{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,6]],"date-time":"2025-12-06T08:09:30Z","timestamp":1765008570663,"version":"3.46.0"},"publisher-location":"New York, NY, USA","reference-count":37,"publisher":"ACM","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,12,9]]},"DOI":"10.1145\/3743093.3771000","type":"proceedings-article","created":{"date-parts":[[2025,12,6]],"date-time":"2025-12-06T08:06:16Z","timestamp":1765008376000},"page":"1-7","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["AS-UAP:Attention-Shift Universal Adversarial Perturbation on Transformer-based Models"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-8235-3091","authenticated-orcid":false,"given":"Xiaoyu","family":"Zhang","sequence":"first","affiliation":[{"name":"Jinan University, Guangzhou, Guangdong, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-5716-400X","authenticated-orcid":false,"given":"Bowei","family":"Wu","sequence":"additional","affiliation":[{"name":"Jinan University, Guangzhou, Guangdong, China and Key Laboratory of Industrial Internet of Things and Networked Control, Ministry of Education of China, Chongqing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-0996-1865","authenticated-orcid":false,"given":"Shujun","family":"Xie","sequence":"additional","affiliation":[{"name":"Jinan University, Guangzhou, Guangdong, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-0160-7872","authenticated-orcid":false,"given":"Qiang","family":"Xu","sequence":"additional","affiliation":[{"name":"Jinan University, Guangzhou, Guangdong, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-6957-2145","authenticated-orcid":false,"given":"Shuai","family":"Pang","sequence":"additional","affiliation":[{"name":"Jinan University, Guangzhou, Guangdong, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4256-4528","authenticated-orcid":false,"given":"Dehua","family":"Zhou","sequence":"additional","affiliation":[{"name":"Jinan University, Guangzhou, Guangdong, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,12,6]]},"reference":[{"key":"e_1_3_3_2_2_2","unstructured":"Dosovitskiy Alexey. 2020. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/ 2010.11929 (2020)."},{"key":"e_1_3_3_2_3_2","unstructured":"Josh Beal Eric Kim Eric Tzeng Dong\u00a0Huk Park Andrew Zhai and Dmitry Kislyuk. 2020. Toward transformer-based object detection. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2012.09958 (2020)."},{"key":"e_1_3_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01007"},{"key":"e_1_3_3_2_5_2","unstructured":"Tom\u00a0B Brown Dandelion Man\u00e9 Aurko Roy Mart\u00edn Abadi and Justin Gilmer. 2017. Adversarial patch. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/1712.09665 (2017)."},{"key":"e_1_3_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP42928.2021.9506325"},{"key":"e_1_3_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"e_1_3_3_2_8_2","unstructured":"Yonggan Fu Shunyao Zhang Shang Wu Cheng Wan and Yingyan Lin. 2022. Patch-fool: Are vision transformers always robust against adversarial perturbations?arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2203.08392 (2022)."},{"key":"e_1_3_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00816"},{"key":"e_1_3_3_2_10_2","unstructured":"Ian\u00a0J Goodfellow Jonathon Shlens and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/1412.6572 (2014)."},{"key":"e_1_3_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01172"},{"key":"e_1_3_3_2_13_2","doi-asserted-by":"crossref","unstructured":"Haoqi Hu Xiaofeng Lu Xinpeng Zhang Tianxing Zhang and Guangling Sun. 2021. Inheritance attention matrix-based universal adversarial perturbations on vision transformers. IEEE Signal Processing Letters 28 (2021) 1923\u20131927.","DOI":"10.1109\/LSP.2021.3112099"},{"key":"e_1_3_3_2_14_2","doi-asserted-by":"crossref","unstructured":"Yihao Huang Qing Guo Felix Juefei-Xu Ming Hu Xiaojun Jia Xiaochun Cao Geguang Pu and Yang Liu. 2024. Texture Re-scalable Universal Adversarial Perturbation. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2406.06089 (2024).","DOI":"10.1109\/TIFS.2024.3416030"},{"key":"e_1_3_3_2_15_2","first-page":"2","volume-title":"Proceedings of naacL-HLT","volume":"1","author":"Kenton Jacob Devlin Ming-Wei\u00a0Chang","year":"2019","unstructured":"Jacob Devlin Ming-Wei\u00a0Chang Kenton and Lee\u00a0Kristina Toutanova. 2019. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of naacL-HLT , Vol.\u00a01. Minneapolis, Minnesota, 2."},{"key":"e_1_3_3_2_16_2","unstructured":"Alex Krizhevsky Ilya Sutskever and Geoffrey\u00a0E Hinton. 2012. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems 25 (2012)."},{"key":"e_1_3_3_2_17_2","unstructured":"Alexey Kurakin Ian Goodfellow and Samy Bengio. 2016. Adversarial machine learning at scale. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/1611.01236 (2016)."},{"key":"e_1_3_3_2_18_2","doi-asserted-by":"crossref","unstructured":"Yiran Li Junpeng Wang Xin Dai Liang Wang Chin-Chia\u00a0Michael Yeh Yan Zheng Wei Zhang and Kwan-Liu Ma. 2023. How does attention work in vision transformers? A visual analytics attempt. IEEE transactions on visualization and computer graphics 29 6 (2023) 2888\u20132900.","DOI":"10.1109\/TVCG.2023.3261935"},{"key":"e_1_3_3_2_19_2","unstructured":"Yinhan Liu. 2019. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/1907.11692 364 (2019)."},{"key":"e_1_3_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01480"},{"key":"e_1_3_3_2_21_2","unstructured":"Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/1706.06083 (2017)."},{"key":"e_1_3_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00774"},{"key":"e_1_3_3_2_23_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"e_1_3_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"e_1_3_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.6017"},{"key":"e_1_3_3_2_26_2","unstructured":"Rulin Shao Zhouxing Shi Jinfeng Yi Pin-Yu Chen and Cho-Jui Hsieh. 2021. On the adversarial robustness of vision transformers. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/2103.15670 (2021)."},{"key":"e_1_3_3_2_27_2","unstructured":"Yucheng Shi Yahong Han Yu-an Tan and Xiaohui Kuang. 2022. Decision-based black-box attack against vision transformers via patch-wise adversarial removal. Advances in Neural Information Processing Systems 35 (2022) 12921\u201312933."},{"key":"e_1_3_3_2_28_2","volume-title":"First International Conference on Learning Representations (ICLR 2015)","author":"Simonyan Karen","year":"2015","unstructured":"Karen Simonyan. 2015. Very deep convolutional networks for large-scale image recognition. In First International Conference on Learning Representations (ICLR 2015)."},{"key":"e_1_3_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00717"},{"key":"e_1_3_3_2_30_2","unstructured":"C Szegedy. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/1312.6199 (2013)."},{"key":"e_1_3_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298594"},{"key":"e_1_3_3_2_32_2","first-page":"10347","volume-title":"International conference on machine learning","author":"Touvron Hugo","year":"2021","unstructured":"Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Herv\u00e9 J\u00e9gou. 2021. Training data-efficient image transformers & distillation through attention. In International conference on machine learning. PMLR, 10347\u201310357."},{"key":"e_1_3_3_2_33_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00010"},{"key":"e_1_3_3_2_34_2","unstructured":"A Vaswani. 2017. Attention is all you need. Advances in Neural Information Processing Systems (2017)."},{"key":"e_1_3_3_2_35_2","doi-asserted-by":"crossref","unstructured":"Elena Voita David Talbot Fedor Moiseev Rico Sennrich and Ivan Titov. 2019. Analyzing multi-head self-attention: Specialized heads do the heavy lifting the rest can be pruned. arXiv preprint arXiv:https:\/\/arXiv.org\/abs\/1905.09418 (2019).","DOI":"10.18653\/v1\/P19-1580"},{"key":"e_1_3_3_2_36_2","doi-asserted-by":"crossref","unstructured":"Donghua Wang Wen Yao Tingsong Jiang and Xiaoqian Chen. 2023. Improving transferability of universal adversarial perturbation with feature disruption. IEEE Transactions on Image Processing (2023).","DOI":"10.1109\/TIP.2023.3345136"},{"key":"e_1_3_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN54540.2023.10191632"},{"key":"e_1_3_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00777"}],"event":{"name":"MMAsia '25: ACM Multimedia Asia","location":"Kuala Lumpur Malaysia","acronym":"MMAsia '25","sponsor":["SIGMM ACM Special Interest Group on Multimedia"]},"container-title":["Proceedings of the 7th ACM International Conference on Multimedia in Asia"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3743093.3771000","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,6]],"date-time":"2025-12-06T08:06:31Z","timestamp":1765008391000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3743093.3771000"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,12,6]]},"references-count":37,"alternative-id":["10.1145\/3743093.3771000","10.1145\/3743093"],"URL":"https:\/\/doi.org\/10.1145\/3743093.3771000","relation":{},"subject":[],"published":{"date-parts":[[2025,12,6]]},"assertion":[{"value":"2025-12-06","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}