377"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.431"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.374"},{"key":"ref22","first-page":"1","article-title":"On the feasibility of specialized ability stealing for large language code models","volume-title":"Proc. ICSE","author":"Li"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.540"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2022.119110"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.661"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939778"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/n16-1174"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/N16-1018"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D18-2029"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4419-1576-4_6"},{"key":"ref31","first-page":"142","article-title":"Learning word vectors for sentiment analysis","volume-title":"Proc. 49th Annu. Meeting Assoc. Comput. Linguistics, Hum. Lang. Technol.","author":"Maas"},{"key":"ref32","first-page":"649","article-title":"Character-level convolutional networks for text classification","volume-title":"Proc. NeurIPS","author":"Zhang"},{"key":"ref33","first-page":"1631","article-title":"Recursive deep models for semantic compositionality over a sentiment treebank","volume-title":"Proc. Conf. Empir. Methods Nat. Lang. Process.","author":"Socher"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/d15-1075"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/N18-1101"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1997.9.8.1735"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/d14-1181"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1810.04805"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P17-1152"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/D14-1162"},{"key":"ref41","first-page":"1","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. ICLR","author":"Goodfellow"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2025.3560042"},{"key":"ref43","first-page":"1","article-title":"An LLM can fool itself: A prompt-based adversarial attack","volume-title":"Proc. ICLR","author":"Xu"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1016\/j.hcc.2024.100211"},{"key":"ref45","first-page":"1","article-title":"On the robustness of ChatGPT: An adversarial and Out-of-distribution perspective","volume-title":"Proc. ICLR Workshop","author":"Wang"},{"issue":"140","key":"ref46","first-page":"1","article-title":"Exploring the limits of transfer learning with a unified text-to-text transformer","volume":"21","author":"Raffel","year":"2019","journal-title":"J. Mach. Learn. Res."},{"issue":"70","key":"ref47","first-page":"1","article-title":"Scaling instruction-finetuned language models","volume":"25","author":"Chung","year":"2022","journal-title":"J. Mach. Learn. Res."},{"key":"ref48","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2017","journal-title":"arXiv:1706.06083"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.findings-acl.137"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.680"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P18-2006"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.426"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.acl-long.459"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.acl-long.538"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i14.17533"},{"key":"ref56","first-page":"3319","article-title":"Axiomatic attribution for deep networks","volume-title":"Proc. Int. Conf. Mach. Learn.","volume":"70","author":"Sundararajan"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/11184673.pdf?arnumber=11184673","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,13]],"date-time":"2025-10-13T17:39:59Z","timestamp":1760377199000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11184673\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":56,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3615475","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}