{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T20:20:54Z","timestamp":1792786854456,"version":"4.5.0"},"reference-count":59,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"National Key Research and Development Program of China","award":["2023YFE0116300"],"award-info":[{"award-number":["2023YFE0116300"]}]},{"name":"National Key Research and Development Program of China","award":["2023YFF1105102"],"award-info":[{"award-number":["2023YFF1105102"]}]},{"name":"National Key Research and Development Program of China","award":["2023YFF1105105"],"award-info":[{"award-number":["2023YFF1105105"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62006097"],"award-info":[{"award-number":["62006097"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3620638","type":"journal-article","created":{"date-parts":[[2025,10,13]],"date-time":"2025-10-13T17:39:59Z","timestamp":1760377199000},"page":"10909-10920","source":"Crossref","is-referenced-by-count":1,"title":["Robust Token Gradient and Frequency-Aware Transferable Adversarial Attacks on Vision Transformers"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8473-077X","authenticated-orcid":false,"given":"Cong","family":"Hu","sequence":"first","affiliation":[{"name":"Jiangsu Provincial Laboratory of Pattern Recognition and Computational Intelligence and the School of Artificial Intelligence and Computer Science, Jiangnan University, Wuxi, Jiangsu, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-4716-3193","authenticated-orcid":false,"given":"Zhi-Chao","family":"He","sequence":"additional","affiliation":[{"name":"Jiangsu Provincial Laboratory of Pattern Recognition and Computational Intelligence and the School of Artificial Intelligence and Computer Science, Jiangnan University, Wuxi, Jiangsu, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0731-8885","authenticated-orcid":false,"given":"Yuan-Bo","family":"Li","sequence":"additional","affiliation":[{"name":"Jiangsu Provincial Laboratory of Pattern Recognition and Computational Intelligence and the School of Artificial Intelligence and Computer Science, Jiangnan University, Wuxi, Jiangsu, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0310-5778","authenticated-orcid":false,"given":"Xiao-Jun","family":"Wu","sequence":"additional","affiliation":[{"name":"Jiangsu Provincial Laboratory of Pattern Recognition and Computational Intelligence and the School of Artificial Intelligence and Computer Science, Jiangnan University, Wuxi, Jiangsu, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3337970"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02527"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2024.3375526"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-72952-2_19"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3515814"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2021.3089493"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TGRS.2023.3340566"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2024.3383776"},{"key":"ref9","first-page":"1","article-title":"An image is worth 16\u00d716 words: Transformers for image recognition at scale","volume-title":"Proc. ICLR","author":"Dosovitskiy"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP49359.2023.10222303"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/TIM.2023.3241825"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/TAI.2024.3404910"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3402167"},{"key":"ref14","article-title":"Adversarial token attacks on vision transformers","author":"Joshi","year":"2021","journal-title":"arXiv:2110.04337"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2024.111263"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19775-8_24"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2024.3480519"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02297"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01007"},{"key":"ref20","first-page":"1","article-title":"How do vision transformers work?","volume-title":"Proc. ICLR","author":"Park"},{"key":"ref21","first-page":"1","article-title":"On improving adversarial transferability of vision transformers","volume-title":"Proc. ICLR","author":"Naseer"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i3.27947"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01575"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i3.20169"},{"key":"ref25","article-title":"Enhancing transferable adversarial attacks on vision transformers through gradient normalization scaling and high-frequency adaptation","volume-title":"Proc. ICLR","author":"Zhu"},{"key":"ref26","first-page":"1","article-title":"Towards evaluating the robustness of neural networks learned by transduction","volume-title":"Proc. ICLR","author":"Chen"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i4.28156"},{"key":"ref28","first-page":"1","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. ICLR","author":"Goodfellow"},{"key":"ref29","first-page":"1","article-title":"Intriguing properties of neural networks","volume-title":"Proc. ICLR","author":"Szegedy"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3169802"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2024.120245"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i8.26139"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2023.119918"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref37","first-page":"1","article-title":"Skip connections matter: On the transferability of adversarial examples generated with ResNets","volume-title":"Proc. ICLR","author":"Wu"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00394"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01456"},{"key":"ref40","first-page":"5348","article-title":"Blackbox attacks via surrogate ensemble search","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Cai"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2023.119474"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i7.28541"},{"key":"ref43","first-page":"20887","article-title":"Boosting the transferability of adversarial attack on vision transformer with adaptive token tuning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"37","author":"Ming"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1007\/s10462-023-10595-0"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01172"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00010"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00063"},{"key":"ref48","first-page":"10347","article-title":"Training data-efficient image transformers & distillation through attention","volume-title":"Proc. ICML","author":"Touvron"},{"key":"ref49","first-page":"15908","article-title":"Transformer in transformer","volume-title":"Proc. NeurIPS","author":"Han"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01204"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1088\/1742-5468\/ac9830"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01173"},{"key":"ref53","first-page":"1","article-title":"Discrete representations strengthen vision transformer robustness","volume-title":"Proc. ICLR","author":"Mao"},{"key":"ref54","first-page":"7520","article-title":"Enhance the visual representation via discrete adversarial training","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Mao"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v31i1.11231"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref58","first-page":"22844","article-title":"A2: Efficient automated attacker for boosting adversarial training","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Xu"},{"key":"ref59","first-page":"16805","article-title":"Diffusion models for adversarial purification","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","author":"Nie"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/11202177.pdf?arnumber=11202177","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,27]],"date-time":"2025-10-27T17:57:06Z","timestamp":1761587826000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11202177\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":59,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3620638","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}