{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,13]],"date-time":"2025-11-13T18:43:24Z","timestamp":1763059404147,"version":"build-2065373602"},"reference-count":49,"publisher":"Association for Computing Machinery (ACM)","issue":"10","funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["62372037 and U24B20179"],"award-info":[{"award-number":["62372037 and U24B20179"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100007129","name":"Shandong Provincial Natural Science Foundation","doi-asserted-by":"crossref","award":["ZR2022LZH011"],"award-info":[{"award-number":["ZR2022LZH011"]}],"id":[{"id":"10.13039\/501100007129","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Multimedia Comput. Commun. Appl."],"published-print":{"date-parts":[[2025,10,31]]},"abstract":"<jats:p>Transferable adversarial examples have received increasing attention for their utility in spoofing multiple models, but existing attacks still perform poorly in terms of transferability. In light of this, a novel attack method called Spatio-Temporal Context-Based Enhanced Momentum Iteration (STCEMI) is proposed for transferability enhancement. First, two spatially and temporally oriented context exploitation strategies are devised, respectively. On the one hand, the blended image is obtained by summing a randomly scrambled version of the original image with itself, and the correction of spatial context momentum to the gradient of the current position is achieved by utilizing the blended image to optimize the perturbation. On the other hand, with the short-time context obtained from single-step iteration along the backward and forward gradient directions, the gradient of the current iteration can be corrected by the temporal context momentum. Second, considering the complementarity of spatial and temporal contexts, two strategies are naturally integrated to construct the spatio-temporal context-based attack, STCEMI, with the objective of achieving stronger transferability. The results of extensive experiments demonstrate that the adversarial images generated by STCEMI achieve the highest cross-model attack success rate across multiple mainstream normally trained and adversarially trained models.<\/jats:p>","DOI":"10.1145\/3766545","type":"journal-article","created":{"date-parts":[[2025,9,10]],"date-time":"2025-09-10T14:04:33Z","timestamp":1757513073000},"page":"1-22","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Boosting Transferability of Adversarial Examples with Spatio-Temporal Context"],"prefix":"10.1145","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-9005-1337","authenticated-orcid":false,"given":"Jingtian","family":"Wang","sequence":"first","affiliation":[{"name":"Institute of Information Science, Beijing Jiaotong University, Beijing, China and Beijing Key Laboratory of Advanced Information Science and Network Technology, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6181-6044","authenticated-orcid":false,"given":"Xiaolong","family":"Li","sequence":"additional","affiliation":[{"name":"Institute of Information Science, Beijing Jiaotong University, Beijing, China and Beijing Key Laboratory of Advanced Information Science and Network Technology, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9030-7393","authenticated-orcid":false,"given":"Bin","family":"Ma","sequence":"additional","affiliation":[{"name":"School of Cyber Security, Qilu University of Technology, Jinan, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8581-9554","authenticated-orcid":false,"given":"Yao","family":"Zhao","sequence":"additional","affiliation":[{"name":"Institute of Information Science, Beijing Jiaotong University, Beijing, China and Beijing Key Laboratory of Advanced Information Science and Network Technology, Beijing, China"}]}],"member":"320","published-online":{"date-parts":[[2025,10,14]]},"reference":[{"key":"e_1_3_1_2_2","first-page":"1983","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR)","author":"Brendel Wieland","year":"2018","unstructured":"Wieland Brendel, Jonas Rauber, and Matthias Bethge. 2018. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In Proceedings of the International Conference on Learning Representations (ICLR), 1983\u20131994."},{"key":"e_1_3_1_3_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01481"},{"key":"e_1_3_1_4_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_1_5_2","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"e_1_3_1_6_2","first-page":"5169","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR)","author":"Cheng Minhao","year":"2019","unstructured":"Minhao Cheng, Thong Le, Pin-Yu Chen, Huan Zhang, JinFeng Yi, and Cho-Jui Hsieh. 2019. Query-Efficient hard-label black-box attack: An optimization-based approach. In Proceedings of the International Conference on Learning Representations (ICLR), 5169\u20135182."},{"key":"e_1_3_1_7_2","first-page":"1310","volume-title":"Proceedings of the International Conference on Machine Learning (ICML)","author":"Cohen Jeremy","year":"2019","unstructured":"Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. 2019. Certified adversarial robustness via randomized smoothing. In Proceedings of the International Conference on Machine Learning (ICML), 1310\u20131320."},{"key":"e_1_3_1_8_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"e_1_3_1_9_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"e_1_3_1_10_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"e_1_3_1_11_2","doi-asserted-by":"publisher","DOI":"10.1145\/3524619"},{"key":"e_1_3_1_12_2","first-page":"70141","article-title":"Boosting adversarial transferability by achieving flat local maxima","volume":"36","author":"Ge Zhijin","year":"2023","unstructured":"Zhijin Ge, Hongying Liu, Wang Xiaosen, Fanhua Shang, and Yuanyuan Liu. 2023. Boosting adversarial transferability by achieving flat local maxima. Proceedings of Advances in Neural Information Processing Systems 36 (2023), 70141\u201370161.","journal-title":"Proceedings of Advances in Neural Information Processing Systems"},{"key":"e_1_3_1_13_2","first-page":"1","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR)","author":"Goodfellow Ian J.","year":"2015","unstructured":"Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. In Proceedings of the International Conference on Learning Representations (ICLR), 1\u201311."},{"key":"e_1_3_1_14_2","first-page":"4914","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR)","author":"Guo Chuan","year":"2018","unstructured":"Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens van der Maaten. 2018. Countering adversarial images using input transformations. In Proceedings of the International Conference on Learning Representations (ICLR), 4914\u20134925."},{"key":"e_1_3_1_15_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_1_16_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01426"},{"key":"e_1_3_1_17_2","first-page":"99","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR)","author":"Kurakin Alexey","year":"2017","unstructured":"Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. 2017. Adversarial examples in the physical world. In Proceedings of the International Conference on Learning Representations (ICLR), 99\u2013112."},{"key":"e_1_3_1_18_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"e_1_3_1_19_2","first-page":"2854","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR)","author":"Lin Jiadong","year":"2020","unstructured":"Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E. Hopcroft. 2020. Nesterov accelerated gradient and scale invariance for adversarial attacks. In Proceedings of the International Conference on Learning Representations (ICLR), 2854\u20132865."},{"key":"e_1_3_1_20_2","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2023\/133"},{"key":"e_1_3_1_21_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00095"},{"key":"e_1_3_1_22_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19772-7_32"},{"key":"e_1_3_1_23_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00427"},{"key":"e_1_3_1_24_2","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR),","author":"Madry Aleksander","year":"2018","unstructured":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards deep learning models resistant to adversarial attacks. In Proceedings of the International Conference on Learning Representations (ICLR), 4138\u20134160."},{"key":"e_1_3_1_25_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"e_1_3_1_26_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00034"},{"key":"e_1_3_1_27_2","first-page":"543","article-title":"A method for unconstrained convex minimization problem with the rate of convergence O (1\/k2)","volume":"269","author":"Nesterov Yurii","year":"1983","unstructured":"Yurii Nesterov. 1983. A method for unconstrained convex minimization problem with the rate of convergence O (1\/k2). Doklady Akademii Nauk SSSR 269 (1983), 543.","journal-title":"Doklady Akademii Nauk SSSR"},{"key":"e_1_3_1_28_2","first-page":"29845","volume-title":"Proceedings of Advances in Neural Information Processing Systems (NeurIPS)","volume":"35","author":"Qin Zeyu","year":"2022","unstructured":"Zeyu Qin, Yanbo Fan, Yi Liu, Li Shen, Yong Zhang, Jue Wang, and Baoyuan Wu. 2022. Boosting the transferability of adversarial attacks with reverse adversarial perturbation. Proceedings of Advances in Neural Information Processing Systems (NeurIPS) 35 (2022), 29845\u201329858."},{"key":"e_1_3_1_29_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2023.119273"},{"key":"e_1_3_1_30_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.74"},{"key":"e_1_3_1_31_2","first-page":"1589","volume-title":"Proceedings of the USENIX Security Symposium (USENIX Security)","author":"Shan Shawn","year":"2020","unstructured":"Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Y. Zhao. 2020. Fawkes: Protecting privacy against unauthorized deep learning models. In Proceedings of the USENIX Security Symposium (USENIX Security), 1589\u20131604."},{"key":"e_1_3_1_32_2","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978392"},{"key":"e_1_3_1_33_2","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR),","author":"Song Chuanbiao","year":"2019","unstructured":"Chuanbiao Song, Kun He, Liwei Wang, and John E. Hopcroft. 2019. Improving the generalization of adversarial training with domain adaptation. In Proceedings of the International Conference on Learning Representations (ICLR), 2169\u20132182."},{"key":"e_1_3_1_34_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v31i1.11231"},{"key":"e_1_3_1_35_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"e_1_3_1_36_2","unstructured":"Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian Goodfellow and Rob Fergus. 2014. Intriguing properties of neural networks. arxiv:1312.6199. Retrieved from http:\/\/arxiv.org\/abs\/1312.6199"},{"key":"e_1_3_1_37_2","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR),","author":"Tram\u00e8r Florian","year":"2018","unstructured":"Florian Tram\u00e8r, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. 2018. Ensemble adversarial training: Attacks and defenses. In Proceedings of the International Conference on Learning Representations (ICLR), 1894\u20131913."},{"key":"e_1_3_1_38_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.3301742"},{"key":"e_1_3_1_39_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2024.124757"},{"key":"e_1_3_1_40_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00196"},{"key":"e_1_3_1_41_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01585"},{"key":"e_1_3_1_42_2","doi-asserted-by":"publisher","DOI":"10.5244\/C.35.186"},{"key":"e_1_3_1_43_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00425"},{"key":"e_1_3_1_44_2","first-page":"8909","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR)","author":"Wang Yisen","year":"2020","unstructured":"Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. 2020. Improving adversarial robustness requires revisiting misclassified examples. In Proceedings of the International Conference on Learning Representations (ICLR), 8909\u20138922."},{"key":"e_1_3_1_45_2","doi-asserted-by":"publisher","DOI":"10.1145\/3572843"},{"key":"e_1_3_1_46_2","first-page":"960","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR)","author":"Xie Cihang","year":"2018","unstructured":"Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. 2018. Mitigating adversarial effects through randomization. In Proceedings of the International Conference on Learning Representations (ICLR), 960\u2013975."},{"key":"e_1_3_1_47_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"e_1_3_1_48_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"e_1_3_1_49_2","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/173"},{"key":"e_1_3_1_50_2","first-page":"3231","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR)","author":"Zhang Yang","year":"2019","unstructured":"Yang Zhang, Hassan Foroosh, Philip David, and Boqing Gong. 2019. CAMOU: Learning physical vehicle camouflages to adversarially attack detectors in the wild. In Proceedings of the International Conference on Learning Representations (ICLR), 3231\u20133250."}],"container-title":["ACM Transactions on Multimedia Computing, Communications, and Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3766545","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,14]],"date-time":"2025-10-14T21:23:23Z","timestamp":1760477003000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3766545"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,14]]},"references-count":49,"journal-issue":{"issue":"10","published-print":{"date-parts":[[2025,10,31]]}},"alternative-id":["10.1145\/3766545"],"URL":"https:\/\/doi.org\/10.1145\/3766545","relation":{},"ISSN":["1551-6857","1551-6865"],"issn-type":[{"type":"print","value":"1551-6857"},{"type":"electronic","value":"1551-6865"}],"subject":[],"published":{"date-parts":[[2025,10,14]]},"assertion":[{"value":"2024-09-27","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-09-01","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-10-14","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}