{"id":"https://openalex.org/W7076054002","doi":"https://doi.org/10.1109/tifs.2025.3599257","title":"MF-CLIP: Leveraging CLIP as Surrogate Models for No-Box Adversarial Attacks","display_name":"MF-CLIP: Leveraging CLIP as Surrogate Models for No-Box Adversarial Attacks","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W7076054002","doi":"https://doi.org/10.1109/tifs.2025.3599257"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2025.3599257","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3599257","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Jiaming Zhang","orcid":"https://orcid.org/0000-0003-0991-7109"},"institutions":[{"id":"https://openalex.org/I200769079","display_name":"Hong Kong University of Science and Technology","ror":"https://ror.org/00q4vv597","country_code":"HK","type":"education","lineage":["https://openalex.org/I200769079"]}],"countries":["HK"],"is_corresponding":true,"raw_author_name":"Jiaming Zhang","raw_affiliation_strings":["Department of Computer Science and Engineering, The Hong Kong University of Science and Technology, Hong Kong, China"],"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, The Hong Kong University of Science and Technology, Hong Kong, China","institution_ids":["https://openalex.org/I200769079"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Lingyu Qiu","orcid":"https://orcid.org/0009-0001-0571-8156"},"institutions":[{"id":"https://openalex.org/I71267560","display_name":"University of Naples Federico II","ror":"https://ror.org/05290cv24","country_code":"IT","type":"education","lineage":["https://openalex.org/I71267560"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Lingyu Qiu","raw_affiliation_strings":["Department of Mathematics and Applications, University of Naples Federico II, Naples, Italy"],"affiliations":[{"raw_affiliation_string":"Department of Mathematics and Applications, University of Naples Federico II, Naples, Italy","institution_ids":["https://openalex.org/I71267560"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Qi Yi","orcid":null},"institutions":[{"id":"https://openalex.org/I21193070","display_name":"Beijing Jiaotong University","ror":"https://ror.org/01yj56c84","country_code":"CN","type":"education","lineage":["https://openalex.org/I21193070"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qi Yi","raw_affiliation_strings":["School of Computer and Information Technology and the Beijing Key Laboratory of Traffic Data Mining and Embodied Intelligence, Beijing Jiaotong University, Beijing, China"],"affiliations":[{"raw_affiliation_string":"School of Computer and Information Technology and the Beijing Key Laboratory of Traffic Data Mining and Embodied Intelligence, Beijing Jiaotong University, Beijing, China","institution_ids":["https://openalex.org/I21193070"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yige Li","orcid":null},"institutions":[{"id":"https://openalex.org/I79891267","display_name":"Singapore Management University","ror":"https://ror.org/050qmg959","country_code":"SG","type":"education","lineage":["https://openalex.org/I79891267"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Yige Li","raw_affiliation_strings":["School of Computing and Information Systems, Singapore Management University, Bras Basah, Singapore"],"affiliations":[{"raw_affiliation_string":"School of Computing and Information Systems, Singapore Management University, Bras Basah, Singapore","institution_ids":["https://openalex.org/I79891267"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Jitao Sang","orcid":"https://orcid.org/0000-0002-0699-3205"},"institutions":[{"id":"https://openalex.org/I21193070","display_name":"Beijing Jiaotong University","ror":"https://ror.org/01yj56c84","country_code":"CN","type":"education","lineage":["https://openalex.org/I21193070"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jitao Sang","raw_affiliation_strings":["School of Computer and Information Technology and the Beijing Key Laboratory of Traffic Data Mining and Embodied Intelligence, Beijing Jiaotong University, Beijing, China"],"affiliations":[{"raw_affiliation_string":"School of Computer and Information Technology and the Beijing Key Laboratory of Traffic Data Mining and Embodied Intelligence, Beijing Jiaotong University, Beijing, China","institution_ids":["https://openalex.org/I21193070"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Changsheng Xu","orcid":"https://orcid.org/0000-0001-8343-9665"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210094879","display_name":"Shandong Institute of Automation","ror":"https://ror.org/00qdtba35","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210094879","https://openalex.org/I4210142748"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Changsheng Xu","raw_affiliation_strings":["MAIS, Institute of Automation, Chinese Academy of Sciences, Beijing, China"],"affiliations":[{"raw_affiliation_string":"MAIS, Institute of Automation, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210094879","https://openalex.org/I19820366"]}]},{"author_position":"last","author":{"id":null,"display_name":"Dit-Yan Yeung","orcid":"https://orcid.org/0000-0003-3716-8125"},"institutions":[{"id":"https://openalex.org/I200769079","display_name":"Hong Kong University of Science and Technology","ror":"https://ror.org/00q4vv597","country_code":"HK","type":"education","lineage":["https://openalex.org/I200769079"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Dit-Yan Yeung","raw_affiliation_strings":["Department of Computer Science and Engineering, The Hong Kong University of Science and Technology, Hong Kong, China"],"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, The Hong Kong University of Science and Technology, Hong Kong, China","institution_ids":["https://openalex.org/I200769079"]}]}],"institutions":[],"countries_distinct_count":4,"institutions_distinct_count":7,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I200769079"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.27895541,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"20","issue":null,"first_page":"9195","last_page":"9206"},"is_retracted":false,"is_paratext":false,"is_xpac":true,"primary_topic":{"id":"https://openalex.org/T12157","display_name":"Geochemistry and Geologic Mapping","score":0.6735000014305115,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12157","display_name":"Geochemistry and Geologic Mapping","score":0.6735000014305115,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13067","display_name":"Geological Modeling and Analysis","score":0.020500000566244125,"subfield":{"id":"https://openalex.org/subfields/1906","display_name":"Geochemistry and Petrology"},"field":{"id":"https://openalex.org/fields/19","display_name":"Earth and Planetary Sciences"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T14311","display_name":"Electrical and Electromagnetic Research","score":0.019500000402331352,"subfield":{"id":"https://openalex.org/subfields/3107","display_name":"Atomic and Molecular Physics, and Optics"},"field":{"id":"https://openalex.org/fields/31","display_name":"Physics and Astronomy"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/discriminative-model","display_name":"Discriminative model","score":0.6974999904632568},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.6869999766349792},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.6345999836921692},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5708000063896179},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.5663999915122986},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.44690001010894775},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.4036000072956085},{"id":"https://openalex.org/keywords/surrogate-model","display_name":"Surrogate model","score":0.3901999890804291},{"id":"https://openalex.org/keywords/baseline","display_name":"Baseline (sea)","score":0.3637999892234802}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.902999997138977},{"id":"https://openalex.org/C97931131","wikidata":"https://www.wikidata.org/wiki/Q5282087","display_name":"Discriminative model","level":2,"score":0.6974999904632568},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.6869999766349792},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.6345999836921692},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5708000063896179},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5663999915122986},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4880000054836273},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.48249998688697815},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.44690001010894775},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.4036000072956085},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4002000093460083},{"id":"https://openalex.org/C131675550","wikidata":"https://www.wikidata.org/wiki/Q7646884","display_name":"Surrogate model","level":2,"score":0.3901999890804291},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.3637999892234802},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.34619998931884766},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.33640000224113464},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.33570000529289246},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.33079999685287476},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.3278000056743622},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.3179999887943268},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3149999976158142},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.31310001015663147},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.3068999946117401},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.30300000309944153},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.27709999680519104},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2766999900341034},{"id":"https://openalex.org/C2778572836","wikidata":"https://www.wikidata.org/wiki/Q380933","display_name":"Space (punctuation)","level":2,"score":0.27559998631477356},{"id":"https://openalex.org/C49937458","wikidata":"https://www.wikidata.org/wiki/Q2599292","display_name":"Probabilistic logic","level":2,"score":0.27140000462532043},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.2694999873638153},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.26759999990463257},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.2540999948978424},{"id":"https://openalex.org/C2984842247","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep neural networks","level":3,"score":0.25290000438690186}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/tifs.2025.3599257","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3599257","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},{"id":"pmh:oai:repository.hkust.edu.hk:1783.1-165735","is_oa":false,"landing_page_url":"http://repository.hkust.edu.hk/ir/Record/1783.1-165735","pdf_url":null,"source":{"id":"https://openalex.org/S4306401796","display_name":"Rare & Special e-Zone (The Hong Kong University of Science and Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I200769079","host_organization_name":"Hong Kong University of Science and Technology","host_organization_lineage":["https://openalex.org/I200769079"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Reduced inequalities","score":0.6651491522789001,"id":"https://metadata.un.org/sdg/10"}],"awards":[{"id":"https://openalex.org/G2739706392","display_name":null,"funder_award_id":"GRF 16203224","funder_id":"https://openalex.org/F4320320671","funder_display_name":"National Research Foundation"},{"id":"https://openalex.org/G3118817269","display_name":null,"funder_award_id":"2023YFC3310700","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"},{"id":"https://openalex.org/G5650502627","display_name":null,"funder_award_id":"62276067","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320320671","display_name":"National Research Foundation","ror":"https://ror.org/05s0g1g46"},{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":35,"referenced_works":["https://openalex.org/W12634471","https://openalex.org/W1977295328","https://openalex.org/W2017814585","https://openalex.org/W2096733369","https://openalex.org/W2133665775","https://openalex.org/W2138011018","https://openalex.org/W2194775991","https://openalex.org/W2533598788","https://openalex.org/W2774644650","https://openalex.org/W2962785568","https://openalex.org/W2962847335","https://openalex.org/W2964194231","https://openalex.org/W2969985801","https://openalex.org/W2984699060","https://openalex.org/W3034429256","https://openalex.org/W3186991201","https://openalex.org/W4294811474","https://openalex.org/W4297697565","https://openalex.org/W4377231695","https://openalex.org/W4382318428","https://openalex.org/W4390871946","https://openalex.org/W4393154441","https://openalex.org/W4393156324","https://openalex.org/W4399729888","https://openalex.org/W4402716179","https://openalex.org/W4402727764","https://openalex.org/W4402754002","https://openalex.org/W4404914434","https://openalex.org/W4405306317","https://openalex.org/W4405521688","https://openalex.org/W4405718359","https://openalex.org/W4405845641","https://openalex.org/W4406171890","https://openalex.org/W4406983109","https://openalex.org/W4409869032"],"related_works":[],"abstract_inverted_index":{"The":[0],"vulnerability":[1],"of":[2,42,85,96],"Deep":[3],"Neural":[4],"Networks":[5],"(DNNs)":[6],"to":[7,14,39,169],"adversarial":[8],"attacks":[9,87],"poses":[10],"a":[11,55,79,100,113,121,156],"significant":[12],"challenge":[13],"their":[15],"deployment":[16],"in":[17,82,143,175],"safety-critical":[18],"applications.":[19],"While":[20],"extensive":[21],"research":[22,174],"has":[23],"addressed":[24],"various":[25],"attack":[26,30],"scenarios,":[27],"the":[28,43,83,141],"no-box":[29,71,86,144],"setting\u2014where":[31],"adversaries":[32],"have":[33],"no":[34],"prior":[35],"knowledge,":[36],"including":[37],"access":[38],"training":[40],"data":[41],"target":[44],"model\u2014remains":[45],"relatively":[46],"underexplored":[47],"despite":[48],"its":[49],"practical":[50],"relevance.":[51],"This":[52],"work":[53],"presents":[54],"systematic":[56],"investigation":[57],"into":[58],"leveraging":[59],"large-scale":[60],"Vision-Language":[61],"Models":[62],"(VLMs),":[63],"particularly":[64],"CLIP,":[65],"as":[66,99,120],"surrogate":[67,101,122],"models":[68,153],"for":[69,93],"executing":[70],"attacks.":[72],"Our":[73,163],"theoretical":[74],"and":[75,134,154,172],"empirical":[76],"analyses":[77],"reveal":[78],"key":[80],"limitation":[81],"execution":[84],"stemming":[88],"from":[89],"insufficient":[90],"discriminative":[91],"capabilities":[92],"direct":[94],"application":[95],"vanilla":[97],"CLIP":[98],"model.":[102],"To":[103],"address":[104],"this":[105,176],"limitation,":[106],"we":[107],"propose":[108],"MF-CLIP":[109,138],"(Margin-based":[110],"Fine-tuned":[111],"CLIP),":[112],"novel":[114],"framework":[115],"that":[116,137],"enhances":[117],"CLIP\u2019s":[118],"effectiveness":[119],"model":[123],"through":[124],"margin-aware":[125],"feature":[126],"space":[127],"optimization.":[128],"Comprehensive":[129],"evaluations":[130],"across":[131],"diverse":[132],"architectures":[133],"datasets":[135],"demonstrate":[136],"substantially":[139],"advances":[140],"state-of-the-art":[142],"attacks,":[145],"surpassing":[146],"existing":[147],"baselines":[148],"by":[149],"15.23%":[150],"on":[151,159],"standard":[152],"achieving":[155],"9.52%":[157],"improvement":[158],"adversarially":[160],"trained":[161],"models.":[162],"code":[164],"is":[165],"made":[166],"publicly":[167],"available":[168],"facilitate":[170],"reproducibility":[171],"future":[173],"direction.":[177]},"counts_by_year":[],"updated_date":"2026-04-09T08:11:56.329763","created_date":"2025-10-10T00:00:00"}