{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,1]],"date-time":"2026-02-01T03:53:49Z","timestamp":1769918029604,"version":"3.49.0"},"publisher-location":"New York, NY, USA","reference-count":76,"publisher":"ACM","license":[{"start":{"date-parts":[[2019,11,6]],"date-time":"2019-11-06T00:00:00Z","timestamp":1572998400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Data Spartan","award":["DSRD201801"],"award-info":[{"award-number":["DSRD201801"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2019,11,6]]},"DOI":"10.1145\/3319535.3345660","type":"proceedings-article","created":{"date-parts":[[2019,11,7]],"date-time":"2019-11-07T13:08:32Z","timestamp":1573132112000},"page":"275-289","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":49,"title":["Procedural Noise Adversarial Examples for Black-Box Attacks on Deep Convolutional Networks"],"prefix":"10.1145","author":[{"given":"Kenneth T.","family":"Co","sequence":"first","affiliation":[{"name":"Imperial College London, London, United Kingdom"}]},{"given":"Luis","family":"Mu\u00f1oz-Gonz\u00e1lez","sequence":"additional","affiliation":[{"name":"Imperial College London, London, United Kingdom"}]},{"given":"Sixte","family":"de Maupeou","sequence":"additional","affiliation":[{"name":"Imperial College London, London, United Kingdom"}]},{"given":"Emil C.","family":"Lupu","sequence":"additional","affiliation":[{"name":"Imperial College London, London, United Kingdom"}]}],"member":"320","published-online":{"date-parts":[[2019,11,6]]},"reference":[{"key":"e_1_3_2_2_1_1","volume-title":"Proceedings of the 35th International Conference on Machine Learning (Proceedings of Machine Learning Research)","volume":"80","author":"Athalye Anish","year":"2018"},{"key":"e_1_3_2_2_2_1","volume-title":"Proceedings of the 2006 ACM Symposium on Information, Computer and Communications Security (ASIACCS '06)","author":"Barreno Marco"},{"key":"e_1_3_2_2_3_1","volume-title":"ICLR Workshop .","author":"Bhagoji Arjun Nitin","year":"2018"},{"key":"e_1_3_2_2_4_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"e_1_3_2_2_5_1","volume-title":"Davide Del Testa","author":"Bojarski Mariusz","year":"2016"},{"key":"e_1_3_2_2_6_1","volume-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprint arXiv:1712.04248","author":"Brendel Wieland","year":"2017"},{"key":"e_1_3_2_2_7_1","volume-title":"A tutorial on Bayesian optimization of expensive cost functions, with application to active user modeling and hierarchical reinforcement learning. arXiv preprint arXiv:1012.2599","author":"Brochu Eric","year":"2010"},{"key":"e_1_3_2_2_8_1","volume-title":"On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705","author":"Carlini Nicholas","year":"2019"},{"key":"e_1_3_2_2_9_1","volume-title":"USENIX Security Symposium . 513--530","author":"Carlini Nicholas","year":"2016"},{"key":"e_1_3_2_2_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_2_2_11_1","volume-title":"Audio adversarial examples: Targeted attacks on speech-to-text. arXiv preprint arXiv:1801.01944","author":"Carlini Nicholas","year":"2018"},{"key":"e_1_3_2_2_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"e_1_3_2_2_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/3270101.3270106"},{"key":"e_1_3_2_2_14_1","volume-title":"ImageNet-trained CNNs are biased towards texture","author":"Geirhos Robert","year":"1811"},{"key":"e_1_3_2_2_15_1","volume-title":"Fast R-CNN. In Proceedings of the IEEE international conference on computer vision. 1440--1448","author":"Girshick Ross","year":"2015"},{"key":"e_1_3_2_2_16_1","volume-title":"Defense against the dark arts: An overview of adversarial example security research and future research directions. arXiv preprint arXiv:1806.04169","author":"Goodfellow Ian","year":"2018"},{"key":"e_1_3_2_2_17_1","volume-title":"Deep learning","author":"Goodfellow Ian"},{"key":"e_1_3_2_2_18_1","volume-title":"Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572","author":"Goodfellow Ian J","year":"2014"},{"key":"e_1_3_2_2_19_1","volume-title":"Adversarial perturbations against deep neural networks for malware classification. arXiv preprint arXiv:1606.04435","author":"Grosse Kathrin","year":"2016"},{"key":"e_1_3_2_2_20_1","volume-title":"Deep compression: Compressing deep neural networks with pruning, trained quantization and Huffman coding. arXiv preprint arXiv:1510.00149","author":"Han Song","year":"2015"},{"key":"e_1_3_2_2_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_2_2_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2012.2205597"},{"key":"e_1_3_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/2046684.2046692"},{"key":"e_1_3_2_2_24_1","volume-title":"Adversarial attacks on neural network policies. arXiv preprint arXiv:1702.02284","author":"Huang Sandy","year":"2017"},{"key":"e_1_3_2_2_25_1","volume-title":"International Conference on Learning Representations .","author":"Ilyas Andrew","year":"2019"},{"key":"e_1_3_2_2_26_1","volume-title":"2019 b. Adversarial examples are not bugs, they are features. arXiv preprint arXiv:1905.02175","author":"Ilyas Andrew","year":"2019"},{"key":"e_1_3_2_2_27_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_32"},{"key":"e_1_3_2_2_28_1","doi-asserted-by":"publisher","DOI":"10.4108\/eai.3-12-2015.2262516"},{"key":"e_1_3_2_2_29_1","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0155781"},{"key":"e_1_3_2_2_30_1","volume-title":"Procs. Conf. on Computer Vision and Pattern Recognition. 8562--8570","author":"Khrulkov Valentin","year":"2018"},{"key":"e_1_3_2_2_31_1","unstructured":"Alex Krizhevsky Ilya Sutskever and Geoffrey E Hinton. 2012. ImageNet classification with deep convolutional neural networks. In Advances in Neural Information Processing Systems. 1097--1105.  Alex Krizhevsky Ilya Sutskever and Geoffrey E Hinton. 2012. ImageNet classification with deep convolutional neural networks. In Advances in Neural Information Processing Systems. 1097--1105."},{"key":"e_1_3_2_2_32_1","volume-title":"Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236","author":"Kurakin Alexey","year":"2016"},{"key":"e_1_3_2_2_33_1","volume-title":"International Conference on Learning Representations .","author":"Kurakin Alexey","year":"2017"},{"key":"e_1_3_2_2_34_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1467-8659.2010.01827.x"},{"key":"e_1_3_2_2_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/1531326.1531360"},{"key":"e_1_3_2_2_36_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10602-1_48"},{"key":"e_1_3_2_2_37_1","volume-title":"Tactics of adversarial attack on deep reinforcement learning agents. arXiv preprint arXiv:1703.06748","author":"Lin Yen-Chen","year":"2017"},{"key":"e_1_3_2_2_38_1","volume-title":"On the limited memory BFGS method for large scale optimization. Mathematical programming","author":"Liu Dong C","year":"1989"},{"key":"e_1_3_2_2_39_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2016.07.026"},{"key":"e_1_3_2_2_40_1","volume-title":"Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083","author":"Madry Aleksander","year":"2017"},{"key":"e_1_3_2_2_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2016.51"},{"key":"e_1_3_2_2_42_1","doi-asserted-by":"publisher","DOI":"10.5555\/3020948.3021002"},{"key":"e_1_3_2_2_43_1","first-page":"117","article-title":"The application of Bayesian methods for seeking the extremum","volume":"2","author":"Mo\u0107kus J","year":"1978","journal-title":"Towards Global Optimization"},{"key":"e_1_3_2_2_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"e_1_3_2_2_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"e_1_3_2_2_46_1","volume-title":"Procs. Conf. on Computer Vision and Pattern Recognition. 742--751","author":"Mopuri Konda"},{"key":"e_1_3_2_2_48_1","doi-asserted-by":"publisher","DOI":"10.23915\/distill.00007"},{"key":"e_1_3_2_2_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2014.222"},{"key":"e_1_3_2_2_50_1","volume-title":"Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277","author":"Papernot Nicolas","year":"2016"},{"key":"e_1_3_2_2_51_1","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"e_1_3_2_2_52_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2018.00035"},{"key":"e_1_3_2_2_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/325165.325247"},{"key":"e_1_3_2_2_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/566654.566636"},{"key":"e_1_3_2_2_55_1","volume-title":"Williams","author":"Rasmussen Carl Edward","year":"2006"},{"key":"e_1_3_2_2_56_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.91"},{"key":"e_1_3_2_2_57_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.690"},{"key":"e_1_3_2_2_58_1","volume-title":"YOLOv3: An incremental improvement. arXiv preprint arXiv:1804.02767","author":"Redmon Joseph","year":"2018"},{"key":"e_1_3_2_2_59_1","unstructured":"Shaoqing Ren Kaiming He Ross Girshick and Jian Sun. 2015. Faster R-CNN: Towards real-time object detection with region proposal networks. In Advances in neural information processing systems. 91--99.  Shaoqing Ren Kaiming He Ross Girshick and Jian Sun. 2015. Faster R-CNN: Towards real-time object detection with region proposal networks. In Advances in neural information processing systems. 91--99."},{"key":"e_1_3_2_2_60_1","volume-title":"Proceedings of the 28th International Conference on International Conference on Machine Learning (ICML'11)","author":"Rifai Salah","year":"2011"},{"key":"e_1_3_2_2_61_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"e_1_3_2_2_62_1","doi-asserted-by":"publisher","DOI":"10.1109\/MALWARE.2015.7413680"},{"key":"e_1_3_2_2_63_1","volume-title":"eXpose: A character-level convolutional neural network with embeddings for detecting malicious URLs, file paths and registry keys. arXiv preprint arXiv:1702.08568","author":"Saxe Joshua","year":"2017"},{"key":"e_1_3_2_2_64_1","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2015.2494218"},{"key":"e_1_3_2_2_65_1","volume-title":"Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556","author":"Simonyan Karen","year":"2014"},{"key":"e_1_3_2_2_66_1","unstructured":"Jasper Snoek Hugo Larochelle and Ryan P Adams. 2012. Practical Bayesian optimization of machine learning algorithms. In Advances in Neural information Processing Systems. 2951--2959.  Jasper Snoek Hugo Larochelle and Ryan P Adams. 2012. Practical Bayesian optimization of machine learning algorithms. In Advances in Neural information Processing Systems. 2951--2959."},{"key":"e_1_3_2_2_67_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSP.2017.2708039"},{"key":"e_1_3_2_2_68_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2013.446"},{"key":"e_1_3_2_2_69_1","first-page":"12","article-title":"Inception-v4, Inception-ResNet and the impact of residual connections on learning","volume":"4","author":"Szegedy Christian","year":"2017","journal-title":"AAAI"},{"key":"e_1_3_2_2_70_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"e_1_3_2_2_71_1","volume-title":"Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199","author":"Szegedy Christian","year":"2013"},{"key":"e_1_3_2_2_72_1","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180220"},{"key":"e_1_3_2_2_73_1","volume-title":"International Conference on Learning Representations .","author":"Tram\u00e9r Florian","year":"2018"},{"key":"e_1_3_2_2_74_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2017.60"},{"key":"e_1_3_2_2_75_1","volume-title":"Generating adversarial examples with adversarial networks. arXiv preprint arXiv:1801.02610","author":"Xiao Chaowei","year":"2018"},{"key":"e_1_3_2_2_76_1","unstructured":"Jason Yosinski Jeff Clune Yoshua Bengio and Hod Lipson. 2014. How transferable are features in deep neural networks?. In Advances in neural information processing systems. 3320--3328.  Jason Yosinski Jeff Clune Yoshua Bengio and Hod Lipson. 2014. How transferable are features in deep neural networks?. In Advances in neural information processing systems. 3320--3328."},{"key":"e_1_3_2_2_77_1","volume-title":"Computer Vision--ECCV 2018","author":"Zhou Wen"}],"event":{"name":"CCS '19: 2019 ACM SIGSAC Conference on Computer and Communications Security","location":"London United Kingdom","acronym":"CCS '19","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3319535.3345660","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3319535.3345660","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T23:24:02Z","timestamp":1750202642000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3319535.3345660"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,11,6]]},"references-count":76,"alternative-id":["10.1145\/3319535.3345660","10.1145\/3319535"],"URL":"https:\/\/doi.org\/10.1145\/3319535.3345660","relation":{},"subject":[],"published":{"date-parts":[[2019,11,6]]},"assertion":[{"value":"2019-11-06","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}