{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,18]],"date-time":"2026-01-18T10:16:50Z","timestamp":1768731410090,"version":"3.49.0"},"reference-count":49,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62036005"],"award-info":[{"award-number":["62036005"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["2042020KF0205"],"award-info":[{"award-number":["2042020KF0205"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. on Image Process."],"published-print":{"date-parts":[[2021]]},"DOI":"10.1109\/tip.2021.3092822","type":"journal-article","created":{"date-parts":[[2021,7,2]],"date-time":"2021-07-02T20:08:10Z","timestamp":1625256490000},"page":"6156-6167","source":"Crossref","is-referenced-by-count":13,"title":["Toward Visual Distortion in Black-Box Attacks"],"prefix":"10.1109","volume":"30","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1545-019X","authenticated-orcid":false,"given":"Nannan","family":"Li","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7882-1066","authenticated-orcid":false,"given":"Zhenzhong","family":"Chen","sequence":"additional","affiliation":[]}],"member":"263","reference":[{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/TNN.1998.712192"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00068"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2016.2614187"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2014.2377181"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2016.58"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1016\/j.patrec.2021.03.033"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2003.819861"},{"key":"ref36","article-title":"Intriguing properties of neural networks","author":"szegedy","year":"2014","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00042"},{"key":"ref34","article-title":"Generating natural adversarial examples","author":"zhao","year":"2017","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/543"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2946461"},{"key":"ref2","article-title":"Adversarial machine learning at scale","author":"kurakin","year":"2017","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2925452"},{"key":"ref20","first-page":"3142","article-title":"Nonlinear projection gradient estimation for query efficient blackbox attack","author":"li","year":"2021","journal-title":"Proc Int Conf Artif Intell Statist"},{"key":"ref22","first-page":"3866","article-title":"NATTACK: Learning the distributions of adversarial examples for an improved black-box attack on deep neural networks","author":"li","year":"2019","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref21","article-title":"Black-box adversarial attack with transferable model-based embedding","author":"huang","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref24","article-title":"Transferability in machine learning: From phenomena to black-box attacks using adversarial samples","author":"papernot","year":"2016","journal-title":"arXiv 1605 07277"},{"key":"ref23","first-page":"10932","article-title":"Improving black-box adversarial attacks with a transfer-based prior","author":"cheng","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref26","article-title":"Yet another but more efficient black-box adversarial attack: Tiling and evolution strategies","author":"meunier","year":"2019","journal-title":"arXiv 1910 02244"},{"key":"ref25","first-page":"4636","article-title":"Parsimonious black-box adversarial attacks via efficient combinatorial optimization","author":"moon","year":"2019","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref10","article-title":"Sign bits are all you need for black-box attacks","author":"al-dujaili","year":"2020","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2020.2975918"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/368"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2948146"},{"key":"ref13","article-title":"Explaining and harnessing adversarial examples","author":"goodfellow","year":"2015","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref14","first-page":"10408","article-title":"Functional adversarial attacks","author":"laidlaw","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst (NeurIPS)"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33012253"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2020.3032061"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.3301742"},{"key":"ref19","first-page":"11163","article-title":"Dual-path distillation: A unified framework to improve black-box attacks","author":"zhang","year":"2020","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2807385"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref8","article-title":"Prior convictions: Black-box adversarial attacks with bandits and priors","author":"ilyas","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref7","article-title":"Quantifying perceptual distortion of adversarial examples","author":"jordan","year":"2019","journal-title":"arXiv 1902 08265"},{"key":"ref49","article-title":"Ensemble adversarial training: Attacks and defenses","author":"tram\u00e8r","year":"2018","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1016\/j.jvcir.2007.06.001"},{"key":"ref46","article-title":"Very deep convolutional networks for large-scale image recognition","author":"simonyan","year":"2015","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00745"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00112"},{"key":"ref42","year":"2020","journal-title":"Almost Sure Convergence of SGD on Smooth Non-Convex Functions"},{"key":"ref41","article-title":"On the properties of the Softmax function with application in game theory and reinforcement learning","author":"gao","year":"2017","journal-title":"arXiv 1704 00805"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"}],"container-title":["IEEE Transactions on Image Processing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/83\/9263394\/09472988.pdf?arnumber=9472988","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,5,10]],"date-time":"2022-05-10T14:50:10Z","timestamp":1652194210000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9472988\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021]]},"references-count":49,"URL":"https:\/\/doi.org\/10.1109\/tip.2021.3092822","relation":{},"ISSN":["1057-7149","1941-0042"],"issn-type":[{"value":"1057-7149","type":"print"},{"value":"1941-0042","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021]]}}}