{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,10]],"date-time":"2025-11-10T13:07:28Z","timestamp":1762780048948,"version":"3.37.3"},"reference-count":96,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"1","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62076067","62406252"],"award-info":[{"award-number":["62076067","62406252"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Fundamental Research Funds for Central Universities","award":["D5000240037","D5000230355"],"award-info":[{"award-number":["D5000240037","D5000230355"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2025,1]]},"DOI":"10.1109\/tpami.2024.3469952","type":"journal-article","created":{"date-parts":[[2024,9,27]],"date-time":"2024-09-27T18:35:41Z","timestamp":1727462141000},"page":"486-501","source":"Crossref","is-referenced-by-count":4,"title":["Dynamic Routing and Knowledge Re-Learning for Data-Free Black-Box Attack"],"prefix":"10.1109","volume":"47","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8049-7288","authenticated-orcid":false,"given":"Xuelin","family":"Qian","sequence":"first","affiliation":[{"name":"School of Automation, and the Brain and Artificial Intelligence Lab (Brain Lab), Northwestern Polytechnical University, Xi’an, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7142-9734","authenticated-orcid":false,"given":"Wenxuan","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Computer Science, Northwestern Polytechnical University, Xi’an, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1907-8567","authenticated-orcid":false,"given":"Yu-Gang","family":"Jiang","sequence":"additional","affiliation":[{"name":"School of Computer Science, Fudan University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4897-9209","authenticated-orcid":false,"given":"Xiangyang","family":"Xue","sequence":"additional","affiliation":[{"name":"School of Computer Science, Fudan University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6595-6893","authenticated-orcid":false,"given":"Yanwei","family":"Fu","sequence":"additional","affiliation":[{"name":"School of Data Science, and Fudan ISTBI—ZJNU Algorithm Centre for Brain-inspired Intelligence, Fudan University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00472"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.691"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00482"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00552"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01240-3_40"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00224"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/JBHI.2020.3030853"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1038\/s41746-020-00376-2"},{"article-title":"Intriguing properties of neural networks","year":"2013","author":"Szegedy","key":"ref9"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.11499"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"article-title":"Towards deep learning models resistant to adversarial attacks","year":"2017","author":"Madry","key":"ref12"},{"article-title":"Explaining and harnessing adversarial examples","year":"2014","author":"Goodfellow","key":"ref13"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01264-9_28"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2020.3033291"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"article-title":"Prior convictions: Black-box adversarial attacks with bandits and priors","year":"2018","author":"Ilyas","key":"ref18"},{"article-title":"Black-box adversarial attacks with limited queries and information","year":"2018","author":"Ilyas","key":"ref19"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00790"},{"article-title":"Query-efficient hard-label black-box attack: An optimization-based approach","year":"2018","author":"Cheng","key":"ref21"},{"article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","year":"2017","author":"Brendel","key":"ref22"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-021-01453-z"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00668"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241142"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00031"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00473"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01360"},{"volume-title":"Reinforcement Learning: An Introduction","year":"2018","author":"Sutton","key":"ref31"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00919"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01396"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"article-title":"Very deep convolutional networks for large-scale image recognition","year":"2014","author":"Simonyan","key":"ref35"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3065386"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2019.2928294"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00577"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"article-title":"Adversarial examples in the physical world","year":"2016","author":"Kurakin","key":"ref40"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP40778.2020.9191063"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.3390\/app9112286"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00483"},{"article-title":"Learning black-box attackers with transferable priors and query feedback","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Yang","key":"ref44"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00072"},{"article-title":"Simple black-box adversarial attacks","year":"2019","author":"Guo","key":"ref46"},{"article-title":"Nesterov accelerated gradient and scale invariance for adversarial attacks","year":"2019","author":"Lin","key":"ref47"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00196"},{"article-title":"Beyond ImageNet attack: Towards crafting adversarial examples for black-box domains","year":"2022","author":"Zhang","key":"ref49"},{"key":"ref50","first-page":"36 914","article-title":"GAMA: Generative adversarial multi-object scene attacks","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Aich"},{"key":"ref51","first-page":"12 849","article-title":"Practical no-box adversarial attacks against DNNs","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Li"},{"key":"ref52","first-page":"1196","article-title":"Pre-trained adversarial perturbations","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Ban"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01457"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i2.25239"},{"article-title":"Hermes attack: Steal DNN models with lossless inference accuracy","year":"2020","author":"Zhu","key":"ref56"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00874"},{"key":"ref58","first-page":"2701","article-title":"Knowledge extraction with no observable data","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Yoo"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2018.2861800"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-47436-2_10"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00777"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-05318-5_3"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3234810"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01162"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00206"},{"article-title":"Distilling the knowledge in a neural network","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Hinton","key":"ref66"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v30i1.10449"},{"article-title":"Paying more attention to attention: Improving the performance of convolutional neural networks via attention transfer","year":"2016","author":"Zagoruyko","key":"ref68"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01231-1_21"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33013779"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i15.17610"},{"article-title":"Deep model compression: Distilling knowledge from noisy teachers","year":"2016","author":"Sau","key":"ref72"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098135"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-22796-8_7"},{"article-title":"Knowledge distillation in generations: More tolerant teachers educate better students","year":"2018","author":"Yang","key":"ref75"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i16.17680"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00474"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00716"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.634"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.131"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1002\/j.1538-7305.1948.tb01338.x"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102555"},{"key":"ref83","first-page":"15 115","article-title":"Towards efficient data free black-box adversarial attack","volume-title":"Proc. IEEE\/CVF Conf. Comput. Vis. Pattern Recognit.","author":"Zhang"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"article-title":"Learning multiple layers of features from tiny images","year":"2009","author":"Krizhevsky","key":"ref85"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"article-title":"Labeled faces in the wild: A database for studying face recognition in unconstrained environments","year":"2007","author":"Huang","key":"ref88"},{"article-title":"An image is worth 16x16 words: Transformers for image recognition at scale","year":"2020","author":"Dosovitskiy","key":"ref89"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01172"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1088\/1742-5468\/ac9830"},{"article-title":"Small input noise is enough to defend against query-based black-box attacks","year":"2021","author":"Byun","key":"ref92"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i6.20545"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.324"},{"key":"ref95","first-page":"2579","article-title":"Visualizing data using t-SNE","volume":"9","author":"Maaten","year":"2008","journal-title":"J. Mach. Learn. Res."},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_29"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/34\/10777928\/10697391.pdf?arnumber=10697391","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,12,5]],"date-time":"2024-12-05T06:30:20Z","timestamp":1733380220000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10697391\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,1]]},"references-count":96,"journal-issue":{"issue":"1"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2024.3469952","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"type":"print","value":"0162-8828"},{"type":"electronic","value":"2160-9292"},{"type":"electronic","value":"1939-3539"}],"subject":[],"published":{"date-parts":[[2025,1]]}}}