{"as_of":"2026-08-09T05:25:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:093cdca666f76bbb007a831d37f46116569405abb3c8233a240ba5f7f98a7173","coverage":[{"denominator":40,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":40,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T14:41:11.853919Z","state":"measured"},{"denominator":40,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":40,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-08T06:32:00.761636+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2505.18097/citation-record","integrity":"/paper/2505.18097/integrity","json":"/paper/2505.18097/citation-record.json","paper":"/paper/2505.18097"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:16.555982Z","title":"Intriguing properties of neural networks","venue":null,"work_id":"a438ca32-5872-4fab-a33a-634697249a49","year":2014},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:08.298546Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:de2e7cdabd5ed52e6a7fb402bd78b6e4bc14b0d8ad44b4f355cb3d38fd8511b5","observation_id":"5c7ee68e-ccd1-41c3-a309-c34651fc2586","resolution":{"observed_at":"2026-08-07T14:41:16.713724Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:08.367380Z","title":"A grey-box attack against latent diffusion model-based image editing by posterior collapse","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:08.367380Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:07b96533f39f74d9c44b96f8f66508633f425d239eab50951f73db7067d0810c","observation_id":"6cb7494b-8380-45cf-9d46-ca3e40420409","resolution":{"observed_at":"2026-08-07T14:41:08.367380Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:16.367975Z","title":"A survey of recent backdoor attacks and defenses in large language models","venue":null,"work_id":"3c98e04c-e6af-41e4-8424-5bd9a5df8ac7","year":2025},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:08.476986Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:ae61d2613375554ca2316e33cea2d426dbadf316480fc1ff56f24ed2e457b7ce","observation_id":"284c764e-1611-4958-bafe-dac8b9e5f6f1","resolution":{"observed_at":"2026-08-07T14:41:16.431346Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:16.183463Z","title":"A white-box false positive adversarial attack method on contrastive loss based offline handwritten signature verification models","venue":null,"work_id":"69c10696-8e16-492b-b232-fa43701173bc","year":2024},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:08.596309Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:d67adbdc8a5b51c5044d673c1c94b890ad27209f135bbeece1badfbed8db648e","observation_id":"f616c61b-6819-47ed-b17d-55e593daf5b1","resolution":{"observed_at":"2026-08-07T14:41:16.265780Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:16.017452Z","title":"Threats and defenses in the federated learning life cycle: A comprehensive survey and challenges","venue":null,"work_id":"b60f6591-a59c-48a6-9ae5-87b11d27ad11","year":2025},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:08.679373Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:7d97b20fac17317e775c311a77c34c51a2f9578709becc809fdd52df7f492f7c","observation_id":"1d4b4651-6cd3-423a-8591-11d368dce6d9","resolution":{"observed_at":"2026-08-07T14:41:16.108952Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2409.17946","last_updated":"2025-07-09T03:32:17Z","snapshot_observed_at":"2026-07-06T19:22:50.028253Z","submitted_at":"2024-09-26T15:20:37Z","title":"Breaking PEFT Limitations: Leveraging Weak-to-Strong Knowledge Transfer for Backdoor Attacks in LLMs","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.17946","snapshot_observed_at":"2026-08-07T14:41:08.810460Z","title":"Weak-to-strong backdoor attack for large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:08.810460Z"},"links":{"cited_paper":"/paper/2409.17946","citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:c25a2328c82d04d429526efd0187ef84b2d190d95117f0028729deedad2d7081","observation_id":"e1c4318c-a6da-43d7-b404-45b452bc5b1b","resolution":{"observed_at":"2026-08-07T14:41:08.810460Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:15.829857Z","title":"Boosting adversarial attacks with momentum","venue":null,"work_id":"4ff90f26-4874-4ac5-94db-3c3efd2a0ce4","year":2018},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:08.904061Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:a0d0e13c4b271f33cf7af70a4e4112aa677a90a7c83feb269fbc93306168413d","observation_id":"dfbb2cdf-6b65-4027-87c2-89b8ed687af3","resolution":{"observed_at":"2026-08-07T14:41:15.917766Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:15.484256Z","title":"Artwork protection against neural style transfer using locally adaptive adversarial color attack","venue":null,"work_id":"89019fe6-b9a4-4dff-b2f8-8d06e9a20722","year":2024},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:09.006754Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:18197839641454c035f1eeda70e005d814b0e9b3f335c4560953d9fb78b8726e","observation_id":"86fe32d9-41ce-4346-92e4-20a6d88fc16b","resolution":{"observed_at":"2026-08-07T14:41:15.656860Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:15.321575Z","title":"Meta-attack: Class-agnostic and model-agnostic physical adversarial attack","venue":null,"work_id":"9ea2a04a-7428-4067-9684-d8c3c724072b","year":2021},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:09.130906Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:0aa57fbb6e01a9610bfd9dbf82a39420c32e2a129639fd5d0c2385bb1c27b871","observation_id":"9532172d-b8eb-4688-b50d-52789c4ad60c","resolution":{"observed_at":"2026-08-07T14:41:15.367205Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:15.081884Z","title":"Diffusion-based adversarial sample generation for improved stealthiness and controllability.Advances in Neural Information Processing Systems, 36:2894–2921, 2023","venue":null,"work_id":"6da0064f-db98-4a29-9968-1b20e9d1c2ed","year":2023},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:09.238947Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:0ec9602929c64203725a47073d9d740607d80c9f63a3402ab768a9877cf4cdce","observation_id":"d6d5430f-82b0-45e6-a189-07088747e992","resolution":{"observed_at":"2026-08-07T14:41:15.201497Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:14.751387Z","title":"Diffusion models for adversarial purification","venue":null,"work_id":"0d8f899c-a4dc-49d9-a608-0a79e774af62","year":2022},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:09.357630Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:c876bf779581d89e6f2a643b02dbdc40f176285bf9308dfaa07c371fbee25287","observation_id":"07122a67-2afe-486b-8179-63a193dd9347","resolution":{"observed_at":"2026-08-07T14:41:14.908549Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2105.05233","last_updated":"2021-06-01T17:49:49Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2021-05-11T17:50:24Z","title":"Diffusion Models Beat GANs on Image Synthesis","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2105.05233","snapshot_observed_at":"2026-08-07T14:41:09.453299Z","title":"Diffusion models beat gans on image synthesis","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:09.453299Z"},"links":{"cited_paper":"/paper/2105.05233","citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:951909627f65623bae2c5236e3a0b991f3d2633198ae70a206254b8a21d522ed","observation_id":"dfdcbbf5-822c-46bb-84b0-cd648b8bd92e","resolution":{"observed_at":"2026-08-07T14:41:09.453299Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:14.479254Z","title":"Explaining and harnessing adversar- ial examples","venue":null,"work_id":"96aaa759-14fa-4e3c-96c7-7097d361e59a","year":2015},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:09.559651Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:3e9b992ac0a5782d6deb55312dc6650c7bf2889b9234f13f2e2057e16fd2183e","observation_id":"8d1151aa-d6c1-4bf3-ba3c-8523809ea4c1","resolution":{"observed_at":"2026-08-07T14:41:14.630892Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:09.653265Z","title":"Towards deep learning models resistant to adversarial attacks","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:09.653265Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:0e58acb1b5db04709745b15155c7989ca746237d6cc6b0053c35ef1b70162f08","observation_id":"22eacdc8-071e-40c4-a121-3a5269b5ca7c","resolution":{"observed_at":"2026-08-07T14:41:09.653265Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1712.04248","last_updated":"2018-02-16T14:40:42Z","snapshot_observed_at":"2026-07-06T06:13:56.299732Z","submitted_at":"2017-12-12T11:36:26Z","title":"Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1712.04248","snapshot_observed_at":"2026-08-07T14:41:09.746841Z","title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:09.746841Z"},"links":{"cited_paper":"/paper/1712.04248","citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:6dfe6215c8d05e9baa67089b3edfce541d0fa09336ed9ad7c5517abfe3de0871","observation_id":"39a9d347-34fa-4363-8258-2c5241c81a30","resolution":{"observed_at":"2026-08-07T14:41:09.746841Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:14.200351Z","title":"Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models","venue":null,"work_id":"c581b15d-7842-4307-a762-b6c1e033b50c","year":2017},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:09.842285Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:a757a2050ef015d9cdeb635fa21c0468a411477f46543693e98b58b71e0777b2","observation_id":"76147a81-3587-43b2-9651-54f88f9e736b","resolution":{"observed_at":"2026-08-07T14:41:14.320469Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1605.07277","last_updated":"2016-05-24T03:27:48Z","snapshot_observed_at":"2026-07-06T04:57:19.691523Z","submitted_at":"2016-05-24T03:27:48Z","title":"Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1605.07277","snapshot_observed_at":"2026-08-07T14:41:09.931290Z","title":"Transferability in machine learning: From phenomena to black-box attacks using adversarial samples","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:09.931290Z"},"links":{"cited_paper":"/paper/1605.07277","citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:99ab49a033955cd67e0364778cc9fc4791b035ccf23242cd1427364042ee9166","observation_id":"c50b569a-ea91-4f55-989e-55877f0b7d89","resolution":{"observed_at":"2026-08-07T14:41:09.931290Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:13.968840Z","title":"Rethinking model ensemble in transfer-based adversarial attacks","venue":null,"work_id":"32ed8f5d-9014-4f34-9d27-e46f5cfbfd36","year":2024},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:10.015007Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:db148c16af59e11183d8a7bf8a22b7ca6fc6f43b87e1821b4d8c958af85aeffb","observation_id":"5c806b53-d032-4f3e-af75-afd98e02e1d4","resolution":{"observed_at":"2026-08-07T14:41:14.080657Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.06851","last_updated":"2025-05-28T08:41:05Z","snapshot_observed_at":"2026-07-06T19:30:21.486298Z","submitted_at":"2024-10-09T13:14:11Z","title":"Understanding Model Ensemble in Transferable Adversarial Attack","version":3},"cited_work":{"arxiv_id":"2410.06851","doi":null,"metadata_source":"pith","pith_arxiv_id":"2410.06851","snapshot_observed_at":"2026-08-07T14:41:11.999824Z","title":"Understanding Model Ensemble in Transferable Adversarial Attack","venue":"cs.LG","work_id":"ddaaa16f-961a-4d16-a571-138c5e48e59c","year":2024},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:10.107836Z"},"links":{"cited_paper":"/paper/2410.06851","citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:1f9c08f801976c1952b28c810e6e88f14465ee5096c90791b49013d5b2a18f41","observation_id":"03ed648d-9a33-4979-bf45-a98f248d1230","resolution":{"observed_at":"2026-08-07T14:41:12.066759Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:13.753341Z","title":"Diffusion models for imperceptible and transferable adversarial attack","venue":null,"work_id":"bbfd3466-efab-452c-8dc8-6b881e9ed1e0","year":2024},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:10.205179Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:ed47db587602898fcc772d9ee164f1e51b6c5dbad0be634b4484b2f2ae5b7ea7","observation_id":"aa34e1a1-6ff2-42bb-8187-4fba9c942319","resolution":{"observed_at":"2026-08-07T14:41:13.840393Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:10.304189Z","title":"Deep unsuper- vised learning using nonequilibrium thermodynamics","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:10.304189Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:36dc63ed874c4cecdcc4fecd536d7d0ac2c3e5c932b4e7877787825964845e6d","observation_id":"d1a3219d-b8a5-40ec-ae11-342a45a733a7","resolution":{"observed_at":"2026-08-07T14:41:10.304189Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:10.402349Z","title":"Denoising diffusion probabilistic models","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:10.402349Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:fb84f9f588a962196bae7b48971ef556986c2cf72d7d3d525d316a8d0613406c","observation_id":"2c9a3d45-82ea-44b8-8558-17760bd5a71f","resolution":{"observed_at":"2026-08-07T14:41:10.402349Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2207.12598","last_updated":"2022-07-26T01:42:07Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-07-26T01:42:07Z","title":"Classifier-Free Diffusion Guidance","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2207.12598","snapshot_observed_at":"2026-08-07T14:41:10.518510Z","title":"Classifier-free diffusion guidance","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:10.518510Z"},"links":{"cited_paper":"/paper/2207.12598","citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:1d5f531f6178cb75e8ee5e8777b0ea65da5d58cce510d5bcedf93cc9bc957f2d","observation_id":"8febf8f1-a4ee-4921-9015-67a4c9e43fa8","resolution":{"observed_at":"2026-08-07T14:41:10.518510Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:13.393643Z","title":"High- resolution image synthesis with latent diffusion models","venue":null,"work_id":"d9fd0bda-ae27-492e-a6fc-2a66146ec536","year":2022},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:10.594242Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:003b34b3278ff13346f175239c13a61d7da0cf7d5326d4607790d2d51388738b","observation_id":"92421e20-8c5b-4705-8869-a0eed95a713a","resolution":{"observed_at":"2026-08-07T14:41:13.569393Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:13.051646Z","title":"Instant ad- versarial purification with adversarial consistency distillation","venue":null,"work_id":"4123e3cd-aeda-4413-ba03-40dc4585004c","year":2025},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:10.687214Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:4c960727009e3064344bf17432e728155aa86c3044b584d5c5b3f04de70e5134","observation_id":"24bbb228-de02-4514-9cd5-07bf22672352","resolution":{"observed_at":"2026-08-07T14:41:13.155109Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:10.781655Z","title":"Denoising diffusion implicit models","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:10.781655Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:f117886e7040fc7eca6f68f9effd001bd1e0a856ecba2c6a47390bdcec614add","observation_id":"28ad529e-875c-46cc-8718-ca76793999c1","resolution":{"observed_at":"2026-08-07T14:41:10.781655Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:10.840601Z","title":"Variational diffusion models","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:10.840601Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:f82797f6d4c00f06d220da59d294d186a53c776aae575edf5c3bd57def230916","observation_id":"2ec7e366-4bf4-44ca-981b-c0dd036eb3ee","resolution":{"observed_at":"2026-08-07T14:41:10.840601Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:10.931789Z","title":"Score-based generative modeling through stochastic differential equations","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:10.931789Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:9be910c488aeab2c576ac38c70c70d3408d5ac3c693ad1ca3fe7ae95adbbd1c6","observation_id":"f850ec1f-3c3b-4a96-8e9b-c760dba48546","resolution":{"observed_at":"2026-08-07T14:41:10.931789Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1908.06281","last_updated":"2020-02-03T02:58:31Z","snapshot_observed_at":"2026-07-06T08:14:59.387021Z","submitted_at":"2019-08-17T10:03:05Z","title":"Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1908.06281","snapshot_observed_at":"2026-08-07T14:41:11.038741Z","title":"Nesterov accelerated gradient and scale invariance for adversarial attacks","venue":null,"work_id":null,"year":1908},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:11.038741Z"},"links":{"cited_paper":"/paper/1908.06281","citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:94c6b35b0ac430b95e30fc68c0646fe18d664177a1b905e89f2eac7dbea5cf4f","observation_id":"c793e992-9a05-4370-815c-c7d65c6e5cde","resolution":{"observed_at":"2026-08-07T14:41:11.038741Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:11.144156Z","title":"Imagenet: A large- scale hierarchical image database","venue":null,"work_id":null,"year":2009},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:11.144156Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:32c46540be4a368d25cfc41de3cc3d62514a6a0de2052b4f2e86e0b8e7511e60","observation_id":"dc5fd4f6-c1dc-4071-82e5-39419118a9f2","resolution":{"observed_at":"2026-08-07T14:41:11.144156Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:12.804342Z","title":"Deep residual learning for im- age recognition","venue":null,"work_id":"c81399cc-9d66-4bdf-a108-355f5a31fb2c","year":2016},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:11.252105Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:ff89b9420b7043cd72c11790d33f031f6d9bf827a28b67a33640c61794cde6ec","observation_id":"f66a0df4-078a-4827-a885-36d1b6116a4b","resolution":{"observed_at":"2026-08-07T14:41:12.899428Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:12.657294Z","title":"Wide residual networks","venue":null,"work_id":"3d7ebc2a-ee5d-4c6f-9494-839773817cd3","year":2016},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:11.318782Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:291dd1eea1c31f16b5940a2ad9cbaab7d03902d11753652d998b1b135b9df4e1","observation_id":"e355ea0f-25e6-4a3b-9409-05d0ea6719e1","resolution":{"observed_at":"2026-08-07T14:41:12.727119Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:11.383924Z","title":"Image quality assessment: from error visibility to structural similarity","venue":null,"work_id":null,"year":2004},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:11.383924Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:c526a30b3b7f6cb67148c13367962522e2e6994bf53615de964cf46cfbb02899","observation_id":"b15c752a-1876-4a87-95db-be913cbc1462","resolution":{"observed_at":"2026-08-07T14:41:11.383924Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:12.534449Z","title":"Efros, Eli Shechtman, and Oliver Wang","venue":null,"work_id":"242592dc-9a21-4bb4-b3ad-b57daa8ef9d4","year":2018},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:11.440429Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:360d306eb56c06f2aa8f662a94f6d1a27d0f4183cfbeea6a4efc3676d9976b35","observation_id":"6cf3927f-f110-42e0-b4ef-01c8904d8729","resolution":{"observed_at":"2026-08-07T14:41:12.579156Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:11.495022Z","title":"Pytorch: An imperative style, high-performance deep learning library","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:11.495022Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:ce56d4e8b6f81fabab82e29a295b598a99346f4fc06631bf9fdbfe86b5a4db94","observation_id":"6e0a3936-b435-425e-9761-fc7319479811","resolution":{"observed_at":"2026-08-07T14:41:11.495022Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2109.08203","last_updated":"2023-05-11T21:36:07Z","snapshot_observed_at":"2026-08-05T15:38:15.380186Z","submitted_at":"2021-09-16T20:10:12Z","title":"Torch.manual_seed(3407) is all you need: On the influence of random seeds in deep learning architectures for computer vision","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2109.08203","snapshot_observed_at":"2026-08-07T14:41:11.564844Z","title":null,"venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:11.564844Z"},"links":{"cited_paper":"/paper/2109.08203","citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:fe4c53f6544c2bf286d6fc548c797ae707357f0ea72d496054f25566532005f7","observation_id":"7fe46835-5bfa-4855-b2c4-ec64bded2c43","resolution":{"observed_at":"2026-08-07T14:41:11.564844Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:12.419644Z","title":"Very deep convolutional networks for large-scale image recognition","venue":null,"work_id":"08bb83c6-03f7-491b-9abc-b319b6272060","year":2015},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:11.637144Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:c896af4de2866122df9aff43f629e356c0a1497c68d6ff12f376b800c8c203d3","observation_id":"5d270535-0b10-4a8d-8807-928bd20ae11f","resolution":{"observed_at":"2026-08-07T14:41:12.460387Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:11.705392Z","title":"Microsoft coco: Common objects in context","venue":null,"work_id":null,"year":2014},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:11.705392Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:0797b5c0672c68e57c20c017b28cfe2e985b64912ff797c65bb0df5928351387","observation_id":"0c2c448f-c5e7-40c7-886a-351413a76cda","resolution":{"observed_at":"2026-08-07T14:41:11.705392Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2111.11429","last_updated":"2021-11-22T18:59:15Z","snapshot_observed_at":"2026-07-06T12:11:02.119174Z","submitted_at":"2021-11-22T18:59:15Z","title":"Benchmarking Detection Transfer Learning with Vision Transformers","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2111.11429","snapshot_observed_at":"2026-08-07T14:41:11.779207Z","title":"Bench- marking detection transfer learning with vision transformers","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:11.779207Z"},"links":{"cited_paper":"/paper/2111.11429","citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:cc2e632aa7ee7c5191c349e49a968d7c46f6dcbe53e2fd3abadf365ef8be20cf","observation_id":"f5da79d6-9ca5-4b34-b89b-d243c4f3392a","resolution":{"observed_at":"2026-08-07T14:41:11.779207Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:41:12.283927Z","title":"Faster r-cnn: Towards real-time object detection with region proposal networks","venue":null,"work_id":"b7f1bf20-f7e2-4e05-82cb-a91e44987867","year":2015},"citing_paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-07T14:41:11.853919Z"},"links":{"citing_paper":"/paper/2505.18097"},"observation_digest":"sha256:b3ee5529dc73c8e40325eed3d224f4d41d8cc24d82974bfc962a587faac88f2a","observation_id":"3494d486-52c8-4674-8000-76392a1560ac","resolution":{"observed_at":"2026-08-07T14:41:12.347418Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2505.18097","last_updated":"2025-05-23T16:49:20Z","latest_version":1,"primary_category":"cs.LG","snapshot_observed_at":"2026-08-08T06:05:05.985675Z","submitted_at":"2025-05-23T16:49:20Z","title":"Towards more transferable adversarial attack in black-box manner"},"reference_resolution":{"displayed":40,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":19,"verified_exact":1,"verified_fuzzy":20},"total_outbound_references":40},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"thesis":"As of 9 August 2026, this Paper Citation Record lists 40 of 40 outbound references and 0 inbound Pith citation observations for arXiv:2505.18097."}