{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,8]],"date-time":"2026-06-08T20:05:15Z","timestamp":1780949115818,"version":"3.54.1"},"reference-count":98,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"7","license":[{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["92370129"],"award-info":[{"award-number":["92370129"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62376010"],"award-info":[{"award-number":["62376010"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Beijing Major Science and Technology Project"},{"DOI":"10.13039\/501100005090","name":"Beijing Nova Program","doi-asserted-by":"publisher","award":["20230484344"],"award-info":[{"award-number":["20230484344"]}],"id":[{"id":"10.13039\/501100005090","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100005090","name":"Beijing Nova Program","doi-asserted-by":"publisher","award":["20240484642"],"award-info":[{"award-number":["20240484642"]}],"id":[{"id":"10.13039\/501100005090","id-type":"DOI","asserted-by":"publisher"}]},{"name":"State Key Laboratory of General Artificial Intelligence"},{"name":"Beijing Major Science and Technology Project"},{"name":"NSF China","award":["62276004"],"award-info":[{"award-number":["62276004"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2026,7]]},"DOI":"10.1109\/tpami.2026.3666165","type":"journal-article","created":{"date-parts":[[2026,2,18]],"date-time":"2026-02-18T21:17:30Z","timestamp":1771449450000},"page":"7846-7858","source":"Crossref","is-referenced-by-count":0,"title":["On the Adversarial Transferability of Generalized \u201cSkip Connections\u201d"],"prefix":"10.1109","volume":"48","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-8623-6318","authenticated-orcid":false,"given":"Yisen","family":"Wang","sequence":"first","affiliation":[{"name":"State Key Lab of General Artificial Intelligence, School of Intelligence Science and Technology, Peking University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2663-2052","authenticated-orcid":false,"given":"Yichuan","family":"Mo","sequence":"additional","affiliation":[{"name":"State Key Lab of General Artificial Intelligence, School of Intelligence Science and Technology, Peking University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5147-3516","authenticated-orcid":false,"given":"Dongxian","family":"Wu","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1588-2654","authenticated-orcid":false,"given":"Mingjie","family":"Li","sequence":"additional","affiliation":[{"name":"State Key Lab of General Artificial Intelligence, School of Intelligence Science and Technology, Peking University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2099-4973","authenticated-orcid":false,"given":"Xingjun","family":"Ma","sequence":"additional","affiliation":[{"name":"Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1493-7569","authenticated-orcid":false,"given":"Zhouchen","family":"Lin","sequence":"additional","affiliation":[{"name":"State Key Lab of General Artificial Intelligence, School of Intelligence Science and Technology, Peking University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.5244\/C.30.87"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.243"},{"key":"ref4","first-page":"1","article-title":"An image is worth 16 \u00d7 16 words: Transformers for image recognition at scale","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Dosovitskiy","year":"2020"},{"key":"ref5","first-page":"1","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Szegedy","year":"2013"},{"key":"ref6","first-page":"1","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Goodfellow","year":"2014"},{"key":"ref7","first-page":"1","article-title":"Delving into transferable adversarial examples and black-box attacks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Liu","year":"2017"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref13","article-title":"Towards good practices in evaluating transfer adversarial attacks","author":"Zhao","year":"2022"},{"key":"ref14","first-page":"29845","article-title":"Boosting the transferability of adversarial attacks with reverse adversarial perturbation","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Qin","year":"2022"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref16","first-page":"1","article-title":"Skip connections matter: On the transferability of adversarial examples generated with ResNets","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wu","year":"2020"},{"key":"ref17","first-page":"24261","article-title":"MLP-mixer: An all-MLP architecture for vision","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Tolstikhin","year":"2021"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.5555\/3298023.3298188"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-05318-5_3"},{"key":"ref21","article-title":"A survey on neural architecture search","author":"Wistuba","year":"2019"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_10"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3343031.3351088"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.5244\/C.35.186"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2024.124757"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2022\/227"},{"key":"ref29","article-title":"Adversarial attack based on prediction-correction","author":"Wan","year":"2023"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP49357.2023.10096558"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00437"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.52202\/075280-3073"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i3.20279"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2023.119491"},{"key":"ref35","article-title":"Nesterov accelerated gradient and scale invariance for adversarial attacks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Lin","year":"2020"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19772-7_32"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3708821.3710827"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02297"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00425"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20065-6_1"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3581783.3612070"},{"key":"ref42","first-page":"3519","article-title":"Similarity of neural network representations revisited","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Kornblith","year":"2019"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00483"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00754"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01457"},{"key":"ref46","article-title":"Enhancing the transferability via feature-momentum adversarial attack","author":"Li","year":"2022"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2022\/233"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2025.3526067"},{"key":"ref49","first-page":"32900","article-title":"Improving adversarial transferability via intermediate-level perturbation decay","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Li","year":"2023"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00010"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.52202\/075280-0092"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP40778.2020.9191063"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i6.28365"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i3.20169"},{"key":"ref55","article-title":"Improving the transferability of adversarial examples with restructure embedded patches","author":"Zhou","year":"2022"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01575"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i7.28541"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN54540.2023.10191679"},{"key":"ref59","first-page":"550","article-title":"Residual networks behave like ensembles of relatively shallow networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Veit","year":"2016"},{"key":"ref60","first-page":"1","article-title":"Rethinking adversarial transferability from a data distribution perspective","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Zhu","year":"2022"},{"key":"ref61","first-page":"11918","article-title":"Generative modeling by estimating gradients of the data distribution","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Song","year":"2019"},{"key":"ref62","article-title":"Sampling-based fast gradient rescaling method for highly transferable adversarial attacks","author":"Han","year":"2023"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01585"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00196"},{"key":"ref65","first-page":"1","article-title":"Transferable adversarial attack based on integrated gradients","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Huang","year":"2022"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/ICTAI59109.2023.00098"},{"key":"ref67","first-page":"9759","article-title":"A little robustness goes a long way: Leveraging robust features for targeted transfer attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Springer","year":"2021"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00138"},{"key":"ref69","first-page":"1","article-title":"Very deep convolutional networks for large-scale image recognition","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Simonyan","year":"2015"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00745"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1088\/1742-5468\/ac9830"},{"key":"ref72","first-page":"15908","article-title":"Transformer in transformer","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Han","year":"2021"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00063"},{"key":"ref74","first-page":"1","article-title":"Neural architecture search with reinforcement learning","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Zoph","year":"2017"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1007\/s11704-019-8208-z"},{"key":"ref76","first-page":"6115","article-title":"On success and simplicity: A second look at transferable targeted attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zhao","year":"2021"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP48485.2024.10446654"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.02361"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3284649"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.52202\/068431-1351"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00792"},{"key":"ref82","first-page":"13931","article-title":"Revisiting adversarial training for ImageNet: Architectures, training and generalization across threat models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Singh","year":"2023"},{"key":"ref83","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Cohen","year":"2019"},{"key":"ref84","article-title":"On the certified robustness for ensemble models and beyond","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Yang","year":"2022"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00034"},{"key":"ref87","first-page":"1","article-title":"Fast is better than free: Revisiting adversarial training","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wong","year":"2020"},{"key":"ref88","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Athalye","year":"2018"},{"key":"ref89","article-title":"SmoothGrad: Removing noise by adding noise","author":"Smilkov","year":"2017"},{"key":"ref90","article-title":"Universal and transferable adversarial attacks on aligned language models","author":"Zou","year":"2023"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/tpami.2026.3660147"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.52202\/079017-2049"},{"key":"ref93","article-title":"VICUNA: An open-source chatbot impressing GPT-4 with 90% ChatGPT quality","author":"Chiang","year":"2023"},{"key":"ref94","article-title":"Introducing MPT-7B: A new standard for open-source, commercially usable LLMs","author":"Team","year":"2023"},{"key":"ref95","first-page":"2397","article-title":"Pythia: A suite for analyzing large language models across training and scaling","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Biderman","year":"2023"},{"key":"ref96","article-title":"stable-vicuna-13b-delta","year":"2023"},{"key":"ref97","first-page":"1","article-title":"RobustBench: A standardized adversarial robustness benchmark","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Croce","year":"2021"},{"key":"ref98","first-page":"3533","article-title":"Do adversarially robust imagenet models transfer better?","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Salman","year":"2020"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/34\/11552636\/11399637.pdf?arnumber=11399637","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,8]],"date-time":"2026-06-08T19:51:46Z","timestamp":1780948306000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11399637\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7]]},"references-count":98,"journal-issue":{"issue":"7"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2026.3666165","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"value":"0162-8828","type":"print"},{"value":"2160-9292","type":"electronic"},{"value":"1939-3539","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7]]}}}