1.Title of the Publication Optimizing Latent Variables in Integrating Transfer and Query Based Attack Framework 2.Author Information: the name, complete physical mailing address, e-mail address, and phone number of EACH author of EACH paper(s); Chao Li; School of Artificial Intelligence, Xidian University, Xi’an 710071, China; lichaoedu@126.com; +86-13298301552 Tingsong Jiang; Defense Innovation Institute, Chinese Academy of Military Science, Beijing 100071, China; tingsong@pku.edu.cn; +86-15210599701 Handing Wang; School of Artificial Intelligence, Xidian University, Xi’an 710071, China; hdwang@xidian.edu.cn; +86-18681895468 Wen Yao; Defense Innovation Institute, Chinese Academy of Military Science, Beijing 100071, China; wendy0782@126.com; +86-18518169621 Donghua Wang; Zhejiang University, Hangzhou 310027, China; wangdonghua@zju.edu.cn; +86-15979825052 3.Corresponding Author Handing Wang; Wen Yao. 4.The abstract of the paper Black-box adversarial attacks can be categorized into transfer-based and query-based attacks. The former usually has poor transfer performance due to the mismatch between the architectures of models, while the query-based attacks require massive queries and high dimensional optimization variables. In order to solve the above problems, we propose a novel attack framework integrating the advantages of transfer- and query-based attacks, where the framework is divided into two phases: training the adversarial generator and executing the black-box attacks. In the first stage, a generator is trained by the adversarial loss function so that it can output adversarial perturbation, where the latent variables are designed as the input of the generator to reduce the dimension of the optimization variables. In the second stage, based on the trained generator, we further employ a particle swarm optimization algorithm to optimize the latent variables so that the generator can output the perturbation that can achieve a successful attack. Extensive experiments are performed on the ImageNet dataset, and the results demonstrate that the proposed framework can obtain better attack performance compared with a number of the state-of-the-art black-box adversarial attack methods. In addition, we show the flexibility of the proposed framework by extending the experiment for few-pixel attacks. 5. A list containing one or more of the eight letters (A, B, C, D, E, F, G, or H) that correspond to the criteria that the author claims that the work satisfies; (D) The result is publishable in its own right as a new scientific result — independent of the fact that the result was mechanically created. (G) The result solves a problem of indisputable difficulty in its field. 6. A statement stating why the result satisfies the criteria that the contestant claims (see examples of statements of human-competitiveness as a guide to aid in constructing this part of the submission); D: Black-box adversarial attacks can be categorized into transfer-based and query-based attacks, where the former can efficiently craft the adversarial example by using the gradient information of a surrogate model, however, the mismatch between the architectures of the surrogate model and the target model limits the attack performance of the adversarial examples. The query-based methods usually model adversarial attacks as an optimization problem, where evolutionary computation (EC) is usually selected as the optimizer due to its effectiveness in solving black-box optimization problems. However, the EC-based query methods usually employ the perturbation matrix with the same size as the image as the optimization variable, resulting in the increase of the optimization variable dimension, which makes it difficult to find the optimal solutions in the high-dimensional search space, and the massive queries are usually needed. Therefore, it is necessary to consider both attack performance and the efficiency in the process of generating the adversarial examples. In this work, we propose a transfer- and query- based integration framework for the first time, where the proposed framework performs efficient optimization in a low-dimensional space to enhance the attack performance of adversarial examples. Thus, the published results can be considered as a new scientific result. G: Improving the attack performance of adversarial examples and reducing the number of queries are the main challenges in the black-box adversarial attack problem. Compared to the transfer-based attack methods, the proposed method improves the attack performance by approximately 20%. Compared to the EC-based query methods, the proposed method effectively reduces the optimization variables dimension to 50, and the performance is improved by approximately 30% with only using 500 queries. 7.A full citation of the paper; Chao Li, Tingsong Jiang, Handing Wang, Wen Yao and Donghua Wang, Optimizing Latent Variables in Integrating Transfer and Query Based Attack Framework, IEEE Transactions on Pattern Analysis and Machine Intelligence, vol.47, no.1, pp.161-171, 2025. 8.A statement either that "any prize money, if any, is to be divided equally among the co-authors" OR a specific percentage breakdown as to how the prize money, if any, is to be divided among the co-authors; Any prize money, if any, is to be split equally between the co-authors of the cited paper. 9.A statement stating why the authors expect that their entry would be the "best"; This paper proposes a transfer- and query-based integration framework to improve the transferability of adversarial examples and reduce the number of queries. We will illustrate the practicality and research value of this project from the following two aspects. Firstly, this project proposes a novel attack framework integrating the advantages of transfer- and query-based attacks for the first time, where the proposed framework can utilize the efficiency of transfer-based methods to reduce the number of queries, meanwhile, the idea of the query-based methods can further improve the attack performance. According to experimental results, the proposed method can obtain superior attack performance with only using 500 queries. Secondly, the proposed framework is flexible to be extended or changed. For example, the dimension of optimization variables can be set according to user preference, and each element in the framework can be replaced with other element. In addition, the output of the framework can be slightly modified to accomplish different attack tasks, such as few-pixel attack. Overall, we hope the introduction of this method will lead black-box adversarial attacks towards a new journey of efficiency and convenience. 10.An indication of the general type of genetic or evolutionary computation used; PSO (particle swarm optimization) 11.The date of publication. 16 September 2024