{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T04:13:04Z","timestamp":1750219984891,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":37,"publisher":"ACM","license":[{"start":{"date-parts":[[2022,10,17]],"date-time":"2022-10-17T00:00:00Z","timestamp":1665964800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"ITC of Hong Kong","award":["MHP\/001\/19"],"award-info":[{"award-number":["MHP\/001\/19"]}]},{"name":"Jiangsu Province Science and Technology Collaboration Fund","award":["BZ2021065"],"award-info":[{"award-number":["BZ2021065"]}]},{"name":"National Natural Science Foundation of China","award":["U20B2053"],"award-info":[{"award-number":["U20B2053"]}]},{"name":"National Key Research and Development Program of China","award":["2019YFE0198200"],"award-info":[{"award-number":["2019YFE0198200"]}]},{"name":"RGC of Hong Kong","award":["R6020-19,R6021-20,16211520"],"award-info":[{"award-number":["R6020-19,R6021-20,16211520"]}]},{"name":"HKMAAC"},{"name":"UGC Research Matching Grants","award":["RMGS20EG01-D,RMGS20CR11,RMGS20CR12,RMGS20EG19,RMGS20EG21"],"award-info":[{"award-number":["RMGS20EG01-D,RMGS20CR11,RMGS20CR12,RMGS20EG19,RMGS20EG21"]}]},{"name":"CUSBLT"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2022,10,17]]},"DOI":"10.1145\/3511808.3557276","type":"proceedings-article","created":{"date-parts":[[2022,10,16]],"date-time":"2022-10-16T01:29:57Z","timestamp":1665883797000},"page":"2661-2670","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Cross-domain Cross-architecture Black-box Attacks on Fine-tuned Models with Transferred Evolutionary Strategies"],"prefix":"10.1145","author":[{"given":"Yinghua","family":"Zhang","sequence":"first","affiliation":[{"name":"Hong Kong University of Science and Technology, Hong Kong, Hong Kong"}]},{"given":"Yangqiu","family":"Song","sequence":"additional","affiliation":[{"name":"Hong Kong University of Science and Technology, Hong Kong, Hong Kong"}]},{"given":"Kun","family":"Bai","sequence":"additional","affiliation":[{"name":"IEEE Senior Member, New York, NY, USA"}]},{"given":"Qiang","family":"Yang","sequence":"additional","affiliation":[{"name":"Hong Kong University of Science and Technology, WeBank, Hong Kong, Hong Kong"}]}],"member":"320","published-online":{"date-parts":[[2022,10,17]]},"reference":[{"volume-title":"Learning to attack: Adversarial transformation networks","author":"Baluja Shumeet","key":"e_1_3_2_1_1_1","unstructured":"Shumeet Baluja and Ian Fischer . 2018. Learning to attack: Adversarial transformation networks . In AAAI. AAAI Press , 2687--2695. Shumeet Baluja and Ian Fischer. 2018. Learning to attack: Adversarial transformation networks. In AAAI. AAAI Press, 2687--2695."},{"volume-title":"Practical black-box attacks on deep neural networks using efficient query mechanisms","author":"Bhagoji Arjun Nitin","key":"e_1_3_2_1_2_1","unstructured":"Arjun Nitin Bhagoji , Warren He , Bo Li , and Dawn Song . 2018. Practical black-box attacks on deep neural networks using efficient query mechanisms . In ECCV. Springer , 154--169. Arjun Nitin Bhagoji, Warren He, Bo Li, and Dawn Song. 2018. Practical black-box attacks on deep neural networks using efficient query mechanisms. In ECCV. Springer, 154--169."},{"key":"e_1_3_2_1_3_1","unstructured":"Wieland Brendel Jonas Rauber and Matthias Bethge. 2018. Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models. In ICLR.  Wieland Brendel Jonas Rauber and Matthias Bethge. 2018. Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models. In ICLR."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_2_1_5_1","volume-title":"Rays: A ray searching method for hard-label adversarial attack. In KDD. ACM, 1739--1747.","author":"Chen Jinghui","year":"2020","unstructured":"Jinghui Chen and Quanquan Gu . 2020 . Rays: A ray searching method for hard-label adversarial attack. In KDD. ACM, 1739--1747. Jinghui Chen and Quanquan Gu. 2020. Rays: A ray searching method for hard-label adversarial attack. In KDD. ACM, 1739--1747."},{"key":"e_1_3_2_1_6_1","volume-title":"Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In AISec. ACM, 15--26.","author":"Chen Pin-Yu","year":"2017","unstructured":"Pin-Yu Chen , Huan Zhang , Yash Sharma , Jinfeng Yi , and Cho-Jui Hsieh . 2017 . Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In AISec. ACM, 15--26. Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. 2017. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In AISec. ACM, 15--26."},{"key":"e_1_3_2_1_7_1","unstructured":"Minhao Cheng Thong Le Pin-Yu Chen Huan Zhang Jinfeng Yi and Cho-Jui Hsieh. 2019b. Query-Efficient Hard-label Black-box Attack: An Optimization-based Approach. In ICLR.  Minhao Cheng Thong Le Pin-Yu Chen Huan Zhang Jinfeng Yi and Cho-Jui Hsieh. 2019b. Query-Efficient Hard-label Black-box Attack: An Optimization-based Approach. In ICLR."},{"key":"e_1_3_2_1_8_1","unstructured":"Minhao Cheng Simranjit Singh Patrick H. Chen Pin-Yu Chen Sijia Liu and Cho-Jui Hsieh. 2020. Sign-OPT: A Query-Efficient Hard-label Adversarial Attack. In ICLR.  Minhao Cheng Simranjit Singh Patrick H. Chen Pin-Yu Chen Sijia Liu and Cho-Jui Hsieh. 2020. Sign-OPT: A Query-Efficient Hard-label Adversarial Attack. In ICLR."},{"key":"e_1_3_2_1_9_1","unstructured":"Shuyu Cheng Yinpeng Dong Tianyu Pang Hang Su and Jun Zhu. 2019a. Improving black-box adversarial attacks with a transfer-based prior. In NeurIPS. 10932--10942.  Shuyu Cheng Yinpeng Dong Tianyu Pang Hang Su and Jun Zhu. 2019a. Improving black-box adversarial attacks with a transfer-based prior. In NeurIPS. 10932--10942."},{"key":"e_1_3_2_1_10_1","unstructured":"Ian J Goodfellow Jonathon Shlens and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. In ICLR.  Ian J Goodfellow Jonathon Shlens and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. In ICLR."},{"key":"e_1_3_2_1_11_1","unstructured":"Yiwen Guo Ziang Yan and Changshui Zhang. 2019. Subspace attack: Exploiting promising subspaces for query-efficient black-box attacks. In NeurIPS. 3820--3829.  Yiwen Guo Ziang Yan and Changshui Zhang. 2019. Subspace attack: Exploiting promising subspaces for query-efficient black-box attacks. In NeurIPS. 3820--3829."},{"volume-title":"Deep residual learning for image recognition","author":"He Kaiming","key":"e_1_3_2_1_12_1","unstructured":"Kaiming He , Xiangyu Zhang , Shaoqing Ren , and Jian Sun . 2016. Deep residual learning for image recognition . In CVPR. IEEE Computer Society , 770--778. Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. In CVPR. IEEE Computer Society, 770--778."},{"key":"e_1_3_2_1_13_1","volume-title":"Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531","author":"Hinton Geoffrey","year":"2015","unstructured":"Geoffrey Hinton , Oriol Vinyals , and Jeff Dean . 2015. Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531 ( 2015 ). Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. 2015. Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531 (2015)."},{"key":"e_1_3_2_1_14_1","unstructured":"Zhichao Huang and Tong Zhang. 2020. Black-Box Adversarial Attack with Transferable Model-based Embedding. In ICLR.  Zhichao Huang and Tong Zhang. 2020. Black-Box Adversarial Attack with Transferable Model-based Embedding. In ICLR."},{"key":"e_1_3_2_1_15_1","volume-title":"ICML","volume":"80","author":"Ilyas Andrew","year":"2018","unstructured":"Andrew Ilyas , Logan Engstrom , Anish Athalye , and Jessy Lin . 2018 . Black-box Adversarial Attacks with Limited Queries and Information . In ICML , Vol. 80 . PMLR, 2142--2151. Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. 2018. Black-box Adversarial Attacks with Limited Queries and Information. In ICML, Vol. 80. PMLR, 2142--2151."},{"key":"e_1_3_2_1_16_1","volume-title":"ICLR Workshop.","author":"Kurakin Alexey","year":"2017","unstructured":"Alexey Kurakin , Ian J. Goodfellow , and Samy Bengio . 2017 . Adversarial examples in the physical world . In ICLR Workshop. Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. 2017. Adversarial examples in the physical world. In ICLR Workshop."},{"key":"e_1_3_2_1_17_1","volume-title":"A Review of Adversarial Attack and Defense for Classification Methods. The American Statistician","author":"Li Yao","year":"2021","unstructured":"Yao Li , Minhao Cheng , Cho-Jui Hsieh , and Thomas CM Lee . 2021. A Review of Adversarial Attack and Defense for Classification Methods. The American Statistician ( 2021 ), 1--44. Yao Li, Minhao Cheng, Cho-Jui Hsieh, and Thomas CM Lee. 2021. A Review of Adversarial Attack and Defense for Classification Methods. The American Statistician (2021), 1--44."},{"key":"e_1_3_2_1_18_1","volume-title":"ICML","volume":"97","author":"Li Yandong","year":"2019","unstructured":"Yandong Li , Lijun Li , Liqiang Wang , Tong Zhang , and Boqing Gong . 2019 . NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks . In ICML , Vol. 97 . PMLR, 3866--3876. Yandong Li, Lijun Li, Liqiang Wang, Tong Zhang, and Boqing Gong. 2019. NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks. In ICML, Vol. 97. PMLR, 3866--3876."},{"key":"e_1_3_2_1_19_1","unstructured":"Yanpei Liu Xinyun Chen Chang Liu and Dawn Song. 2017. Delving into transferable adversarial examples and black-box attacks. In ICLR.  Yanpei Liu Xinyun Chen Chang Liu and Dawn Song. 2017. Delving into transferable adversarial examples and black-box attacks. In ICLR."},{"key":"e_1_3_2_1_20_1","unstructured":"Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. 2018. Towards deep learning models resistant to adversarial attacks. In ICLR.  Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. 2018. Towards deep learning models resistant to adversarial attacks. In ICLR."},{"key":"e_1_3_2_1_21_1","volume-title":"ICML","volume":"97","author":"Maheswaranathan Niru","year":"2019","unstructured":"Niru Maheswaranathan , Luke Metz , George Tucker , Dami Choi , and Jascha Sohl-Dickstein . 2019 . Guided evolutionary strategies: augmenting random search with surrogate gradients . In ICML , Vol. 97 . PMLR, 4264--4273. Niru Maheswaranathan, Luke Metz, George Tucker, Dami Choi, and Jascha Sohl-Dickstein. 2019. Guided evolutionary strategies: augmenting random search with surrogate gradients. In ICML, Vol. 97. PMLR, 4264--4273."},{"volume-title":"Deepfool: a simple and accurate method to fool deep neural networks","author":"Moosavi-Dezfooli Seyed-Mohsen","key":"e_1_3_2_1_22_1","unstructured":"Seyed-Mohsen Moosavi-Dezfooli , Alhussein Fawzi , and Pascal Frossard . 2016. Deepfool: a simple and accurate method to fool deep neural networks . In CVPR. IEEE Computer Society , 2574--2582. Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. 2016. Deepfool: a simple and accurate method to fool deep neural networks. In CVPR. IEEE Computer Society, 2574--2582."},{"key":"e_1_3_2_1_23_1","volume-title":"Fahad Shahbaz Khan, and Fatih Porikli.","author":"Naseer Muhammad Muzammal","year":"2019","unstructured":"Muhammad Muzammal Naseer , Salman H Khan , Muhammad Haris Khan , Fahad Shahbaz Khan, and Fatih Porikli. 2019 . Cross-domain transferability of adversarial perturbations. In NeurIPS. 12885--12895. Muhammad Muzammal Naseer, Salman H Khan, Muhammad Haris Khan, Fahad Shahbaz Khan, and Fatih Porikli. 2019. Cross-domain transferability of adversarial perturbations. In NeurIPS. 12885--12895."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"crossref","unstructured":"Nicolas Papernot Patrick McDaniel Ian Goodfellow Somesh Jha Z Berkay Celik and Ananthram Swami. 2017. Practical black-box attacks against machine learning. In ACM ASIACCS. 506--519.  Nicolas Papernot Patrick McDaniel Ian Goodfellow Somesh Jha Z Berkay Celik and Ananthram Swami. 2017. Practical black-box attacks against machine learning. In ACM ASIACCS. 506--519.","DOI":"10.1145\/3052973.3053009"},{"volume-title":"Euro S&P","author":"Papernot Nicolas","key":"e_1_3_2_1_25_1","unstructured":"Nicolas Papernot , Patrick McDaniel , Somesh Jha , Matt Fredrikson , Z Berkay Celik , and Ananthram Swami . 2016. The limitations of deep learning in adversarial settings . In Euro S&P . IEEE , 372--387. Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. 2016. The limitations of deep learning in adversarial settings. In Euro S&P. IEEE, 372--387."},{"key":"e_1_3_2_1_26_1","volume-title":"Pytorch: An imperative style, high-performance deep learning library. In NeurIPS. 8026--8037.","author":"Paszke Adam","year":"2019","unstructured":"Adam Paszke , Sam Gross , Francisco Massa , Adam Lerer , James Bradbury , Gregory Chanan , Trevor Killeen , Zeming Lin , Natalia Gimelshein , Luca Antiga , 2019 . Pytorch: An imperative style, high-performance deep learning library. In NeurIPS. 8026--8037. Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. 2019. Pytorch: An imperative style, high-performance deep learning library. In NeurIPS. 8026--8037."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"e_1_3_2_1_28_1","unstructured":"Karen Simonyan and Andrew Zisserman. 2015. Very deep convolutional networks for large-scale image recognition. In ICLR.  Karen Simonyan and Andrew Zisserman. 2015. Very deep convolutional networks for large-scale image recognition. In ICLR."},{"volume-title":"Rethinking the inception architecture for computer vision","author":"Szegedy Christian","key":"e_1_3_2_1_29_1","unstructured":"Christian Szegedy , Vincent Vanhoucke , Sergey Ioffe , Jon Shlens , and Zbigniew Wojna . 2016. Rethinking the inception architecture for computer vision . In CVPR. IEEE Computer Society , 2818--2826. Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. 2016. Rethinking the inception architecture for computer vision. In CVPR. IEEE Computer Society, 2818--2826."},{"key":"e_1_3_2_1_30_1","unstructured":"Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian Goodfellow and Rob Fergus. 2014. Intriguing properties of neural networks. In ICLR.  Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian Goodfellow and Rob Fergus. 2014. Intriguing properties of neural networks. In ICLR."},{"key":"e_1_3_2_1_31_1","volume-title":"McDaniel","author":"Tram\u00e8r Florian","year":"2018","unstructured":"Florian Tram\u00e8r , Alexey Kurakin , Nicolas Papernot , Ian J. Goodfellow , Dan Boneh , and Patrick D . McDaniel . 2018 . Ensemble Adversarial Training: Attacks and Defenses. In ICLR. Florian Tram\u00e8r, Alexey Kurakin, Nicolas Papernot, Ian J. Goodfellow, Dan Boneh, and Patrick D. McDaniel. 2018. Ensemble Adversarial Training: Attacks and Defenses. In ICLR."},{"key":"e_1_3_2_1_32_1","volume-title":"Autozoom: Autoencoder-based zeroth order optimization method for attacking black-box neural networks","author":"Tu Chun-Chen","year":"2019","unstructured":"Chun-Chen Tu , Paishun Ting , Pin-Yu Chen , Sijia Liu , Huan Zhang , Jinfeng Yi , Cho-Jui Hsieh , and Shin-Ming Cheng . 2019 . Autozoom: Autoencoder-based zeroth order optimization method for attacking black-box neural networks . In AAAI. AAAI Press , 742--749. Chun-Chen Tu, Paishun Ting, Pin-Yu Chen, Sijia Liu, Huan Zhang, Jinfeng Yi, Cho-Jui Hsieh, and Shin-Ming Cheng. 2019. Autozoom: Autoencoder-based zeroth order optimization method for attacking black-box neural networks. In AAAI. AAAI Press, 742--749."},{"volume-title":"Deep Hashing Network for Unsupervised Domain Adaptation","author":"Venkateswara Hemanth","key":"e_1_3_2_1_33_1","unstructured":"Hemanth Venkateswara , Jose Eusebio , Shayok Chakraborty , and Sethuraman Panchanathan . 2017. Deep Hashing Network for Unsupervised Domain Adaptation . In CVPR. IEEE Computer Society , 5385--5394. Hemanth Venkateswara, Jose Eusebio, Shayok Chakraborty, and Sethuraman Panchanathan. 2017. Deep Hashing Network for Unsupervised Domain Adaptation. In CVPR. IEEE Computer Society, 5385--5394."},{"volume-title":"USENIX Security","author":"Wang Bolun","key":"e_1_3_2_1_34_1","unstructured":"Bolun Wang , Yuanshun Yao , Bimal Viswanath , Haitao Zheng , and Ben Y Zhao . 2018. With great training comes great vulnerability: Practical attacks against transfer learning . In USENIX Security . USENIX Association , 1281--1297. Bolun Wang, Yuanshun Yao, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. 2018. With great training comes great vulnerability: Practical attacks against transfer learning. In USENIX Security. USENIX Association, 1281--1297."},{"key":"e_1_3_2_1_35_1","volume-title":"Adversarial examples: Attacks and defenses for deep learning","author":"Yuan Xiaoyong","year":"2019","unstructured":"Xiaoyong Yuan , Pan He , Qile Zhu , and Xiaolin Li. 2019. Adversarial examples: Attacks and defenses for deep learning . IEEE TNNLS ( 2019 ). Xiaoyong Yuan, Pan He, Qile Zhu, and Xiaolin Li. 2019. Adversarial examples: Attacks and defenses for deep learning. IEEE TNNLS (2019)."},{"key":"e_1_3_2_1_36_1","volume-title":"ICML","volume":"97","author":"Zhang Hongyang","year":"2019","unstructured":"Hongyang Zhang , Yaodong Yu , Jiantao Jiao , Eric Xing , Laurent El Ghaoui , and Michael Jordan . 2019 . Theoretically principled trade-off between robustness and accuracy . In ICML , Vol. 97 . PMLR, 7472--7482. Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. 2019. Theoretically principled trade-off between robustness and accuracy. In ICML, Vol. 97. PMLR, 7472--7482."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"crossref","unstructured":"Yinghua Zhang Yangqiu Song Jian Liang Kun Bai and Qiang Yang. 2020. Two Sides of the Same Coin: White-box and Black-box Attacks for Transfer Learning. In KDD. ACM 2989--2997.  Yinghua Zhang Yangqiu Song Jian Liang Kun Bai and Qiang Yang. 2020. Two Sides of the Same Coin: White-box and Black-box Attacks for Transfer Learning. In KDD. ACM 2989--2997.","DOI":"10.1145\/3394486.3403349"}],"event":{"name":"CIKM '22: The 31st ACM International Conference on Information and Knowledge Management","sponsor":["SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web","SIGIR ACM Special Interest Group on Information Retrieval"],"location":"Atlanta GA USA","acronym":"CIKM '22"},"container-title":["Proceedings of the 31st ACM International Conference on Information & Knowledge Management"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3511808.3557276","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3511808.3557276","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:49:28Z","timestamp":1750182568000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3511808.3557276"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,10,17]]},"references-count":37,"alternative-id":["10.1145\/3511808.3557276","10.1145\/3511808"],"URL":"https:\/\/doi.org\/10.1145\/3511808.3557276","relation":{},"subject":[],"published":{"date-parts":[[2022,10,17]]},"assertion":[{"value":"2022-10-17","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}