{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,20]],"date-time":"2026-02-20T11:48:34Z","timestamp":1771588114495,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":55,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,11,30]],"date-time":"2023-11-30T00:00:00Z","timestamp":1701302400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,11,30]]},"DOI":"10.1145\/3611643.3616370","type":"proceedings-article","created":{"date-parts":[[2023,11,30]],"date-time":"2023-11-30T23:14:38Z","timestamp":1701386078000},"page":"1384-1394","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":7,"title":["DeepRover: A Query-Efficient Blackbox Attack for Deep Neural Networks"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-6560-5102","authenticated-orcid":false,"given":"Fuyuan","family":"Zhang","sequence":"first","affiliation":[{"name":"Kyushu University, Fukuoka, Japan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9566-5424","authenticated-orcid":false,"given":"Xinwen","family":"Hu","sequence":"additional","affiliation":[{"name":"Hunan Normal University, Changsha, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8621-2420","authenticated-orcid":false,"given":"Lei","family":"Ma","sequence":"additional","affiliation":[{"name":"The University of Tokyo, Tokyo, Japan \/ University of Alberta, Edmonton, Canada"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8083-4352","authenticated-orcid":false,"given":"Jianjun","family":"Zhao","sequence":"additional","affiliation":[{"name":"Kyushu University, Fukuoka, Japan"}]}],"member":"320","published-online":{"date-parts":[[2023,11,30]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"Abdullah Al-Dujaili and Una-May O\u2019Reilly. 2020. Sign Bits Are All You Need for Black-Box Attacks. In ICLR."},{"key":"e_1_3_2_2_2_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"e_1_3_2_2_3_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_10"},{"key":"e_1_3_2_2_4_1","unstructured":"Wieland Brendel Jonas Rauber and Matthias Bethge. 2018. Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models. In ICLR. OpenReview.net."},{"key":"e_1_3_2_2_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_2_2_6_1","doi-asserted-by":"publisher","unstructured":"Pin-Yu Chen Huan Zhang Yash Sharma Jinfeng Yi and Cho-Jui Hsieh. 2017. ZOO: Zeroth Order Optimization Based Black-box Attacks to Deep Neural Networks Without Training Substitute Models. In AISec@CCS. ACM 15\u201326. https:\/\/doi.org\/10.1145\/3128572.3140448 10.1145\/3128572.3140448","DOI":"10.1145\/3128572.3140448"},{"key":"e_1_3_2_2_7_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58555-6_17"},{"key":"e_1_3_2_2_8_1","unstructured":"Minhao Cheng Thong Le Pin-Yu Chen Huan Zhang Jinfeng Yi and Cho-Jui Hsieh. 2019. Query-Efficient Hard-label Black-box Attack: An Optimization-based Approach. In ICLR."},{"key":"e_1_3_2_2_9_1","unstructured":"Minhao Cheng Simranjit Singh Patrick H. Chen Pin-Yu Chen Sijia Liu and Cho-Jui Hsieh. 2020. Sign-OPT: A Query-Efficient Hard-label Adversarial Attack. In ICLR."},{"key":"e_1_3_2_2_10_1","doi-asserted-by":"publisher","unstructured":"Xiaoning Du Xiaofei Xie Yi Li Lei Ma Yang Liu and Jianjun Zhao. 2019. DeepStellar: model-based quantitative analysis of stateful deep learning systems. In ESEC\/FSE. ACM 477\u2013487. https:\/\/doi.org\/10.1145\/3338906.3338954 10.1145\/3338906.3338954","DOI":"10.1145\/3338906.3338954"},{"key":"e_1_3_2_2_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00058"},{"key":"e_1_3_2_2_12_1","unstructured":"Ian J. Goodfellow Jonathon Shlens and Christian Szegedy. 2015. Explaining and Harnessing Adversarial Examples. In ICLR."},{"key":"e_1_3_2_2_13_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01090-4_1"},{"key":"e_1_3_2_2_14_1","volume-title":"Symbolic Execution for Deep Neural Networks. CoRR, abs\/1807.10439","author":"Gopinath Divya","year":"2018","unstructured":"Divya Gopinath, Kaiyuan Wang, Mengshi Zhang, Corina S. Pasareanu, and Sarfraz Khurshid. 2018. Symbolic Execution for Deep Neural Networks. CoRR, abs\/1807.10439 (2018)."},{"key":"e_1_3_2_2_15_1","volume-title":"Andrew Gordon Wilson, and Kilian Q. Weinberger","author":"Guo Chuan","year":"2019","unstructured":"Chuan Guo, Jacob R. Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Q. Weinberger. 2019. Simple Black-box Adversarial Attacks. In ICML. PMLR."},{"key":"e_1_3_2_2_16_1","doi-asserted-by":"publisher","unstructured":"Jianmin Guo Yu Jiang Yue Zhao Quan Chen and Jiaguang Sun. 2018. DLFuzz: Differential Fuzzing Testing of Deep Learning Systems. In ESEC\/FSE. ACM 739\u2013743. https:\/\/doi.org\/10.1145\/3236024.3264835 10.1145\/3236024.3264835","DOI":"10.1145\/3236024.3264835"},{"key":"e_1_3_2_2_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_2_2_18_1","volume-title":"ICML (PMLR","volume":"2151","author":"Ilyas Andrew","year":"2018","unstructured":"Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. 2018. Black-Box Adversarial Attacks with Limited Queries and Information. In ICML (PMLR, Vol. 80). PMLR, 2142\u20132151."},{"key":"e_1_3_2_2_19_1","volume-title":"Prior Convictions: Black-box Adversarial Attacks with Bandits and Priors. In ICLR.","author":"Ilyas Andrew","year":"2019","unstructured":"Andrew Ilyas, Logan Engstrom, and Aleksander Madry. 2019. Prior Convictions: Black-box Adversarial Attacks with Bandits and Priors. In ICLR."},{"key":"e_1_3_2_2_20_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-63387-9_5"},{"key":"e_1_3_2_2_21_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-25540-4_26"},{"key":"e_1_3_2_2_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00108"},{"key":"e_1_3_2_2_23_1","volume-title":"Learning Multiple Layers of Features from Tiny Images","author":"Krizhevsky Alex","unstructured":"Alex Krizhevsky. 2009. Learning Multiple Layers of Features from Tiny Images. University of Toronto."},{"key":"e_1_3_2_2_24_1","doi-asserted-by":"crossref","unstructured":"Alexey Kurakin Ian J. Goodfellow and Samy Bengio. 2017. Adversarial Examples in the Physical World. In ICLR. OpenReview.net.","DOI":"10.1201\/9781351251389-8"},{"key":"e_1_3_2_2_25_1","doi-asserted-by":"publisher","unstructured":"Lei Ma Felix Juefei-Xu Fuyuan Zhang Jiyuan Sun Minhui Xue Bo Li Chunyang Chen Ting Su Li Li Yang Liu Jianjun Zhao and Yadong Wang. 2018. DeepGauge: Multi-Granularity Testing Criteria for Deep Learning Systems. In ASE. ACM 120\u2013131. https:\/\/doi.org\/10.1145\/3238147.3238202 10.1145\/3238147.3238202","DOI":"10.1145\/3238147.3238202"},{"key":"e_1_3_2_2_26_1","volume-title":"Combinatorial Testing for Deep Learning Systems. CoRR, abs\/1806.07723","author":"Ma Lei","year":"2018","unstructured":"Lei Ma, Fuyuan Zhang, Minhui Xue, Bo Li, Yang Liu, Jianjun Zhao, and Yadong Wang. 2018. Combinatorial Testing for Deep Learning Systems. CoRR, abs\/1806.07723 (2018)."},{"key":"e_1_3_2_2_27_1","doi-asserted-by":"publisher","unstructured":"Shiqing Ma Yingqi Liu Wen-Chuan Lee Xiangyu Zhang and Ananth Grama. 2018. MODE: automated neural network model debugging via state differential analysis and input selection. In ESEC\/FSE. ACM 175\u2013186. https:\/\/doi.org\/10.1145\/3236024.3236082 10.1145\/3236024.3236082","DOI":"10.1145\/3236024.3236082"},{"key":"e_1_3_2_2_28_1","unstructured":"Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. In ICLR. OpenReview.net."},{"key":"e_1_3_2_2_29_1","unstructured":"Seungyong Moon Gaon An and Hyun Oh Song. 2019. Parsimonious Black-Box Adversarial Attacks via Efficient Combinatorial Optimization. In ICML. PMLR."},{"key":"e_1_3_2_2_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"e_1_3_2_2_31_1","volume-title":"Reading Digits in Natural Images with Unsupervised Feature Learning. In NIPS Workshop on Deep Learning and Unsupervised Feature Learning.","author":"Netzer Yuval","year":"2011","unstructured":"Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. 2011. Reading Digits in Natural Images with Unsupervised Feature Learning. In NIPS Workshop on Deep Learning and Unsupervised Feature Learning."},{"key":"e_1_3_2_2_32_1","volume-title":"Goodfellow","author":"Odena Augustus","year":"2019","unstructured":"Augustus Odena, Catherine Olsson, David Andersen, and Ian J. Goodfellow. 2019. TensorFuzz: Debugging Neural Networks with Coverage-Guided Fuzzing. In ICML (PMLR, Vol. 97). PMLR, 4901\u20134911."},{"key":"e_1_3_2_2_33_1","volume-title":"Goodfellow","author":"Papernot Nicolas","year":"2016","unstructured":"Nicolas Papernot, Patrick D. McDaniel, and Ian J. Goodfellow. 2016. Transferability in Machine Learning: From Phenomena to Black-Box Attacks Using Adversarial Samples. CoRR, abs\/1605.07277 (2016)."},{"key":"e_1_3_2_2_34_1","doi-asserted-by":"publisher","unstructured":"Nicolas Papernot Patrick D. McDaniel Ian J. Goodfellow Somesh Jha Z. Berkay Celik and Ananthram Swami. 2017. Practical Black-Box Attacks Against Machine Learning. In AsiaCCS. ACM 506\u2013519. https:\/\/doi.org\/10.1145\/3052973.3053009 10.1145\/3052973.3053009","DOI":"10.1145\/3052973.3053009"},{"key":"e_1_3_2_2_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/EUROSP.2016.36"},{"key":"e_1_3_2_2_36_1","doi-asserted-by":"publisher","unstructured":"Kexin Pei Yinzhi Cao Junfeng Yang and Suman Jana. 2017. DeepXplore: Automated Whitebox Testing of Deep Learning Systems. In SOSP. ACM 1\u201318. https:\/\/doi.org\/10.1145\/3132747.3132785 10.1145\/3132747.3132785","DOI":"10.1145\/3132747.3132785"},{"key":"e_1_3_2_2_37_1","doi-asserted-by":"crossref","unstructured":"Olga Russakovsky Jia Deng Hao Su Jonathan Krause Sanjeev Satheesh Sean Ma Zhiheng Huang Andrej Karpathy Aditya Khosla Michael Bernstein Alexander C. Berg and Fei-Fei Li. 2015. ImageNet Large Scale Visual Recognition Challenge. IJCV 211\u2013252.","DOI":"10.1007\/s11263-015-0816-y"},{"key":"e_1_3_2_2_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/3290354"},{"key":"e_1_3_2_2_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/3453483.3454064"},{"key":"e_1_3_2_2_40_1","doi-asserted-by":"publisher","unstructured":"Bing Sun Jun Sun Long H. Pham and Tie Shi. 2022. Causality-Based Neural Network Repair. In ICSE. ACM 338\u2013349. https:\/\/doi.org\/10.1145\/3510003.3510080 10.1145\/3510003.3510080","DOI":"10.1145\/3510003.3510080"},{"key":"e_1_3_2_2_41_1","volume-title":"Testing Deep Neural Networks. CoRR, abs\/1803.04792","author":"Sun Youcheng","year":"2018","unstructured":"Youcheng Sun, Xiaowei Huang, and Daniel Kroening. 2018. Testing Deep Neural Networks. CoRR, abs\/1803.04792 (2018)."},{"key":"e_1_3_2_2_42_1","doi-asserted-by":"publisher","unstructured":"Youcheng Sun Min Wu Wenjie Ruan Xiaowei Huang Marta Kwiatkowska and Daniel Kroening. 2018. Concolic Testing for Deep Neural Networks. In ASE. ACM 109\u2013119. https:\/\/doi.org\/10.1145\/3238147.3238172 10.1145\/3238147.3238172","DOI":"10.1145\/3238147.3238172"},{"key":"e_1_3_2_2_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"e_1_3_2_2_44_1","unstructured":"Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian J. Goodfellow and Rob Fergus. 2014. Intriguing Properties of Neural Networks. In ICLR."},{"key":"e_1_3_2_2_45_1","doi-asserted-by":"publisher","unstructured":"Yuchi Tian Kexin Pei Suman Jana and Baishakhi Ray. 2018. DeepTest: Automated Testing of Deep-Neural-Network-Driven Autonomous Cars. In ICSE. ACM 303\u2013314. https:\/\/doi.org\/10.1145\/3180155.3180220 10.1145\/3180155.3180220","DOI":"10.1145\/3180155.3180220"},{"key":"e_1_3_2_2_46_1","doi-asserted-by":"publisher","unstructured":"Caterina Urban Maria Christakis Valentin W\u00fcstholz and Fuyuan Zhang. 2020. Perfectly parallel fairness certification of neural networks. 185:1\u2013185:30. https:\/\/doi.org\/10.1145\/3428253 10.1145\/3428253","DOI":"10.1145\/3428253"},{"key":"e_1_3_2_2_47_1","doi-asserted-by":"publisher","unstructured":"Xiaofei Xie Lei Ma Felix Juefei-Xu Minhui Xue Hongxu Chen Yang Liu Jianjun Zhao Bo Li Jianxiong Yin and Simon See. 2019. DeepHunter: A Coverage-Guided Fuzz Testing Framework for Deep Neural Networks. In ISSTA. ACM 146\u2013157. https:\/\/doi.org\/10.1145\/3293882.3330579 10.1145\/3293882.3330579","DOI":"10.1145\/3293882.3330579"},{"key":"e_1_3_2_2_48_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i12.26779"},{"key":"e_1_3_2_2_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2021.3096332"},{"key":"e_1_3_2_2_50_1","doi-asserted-by":"publisher","unstructured":"Yuanyuan Yuan Qi Pang and Shuai Wang. 2023. Revisiting Neuron Coverage for DNN Testing: A layer-Wise and Distribution-Aware Criterion. In ICSE. 1200\u20131212. https:\/\/doi.org\/10.1109\/ICSE48619.2023.00107 10.1109\/ICSE48619.2023.00107","DOI":"10.1109\/ICSE48619.2023.00107"},{"key":"e_1_3_2_2_51_1","doi-asserted-by":"crossref","unstructured":"Sergey Zagoruyko and Nikos Komodakis. 2016. Wide Residual Networks. In BMVC.","DOI":"10.5244\/C.30.87"},{"key":"e_1_3_2_2_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/3368089.3409750"},{"key":"e_1_3_2_2_53_1","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2019.00043"},{"key":"e_1_3_2_2_54_1","volume-title":"Laurent El Ghaoui, and Michael I. Jordan","author":"Zhang Hongyang","year":"2019","unstructured":"Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. 2019. Theoretically Principled Trade-off between Robustness and Accuracy. In ICML."},{"key":"e_1_3_2_2_55_1","doi-asserted-by":"publisher","unstructured":"Mengshi Zhang Yuqun Zhang Lingming Zhang Cong Liu and Sarfraz Khurshid. 2018. DeepRoad: GAN-Based Metamorphic Testing and Input Validation Framework for Autonomous Driving Systems. In ASE. ACM 132\u2013142. https:\/\/doi.org\/10.1145\/3238147.3238187 10.1145\/3238147.3238187","DOI":"10.1145\/3238147.3238187"}],"event":{"name":"ESEC\/FSE '23: 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering","location":"San Francisco CA USA","acronym":"ESEC\/FSE '23","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering"]},"container-title":["Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3611643.3616370","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3611643.3616370","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T16:36:11Z","timestamp":1750178171000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3611643.3616370"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,11,30]]},"references-count":55,"alternative-id":["10.1145\/3611643.3616370","10.1145\/3611643"],"URL":"https:\/\/doi.org\/10.1145\/3611643.3616370","relation":{},"subject":[],"published":{"date-parts":[[2023,11,30]]},"assertion":[{"value":"2023-11-30","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}