{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,7,25]],"date-time":"2025-07-25T10:24:47Z","timestamp":1753439087134,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":45,"publisher":"ACM","license":[{"start":{"date-parts":[[2019,11,11]],"date-time":"2019-11-11T00:00:00Z","timestamp":1573430400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"ICRI-CARS"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2019,11,11]]},"DOI":"10.1145\/3338501.3357366","type":"proceedings-article","created":{"date-parts":[[2019,11,8]],"date-time":"2019-11-08T13:40:33Z","timestamp":1573220433000},"page":"83-94","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":3,"title":["Making Targeted Black-box Evasion Attacks Effective and Efficient"],"prefix":"10.1145","author":[{"given":"Mika","family":"Juuti","sequence":"first","affiliation":[{"name":"Aalto University, Espoo, Finland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Buse","family":"Gul Atli","sequence":"additional","affiliation":[{"name":"Aalto University, Espoo, Finland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"N.","family":"Asokan","sequence":"additional","affiliation":[{"name":"Aalto University, Espoo, Finland"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2019,11,11]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"George Adam Petr Smirnov Benjamin Haibe-Kains and Anna Goldenberg. 2019. Reducing Adversarial Example Transferability Using Gradient Regularization. arXiv preprint arXiv:1904.07980 (2019).  George Adam Petr Smirnov Benjamin Haibe-Kains and Anna Goldenberg. 2019. Reducing Adversarial Example Transferability Using Gradient Regularization. arXiv preprint arXiv:1904.07980 (2019)."},{"volume-title":"Genattack: Practical black-box attacks with gradient-free optimization. arXiv preprint arXiv:1805.11090","year":"2018","author":"Alzantot Moustafa","key":"e_1_3_2_1_2_1"},{"volume-title":"International Conference on Machine Learning. 274--283","year":"2018","author":"Athalye Anish","key":"e_1_3_2_1_3_1"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"volume-title":"International Conference on Learning Representations.","year":"2018","author":"Brendel Wieland","key":"e_1_3_2_1_5_1"},{"key":"e_1_3_2_1_6_1","unstructured":"Thomas Brunner Frederik Diehl and Alois Knoll. [n. d.]. Copy and Paste: A Simple But Effective Initialization Method for Black-Box Adversarial Attacks. arXiv:1906.06086 ([n. d.]).  Thomas Brunner Frederik Diehl and Alois Knoll. [n. d.]. Copy and Paste: A Simple But Effective Initialization Method for Black-Box Adversarial Attacks. arXiv:1906.06086 ([n. d.])."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/3270101.3270106"},{"volume-title":"ICLR","year":"2018","author":"Engstrom Logan","key":"e_1_3_2_1_11_1"},{"key":"e_1_3_2_1_12_1","unstructured":"Alhussein Fawzi Seyed-Mohsen Moosavi-Dezfooli Pascal Frossard and Stefano Soatto. 2017. Classification regions of deep neural networks. arXiv preprint arXiv:1705.09552 (2017).  Alhussein Fawzi Seyed-Mohsen Moosavi-Dezfooli Pascal Frossard and Stefano Soatto. 2017. Classification regions of deep neural networks. arXiv preprint arXiv:1705.09552 (2017)."},{"volume-title":"International Conference on Machine Learning . 201--210","year":"2016","author":"Gilad-Bachrach Ran","key":"e_1_3_2_1_13_1"},{"key":"e_1_3_2_1_14_1","unstructured":"Ian Goodfellow Yoshua Bengio and Aaron Courville. 2016. Deep learning .MIT press.  Ian Goodfellow Yoshua Bengio and Aaron Courville. 2016. Deep learning .MIT press."},{"volume-title":"Explaining and Harnessing Adversarial Examples. In ICLR","year":"2015","author":"Goodfellow Ian","key":"e_1_3_2_1_15_1"},{"volume-title":"Explaining and Harnessing Adversarial Examples. In International Conference on Learning Representations .","year":"2015","author":"Goodfellow Ian","key":"e_1_3_2_1_16_1"},{"volume-title":"ICLR","year":"2018","author":"Guo Chuan","key":"e_1_3_2_1_17_1"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/3270101.3270111"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"volume-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition.","author":"Huang Gao","key":"e_1_3_2_1_20_1"},{"key":"e_1_3_2_1_21_1","unstructured":"Forrest N. Iandola Song Han Matthew W. Moskewicz Khalid Ashraf William J. Dally and Kurt Keutzer. 2016. SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and $<$0.5MB model size. arXiv:1602.07360 (2016).  Forrest N. Iandola Song Han Matthew W. Moskewicz Khalid Ashraf William J. Dally and Kurt Keutzer. 2016. SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and $<$0.5MB model size. arXiv:1602.07360 (2016)."},{"volume-title":"Proceedings of the 35th International Conference on Machine Learning, ICML 2018. https:\/\/arxiv.org\/abs\/1804","year":"2018","author":"Ilyas Andrew","key":"e_1_3_2_1_22_1"},{"key":"e_1_3_2_1_23_1","unstructured":"Andrew Ilyas Logan Engstrom and Aleksander Madry. 2018a. Prior convictions: Black-box adversarial attacks with bandits and priors. arXiv preprint arXiv:1807.07978 (2018).  Andrew Ilyas Logan Engstrom and Aleksander Madry. 2018a. Prior convictions: Black-box adversarial attacks with bandits and priors. arXiv preprint arXiv:1807.07978 (2018)."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243757"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00044"},{"volume-title":"GAZELLE: A Low Latency Framework for Secure Neural Network Inference. In 27th USENIX Security Symposium ($$USENIX$$ Security 18)","year":"2018","author":"Juvekar Chiraag","key":"e_1_3_2_1_26_1"},{"key":"e_1_3_2_1_27_1","unstructured":"Alexey Kurakin Ian Goodfellow and Samy Bengio. 2016. Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533 (2016).  Alexey Kurakin Ian Goodfellow and Samy Bengio. 2016. Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533 (2016)."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134056"},{"key":"e_1_3_2_1_29_1","unstructured":"Yanpei Liu Xinyun Chen Chang Liu and Dawn Song. 2016. Delving into transferable adversarial examples and black-box attacks. arXiv preprint arXiv:1611.02770 (2016).  Yanpei Liu Xinyun Chen Chang Liu and Dawn Song. 2016. Delving into transferable adversarial examples and black-box attacks. arXiv preprint arXiv:1611.02770 (2016)."},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134057"},{"volume-title":"Proceedings of ACM AISec.","year":"2017","author":"Gonz\u00e1lez Luis Mu","key":"e_1_3_2_1_31_1"},{"key":"e_1_3_2_1_32_1","unstructured":"K Murphy. 2012. Machine learning: a probabilistic approach. Massachusetts Institute of Technology (2012).  K Murphy. 2012. Machine learning: a probabilistic approach. Massachusetts Institute of Technology (2012)."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2017.172"},{"key":"e_1_3_2_1_34_1","unstructured":"Nicolas Papernot Patrick McDaniel and Ian Goodfellow. 2016. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277 (2016).  Nicolas Papernot Patrick McDaniel and Ian Goodfellow. 2016. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277 (2016)."},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2018.00159"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2018.00211"},{"key":"e_1_3_2_1_38_1","unstructured":"K. Simonyan and A. Zisserman. 2014. Very Deep Convolutional Networks for Large-Scale Image Recognition. CoRR Vol. abs\/1409.1556 (2014).  K. Simonyan and A. Zisserman. 2014. Very Deep Convolutional Networks for Large-Scale Image Recognition. CoRR Vol. abs\/1409.1556 (2014)."},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"e_1_3_2_1_40_1","unstructured":"Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian Goodfellow and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013).  Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian Goodfellow and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)."},{"volume-title":"25th USENIX Security Symposium (USENIX Security 16)","year":"2016","author":"Tram\u00e8r Florian","key":"e_1_3_2_1_41_1"},{"key":"e_1_3_2_1_42_1","unstructured":"Chun-Chen Tu Paishun Ting Pin-Yu Chen Sijia Liu Huan Zhang Jinfeng Yi Cho-Jui Hsieh and Shin-Ming Cheng. 2018. AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networks. arXiv preprint arXiv:1805.11770 (2018).  Chun-Chen Tu Paishun Ting Pin-Yu Chen Sijia Liu Huan Zhang Jinfeng Yi Cho-Jui Hsieh and Shin-Ming Cheng. 2018. AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networks. arXiv preprint arXiv:1805.11770 (2018)."},{"volume-title":"27th USENIX Security Symposium ($$USENIX$$ Security 18)","year":"2018","author":"Wang Bolun","key":"e_1_3_2_1_43_1"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/CEC.2008.4631255"},{"volume-title":"Mitigating Adversarial Effects Through Randomization. In ICLR","year":"2018","author":"Xie Cihang","key":"e_1_3_2_1_45_1"}],"event":{"name":"CCS '19: 2019 ACM SIGSAC Conference on Computer and Communications Security","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"location":"London United Kingdom","acronym":"CCS '19"},"container-title":["Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3338501.3357366","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3338501.3357366","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T23:12:49Z","timestamp":1750201969000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3338501.3357366"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,11,11]]},"references-count":45,"alternative-id":["10.1145\/3338501.3357366","10.1145\/3338501"],"URL":"https:\/\/doi.org\/10.1145\/3338501.3357366","relation":{},"subject":[],"published":{"date-parts":[[2019,11,11]]},"assertion":[{"value":"2019-11-11","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}