{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T16:41:24Z","timestamp":1778258484715,"version":"3.51.4"},"reference-count":57,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2021ZD0112804"],"award-info":[{"award-number":["2021ZD0112804"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Science and Technology Commission of Shanghai Municipality Project","award":["21JC1400600"],"award-info":[{"award-number":["21JC1400600"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. on Image Process."],"published-print":{"date-parts":[[2023]]},"DOI":"10.1109\/tip.2023.3331582","type":"journal-article","created":{"date-parts":[[2023,11,15]],"date-time":"2023-11-15T19:14:19Z","timestamp":1700075659000},"page":"6346-6358","source":"Crossref","is-referenced-by-count":14,"title":["Towards Transferable Adversarial Attacks on Image and Video Transformers"],"prefix":"10.1109","volume":"32","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6315-497X","authenticated-orcid":false,"given":"Zhipeng","family":"Wei","sequence":"first","affiliation":[{"name":"Shanghai Key Laboratory of Intelligent Information Processing, School of Computer Science, Fudan University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3148-264X","authenticated-orcid":false,"given":"Jingjing","family":"Chen","sequence":"additional","affiliation":[{"name":"Shanghai Key Laboratory of Intelligent Information Processing, School of Computer Science, Fudan University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8266-2424","authenticated-orcid":false,"given":"Micah","family":"Goldblum","sequence":"additional","affiliation":[{"name":"Center for Data Science, New York University, New York, NY, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zuxuan","family":"Wu","sequence":"additional","affiliation":[{"name":"Shanghai Key Laboratory of Intelligent Information Processing, School of Computer Science, Fudan University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Tom","family":"Goldstein","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Maryland, College Park, MD, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1907-8567","authenticated-orcid":false,"given":"Yu-Gang","family":"Jiang","sequence":"additional","affiliation":[{"name":"Shanghai Key Laboratory of Intelligent Information Processing, School of Computer Science, Fudan University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Larry S.","family":"Davis","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Maryland, College Park, MD, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014","journal-title":"arXiv:1412.6572"},{"key":"ref2","first-page":"1","article-title":"Delving into transferable adversarial examples and black-box attacks","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Liu"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01464"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i3.20168"},{"key":"ref7","first-page":"1","article-title":"An image is worth 16\u00d716 words: Transformers for image recognition at scale","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Dosovitskiy"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"ref9","first-page":"1","article-title":"Nesterov accelerated gradient and scale invariance for adversarial attacks","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Lin"},{"key":"ref10","first-page":"85","article-title":"Backpropagating linearly improves transferability of adversarial examples","volume-title":"Proc. Adv. neural Inf. Process. Syst.","volume":"33","author":"Guo"},{"key":"ref11","first-page":"1","article-title":"Adversarial machine learning at scale","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Kurakin"},{"key":"ref12","article-title":"Improving neural networks by preventing co-adaptation of feature detectors","author":"Hinton","year":"2012","journal-title":"arXiv:1207.0580"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"ref14","article-title":"The kinetics human action video dataset","author":"Kay","year":"2017","journal-title":"arXiv:1705.06950"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i3.20169"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-022-01604-w"},{"key":"ref17","first-page":"1","article-title":"Adversarial examples in the physical world","volume-title":"Proc. Int. Conf. Learn. Represent. Workshop","author":"Kurakin"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01264-9_28"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00124"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.74"},{"key":"ref21","first-page":"1","article-title":"Skip connections matter: On the transferability of adversarial examples generated with ResNets","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Wu"},{"key":"ref22","first-page":"1","article-title":"A unified approach to interpreting and boosting adversarial transferability","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Wang"},{"key":"ref23","first-page":"20791","article-title":"Perturbing across the feature hierarchy to improve standard and strict blackbox attack transferability","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Inkawhich"},{"key":"ref24","first-page":"1","article-title":"Transferable perturbations of deep feature distributions","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Inkawhich"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00761"},{"key":"ref26","first-page":"6115","article-title":"On success and simplicity: A second look at transferable targeted attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Zhao"},{"key":"ref27","first-page":"10347","article-title":"Training data-efficient image transformers & distillation through attention","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Touvron"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00060"},{"key":"ref29","first-page":"15908","article-title":"Transformer in transformer","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Han"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00010"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00009"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01204"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01172"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1088\/1742-5468\/ac9830"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00063"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3512527.3531415"},{"key":"ref37","article-title":"DeepViT: Towards deeper vision transformer","author":"Zhou","year":"2021","journal-title":"arXiv:2103.11886"},{"key":"ref38","article-title":"RobustART: Benchmarking robustness on architecture design and training techniques","author":"Tang","year":"2021","journal-title":"arXiv:2109.05211"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i2.20103"},{"key":"ref40","first-page":"12921","article-title":"Decision-based black-box attack against vision transformers via patch-wise adversarial removal","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Shi"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00675"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00676"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00320"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW54120.2021.00355"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2102.05095"},{"key":"ref46","first-page":"12493","article-title":"Keeping your eye on the ball: Trajectory attention in video transformers","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Patrick"},{"key":"ref47","article-title":"Longformer: The long-document transformer","author":"Beltagy","year":"2020","journal-title":"arXiv:2004.05150"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00986"},{"key":"ref50","first-page":"1","article-title":"On improving adversarial transferability of vision transformers","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Naseer"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref52","first-page":"3519","article-title":"Similarity of neural network representations revisited","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Kornblith"},{"key":"ref53","first-page":"26831","article-title":"Are transformers more robust than CNNs?","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Bai"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.5555\/3298023.3298188"},{"key":"ref55","volume-title":"Pytorch Image Models","author":"Wightman","year":"2019"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01182"},{"key":"ref57","doi-asserted-by":"crossref","first-page":"31","DOI":"10.1017\/CBO9780511528446.003","article-title":"A value for N-person games","volume-title":"The Shapley Value: Essays in Honor of Lloyd S. Shapley","author":"Shapley","year":"1988"}],"container-title":["IEEE Transactions on Image Processing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/83\/9991910\/10319323.pdf?arnumber=10319323","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,3,14]],"date-time":"2024-03-14T02:31:45Z","timestamp":1710383505000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10319323\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023]]},"references-count":57,"URL":"https:\/\/doi.org\/10.1109\/tip.2023.3331582","relation":{},"ISSN":["1057-7149","1941-0042"],"issn-type":[{"value":"1057-7149","type":"print"},{"value":"1941-0042","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023]]}}}