{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,25]],"date-time":"2026-07-25T02:19:02Z","timestamp":1784945942889,"version":"3.55.0"},"reference-count":76,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62162067"],"award-info":[{"award-number":["62162067"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62101480"],"award-info":[{"award-number":["62101480"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001381","name":"National Research Foundation Singapore","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001381","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100008629","name":"Info-communications Media Development Authority","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100008629","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Trust Tech Funding Initiative"},{"name":"ABC Pte Ltd."},{"name":"XYZ association"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Multimedia"],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tmm.2025.3535328","type":"journal-article","created":{"date-parts":[[2025,1,27]],"date-time":"2025-01-27T18:54:42Z","timestamp":1738004082000},"page":"2666-2681","source":"Crossref","is-referenced-by-count":4,"title":["STBA: Towards Evaluating the Robustness of DNNs for Query-Limited Black-Box Scenario"],"prefix":"10.1109","volume":"27","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7121-1257","authenticated-orcid":false,"given":"Renyang","family":"Liu","sequence":"first","affiliation":[{"name":"School of Information Science and Engineering, Yunnan University, Kunming, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7479-7970","authenticated-orcid":false,"given":"Kwok-Yan","family":"Lam","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5881-9436","authenticated-orcid":false,"given":"Wei","family":"Zhou","sequence":"additional","affiliation":[{"name":"School of Software and the Engineering Research Center of Cyberspace, Yunnan University, Kunming, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7278-8720","authenticated-orcid":false,"given":"Sixing","family":"Wu","sequence":"additional","affiliation":[{"name":"School of Software and the Engineering Research Center of Cyberspace, Yunnan University, Kunming, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3004-7091","authenticated-orcid":false,"given":"Jun","family":"Zhao","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dongting","family":"Hu","sequence":"additional","affiliation":[{"name":"Melbourne Centre for Data Science, School of Mathematics and Statistics, University of Melbourne, Parkville, VIC, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7147-5589","authenticated-orcid":false,"given":"Mingming","family":"Gong","sequence":"additional","affiliation":[{"name":"Melbourne Centre for Data Science, School of Mathematics and Statistics, University of Melbourne, Parkville, VIC, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"ref2","article-title":"AdvFlow: Inconspicuous black-box adversarial attacks using normalizing flows","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Dolatabadi","year":"2020"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i6.20595"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3512527.3531399"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2022.109037"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i4.28156"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3530836"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2023.3341170"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3186918"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2022.3232030"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1007\/s11633-019-1211-x"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2021.3097506"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2021.3124083"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/tmm.2022.3216115"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3402446"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2021.3117124"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3390609"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00473"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2021.3116426"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1016\/j.engappai.2022.105469"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2022.3173533"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2021.3108009"},{"key":"ref25","first-page":"3866","article-title":"NATTACK: Learning the distributions of adversarial examples for an improved black-box attack on deep neural networks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Li","year":"2019"},{"key":"ref26","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Brendel","year":"2018"},{"key":"ref27","first-page":"2484","article-title":"Simple black-box adversarial attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Guo","year":"2019"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref30","first-page":"2017","article-title":"Spatial transformer networks","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Jaderberg","year":"2015"},{"key":"ref31","article-title":"Spatially transformed adversarial examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Xiao","year":"2018"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM50108.2020.00186"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3475724.3483604"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.3389\/fnbot.2023.1129720"},{"key":"ref35","first-page":"10236","article-title":"Glow: Generative flow with invertible 1  1 convolutions","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Kingma","year":"2018"},{"key":"ref36","first-page":"2142","article-title":"Black-box adversarial attacks with limited queries and information","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Ilyas","year":"2018"},{"key":"ref37","article-title":"Sign-OPT: A query-efficient hard-label adversarial attack","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Cheng","year":"2020"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01166"},{"key":"ref39","article-title":"Query-limited black-box attacks to classifiers","author":"Suya","year":"2017"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00130"},{"key":"ref41","first-page":"1327","article-title":"Hybrid batch attacks: Finding black-box adversarial examples with limited queries","volume-title":"Proc. USENIX Conf. Secur. Symp.","author":"Suya","year":"2020"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2021.3079723"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3194988"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-21736-9"},{"key":"ref45","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref46","first-page":"215","article-title":"An analysis of single-layer networks in unsupervised feature learning","volume-title":"Proc. Int. Conf. Artif. Intell. Statist.","author":"Coates","year":"2011"},{"key":"ref47","article-title":"Mitigating adversarial effects through randomization","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Xie","year":"2018"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102317"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-99-7356-9_30"},{"key":"ref51","article-title":"Very deep convolutional networks for large-scale image recognition","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Simonyan","year":"2015"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00474"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01264-9_8"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.243"},{"key":"ref55","first-page":"19655","article-title":"HYDRA: Pruning adversarially robust neural networks","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Sehwag","year":"2020"},{"key":"ref56","article-title":"Improving adversarial robustness requires revisiting misclassified examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wang","year":"2020"},{"key":"ref57","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang","year":"2019"},{"key":"ref58","article-title":"Fast is better than free: Revisiting adversarial training","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wong","year":"2020"},{"key":"ref59","first-page":"17258","article-title":"Robustness and accuracy could be reconcilable by (proper) definition","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Pang","year":"2022"},{"key":"ref60","article-title":"Efficient and effective augmentation strategy for adversarial training","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Addepalli","year":"2022"},{"key":"ref61","article-title":"Robust learning meets generative models: Can proxy distributions improve adversarial robustness?","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Sehwag","year":"2022"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01543"},{"key":"ref63","first-page":"3353","article-title":"Adversarial training for free!","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Shafahi","year":"2019"},{"key":"ref64","first-page":"3533","article-title":"Do adversarially robust ImageNet models transfer better?","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Salman","year":"2020"},{"key":"ref65","article-title":"Adversarial robustness as a prior for learned representations","author":"Engstrom","year":"2019"},{"key":"ref66","article-title":"Robustbench: A standardized adversarial robustness benchmark","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Croce","year":"2021"},{"key":"ref67","article-title":"SqueezeNet: AlexNet-level accuracy with 50 fewer parameters and <0.5MB model size","author":"Iandola","year":"2016"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00068"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2020.3045810"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1117\/1.3267105"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2012.2214050"},{"key":"ref72","first-page":"6626","article-title":"GANs trained by a two time-scale update rule converge to a local Nash equilibrium","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Heusel","year":"2017"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2003.819861"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1016\/j.inffus.2011.08.002"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2011.2109730"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.6173"}],"container-title":["IEEE Transactions on Multimedia"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6046\/10844992\/10855612.pdf?arnumber=10855612","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,5,14]],"date-time":"2025-05-14T17:33:16Z","timestamp":1747243996000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10855612\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":76,"URL":"https:\/\/doi.org\/10.1109\/tmm.2025.3535328","relation":{},"ISSN":["1520-9210","1941-0077"],"issn-type":[{"value":"1520-9210","type":"print"},{"value":"1941-0077","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}