{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,6]],"date-time":"2026-01-06T18:40:51Z","timestamp":1767724851329,"version":"3.48.0"},"reference-count":68,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2022YFB3102100"],"award-info":[{"award-number":["2022YFB3102100"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62476250"],"award-info":[{"award-number":["62476250"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62506339"],"award-info":[{"award-number":["62506339"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62472335"],"award-info":[{"award-number":["62472335"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62372137"],"award-info":[{"award-number":["62372137"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Zhejiang Provincial Natural Science Foundation of China","award":["LQN25F010018"],"award-info":[{"award-number":["LQN25F010018"]}]},{"DOI":"10.13039\/501100002481","name":"Postgraduate Research and Innovation Foundation of Zhejiang University of Science and Technology","doi-asserted-by":"publisher","award":["LQN25F010018"],"award-info":[{"award-number":["LQN25F010018"]}],"id":[{"id":"10.13039\/501100002481","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002481","name":"Postgraduate Research and Innovation Foundation of Zhejiang University of Science and Technology","doi-asserted-by":"publisher","award":["2024yjskc19"],"award-info":[{"award-number":["2024yjskc19"]}],"id":[{"id":"10.13039\/501100002481","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/tifs.2025.3648873","type":"journal-article","created":{"date-parts":[[2025,12,26]],"date-time":"2025-12-26T18:23:11Z","timestamp":1766773391000},"page":"592-607","source":"Crossref","is-referenced-by-count":0,"title":["Exploiting Shared Adversarial Features for Dynamic Attacks in Large Vision-Language Models"],"prefix":"10.1109","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4056-9755","authenticated-orcid":false,"given":"Yaguan","family":"Qian","sequence":"first","affiliation":[{"name":"School of Artificial Intelligence and Information Engineering, Zhejiang University of Science and Technology, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-7543-2892","authenticated-orcid":false,"given":"Xucheng","family":"Zhu","sequence":"additional","affiliation":[{"name":"School of Artificial Intelligence and Information Engineering, Zhejiang University of Science and Technology, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-1703-6090","authenticated-orcid":false,"given":"Qiqi","family":"Bao","sequence":"additional","affiliation":[{"name":"School of Artificial Intelligence and Information Engineering, Zhejiang University of Science and Technology, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8970-6269","authenticated-orcid":false,"given":"Fei","family":"Yu","sequence":"additional","affiliation":[{"name":"School of Electronic and Information Engineering, Liaoning University of Technology, Jinzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4268-372X","authenticated-orcid":false,"given":"Shouling","family":"Ji","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7546-852X","authenticated-orcid":false,"given":"Zhaoquan","family":"Gu","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5974-1589","authenticated-orcid":false,"given":"Wei","family":"Wang","sequence":"additional","affiliation":[{"name":"Ministry of Education Key Laboratory for Intelligent Networks and Network Security, Xi’an Jiaotong University, Xi’an, China"}]},{"given":"Bin","family":"Wang","sequence":"additional","affiliation":[{"name":"Zhejiang Key Laboratory of Artificial Intelligence of Things (AIoT) Network and Data Security, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0791-189X","authenticated-orcid":false,"given":"Zhen","family":"Lei","sequence":"additional","affiliation":[{"name":"Center for Biometrics and Security Research and the National Laboratory of Pattern Recognition, Institute of Automation, Chinese Academy of Sciences, Beijing, China"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.emnlp-main.488"},{"key":"ref2","first-page":"19730","article-title":"BLIP-2: Bootstrapping language-image pre-training with frozen image encoders and large language models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Li"},{"key":"ref3","article-title":"MiniGPT-v2: Large language model as a unified interface for vision-language multi-task learning","author":"Chen","year":"2023","journal-title":"arXiv:2310.09478"},{"key":"ref4","article-title":"Qwen-VL: A versatile vision-language model for understanding, localization, text reading, and beyond","author":"Bai","year":"2023","journal-title":"arXiv:2308.12966"},{"key":"ref5","article-title":"InstructBLIP: Towards general-purpose vision-language models with instruction tuning","author":"Dai","year":"2023","journal-title":"arXiv:2305.06500"},{"key":"ref6","first-page":"34892","article-title":"Visual instruction tuning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Liu"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02325"},{"key":"ref8","article-title":"Inducing high energy-latency of large vision-language models with verbose images","author":"Gao","year":"2024","journal-title":"arXiv:2401.11170"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02288"},{"key":"ref10","first-page":"61478","article-title":"Are aligned neural networks adversarially aligned?","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Carlini"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW60793.2023.00395"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/iccv51070.2023.00416"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02291"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02297"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00016"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-72998-0_25"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2025.3601232"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01457"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3664647.3680779"},{"key":"ref21","first-page":"54111","article-title":"On evaluating adversarial robustness of large vision-language models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zhao"},{"key":"ref22","article-title":"Transfer attack for bad and good: Explain and boost adversarial transferability across multimodal large language models","author":"Cheng","year":"2024","journal-title":"arXiv:2405.20090"},{"key":"ref23","first-page":"8748","article-title":"Learning transferable visual models from natural language supervision","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Radford"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01855"},{"key":"ref25","article-title":"LLaMA: Open and efficient foundation language models","author":"Touvron","year":"2023","journal-title":"arXiv:2302.13971"},{"key":"ref26","article-title":"Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context","author":"Georgiev","year":"2024","journal-title":"arXiv:2403.05530"},{"key":"ref27","article-title":"DeepSeek-r1: Incentivizing reasoning capability in LLMs via reinforcement learning","author":"Guo","year":"2025","journal-title":"arXiv:2501.12948"},{"key":"ref28","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2013","journal-title":"arXiv:1312.6199"},{"key":"ref29","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014","journal-title":"arXiv:1412.6572"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"ref31","first-page":"1","article-title":"Improving adversarial robustness requires revisiting misclassified examples","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Wang"},{"key":"ref32","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00414"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01264-9_28"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00483"},{"key":"ref36","article-title":"Task-generalizable adversarial attack based on perceptual metric","author":"Naseer","year":"2018","journal-title":"arXiv:1811.09020"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00816"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/3503161.3547801"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3626772.3657781"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1007\/s44267-024-00066-7"},{"key":"ref41","article-title":"X-transfer attacks: Towards super transferable adversarial attacks on CLIP","author":"Huang","year":"2025","journal-title":"arXiv:2505.05528"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00124"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.blackboxnlp-1.14"},{"key":"ref45","article-title":"Not just a black box: Learning important features through propagating activation differences","author":"Shrikumar","year":"2016","journal-title":"arXiv:1605.01713"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-44781-0_8"},{"key":"ref47","first-page":"3319","article-title":"Axiomatic attribution for deep networks","volume-title":"Proc. Int. Conf. Mach. Learn.","volume":"70","author":"Sundararajan"},{"key":"ref48","article-title":"How important is a neuron?","author":"Dhamdhere","year":"2018","journal-title":"arXiv:1805.12233"},{"key":"ref49","article-title":"Nesterov accelerated gradient and scale invariance for adversarial attacks","author":"Lin","year":"2019","journal-title":"arXiv:1908.06281"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19772-7_32"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01585"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3430508"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.670"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01851"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00331"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i7.28499"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-016-0965-7"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10602-1_48"},{"key":"ref59","first-page":"46595","article-title":"Judging LLM-as-a-judge with MT-bench and chatbot arena","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zheng"},{"key":"ref60","article-title":"OPT: Open pre-trained transformer language models","author":"Zhang","year":"2022","journal-title":"arXiv:2205.01068"},{"issue":"140","key":"ref61","first-page":"1","article-title":"Exploring the limits of transfer learning with a unified text-to-text transformer","volume":"21","author":"Raffel","year":"2019","journal-title":"J. Mach. Learn. Res."},{"volume-title":"Vicuna: An Open-Source Chatbot Impressing Gpt-4 With 90%* ChatGPT Quality","year":"2023","author":"Chiang et al","key":"ref62"},{"key":"ref63","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2017","journal-title":"arXiv:1706.06083"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.279"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00632"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref67","article-title":"An image is worth 16\u00d716 words: Transformers for image recognition at scale","author":"Dosovitskiy","year":"2020","journal-title":"arXiv:2010.11929"},{"key":"ref68","first-page":"1","article-title":"When do universal image jailbreaks transfer between vision-language models?","volume-title":"Proc. 3rd Workshop New Frontiers Adversarial Mach. Learn.","author":"Schaeffer"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/11313711\/11316517.pdf?arnumber=11316517","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,6]],"date-time":"2026-01-06T18:34:44Z","timestamp":1767724484000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11316517\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":68,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3648873","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"type":"print","value":"1556-6013"},{"type":"electronic","value":"1556-6021"}],"subject":[],"published":{"date-parts":[[2026]]}}}