{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,7]],"date-time":"2026-07-07T15:57:29Z","timestamp":1783439849230,"version":"3.54.6"},"reference-count":61,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"Zhongguancun Laboratory"},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62272018"],"award-info":[{"award-number":["62272018"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62206184"],"award-info":[{"award-number":["62206184"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. on Image Process."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tip.2025.3586485","type":"journal-article","created":{"date-parts":[[2025,7,14]],"date-time":"2025-07-14T17:44:54Z","timestamp":1752515094000},"page":"4426-4439","source":"Crossref","is-referenced-by-count":3,"title":["MAP: Masked Adversarial Perturbation for Boosting Black-Box Attack Transferability"],"prefix":"10.1109","volume":"34","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1716-4381","authenticated-orcid":false,"given":"Kaige","family":"Li","sequence":"first","affiliation":[{"name":"State Key Laboratory of Virtual Reality Technology and Systems, Beihang University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-5396-0185","authenticated-orcid":false,"given":"Maoxian","family":"Wan","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Virtual Reality Technology and Systems, Beihang University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0046-5794","authenticated-orcid":false,"given":"Qichuan","family":"Geng","sequence":"additional","affiliation":[{"name":"Information Engineering College, Capital Normal University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-2344-1025","authenticated-orcid":false,"given":"Weimin","family":"Shi","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Virtual Reality Technology and Systems, Beihang University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7141-708X","authenticated-orcid":false,"given":"Xiaochun","family":"Cao","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Technology, Sun Yat-sen University, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5825-7517","authenticated-orcid":false,"given":"Zhong","family":"Zhou","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Virtual Reality Technology and Systems, Beihang University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.5555\/3298023.3298188"},{"key":"ref4","first-page":"1","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Goodfellow"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00437"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2023.3315550"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref8","first-page":"70141","article-title":"Boosting adversarial transferability by achieving flat local maxima","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"36","author":"Ge"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref11","first-page":"1","article-title":"An image is worth 16\u00d716 words: Transformers for image recognition at scale","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Dosovitskiy"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00196"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19772-7_32"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02297"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00425"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01264-9_28"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2022\/233"},{"key":"ref18","first-page":"1905","article-title":"Rethinking the backward propagation for adversarial transferability","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"36","author":"Xiaosen"},{"key":"ref19","first-page":"1","article-title":"Skip connections matter: On the transferability of adversarial examples generated with resnets","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Wu"},{"key":"ref20","first-page":"1","article-title":"Delving into transferable adversarial examples and black-box attacks","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Liu"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00414"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"ref23","article-title":"Transferable adversarial examples with Bayes approach","author":"Fan","year":"2022","journal-title":"arXiv:2208.06538"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01553"},{"issue":"1","key":"ref25","first-page":"1929","article-title":"Dropout: A simple way to prevent neural networks from overfitting","volume":"15","author":"Srivastava","year":"2014","journal-title":"J. Mach. Learn. Res."},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00279"},{"key":"ref27","first-page":"1","article-title":"Self-normalizing neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"30","author":"Klambauer"},{"key":"ref28","first-page":"1","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Szegedy"},{"key":"ref29","article-title":"Improving the transferability of adversarial examples with restructure embedded patches","author":"Zhou","year":"2022","journal-title":"arXiv:2204.12680"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02301"},{"key":"ref31","first-page":"12921","article-title":"Decision-based black-box attack against vision transformers via patch-wise adversarial removal","volume-title":"Proc. NeurIPS","volume":"35","author":"Shi"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3169802"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2022.109037"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2024.3502693"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3411921"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i7.28541"},{"key":"ref37","first-page":"1","article-title":"Fast is better than free: Revisiting adversarial training","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Wong"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00034"},{"key":"ref40","first-page":"1","article-title":"Diffusion models for adversarial purification","volume-title":"Proc. ICML","author":"Nie"},{"key":"ref41","first-page":"1","article-title":"Mitigating adversarial effects through randomization","volume-title":"Proc. ICLR","author":"Xie"},{"key":"ref42","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Cohen"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01481"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.5244\/C.35.186"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i3.20279"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i4.28133"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02291"},{"key":"ref49","first-page":"1","article-title":"Transferable adversarial attack based on integrated gradients","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Huang"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.634"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.243"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01172"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00063"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00986"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20053-3_27"},{"key":"ref56","article-title":"Separable self-attention for mobile vision transformers","author":"Mehta","year":"2022","journal-title":"arXiv:2206.02680"},{"key":"ref57","first-page":"24261","article-title":"MLP-Mixer: An all-MLP architecture for vision","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Tolstikhin"},{"key":"ref58","article-title":"MambaOut: Do we really need mamba for vision?","author":"Yu","year":"2024","journal-title":"arXiv:2405.07992"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.74"},{"key":"ref60","first-page":"5301","article-title":"On the spectral bias of neural networks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Rahaman"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00138"}],"container-title":["IEEE Transactions on Image Processing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/83\/10795784\/11079882.pdf?arnumber=11079882","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,26]],"date-time":"2025-07-26T06:31:19Z","timestamp":1753511479000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11079882\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":61,"URL":"https:\/\/doi.org\/10.1109\/tip.2025.3586485","relation":{},"ISSN":["1057-7149","1941-0042"],"issn-type":[{"value":"1057-7149","type":"print"},{"value":"1941-0042","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}