{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,4]],"date-time":"2025-11-04T23:47:56Z","timestamp":1762300076158,"version":"3.44.0"},"reference-count":55,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2022,10,1]],"date-time":"2022-10-01T00:00:00Z","timestamp":1664582400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2022,10,1]],"date-time":"2022-10-01T00:00:00Z","timestamp":1664582400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2022,10,1]],"date-time":"2022-10-01T00:00:00Z","timestamp":1664582400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2022,10,1]],"date-time":"2022-10-01T00:00:00Z","timestamp":1664582400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2022,10,1]],"date-time":"2022-10-01T00:00:00Z","timestamp":1664582400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2022,10,1]],"date-time":"2022-10-01T00:00:00Z","timestamp":1664582400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2022,10,1]],"date-time":"2022-10-01T00:00:00Z","timestamp":1664582400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2020YFB2103502"],"award-info":[{"award-number":["2020YFB2103502"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["2021JYCXJJ037"],"award-info":[{"award-number":["2021JYCXJJ037"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100013804","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100013804","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62071189"],"award-info":[{"award-number":["62071189"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Pattern Recognition"],"published-print":{"date-parts":[[2022,10]]},"DOI":"10.1016\/j.patcog.2022.108824","type":"journal-article","created":{"date-parts":[[2022,6,3]],"date-time":"2022-06-03T11:16:37Z","timestamp":1654254997000},"page":"108824","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":17,"special_numbering":"C","title":["Model scheduling and sample selection for ensemble adversarial example attacks"],"prefix":"10.1016","volume":"130","author":[{"given":"Zichao","family":"Hu","sequence":"first","affiliation":[]},{"given":"Heng","family":"Li","sequence":"additional","affiliation":[]},{"given":"Liheng","family":"Yuan","sequence":"additional","affiliation":[]},{"given":"Zhang","family":"Cheng","sequence":"additional","affiliation":[]},{"given":"Wei","family":"Yuan","sequence":"additional","affiliation":[]},{"given":"Ming","family":"Zhu","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"issue":"7553","key":"10.1016\/j.patcog.2022.108824_bib0001","doi-asserted-by":"crossref","first-page":"436","DOI":"10.1038\/nature14539","article-title":"Deep learning","volume":"521","author":"LeCun","year":"2015","journal-title":"Nature"},{"key":"10.1016\/j.patcog.2022.108824_bib0002","series-title":"Proc. IEEE Conference on Computer Vision and Pattern Recognition","article-title":"Universal adversarial perturbations","author":"Moosavi-Dezfooli","year":"2017"},{"issue":"6","key":"10.1016\/j.patcog.2022.108824_bib0003","doi-asserted-by":"crossref","first-page":"82","DOI":"10.1109\/MSP.2012.2205597","article-title":"Deep neural networks for acoustic modeling in speech recognition: the shared views of four research groups","volume":"29","author":"Hinton","year":"2012","journal-title":"IEEE Signal Process. Mag."},{"key":"10.1016\/j.patcog.2022.108824_bib0004","doi-asserted-by":"crossref","first-page":"107618","DOI":"10.1016\/j.patcog.2020.107618","article-title":"Coupled adversarial learning for semi-supervised heterogeneous face recognition","volume":"110","author":"He","year":"2021","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2022.108824_bib0005","first-page":"1","article-title":"Transferable face image privacy protection based on federated learning and ensemble models","author":"Yang","year":"2021","journal-title":"Complex Intell. Syst."},{"key":"10.1016\/j.patcog.2022.108824_bib0006","doi-asserted-by":"crossref","first-page":"107332","DOI":"10.1016\/j.patcog.2020.107332","article-title":"Understanding adversarial attacks on deep learning based medical image analysis systems","volume":"110","author":"Ma","year":"2021","journal-title":"Pattern Recognit."},{"issue":"1","key":"10.1016\/j.patcog.2022.108824_bib0007","first-page":"1","article-title":"Neural network methods for natural language processing","volume":"10","author":"Goldberg","year":"2017","journal-title":"Synth. Lect. Hum. Lang. Technol."},{"key":"10.1016\/j.patcog.2022.108824_bib0008","series-title":"Proc. International Conference on Learning Representationse","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2014"},{"key":"10.1016\/j.patcog.2022.108824_bib0009","series-title":"Proc. International Conference on Learning Representations","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2015"},{"key":"10.1016\/j.patcog.2022.108824_bib0010","doi-asserted-by":"crossref","first-page":"317","DOI":"10.1016\/j.patcog.2018.07.023","article-title":"Wild patterns: ten years after the rise of adversarial machine learning","volume":"84","author":"Biggio","year":"2018","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2022.108824_bib0011","doi-asserted-by":"crossref","first-page":"107903","DOI":"10.1016\/j.patcog.2021.107903","article-title":"Fooling deep neural detection networks with adaptive object-oriented adversarial perturbation","volume":"115","author":"Xiao","year":"2021","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2022.108824_bib0012","doi-asserted-by":"crossref","first-page":"107689","DOI":"10.1016\/j.patcog.2020.107689","article-title":"Black-box attack against handwritten signature verification with region-restricted adversarial perturbations","volume":"111","author":"Li","year":"2021","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2022.108824_bib0013","series-title":"Proc. Computer Vision and Pattern Recognition","article-title":"Adversarial machine learning at scale","author":"Kurakin","year":"2017"},{"key":"10.1016\/j.patcog.2022.108824_bib0014","doi-asserted-by":"crossref","first-page":"108303","DOI":"10.1016\/j.patcog.2021.108303","article-title":"(AD)2: adversarial domain adaptation to defense with adversarial perturbation removal","volume":"122","author":"Han","year":"2022","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2022.108824_bib0015","doi-asserted-by":"crossref","unstructured":"Y. Liu, Y. Cheng, L. Gao, X. Liu, Q. Zhang, J. Song, Practical evaluation of adversarial robustness via adaptive auto attack, arXiv preprint arXiv:2203.05154(2022).","DOI":"10.1109\/CVPR52688.2022.01468"},{"key":"10.1016\/j.patcog.2022.108824_bib0016","series-title":"Proc. IEEE Symposium on Security and Privacy","article-title":"Towards evaluating the robustness of neural networks","author":"Carlini","year":"2017"},{"key":"10.1016\/j.patcog.2022.108824_bib0017","series-title":"Proc. the AAAI Conference on Artificial Intelligence","first-page":"742","article-title":"AutoZOOM: autoencoder-based zeroth order optimization method for attacking black-box neural networks","volume":"vol.\u00a033","author":"Tu","year":"2019"},{"key":"10.1016\/j.patcog.2022.108824_bib0018","doi-asserted-by":"crossref","first-page":"108279","DOI":"10.1016\/j.patcog.2021.108279","article-title":"A black-box adversarial attack strategy with adjustable sparsity and generalizability for deep image classifiers","volume":"122","author":"Ghosh","year":"2022","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2022.108824_bib0019","doi-asserted-by":"crossref","first-page":"108306","DOI":"10.1016\/j.patcog.2021.108306","article-title":"A black-box adversarial attack for poisoning clustering","volume":"122","author":"Cin\u00e1","year":"2022","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2022.108824_bib0020","series-title":"Proc. International Conference on Machine Learning","article-title":"Black-box adversarial attacks with limited queries and information","author":"Ilyas","year":"2018"},{"key":"10.1016\/j.patcog.2022.108824_bib0021","series-title":"Proc. the ACM on Asia Conference on Computer and Communications Security","first-page":"506","article-title":"Practical black-box attacks against machine learning","author":"Papernot","year":"2017"},{"key":"10.1016\/j.patcog.2022.108824_bib0022","unstructured":"N. Papernot, P. McDaniel, I. Goodfellow, Transferability in machine learning: from phenomena to black-box attacks using adversarial samples, arXiv preprint arXiv:1605.07277 (2016)."},{"key":"10.1016\/j.patcog.2022.108824_bib0023","unstructured":"F. Tram\u00e9r, N. Papernot, I. Goodfellow, D. Boneh, P. McDaniel, The space of transferable adversarial examples, arXiv preprint arXiv:1704.03453 (2017)."},{"key":"10.1016\/j.patcog.2022.108824_bib0024","doi-asserted-by":"crossref","first-page":"469","DOI":"10.1016\/j.ins.2020.11.026","article-title":"BBAS: towards large scale effective ensemble adversarial attacks against deep neural network learning","volume":"569","author":"Shen","year":"2021","journal-title":"Inf. Sci."},{"key":"10.1016\/j.patcog.2022.108824_bib0025","series-title":"International Conference on Information and Communications Security","article-title":"TranFuzz: an ensemble black-box attack framework based on domain adaptation and fuzzing","author":"Li","year":"2021"},{"key":"10.1016\/j.patcog.2022.108824_bib0026","series-title":"Proc. International Conference on Learning Representations","article-title":"Adversarial examples in the physical world","author":"Kurakin","year":"2017"},{"key":"10.1016\/j.patcog.2022.108824_bib0027","series-title":"Proc. International Conference on Learning Representations","article-title":"Ensemble adversarial training: attacks and defenses","author":"Tram\u00e9r","year":"2018"},{"key":"10.1016\/j.patcog.2022.108824_bib0028","doi-asserted-by":"crossref","first-page":"108249","DOI":"10.1016\/j.patcog.2021.108249","article-title":"Deep image prior based defense against adversarial examples","volume":"122","author":"Dai","year":"2022","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2022.108824_bib0029","series-title":"Proc. IEEE Conference on Computer Vision and Pattern Recognition","article-title":"Boosting adversarial attacks with momentum","author":"Dong","year":"2018"},{"key":"10.1016\/j.patcog.2022.108824_bib0030","doi-asserted-by":"crossref","first-page":"107184","DOI":"10.1016\/j.patcog.2019.107184","article-title":"Ensemble adversarial black-box attacks against deep learning system","volume":"101","author":"Hang","year":"2020","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2022.108824_bib0031","unstructured":"M. Haroon, M.F. Zaffar, P. Srinivasan, Z. Shafiq, Avengers ensemble! Improving transferability of authorship obfuscation, arXiv preprint arXiv:2109.07028(2021)."},{"key":"10.1016\/j.patcog.2022.108824_bib0032","series-title":"Proc. USENIX Security Symposium","article-title":"Hybrid batch attacks: finding black-box adversarial examples with limited queries","author":"Suya","year":"2020"},{"key":"10.1016\/j.patcog.2022.108824_bib0033","series-title":"Proc. the Association for the Advance of Artificial Intelligence","article-title":"A new ensemble adversarial attack powered by long-term gradient memories","author":"Che","year":"2020"},{"key":"10.1016\/j.patcog.2022.108824_bib0034","doi-asserted-by":"crossref","first-page":"102317","DOI":"10.1016\/j.cose.2021.102317","article-title":"EnsembleFool: a method to generate adversarial examples based on model fusion strategy","volume":"107","author":"Peng","year":"2021","journal-title":"Comput. Secur."},{"key":"10.1016\/j.patcog.2022.108824_bib0035","series-title":"IEEE INFOCOM 2020-IEEE Conference on Computer Communications","first-page":"2469","article-title":"Threats of adversarial attacks in DNN-based modulation recognition","author":"Lin","year":"2020"},{"key":"10.1016\/j.patcog.2022.108824_bib0036","unstructured":"A. Madry, A. Makelov, L. Schmidt, D. Tsipras, A. Vladu, Towards deep learning models resistant to adversarial attacks, arXiv preprint arXiv:1706.06083(2017)."},{"key":"10.1016\/j.patcog.2022.108824_bib0037","series-title":"International Conference on Machine Learning","article-title":"Obfuscated gradients give a false sense of security: circumventing defenses to adversarial examples","author":"Athalye","year":"2018"},{"key":"10.1016\/j.patcog.2022.108824_bib0038","doi-asserted-by":"crossref","first-page":"5769","DOI":"10.1109\/TIP.2021.3082317","article-title":"Training robust deep neural networks via adversarial noise propagation","volume":"30","author":"Liu","year":"2021","journal-title":"IEEE Trans. Image Process."},{"issue":"1","key":"10.1016\/j.patcog.2022.108824_bib0039","doi-asserted-by":"crossref","first-page":"389","DOI":"10.1109\/TR.2020.3032744","article-title":"Adversarial attacks in modulation recognition with convolutional neural networks","volume":"70","author":"Lin","year":"2021","journal-title":"IEEE Trans. Reliab."},{"key":"10.1016\/j.patcog.2022.108824_bib0040","series-title":"Proceedings of the Web Conference 2021","first-page":"3603","article-title":"Robust android malware detection against adversarial example attacks","author":"Li","year":"2021"},{"key":"10.1016\/j.patcog.2022.108824_bib0041","series-title":"30th {USENIX} Security Symposium ({USENIX} Security 21)","article-title":"Defeating DNN-based traffic analysis systems in real-time with blind adversarial perturbations","author":"Nasr","year":"2021"},{"key":"10.1016\/j.patcog.2022.108824_bib0042","series-title":"Proc. European Conference on Computer Vision","article-title":"Transferable adversarial perturbations","author":"Zhou","year":"2018"},{"key":"10.1016\/j.patcog.2022.108824_bib0043","series-title":"Proc. the Association for the Advance of Artificial Intelligence","article-title":"Learning transferable adversarial examples via ghost networks","author":"Li","year":"2020"},{"key":"10.1016\/j.patcog.2022.108824_bib0044","series-title":"Proc. International Joint Conference on Artificial Intelligence","article-title":"Efficient project gradient descent for ensemble adversarial attack","author":"Wu","year":"2019"},{"issue":"3","key":"10.1016\/j.patcog.2022.108824_bib0045","doi-asserted-by":"crossref","first-page":"1065","DOI":"10.1214\/aoms\/1177704472","article-title":"On estimation of a probability density function and mode","volume":"33","author":"Parzen","year":"1962","journal-title":"Ann. Math. Stat."},{"key":"10.1016\/j.patcog.2022.108824_bib0046","doi-asserted-by":"crossref","first-page":"1291","DOI":"10.1109\/TIP.2020.3042083","article-title":"Interpreting and improving adversarial robustness of deep neural networks with neuron sensitivity","volume":"30","author":"Zhang","year":"2020","journal-title":"IEEE Trans. Image Process."},{"key":"10.1016\/j.patcog.2022.108824_bib0047","series-title":"Proc. European Conference on Computer Vision","article-title":"Identity mappings in deep residual networks","author":"He","year":"2016"},{"key":"10.1016\/j.patcog.2022.108824_bib0048","series-title":"Proc. the Association for the Advance of Artificial Intelligence","article-title":"Inception-v4, inception-resnet and the impact of residual connections on learning","author":"Szegedy","year":"2017"},{"key":"10.1016\/j.patcog.2022.108824_bib0049","series-title":"Proc. Computer Vision and Pattern Recognition","article-title":"Rethinking the inception architecture for computer vision","author":"Szegedy","year":"2016"},{"issue":"3","key":"10.1016\/j.patcog.2022.108824_bib0050","doi-asserted-by":"crossref","first-page":"211","DOI":"10.1007\/s11263-015-0816-y","article-title":"ImageNet large scale visual recognition challenge","volume":"115","author":"Russakovsky","year":"2015","journal-title":"Int. J. Comput. Vis."},{"key":"10.1016\/j.patcog.2022.108824_bib0051","series-title":"Proc. IEEE Conference on Computer Vision and Pattern Recognition","article-title":"Improving transferability of adversarial examples with input diversity","author":"Xie","year":"2019"},{"key":"10.1016\/j.patcog.2022.108824_bib0052","unstructured":"K. Simonyan, A. Zisserman, Very deep convolutional networks for large-scale image recognition, arXiv preprint arXiv:1409.1556(2014)."},{"key":"10.1016\/j.patcog.2022.108824_bib0053","unstructured":"H. Xiao, K. Rasul, R. Vollgraf, Fashion-MNIST: a novel image dataset for benchmarking machine learning algorithms, arXiv preprint arXiv:1708.07747 (2017)."},{"key":"10.1016\/j.patcog.2022.108824_bib0054","unstructured":"M. Sharif, S. Bhagavatula, L. Bauer, M.K. Reiter, Adversarial generative nets: neural network attacks on state-of-the-art face recognition, arXiv preprint arXiv:1801.003492017."},{"key":"10.1016\/j.patcog.2022.108824_bib0055","series-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","first-page":"1625","article-title":"Robust physical-world attacks on deep learning visual classification","author":"Eykholt","year":"2018"}],"container-title":["Pattern Recognition"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0031320322003053?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0031320322003053?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2025,9,21]],"date-time":"2025-09-21T17:05:32Z","timestamp":1758474332000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0031320322003053"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,10]]},"references-count":55,"alternative-id":["S0031320322003053"],"URL":"https:\/\/doi.org\/10.1016\/j.patcog.2022.108824","relation":{},"ISSN":["0031-3203"],"issn-type":[{"type":"print","value":"0031-3203"}],"subject":[],"published":{"date-parts":[[2022,10]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Model scheduling and sample selection for ensemble adversarial example attacks","name":"articletitle","label":"Article Title"},{"value":"Pattern Recognition","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.patcog.2022.108824","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2022 Elsevier Ltd. All rights reserved.","name":"copyright","label":"Copyright"}],"article-number":"108824"}}