{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,14]],"date-time":"2026-07-14T03:46:14Z","timestamp":1784000774498,"version":"3.55.0"},"reference-count":95,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2025,4,1]],"date-time":"2025-04-01T00:00:00Z","timestamp":1743465600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,4,1]],"date-time":"2025-04-01T00:00:00Z","timestamp":1743465600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,4,1]],"date-time":"2025-04-01T00:00:00Z","timestamp":1743465600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62376223"],"award-info":[{"award-number":["62376223"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Innovation Foundation for Doctor Dissertation of Northwestern Polytechnical University","award":["CX2022054"],"award-info":[{"award-number":["CX2022054"]}]},{"name":"Cultivation Foundation for Outstanding Doctoral Dissertation of the School of Automation, Northwestern Polytechnical University"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2025,4]]},"DOI":"10.1109\/tpami.2024.3519803","type":"journal-article","created":{"date-parts":[[2024,12,18]],"date-time":"2024-12-18T19:31:11Z","timestamp":1734550271000},"page":"2429-2445","source":"Crossref","is-referenced-by-count":9,"title":["STDatav2: Accessing Efficient Black-Box Stealing for Adversarial Attacks"],"prefix":"10.1109","volume":"47","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3977-2529","authenticated-orcid":false,"given":"Xuxiang","family":"Sun","sequence":"first","affiliation":[{"name":"School of Automation, Northwestern Polytechnical University, Xi&#x2019;an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5030-0683","authenticated-orcid":false,"given":"Gong","family":"Cheng","sequence":"additional","affiliation":[{"name":"School of Automation, Northwestern Polytechnical University, Xi&#x2019;an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hongda","family":"Li","sequence":"additional","affiliation":[{"name":"School of Automation, Northwestern Polytechnical University, Xi&#x2019;an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6547-7174","authenticated-orcid":false,"given":"Chunbo","family":"Lang","sequence":"additional","affiliation":[{"name":"School of Automation, Northwestern Polytechnical University, Xi&#x2019;an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5545-7217","authenticated-orcid":false,"given":"Junwei","family":"Han","sequence":"additional","affiliation":[{"name":"School of Automation, Northwestern Polytechnical University, Xi&#x2019;an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref2","first-page":"1097","article-title":"ImageNet classification with deep convolutional neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Krizhevsky"},{"key":"ref3","first-page":"1","article-title":"Very deep convolutional networks for large-scale image recognition","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Simonyan"},{"key":"ref4","article-title":"MobileNets: Efficient convolutional neural networks for mobile vision applications","author":"Howard","year":"2017"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/TGRS.2023.3339658"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00745"},{"key":"ref8","article-title":"SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and <0.5 MB model size","author":"Iandola","year":"2016"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2023.3265865"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2023.3329669"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2023.3315555"},{"key":"ref12","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014"},{"key":"ref13","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2013"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/TGRS.2023.3273287"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2024.3425655"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2023.3276331"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/TGRS.2021.3081421"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2022.108728"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref24","first-page":"1","article-title":"Nesterov accelerated gradient and scale invariance for adversarial attacks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Lin"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00723"},{"key":"ref28","first-page":"20791","article-title":"Perturbing across the feature hierarchy to improve standard and strict blackbox attack transferability","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Inkawhich"},{"key":"ref29","first-page":"1","article-title":"Transferable perturbations of deep feature distributions","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Inkawhich"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00196"},{"key":"ref31","first-page":"2484","article-title":"Simple black-box adversarial attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Guo"},{"key":"ref32","first-page":"1","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Brendel"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00506"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00045"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"ref36","first-page":"1","article-title":"Sign-OPT: A query-efficient hard-label adversarial attack","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Cheng"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01029"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.374"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00847"},{"key":"ref40","first-page":"1","article-title":"BayesOpt adversarial attack","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Ru"},{"key":"ref41","first-page":"15871","article-title":"AdvFlow: Inconspicuous black-box adversarial attacks using normalizing flows","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Dolatabadi"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00509"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref44","article-title":"Data-free knowledge distillation for deep neural networks","author":"Lopes","year":"2017"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00361"},{"key":"ref46","first-page":"4743","article-title":"Zero-shot knowledge distillation in deep networks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Nayak"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5709"},{"key":"ref48","first-page":"2705","article-title":"Knowledge extraction with no observable data","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Yoo"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00874"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00031"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00473"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01360"},{"key":"ref53","first-page":"10675","article-title":"Zero-shot knowledge distillation from a decision-based black-box model","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Wang"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00474"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01492"},{"key":"ref56","first-page":"1","article-title":"Towards principled methods for training generative adversarial networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Arjovsky"},{"key":"ref57","first-page":"1","article-title":"Improved training of Wasserstein GANs","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Gulrajani"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1802.05957"},{"key":"ref59","article-title":"Conditional generative adversarial nets","author":"Mirza","year":"2014"},{"key":"ref60","article-title":"Diversity-sensitive conditional generative adversarial networks","author":"Yang","year":"2019"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00152"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/TGRS.2023.3336665"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/TGRS.2023.3301003"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/TGRS.2023.3238801"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/TGRS.2023.3300071"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00112"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/tifs.2023.3275057\/mm1"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i12.17259"},{"key":"ref69","article-title":"Towards feature space adversarial attack","author":"Xu","year":"2020"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00741"},{"key":"ref71","first-page":"1","article-title":"Skip connections matter: On the transferability of adversarial examples generated with resnets","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wu"},{"key":"ref72","first-page":"3820","article-title":"Subspace attack: Exploiting promising subspaces for query-efficient black-box attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Guo"},{"key":"ref73","first-page":"1","article-title":"Prior convictions: Black-box adversarial attacks with bandits and priors","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Ilyas"},{"key":"ref74","article-title":"Distilling the knowledge in a neural network","author":"Hinton","year":"2015"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241142"},{"key":"ref76","first-page":"1973","article-title":"Hermes attack: Steal DNN models with lossless inference accuracy","volume-title":"Proc. USENIX Conf. Secur. Symp.","author":"Zhu"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.5555\/2969033.2969125"},{"key":"ref78","first-page":"1","article-title":"Unsupervised representation learning with deep convolutional generative adversarial networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Radford"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01485"},{"key":"ref80","first-page":"1","article-title":"Robust learning meets generative models: Can proxy distributions improve adversarial robustness","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Sehwag"},{"key":"ref81","first-page":"1488","article-title":"Efficient and effective augmentation strategy for adversarial training","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Addepalli"},{"key":"ref82","first-page":"4218","article-title":"Improving robustness using generated data","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Gowal"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01543"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01468"},{"key":"ref86","first-page":"14929","article-title":"Adversarial attack on attackers: Post-process to mitigate black-box score-based query attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Chen"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01446"},{"key":"ref88","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2017.7966217"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2017.2723009"},{"key":"ref92","article-title":"Adam: A method for stochastic optimization","author":"Kingma","year":"2014"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/TAI.2023.3257276"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46493-0_38"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.5244\/C.30.87"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/34\/10916529\/10806846.pdf?arnumber=10806846","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,3,7]],"date-time":"2025-03-07T18:43:26Z","timestamp":1741373006000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10806846\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,4]]},"references-count":95,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2024.3519803","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"value":"0162-8828","type":"print"},{"value":"2160-9292","type":"electronic"},{"value":"1939-3539","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,4]]}}}