{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,22]],"date-time":"2026-07-22T16:30:52Z","timestamp":1784737852517,"version":"3.55.0"},"reference-count":83,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Alibaba Group through Alibaba Research Intern Program"},{"DOI":"10.13039\/501100001809","name":"Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62102386"],"award-info":[{"award-number":["62102386"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. on Image Process."],"published-print":{"date-parts":[[2022]]},"DOI":"10.1109\/tip.2022.3211736","type":"journal-article","created":{"date-parts":[[2022,10,12]],"date-time":"2022-10-12T19:45:56Z","timestamp":1665603956000},"page":"6487-6501","source":"Crossref","is-referenced-by-count":71,"title":["Toward Understanding and Boosting Adversarial Transferability From a Distribution Perspective"],"prefix":"10.1109","volume":"31","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0991-1970","authenticated-orcid":false,"given":"Yao","family":"Zhu","sequence":"first","affiliation":[{"name":"College of Biomedical Engineering and Instrument Science, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yuefeng","family":"Chen","sequence":"additional","affiliation":[{"name":"Security Department of Alibaba Group, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaodan","family":"Li","sequence":"additional","affiliation":[{"name":"Security Department of Alibaba Group, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9868-3414","authenticated-orcid":false,"given":"Kejiang","family":"Chen","sequence":"additional","affiliation":[{"name":"CAS Key Laboratory of Electro-Magnetic Space Information, University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6885-1341","authenticated-orcid":false,"given":"Yuan","family":"He","sequence":"additional","affiliation":[{"name":"Security Department of Alibaba Group, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiang","family":"Tian","sequence":"additional","affiliation":[{"name":"College of Biomedical Engineering and Instrument Science, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8788-1725","authenticated-orcid":false,"given":"Bolun","family":"Zheng","sequence":"additional","affiliation":[{"name":"Zhejiang Provincial Key Laboratory for Network Multimedia Technologies, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6037-0631","authenticated-orcid":false,"given":"Yaowu","family":"Chen","sequence":"additional","affiliation":[{"name":"College of Biomedical Engineering and Instrument Science, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7542-296X","authenticated-orcid":false,"given":"Qingming","family":"Huang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, University of Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2015.2395951"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3073823"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3111766"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3076287"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/IROS40897.2019.8968565"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2018.00062"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.3039045"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3082303"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3116438"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1021\/ct2009208"},{"key":"ref11","first-page":"1","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Goodfellow"},{"key":"ref12","first-page":"1","article-title":"Delving into transferable adversarial examples and black-box attacks","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Liu"},{"key":"ref13","first-page":"1","article-title":"Skip connections matter: On the transferability of adversarial examples generated with ResNets","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Wu"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_39"},{"key":"ref15","first-page":"837","article-title":"Towards understanding and improving the transferability of adversarial examples in deep neural networks","volume-title":"Proc. Asian Conf. Mach. Learn.","author":"Wu"},{"key":"ref16","first-page":"17642","article-title":"TRS: Transferability reduced ensemble via encouraging gradient diversity and model smoothness","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Yang"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref18","first-page":"1","article-title":"Nesterov accelerated gradient and scale invariance for adversarial attacks","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Lin"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01585"},{"key":"ref20","first-page":"12905","article-title":"Cross-domain transferability of adversarial perturbations","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Naseer"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00761"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00483"},{"key":"ref23","first-page":"2215","article-title":"On calibration and out-of-domain generalization","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Wald"},{"key":"ref24","first-page":"1","article-title":"Understanding the failure modes of out-of-distribution generalization","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Nagarajan"},{"issue":"24","key":"ref25","first-page":"695","article-title":"Estimation of non-normalized statistical models by score matching","volume":"6","author":"Hyv\u00e4rinen","year":"2005","journal-title":"J. Mach. Learn. Res."},{"key":"ref26","first-page":"574","article-title":"Sliced score matching: A scalable approach to density and score estimation","volume-title":"Uncertainty in Artificial Intelligence","author":"Song","year":"2020"},{"key":"ref27","first-page":"11918","article-title":"Generative modeling by estimating gradients of the data distribution","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Song"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00763"},{"key":"ref29","first-page":"21464","article-title":"Energy-based out-of-distribution detection","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Liu"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.3036801"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/ICPR48806.2021.9412236"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.3002390"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2020.107332"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1126\/science.aaw4399"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3116438"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2018.8462693"},{"key":"ref37","article-title":"Fooling a real car with adversarial traffic signs","author":"Morgulis","year":"2019","journal-title":"arXiv:1907.00374"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/ICESS.2019.8782514"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref42","article-title":"Maximal jacobian-based saliency map attack","author":"Wiyatno","year":"2018","journal-title":"arXiv:1808.07945"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00790"},{"key":"ref47","first-page":"12288","article-title":"Learning black-box attackers with transferable priors and query feedback","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Yang"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"ref50","first-page":"1","article-title":"A unified approach to interpreting and boosting adversarial transferability","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Wang"},{"key":"ref51","first-page":"85","article-title":"Backpropagating linearly improves transferability of adversarial examples","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Guo"},{"key":"ref52","first-page":"6115","article-title":"On success and simplicity: A second look at transferable targeted attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Zhao"},{"key":"ref53","first-page":"13950","article-title":"Learning transferable adversarial perturbations","volume-title":"Proc. 35th Conf. Neural Inf. Process. Syst.","author":"Kanth Nakka"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00465"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00084"},{"key":"ref56","first-page":"1","article-title":"A tutorial on energy-based learning","volume":"1","author":"LeCun","year":"2006","journal-title":"Predicting Structured Data"},{"key":"ref57","first-page":"681","article-title":"Bayesian learning via stochastic gradient Langevin dynamics","volume-title":"Proc. 28th Int. Conf. Mach. Learn.","author":"Welling"},{"issue":"4","key":"ref58","first-page":"1","article-title":"Estimation of non-normalized statistical models by score matching","volume":"6","author":"Hyv\u00e4rinen","year":"2005","journal-title":"J. Mach. Learn. Res."},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1080\/03610918908812806"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"ref61","first-page":"5389","article-title":"Do ImageNet classifiers generalize to ImageNet?","volume-title":"Proc. ICML","author":"Recht"},{"key":"ref62","article-title":"Very deep convolutional networks for large-scale image recognition","author":"Simonyan","year":"2014","journal-title":"arXiv:1409.1556"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr.2016.90"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.243"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00745"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.5244\/C.30.87"},{"key":"ref67","article-title":"SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and <0.5MB model size","author":"Iandola","year":"2016","journal-title":"arXiv:1602.07360"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01264-9_8"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v31i1.11231"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.5555\/3454287.3455008"},{"key":"ref72","first-page":"1","article-title":"An image is worth 16\u00d716 words: Transformers for image recognition at scale","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Dosovitskiy"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00277"},{"key":"ref74","first-page":"1","article-title":"ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Geirhos"},{"key":"ref75","first-page":"1","article-title":"AugMix: A simple method to improve robustness and uncertainty under data shift","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Hendrycks"},{"key":"ref76","first-page":"1","article-title":"Boosting transferability of targeted adversarial examples via hierarchical generative networks","volume":"abs\/2107.01809","author":"Yang","year":"2021","journal-title":"CoRR"},{"key":"ref77","first-page":"1","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Brendel"},{"key":"ref78","first-page":"2137","article-title":"Black-box adversarial attacks with limited queries and information","volume-title":"Proc. 35th Int. Conf. Mach. Learn.","author":"Ilyas"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-00296-0_5"},{"key":"ref80","first-page":"677","article-title":"On the importance of gradients for detecting distributional shifts in the wild","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Huang"},{"key":"ref81","first-page":"6665","article-title":"Fast autoaugment","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NeurIPS)","author":"Lim"},{"key":"ref82","article-title":"MEAL v2: Boosting vanilla ResNet-50 to 80%+ top-1 accuracy on ImageNet without tricks","author":"Shen","year":"2020","journal-title":"arXiv:2009.08453"},{"key":"ref83","first-page":"2579","article-title":"Visualizing data using t-SNE","volume":"9","author":"van der Maaten","year":"2008","journal-title":"J. Mach. Learn. Res."}],"container-title":["IEEE Transactions on Image Processing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/83\/9626658\/09917370.pdf?arnumber=9917370","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,1,15]],"date-time":"2025-01-15T20:27:23Z","timestamp":1736972843000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9917370\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022]]},"references-count":83,"URL":"https:\/\/doi.org\/10.1109\/tip.2022.3211736","relation":{},"ISSN":["1057-7149","1941-0042"],"issn-type":[{"value":"1057-7149","type":"print"},{"value":"1941-0042","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022]]}}}