{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,12,24]],"date-time":"2024-12-24T05:04:54Z","timestamp":1735016694228,"version":"3.32.0"},"reference-count":42,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2024,11,1]],"date-time":"2024-11-01T00:00:00Z","timestamp":1730419200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2024,11,1]],"date-time":"2024-11-01T00:00:00Z","timestamp":1730419200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2024,11,1]],"date-time":"2024-11-01T00:00:00Z","timestamp":1730419200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2024,11,1]],"date-time":"2024-11-01T00:00:00Z","timestamp":1730419200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2024,11,1]],"date-time":"2024-11-01T00:00:00Z","timestamp":1730419200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2024,11,1]],"date-time":"2024-11-01T00:00:00Z","timestamp":1730419200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2024,11,1]],"date-time":"2024-11-01T00:00:00Z","timestamp":1730419200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100004733","name":"University of Macau","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100004733","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Knowledge-Based Systems"],"published-print":{"date-parts":[[2024,11]]},"DOI":"10.1016\/j.knosys.2024.112576","type":"journal-article","created":{"date-parts":[[2024,10,1]],"date-time":"2024-10-01T23:25:36Z","timestamp":1727825136000},"page":"112576","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["Efficient physical image attacks using adversarial fast autoaugmentation methods"],"prefix":"10.1016","volume":"304","author":[{"given":"Xia","family":"Du","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1788-3746","authenticated-orcid":false,"given":"Chi-Man","family":"Pun","sequence":"additional","affiliation":[]},{"given":"Jizhe","family":"Zhou","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"issue":"7553","key":"10.1016\/j.knosys.2024.112576_b1","doi-asserted-by":"crossref","first-page":"436","DOI":"10.1038\/nature14539","article-title":"Deep learning","volume":"521","author":"LeCun","year":"2015","journal-title":"Nature"},{"key":"10.1016\/j.knosys.2024.112576_b2","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2021.107102","article-title":"A low-query black-box adversarial attack based on transferability","volume":"226","author":"Ding","year":"2021","journal-title":"Knowl.-Based Syst."},{"key":"10.1016\/j.knosys.2024.112576_b3","doi-asserted-by":"crossref","unstructured":"X. Du, C.-M. Pun, Z. Zhang, A Unified Framework for Detecting Audio Adversarial Examples, in: Proceedings of the 28th ACM International Conference on Multimedia, 2020, pp. 3986\u20133994.","DOI":"10.1145\/3394171.3413603"},{"key":"10.1016\/j.knosys.2024.112576_b4","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2021.107503","article-title":"DARE: Deceiving audio\u2013visual speech recognition model","volume":"232","author":"Mishra","year":"2021","journal-title":"Knowl.-Based Syst."},{"key":"10.1016\/j.knosys.2024.112576_b5","doi-asserted-by":"crossref","DOI":"10.1109\/TPAMI.2023.3277122","article-title":"A survey on non-autoregressive generation for neural machine translation and beyond","author":"Xiao","year":"2023","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"10.1016\/j.knosys.2024.112576_b6","doi-asserted-by":"crossref","unstructured":"H. Zhuang, Y. Zhang, S. Liu, A pilot study of query-free adversarial attack against stable diffusion, in: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 2384\u20132391.","DOI":"10.1109\/CVPRW59228.2023.00236"},{"key":"10.1016\/j.knosys.2024.112576_b7","doi-asserted-by":"crossref","unstructured":"Z. Li, B. Yin, T. Yao, J. Guo, S. Ding, S. Chen, C. Liu, Sibling-Attack: Rethinking Transferable Adversarial Attacks against Face Recognition, in: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 24626\u201324637.","DOI":"10.1109\/CVPR52729.2023.02359"},{"key":"10.1016\/j.knosys.2024.112576_b8","unstructured":"C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, R. Fergus, Intriguing properties of neural networks, in: International Conference on Learning Representations, ICLR 2014, 2014."},{"issue":"7","key":"10.1016\/j.knosys.2024.112576_b9","doi-asserted-by":"crossref","first-page":"1796","DOI":"10.1109\/TMM.2019.2949872","article-title":"Learning reliable visual saliency for model explanations","volume":"22","author":"Wang","year":"2019","journal-title":"IEEE Trans. Multimed."},{"key":"10.1016\/j.knosys.2024.112576_b10","unstructured":"I. Goodfellow, J. Shlens, C. Szegedy, Explaining and Harnessing Adversarial Examples, in: International Conference on Learning Representations, 2015."},{"key":"10.1016\/j.knosys.2024.112576_b11","series-title":"2017 IEEE Symposium on Security and Privacy","first-page":"39","article-title":"Towards evaluating the robustness of neural networks","author":"Carlini","year":"2017"},{"key":"10.1016\/j.knosys.2024.112576_b12","series-title":"ICLR Workshop","article-title":"Adversarial examples in the physical world","author":"Kurakin","year":"2017"},{"key":"10.1016\/j.knosys.2024.112576_b13","article-title":"Generalizable black-box adversarial attack with meta learning","author":"Yin","year":"2023","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"10.1016\/j.knosys.2024.112576_b14","doi-asserted-by":"crossref","unstructured":"J. Zhang, Y. Huang, W. Wu, M.R. Lyu, Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularization, in: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 16415\u201316424.","DOI":"10.1109\/CVPR52729.2023.01575"},{"key":"10.1016\/j.knosys.2024.112576_b15","doi-asserted-by":"crossref","unstructured":"P.N. Williams, K. Li, Black-Box Sparse Adversarial Attack via Multi-Objective Optimisation, in: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 12291\u201312301.","DOI":"10.1109\/CVPR52729.2023.01183"},{"key":"10.1016\/j.knosys.2024.112576_b16","series-title":"Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security","first-page":"1528","article-title":"Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition","author":"Sharif","year":"2016"},{"year":"2016","series-title":"Adversarial examples in the physical world","author":"Kurakin","key":"10.1016\/j.knosys.2024.112576_b17"},{"key":"10.1016\/j.knosys.2024.112576_b18","series-title":"Proceedings of the 35th International Conference on Machine Learning","first-page":"284","article-title":"Synthesizing robust adversarial examples","volume":"vol. 80","author":"Athalye","year":"2018"},{"year":"2019","series-title":"On physical adversarial patches for object detection","author":"Lee","key":"10.1016\/j.knosys.2024.112576_b19"},{"key":"10.1016\/j.knosys.2024.112576_b20","unstructured":"J. Li, F. Schmidt, Z. Kolter, Adversarial camera stickers: A physical camera-based attack on deep learning systems, in: International Conference on Machine Learning, 2019, pp. 3896\u20133904."},{"year":"2019","series-title":"AdvHat: Real-world adversarial attack on ArcFace face ID system","author":"Komkov","key":"10.1016\/j.knosys.2024.112576_b21"},{"key":"10.1016\/j.knosys.2024.112576_b22","doi-asserted-by":"crossref","unstructured":"B. Phan, F. Mannan, F. Heide, Adversarial imaging pipelines, in: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, 2021, pp. 16051\u201316061.","DOI":"10.1109\/CVPR46437.2021.01579"},{"key":"10.1016\/j.knosys.2024.112576_b23","doi-asserted-by":"crossref","unstructured":"X. Du, C.-M. Pun, Adversarial Image Attacks Using Multi-Sample and Most-Likely Ensemble Methods, in: Proceedings of the 28th ACM International Conference on Multimedia, 2020, pp. 1634\u20131642.","DOI":"10.1145\/3394171.3413808"},{"key":"10.1016\/j.knosys.2024.112576_b24","series-title":"Advances in Neural Information Processing Systems","first-page":"6665","article-title":"Fast autoaugment","author":"Lim","year":"2019"},{"year":"2016","series-title":"Delving into transferable adversarial examples and black-box attacks","author":"Liu","key":"10.1016\/j.knosys.2024.112576_b25"},{"key":"10.1016\/j.knosys.2024.112576_b26","series-title":"Advances in Neural Information Processing Systems","first-page":"231","article-title":"Neural network ensembles, cross validation, and active learning","author":"Krogh","year":"1995"},{"key":"10.1016\/j.knosys.2024.112576_b27","series-title":"Proceedings of the Twenty-First International Conference on Machine Learning","first-page":"18","article-title":"Ensemble selection from libraries of models","author":"Caruana","year":"2004"},{"key":"10.1016\/j.knosys.2024.112576_b28","doi-asserted-by":"crossref","unstructured":"K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, D. Song, Robust physical-world attacks on deep learning visual classification, in: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2018, pp. 1625\u20131634.","DOI":"10.1109\/CVPR.2018.00175"},{"key":"10.1016\/j.knosys.2024.112576_b29","doi-asserted-by":"crossref","unstructured":"E.D. Cubuk, B. Zoph, D. Mane, V. Vasudevan, Q.V. Le, Autoaugment: Learning augmentation policies from data, in: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, 2019, pp. 113\u2013123.","DOI":"10.1109\/CVPR.2019.00020"},{"issue":"4","key":"10.1016\/j.knosys.2024.112576_b30","doi-asserted-by":"crossref","first-page":"345","DOI":"10.1023\/A:1012771025575","article-title":"A taxonomy of global optimization methods based on response surfaces","volume":"21","author":"Jones","year":"2001","journal-title":"J. Glob. Optim."},{"key":"10.1016\/j.knosys.2024.112576_b31","doi-asserted-by":"crossref","unstructured":"K. He, H. Fan, Y. Wu, S. Xie, R. Girshick, Momentum contrast for unsupervised visual representation learning, in: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, 2020, pp. 9729\u20139738.","DOI":"10.1109\/CVPR42600.2020.00975"},{"year":"2017","series-title":"Ensemble adversarial training: Attacks and defenses","author":"Tram\u00e8r","key":"10.1016\/j.knosys.2024.112576_b32"},{"key":"10.1016\/j.knosys.2024.112576_b33","doi-asserted-by":"crossref","unstructured":"Y. Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, J. Li, Boosting adversarial attacks with momentum, in: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2018, pp. 9185\u20139193.","DOI":"10.1109\/CVPR.2018.00957"},{"key":"10.1016\/j.knosys.2024.112576_b34","doi-asserted-by":"crossref","first-page":"598","DOI":"10.1109\/TIP.2021.3127849","article-title":"Universal adversarial patch attack for automatic checkout using perceptual and attentional bias","volume":"31","author":"Wang","year":"2021","journal-title":"IEEE Trans. Image Process."},{"key":"10.1016\/j.knosys.2024.112576_b35","series-title":"European Conference on Computer Vision","first-page":"514","article-title":"Physical attack on monocular depth estimation with optimal adversarial patches","author":"Cheng","year":"2022"},{"key":"10.1016\/j.knosys.2024.112576_b36","doi-asserted-by":"crossref","DOI":"10.1016\/j.patcog.2023.109435","article-title":"Boosting transferability of physical attack against detectors by redistributing separable attention","volume":"138","author":"Zhang","year":"2023","journal-title":"Pattern Recognit."},{"issue":"3","key":"10.1016\/j.knosys.2024.112576_b37","first-page":"2711","article-title":"Adversarial sticker: A stealthy attack method in the physical world","volume":"45","author":"Wei","year":"2022","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"year":"2019","series-title":"Fooling a real car with adversarial traffic signs","author":"Morgulis","key":"10.1016\/j.knosys.2024.112576_b38"},{"key":"10.1016\/j.knosys.2024.112576_b39","unstructured":"C. Xie, J. Wang, Z. Zhang, Z. Ren, A. Yuille, Mitigating Adversarial Effects Through Randomization, in: International Conference on Learning Representations, 2018."},{"key":"10.1016\/j.knosys.2024.112576_b40","doi-asserted-by":"crossref","unstructured":"W. Xu, D. Evans, Y. Qi, Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks, in: 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018, 2018.","DOI":"10.14722\/ndss.2018.23198"},{"year":"2016","series-title":"A study of the effect of jpg compression on adversarial images","author":"Dziugaite","key":"10.1016\/j.knosys.2024.112576_b41"},{"year":"2017","series-title":"Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression","author":"Das","key":"10.1016\/j.knosys.2024.112576_b42"}],"container-title":["Knowledge-Based Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0950705124012103?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0950705124012103?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2024,12,23]],"date-time":"2024-12-23T07:51:03Z","timestamp":1734940263000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0950705124012103"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,11]]},"references-count":42,"alternative-id":["S0950705124012103"],"URL":"https:\/\/doi.org\/10.1016\/j.knosys.2024.112576","relation":{},"ISSN":["0950-7051"],"issn-type":[{"type":"print","value":"0950-7051"}],"subject":[],"published":{"date-parts":[[2024,11]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Efficient physical image attacks using adversarial fast autoaugmentation methods","name":"articletitle","label":"Article Title"},{"value":"Knowledge-Based Systems","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.knosys.2024.112576","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2024 Elsevier B.V. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"112576"}}