{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,25]],"date-time":"2026-03-25T15:09:06Z","timestamp":1774451346761,"version":"3.50.1"},"reference-count":54,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2023,10,1]],"date-time":"2023-10-01T00:00:00Z","timestamp":1696118400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2023,10,1]],"date-time":"2023-10-01T00:00:00Z","timestamp":1696118400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2023,10,1]],"date-time":"2023-10-01T00:00:00Z","timestamp":1696118400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2023,10,1]],"date-time":"2023-10-01T00:00:00Z","timestamp":1696118400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2023,10,1]],"date-time":"2023-10-01T00:00:00Z","timestamp":1696118400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2023,10,1]],"date-time":"2023-10-01T00:00:00Z","timestamp":1696118400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,10,1]],"date-time":"2023-10-01T00:00:00Z","timestamp":1696118400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100005047","name":"Natural Science Foundation of Liaoning Province","doi-asserted-by":"publisher","award":["2020-MS-080"],"award-info":[{"award-number":["2020-MS-080"]}],"id":[{"id":"10.13039\/501100005047","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["N2224005-4"],"award-info":[{"award-number":["N2224005-4"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Expert Systems with Applications"],"published-print":{"date-parts":[[2023,10]]},"DOI":"10.1016\/j.eswa.2023.120248","type":"journal-article","created":{"date-parts":[[2023,4,28]],"date-time":"2023-04-28T21:25:02Z","timestamp":1682717102000},"page":"120248","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":8,"special_numbering":"C","title":["Boosting transferability of targeted adversarial examples with non-robust feature alignment"],"prefix":"10.1016","volume":"227","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6501-4097","authenticated-orcid":false,"given":"Hegui","family":"Zhu","sequence":"first","affiliation":[]},{"given":"Xiaoyan","family":"Sui","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6009-6118","authenticated-orcid":false,"given":"Yuchen","family":"Ren","sequence":"additional","affiliation":[]},{"given":"Yanmeng","family":"Jia","sequence":"additional","affiliation":[]},{"given":"Libo","family":"Zhang","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"key":"10.1016\/j.eswa.2023.120248_b1","series-title":"IEEE intelligent vehicles symposium","first-page":"89","article-title":"Deep learning algorithm for autonomous driving using GoogLeNet","author":"Al-Qizwini","year":"2017"},{"issue":"6","key":"10.1016\/j.eswa.2023.120248_b2","doi-asserted-by":"crossref","first-page":"36","DOI":"10.5815\/ijigsp.2012.06.06","article-title":"Medical image denoising using bilateral filter","volume":"4","author":"Bhonsle","year":"2012","journal-title":"International Journal of Image, Graphics and Signal Processing"},{"key":"10.1016\/j.eswa.2023.120248_b3","series-title":"Machine learning and knowledge discovery in databases: European conference, ECML PKDD 2013, Prague, Czech Republic, September 23\u201327, 2013, proceedings, Part III 13","first-page":"387","article-title":"Evasion attacks against machine learning at test time","author":"Biggio","year":"2013"},{"key":"10.1016\/j.eswa.2023.120248_b4","series-title":"2017 IEEE symposium on security and privacy","first-page":"39","article-title":"Towards evaluating the robustness of neural networks","author":"Carlini","year":"2017"},{"key":"10.1016\/j.eswa.2023.120248_b5","series-title":"Proceedings of the 10th ACM workshop on artificial intelligence and security","article-title":"ZOO","author":"Chen","year":"2017"},{"key":"10.1016\/j.eswa.2023.120248_b6","series-title":"Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining","first-page":"196","article-title":"SHIELD: fast, practical defense and vaccination for deep learning using JPEG compression","author":"Das","year":"2018"},{"key":"10.1016\/j.eswa.2023.120248_b7","series-title":"2018 IEEE conference on computer vision and pattern recognition","first-page":"9185","article-title":"Boosting adversarial attacks with momentum","author":"Dong","year":"2018"},{"key":"10.1016\/j.eswa.2023.120248_b8","series-title":"IEEE conference on computer vision and pattern recognition","first-page":"4312","article-title":"Evading defenses to transferable adversarial examples by translation-invariant attacks","author":"Dong","year":"2019"},{"issue":"2","key":"10.1016\/j.eswa.2023.120248_b9","doi-asserted-by":"crossref","first-page":"303","DOI":"10.1007\/s11263-009-0275-4","article-title":"The Pascal visual object classes (VOC) challenge","volume":"88","author":"Everingham","year":"2010","journal-title":"International Journal of Computer Vision"},{"key":"10.1016\/j.eswa.2023.120248_b10","doi-asserted-by":"crossref","first-page":"99112","DOI":"10.1109\/ACCESS.2021.3096136","article-title":"Recent advances in deep learning techniques for face recognition","volume":"9","author":"Fuad","year":"2021","journal-title":"IEEE Access"},{"key":"10.1016\/j.eswa.2023.120248_b11","series-title":"Proceedings of the thirtieth international joint conference on artificial intelligence","first-page":"671","article-title":"Feature space targeted attacks by statistic alignment","author":"Gao","year":"2021"},{"key":"10.1016\/j.eswa.2023.120248_b12","series-title":"7th international conference on learning representations","article-title":"ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness","author":"Geirhos","year":"2019"},{"key":"10.1016\/j.eswa.2023.120248_b13","series-title":"3rd international conference on learning representations, ICLR 2015, San Diego, CA, USA, May 7\u20139, 2015, conference track proceedings","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2015"},{"key":"10.1016\/j.eswa.2023.120248_b14","series-title":"6th international conference on learning representations, ICLR 2018, Vancouver, BC, Canada, April 30\u2013May 3, 2018, conference track proceedings","article-title":"Countering adversarial images using input transformations","author":"Guo","year":"2018"},{"key":"10.1016\/j.eswa.2023.120248_b15","series-title":"2016 IEEE conference on computer vision and pattern recognition","first-page":"770","article-title":"Deep residual learning for image recognition","author":"He","year":"2016"},{"key":"10.1016\/j.eswa.2023.120248_b16","series-title":"2016 IEEE second international conference on multimedia big data","first-page":"210","article-title":"Fusing deep convolutional networks for large scale visual concept classification","author":"Hilal","year":"2016"},{"key":"10.1016\/j.eswa.2023.120248_b17","series-title":"2017 IEEE conference on computer vision and pattern recognition","first-page":"2261","article-title":"Densely connected convolutional networks","author":"Huang","year":"2017"},{"key":"10.1016\/j.eswa.2023.120248_b18","series-title":"Proceedings of the 35th international conference on machine learning","first-page":"2142","article-title":"Black-box adversarial attacks with limited queries and information","author":"Ilyas","year":"2018"},{"key":"10.1016\/j.eswa.2023.120248_b19","unstructured":"Ilyas, A., Santurkar, S., Tsipras, D., Engstrom, L., Tran, B., & Madry, A. (2019). Adversarial Examples Are Not Bugs, They Are Features. In Advances in neural information processing systems 32: Annual conference on neural information processing systems 2019 (pp. 125\u2013136)."},{"key":"10.1016\/j.eswa.2023.120248_b20","series-title":"8th international conference on learning representations","article-title":"Transferable perturbations of deep feature distributions","author":"Inkawhich","year":"2020"},{"key":"10.1016\/j.eswa.2023.120248_b21","series-title":"Advances in neural information processing systems 33: Annual conference on neural information processing systems 2020","article-title":"Perturbing across the feature hierarchy to improve standard and strict blackbox attack transferability","author":"Inkawhich","year":"2020"},{"key":"10.1016\/j.eswa.2023.120248_b22","series-title":"IEEE conference on computer vision and pattern recognition","first-page":"7066","article-title":"Feature space perturbations yield more transferable adversarial examples","author":"Inkawhich","year":"2019"},{"key":"10.1016\/j.eswa.2023.120248_b23","series-title":"Measuring the tendency of cnns to learn surface statistical regularities","author":"Jo","year":"2017"},{"key":"10.1016\/j.eswa.2023.120248_b24","series-title":"2020 IEEE\/CVF conference on computer vision and pattern recognition","first-page":"638","article-title":"Towards transferable targeted attack","author":"Li","year":"2020"},{"key":"10.1016\/j.eswa.2023.120248_b25","series-title":"Computer vision - ECCV 2014 - 13th European conference, Zurich, Switzerland, September 6\u201312, 2014, proceedings, Part V","first-page":"740","article-title":"Microsoft COCO: common objects in context","author":"Lin","year":"2014"},{"key":"10.1016\/j.eswa.2023.120248_b26","unstructured":"Lin, J., Song, C., He, K., Wang, L., & Hopcroft, J. E. (2020). Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks. In 8th international conference on learning representations."},{"key":"10.1016\/j.eswa.2023.120248_b27","series-title":"Computer vision - ECCV 2022 - 17th European conference, Tel Aviv, Israel, October 23-27, 2022, proceedings, Part IV","first-page":"549","article-title":"Frequency domain model augmentation for adversarial attack","author":"Long","year":"2022"},{"key":"10.1016\/j.eswa.2023.120248_b28","first-page":"2579","article-title":"Visualizing data using t-SNE","volume":"9","author":"Maaten","year":"2008","journal-title":"Journal of Machine Learning Research"},{"key":"10.1016\/j.eswa.2023.120248_b29","series-title":"IEEE conference on computer vision and pattern recognition","first-page":"10430","article-title":"SurFree: A fast surrogate-free black-box attack","author":"Maho","year":"2021"},{"key":"10.1016\/j.eswa.2023.120248_b30","series-title":"2016 IEEE conference on computer vision and pattern recognition","first-page":"2574","article-title":"DeepFool: A simple and accurate method to fool deep neural networks","author":"Moosavi-Dezfooli","year":"2016"},{"key":"10.1016\/j.eswa.2023.120248_b31","series-title":"2021 IEEE\/CVF international conference on computer vision","first-page":"7688","article-title":"On generating transferable targeted perturbations","author":"Naseer","year":"2021"},{"key":"10.1016\/j.eswa.2023.120248_b32","series-title":"Transferability in machine learning: from phenomena to black-box attacks using adversarial samples","author":"Papernot","year":"2016"},{"key":"10.1016\/j.eswa.2023.120248_b33","series-title":"Proceedings of the 2017 ACM on Asia conference on computer and communications security","first-page":"506","article-title":"Practical black-box attacks against machine learning","author":"Papernot","year":"2017"},{"key":"10.1016\/j.eswa.2023.120248_b34","series-title":"2018 IEEE conference on computer vision and pattern recognition","first-page":"8571","article-title":"Deflecting adversarial attacks with pixel deflection","author":"Prakash","year":"2018"},{"key":"10.1016\/j.eswa.2023.120248_b35","series-title":"2016 IEEE conference on computer vision and pattern recognition","first-page":"779","article-title":"You only look once: Unified, real-time object detection","author":"Redmon","year":"2016"},{"issue":"6","key":"10.1016\/j.eswa.2023.120248_b36","doi-asserted-by":"crossref","first-page":"1137","DOI":"10.1109\/TPAMI.2016.2577031","article-title":"Faster R-CNN: towards real-time object detection with region proposal networks","volume":"39","author":"Ren","year":"2017","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"key":"10.1016\/j.eswa.2023.120248_b37","series-title":"IEEE international conference on computer vision","first-page":"618","article-title":"Grad-CAM: Visual explanations from deep networks via gradient-based localization","author":"Selvaraju","year":"2017"},{"key":"10.1016\/j.eswa.2023.120248_b38","series-title":"2020 IEEE international conference on acoustics, speech and signal processing","first-page":"1898","article-title":"Edgefool: an adversarial image enhancement filter","author":"Shamsabadi","year":"2020"},{"key":"10.1016\/j.eswa.2023.120248_b39","series-title":"3rd international conference on learning representations, ICLR 2015, San Diego, CA, USA, May 7\u20139, 2015, conference track proceedings","article-title":"Very deep convolutional networks for large-scale image recognition","author":"Simonyan","year":"2015"},{"key":"10.1016\/j.eswa.2023.120248_b40","series-title":"2016 IEEE conference on computer vision and pattern recognition","first-page":"2818","article-title":"Rethinking the inception architecture for computer vision","author":"Szegedy","year":"2016"},{"key":"10.1016\/j.eswa.2023.120248_b41","series-title":"2nd international conference on learning representations, ICLR 2014, Banff, AB, Canada, April 14\u201316, 2014, conference track proceedings","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2014"},{"key":"10.1016\/j.eswa.2023.120248_b42","series-title":"IEEE conference on computer vision and pattern recognition","first-page":"1924","article-title":"Enhancing the transferability of adversarial attacks through variance tuning","author":"Wang","year":"2021"},{"key":"10.1016\/j.eswa.2023.120248_b43","series-title":"2020 IEEE\/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2020, Seattle, WA, USA, June 13-19, 2020","first-page":"8681","article-title":"High-frequency component helps explain the generalization of convolutional neural networks","author":"Wang","year":"2020"},{"key":"10.1016\/j.eswa.2023.120248_b44","series-title":"2008 IEEE congress on evolutionary computation (IEEE world congress on computational intelligence)","first-page":"3381","article-title":"Natural evolution strategies","author":"Wierstra","year":"2008"},{"key":"10.1016\/j.eswa.2023.120248_b45","series-title":"8th international conference on learning representations","article-title":"Skip connections matter: On the transferability of adversarial examples generated with ResNets","author":"Wu","year":"2020"},{"key":"10.1016\/j.eswa.2023.120248_b46","series-title":"IEEE conference on computer vision and pattern recognition","first-page":"501","article-title":"Feature denoising for improving adversarial robustness","author":"Xie","year":"2019"},{"key":"10.1016\/j.eswa.2023.120248_b47","series-title":"IEEE conference on computer vision and pattern recognition","first-page":"2730","article-title":"Improving transferability of adversarial examples with input diversity","author":"Xie","year":"2019"},{"key":"10.1016\/j.eswa.2023.120248_b48","series-title":"Proceedings 2018 network and distributed system security symposium","article-title":"Feature squeezing: Detecting adversarial examples in deep neural networks","author":"Xu","year":"2018"},{"key":"10.1016\/j.eswa.2023.120248_b49","series-title":"Advances in neural information processing systems 27: annual conference on neural information processing systems 2014","first-page":"3320","article-title":"How transferable are features in deep neural networks?","author":"Yosinski","year":"2014"},{"key":"10.1016\/j.eswa.2023.120248_b50","series-title":"Computer vision - ECCV 2014 - 13th European conference, Zurich, Switzerland, September 6\u201312, 2014, proceedings, Part I","first-page":"818","article-title":"Visualizing and understanding convolutional networks","author":"Zeiler","year":"2014"},{"key":"10.1016\/j.eswa.2023.120248_b51","doi-asserted-by":"crossref","unstructured":"Zhao, Z., Liu, Z., & Larson, M. A. (2020). Adversarial Color Enhancement: Generating Unrestricted Adversarial Images by Optimizing a Color Filter. In 31st British machine vision conference 2020.","DOI":"10.5244\/C.34.26"},{"key":"10.1016\/j.eswa.2023.120248_b52","series-title":"Advances in neural information processing systems 34: Annual conference on neural information processing systems 2021","first-page":"6115","article-title":"On success and simplicity: A second look at transferable targeted attacks","author":"Zhao","year":"2021"},{"key":"10.1016\/j.eswa.2023.120248_b53","article-title":"LIGAA:Generative adversarial attack method based on low-frequency information","author":"Zhu","year":"2022","journal-title":"Computers & Security"},{"issue":"3","key":"10.1016\/j.eswa.2023.120248_b54","doi-asserted-by":"crossref","first-page":"3662","DOI":"10.1609\/aaai.v36i3.20279","article-title":"Making adversarial examples more transferable and indistinguishable","volume":"36","author":"Zou","year":"2022","journal-title":"Proceedings of the AAAI Conference on Artificial Intelligence"}],"container-title":["Expert Systems with Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0957417423007509?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0957417423007509?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2025,10,17]],"date-time":"2025-10-17T06:24:59Z","timestamp":1760682299000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0957417423007509"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,10]]},"references-count":54,"alternative-id":["S0957417423007509"],"URL":"https:\/\/doi.org\/10.1016\/j.eswa.2023.120248","relation":{},"ISSN":["0957-4174"],"issn-type":[{"value":"0957-4174","type":"print"}],"subject":[],"published":{"date-parts":[[2023,10]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Boosting transferability of targeted adversarial examples with non-robust feature alignment","name":"articletitle","label":"Article Title"},{"value":"Expert Systems with Applications","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.eswa.2023.120248","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2023 Elsevier Ltd. All rights reserved.","name":"copyright","label":"Copyright"}],"article-number":"120248"}}