{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,15]],"date-time":"2025-11-15T07:12:59Z","timestamp":1763190779627,"version":"3.45.0"},"reference-count":60,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"the Japan Society for the Promotion of Science (JSPS) KAKENHI","award":["JP21H04907","JP24H00732"],"award-info":[{"award-number":["JP21H04907","JP24H00732"]}]},{"name":"the Japan Science and Technology Agency (JST) CREST through Advanced Integrated Intelligence Platform Project (AIP) Challenge Program","award":["JPMJCR20D3","JPMJCR2562"],"award-info":[{"award-number":["JPMJCR20D3","JPMJCR2562"]}]},{"name":"JST AIP Acceleration","award":["JPMJCR24U3"],"award-info":[{"award-number":["JPMJCR24U3"]}]},{"name":"JST K Program","award":["JPMJKP24C2"],"award-info":[{"award-number":["JPMJKP24C2"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3630890","type":"journal-article","created":{"date-parts":[[2025,11,10]],"date-time":"2025-11-10T18:46:50Z","timestamp":1762800410000},"page":"12080-12095","source":"Crossref","is-referenced-by-count":0,"title":["GreedyPixel: Fine-Grained Black-Box Adversarial Attack via Greedy Algorithm"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-0498-2712","authenticated-orcid":false,"given":"Hanrui","family":"Wang","sequence":"first","affiliation":[{"name":"Echizen Laboratory, National Institute of Informatics (NII), Tokyo, Japan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7723-4591","authenticated-orcid":false,"given":"Ching-Chun","family":"Chang","sequence":"additional","affiliation":[{"name":"Echizen Laboratory, National Institute of Informatics (NII), Tokyo, Japan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5900-0019","authenticated-orcid":false,"given":"Chun-Shien","family":"Lu","sequence":"additional","affiliation":[{"name":"Institute of Information Science, Academia Sinica, Taipei, Taiwan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4388-0517","authenticated-orcid":false,"given":"Christopher","family":"Leckie","sequence":"additional","affiliation":[{"name":"School of Computing and Information Systems, The University of Melbourne, Parkville, VIC, Australia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4908-1860","authenticated-orcid":false,"given":"Isao","family":"Echizen","sequence":"additional","affiliation":[{"name":"Echizen Laboratory, National Institute of Informatics (NII), Tokyo, Japan"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00482"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/S2589-7500(19)30123-2"},{"key":"ref3","first-page":"8748","article-title":"Learning transferable visual models from natural language supervision","volume-title":"Proc. Int. Conf. Mach. Learn.","volume":"139","author":"Radford"},{"key":"ref4","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014","journal-title":"arXiv:1412.6572"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref7","first-page":"11226","article-title":"Greedyfool: Distortion-aware sparse adversarial attack","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Dong"},{"key":"ref8","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref9","first-page":"4636","article-title":"Parsimonious black-box adversarial attacks via efficient combinatorial optimization","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","author":"Moon"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3394171.3413703"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/CEC45853.2021.9504790"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"article-title":"Brusleattack: Query-efficient score-based sparse adversarial attack","volume-title":"Proc. The 12th Int. Conf. Learn. Represent. (ICLR)","author":"Vo","key":"ref14"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01488"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19772-7_32"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3411921"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3632293"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00754"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i4.28133"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52734.2025.01786"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2025.3574989"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00416"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3430508"},{"key":"ref25","first-page":"5348","article-title":"Blackbox attacks via surrogate ensemble search","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NeurIPS)","author":"Cai"},{"article-title":"Attacking deep networks with surrogate-based adversarial black-box methods is easy","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Lord","key":"ref26"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/WACV57701.2024.00394"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01467"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3194988"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i4.28156"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3390609"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/72.279181"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1162\/neco.2006.18.7.1527"},{"article-title":"Ensemble adversarial training: Attacks and defenses","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Tram\u00e8r","key":"ref34"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511814075"},{"article-title":"Learning multiple layers of features from tiny images","year":"2009","author":"Krizhevsky","key":"ref36"},{"volume-title":"NIPS 2017: Defense Against Adversarial Attack","year":"2017","author":"Alex","key":"ref37"},{"article-title":"RobustBench: A standardized adversarial robustness benchmark","volume-title":"Proc. Conf. Neural Inf. Process. Syst. Datasets Benchmarks Track","author":"Croce","key":"ref38"},{"key":"ref39","article-title":"Visual transformers: Token-based image representation and processing for computer vision","author":"Wu","year":"2020","journal-title":"arXiv:2006.03677"},{"article-title":"Very deep convolutional networks for large-scale image recognition","volume-title":"Proc. 3rd Int. Conf. Learn. Represent. (ICLR)","author":"Simonyan","key":"ref40"},{"key":"ref41","first-page":"36246","article-title":"Better diffusion models further improve adversarial training","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","author":"Wang"},{"key":"ref42","first-page":"3046","article-title":"Adversarial robustness limits via scaling-law and human-alignment studies","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","author":"Bartoldson"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/SaTML54575.2023.00024"},{"article-title":"Fast is better than free: Revisiting adversarial training","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Wong","key":"ref44"},{"key":"ref45","first-page":"4218","article-title":"Improving robustness using generated data","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NeurIPS)","volume":"34","author":"Gowal"},{"key":"ref46","article-title":"Robust principles: Architectural design principles for adversarially robust CNNs","author":"Peng","year":"2023","journal-title":"arXiv:2308.16258"},{"key":"ref47","article-title":"Revisiting adversarial training for ImageNet: Architectures, training and generalization across threat models","author":"Singh","year":"2023","journal-title":"arXiv:2303.01870"},{"key":"ref48","article-title":"A comprehensive study on robustness of image classification models: Benchmarking and rethinking","author":"Liu","year":"2023","journal-title":"arXiv:2302.14301"},{"key":"ref49","first-page":"3533","article-title":"Do adversarially robust ImageNet models transfer better?","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NeurIPS)","volume":"33","author":"Salman"},{"key":"ref50","first-page":"16805","article-title":"Diffusion models for adversarial purification","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","author":"Nie"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134057"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2003.819861"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00068"},{"key":"ref54","article-title":"Adversarial robustness toolbox v1.2.0","author":"Nicolae","year":"2018","journal-title":"arXiv:1807.01069"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/JRPROC.1954.274620"},{"key":"ref56","article-title":"Adversarial patch","author":"Brown","year":"2017","journal-title":"arXiv:1712.09665"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"article-title":"Spatially transformed adversarial examples","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Xiao","key":"ref58"},{"volume-title":"Google Cloud Vision Api Documentation","year":"2025","key":"ref59"},{"volume-title":"Amazon Rekognition Api Documentation","year":"2025","key":"ref60"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/11236434.pdf?arnumber=11236434","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,15]],"date-time":"2025-11-15T07:09:00Z","timestamp":1763190540000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11236434\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":60,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3630890","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"type":"print","value":"1556-6013"},{"type":"electronic","value":"1556-6021"}],"subject":[],"published":{"date-parts":[[2025]]}}}