Adversarial Attack on CIFAR-10
72.64ASRSDM
Evaluation Results
| Method | Links | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| SDMTarget Architecture=ResNet-34, Target Defense Method=VAT, Norm Constraint=l2-norm2026.05 | 72.64 | — | — | — | — | — | — | — | — | — | — | |
| APGDTarget Architecture=ResNet-34, Target Defense Method=VAT, Norm Constraint=l2-norm2026.05 | 71.95 | — | — | — | — | — | — | — | — | — | — | |
| PGDTarget Architecture=ResNet-34, Target Defense Method=VAT, Norm Constraint=l2-norm2026.05 | 71.12 | — | — | — | — | — | — | — | — | — | — | |
| SDMTarget Architecture=WideResNet-28-10, Target Defense Method=VAT, Norm Constraint=l2-norm2026.05 | 70.64 | — | — | — | — | — | — | — | — | — | — | |
| C&WTarget Architecture=ResNet-34, Target Defense Method=VAT, Norm Constraint=l2-norm2026.05 | 70.26 | — | — | — | — | — | — | — | — | — | — | |
| APGDTarget Architecture=WideResNet-28-10, Target Defense Method=VAT, Norm Constraint=l2-norm2026.05 | 69.53 | — | — | — | — | — | — | — | — | — | — | |
| PGDTarget Architecture=WideResNet-28-10, Target Defense Method=VAT, Norm Constraint=l2-norm2026.05 | 68.79 | — | — | — | — | — | — | — | — | — | — | |
| SDMTarget Architecture=ResNet-34, Target Defense Method=MART, Norm Constraint=l2-norm2026.05 | 68.02 | — | — | — | — | — | — | — | — | — | — | |
| C&WTarget Architecture=WideResNet-28-10, Target Defense Method=VAT, Norm Constraint=l2-norm2026.05 | 67.71 | — | — | — | — | — | — | — | — | — | — | |
| SDMTarget Architecture=ResNet-34, Target Defense Method=HAT, Norm Constraint=l2-norm2026.05 | 65.8 | — | — | — | — | — | — | — | — | — | — | |
| SDMTarget Architecture=WideResNet-28-10, Target Defense Method=MART, Norm Constraint=l2-norm2026.05 | 65.27 | — | — | — | — | — | — | — | — | — | — | |
| SDMTarget Architecture=ResNet-34, Target Defense Method=LOAT, Norm Constraint=l2-norm2026.05 | 63.75 | — | — | — | — | — | — | — | — | — | — | |
| SDMTarget Architecture=WideResNet-28-10, Target Defense Method=HAT, Norm Constraint=l2-norm2026.05 | 62.45 | — | — | — | — | — | — | — | — | — | — | |
| APGDTarget Architecture=ResNet-34, Target Defense Method=MART, Norm Constraint=l2-norm2026.05 | 62.05 | — | — | — | — | — | — | — | — | — | — | |
| SDMTarget Architecture=WideResNet-28-10, Target Defense Method=LOAT, Norm Constraint=l2-norm2026.05 | 60.66 | — | — | — | — | — | — | — | — | — | — | |
| PGDTarget Architecture=ResNet-34, Target Defense Method=MART, Norm Constraint=l2-norm2026.05 | 60.42 | — | — | — | — | — | — | — | — | — | — | |
| APGDTarget Architecture=WideResNet-28-10, Target Defense Method=MART, Norm Constraint=l2-norm2026.05 | 58.99 | — | — | — | — | — | — | — | — | — | — | |
| PGDTarget Architecture=WideResNet-28-10, Target Defense Method=MART, Norm Constraint=l2-norm2026.05 | 57.93 | — | — | — | — | — | — | — | — | — | — | |
| APGDTarget Architecture=ResNet-34, Target Defense Method=HAT, Norm Constraint=l2-norm2026.05 | 57.92 | — | — | — | — | — | — | — | — | — | — | |
| PGDTarget Architecture=ResNet-34, Target Defense Method=HAT, Norm Constraint=l2-norm2026.05 | 57.38 | — | — | — | — | — | — | — | — | — | — | |
| APGDTarget Architecture=ResNet-34, Target Defense Method=LOAT, Norm Constraint=l2-norm2026.05 | 56.08 | — | — | — | — | — | — | — | — | — | — | |
| PGDTarget Architecture=ResNet-34, Target Defense Method=LOAT, Norm Constraint=l2-norm2026.05 | 55.65 | — | — | — | — | — | — | — | — | — | — | |
| APGDTarget Architecture=WideResNet-28-10, Target Defense Method=HAT, Norm Constraint=l2-norm2026.05 | 54.89 | — | — | — | — | — | — | — | — | — | — | |
| PGDTarget Architecture=WideResNet-28-10, Target Defense Method=HAT, Norm Constraint=l2-norm2026.05 | 54.19 | — | — | — | — | — | — | — | — | — | — | |
| APGDTarget Architecture=WideResNet-28-10, Target Defense Method=LOAT, Norm Constraint=l2-norm2026.05 | 52.76 | — | — | — | — | — | — | — | — | — | — | |
| PGDTarget Architecture=WideResNet-28-10, Target Defense Method=LOAT, Norm Constraint=l2-norm2026.05 | 52.28 | — | — | — | — | — | — | — | — | — | — | |
| C&WTarget Architecture=ResNet-34, Target Defense Method=MART, Norm Constraint=l2-norm2026.05 | 48.6 | — | — | — | — | — | — | — | — | — | — | |
| C&WTarget Architecture=ResNet-34, Target Defense Method=HAT, Norm Constraint=l2-norm2026.05 | 45.77 | — | — | — | — | — | — | — | — | — | — | |
| C&WTarget Architecture=WideResNet-28-10, Target Defense Method=MART, Norm Constraint=l2-norm2026.05 | 45.33 | — | — | — | — | — | — | — | — | — | — | |
| C&WTarget Architecture=ResNet-34, Target Defense Method=LOAT, Norm Constraint=l2-norm2026.05 | 43.71 | — | — | — | — | — | — | — | — | — | — | |
| C&WTarget Architecture=WideResNet-28-10, Target Defense Method=HAT, Norm Constraint=l2-norm2026.05 | 42.49 | — | — | — | — | — | — | — | — | — | — | |
| C&WTarget Architecture=WideResNet-28-10, Target Defense Method=LOAT, Norm Constraint=l2-norm2026.05 | 41.68 | — | — | — | — | — | — | — | — | — | — | |
| AdvADTarget Model=Bartold2024 [5]2025.08 | — | 3.99 | 61.3 | 60.7 | 60.6 | 61.2 | 41.1 | 56.98 | 83.5 | 0.0269 | 49.37 | |
| AdvADTarget Model=Cui2024 [14]2025.08 | — | 0.54 | 66.8 | 67.2 | 66.6 | 66.2 | 45.5 | 62.46 | 83.11 | 0.0265 | 50.95 | |
| AdvADTarget Model=Wang2023 [44]2025.08 | — | 0.54 | 67.4 | 68.4 | 66.4 | 67.2 | 44.1 | 62.7 | 82.64 | 0.0271 | 52.78 | |
| AutoAttackTarget Model=Bartold2024 [5]2025.08 | — | 2.17 | 73.24 | 71.88 | 72.75 | 71.19 | 39.36 | 65.68 | 87.51 | 0.0264 | 53.05 | |
| AutoAttackTarget Model=Cui2024 [14]2025.08 | — | 0.41 | 78.42 | 77.34 | 78.22 | 76.46 | 44.34 | 70.96 | 86.88 | 0.0273 | 56.71 | |
| AutoAttackTarget Model=Wang2023 [44]2025.08 | — | 0.41 | 77.93 | 77.54 | 77.73 | 76.27 | 43.16 | 70.53 | 86.83 | 0.0276 | 56.75 | |
| CWTarget Model=Bartold2024 [5]2025.08 | — | 0.62 | 97.27 | 61.62 | 96.09 | 60.35 | 58.59 | 74.78 | 95.25 | 0.0206 | 55.25 | |
| CWTarget Model=Cui2024 [14]2025.08 | — | 0.11 | 99.8 | 67.68 | 95.51 | 65.33 | 65.33 | 78.73 | 95.39 | 0.0206 | 51.38 | |
| CWTarget Model=Wang2023 [44]2025.08 | — | 0.12 | 98.9 | 70.21 | 94.82 | 66.11 | 51.76 | 76.36 | 95.25 | 0.0208 | 52.86 | |
| DASHTarget Model=Bartold2024 [5]2025.08 | — | 3.25 | 97.62 | 97.32 | 97.62 | 96.13 | 97.32 | 97.2 | 93.89 | 0.0132 | 49.17 | |
| DASHTarget Model=Cui2024 [14]2025.08 | — | 0.42 | 99.8 | 99.8 | 99.8 | 99.22 | 99.41 | 99.61 | 93.21 | 0.0161 | 50.85 | |
| DASHTarget Model=Wang2023 [44]2025.08 | — | 0.42 | 98.93 | 98.83 | 98.93 | 98.34 | 98.54 | 98.71 | 92.91 | 0.0161 | 52.66 | |
| DI-FGSMTarget Model=Bartold2024 [5]2025.08 | — | 0.72 | 41.39 | 42.46 | 42.27 | 42.75 | 35.7 | 40.91 | 90.88 | 0.02 | 59.07 | |
| DI-FGSMTarget Model=Cui2024 [14]2025.08 | — | 0.16 | 51.64 | 52.71 | 52.36 | 53.01 | 45.23 | 50.99 | 90.51 | 0.0206 | 62.2 | |
| DI-FGSMTarget Model=Wang2023 [44]2025.08 | — | 0.17 | 51.64 | 52.13 | 52.09 | 51.84 | 44.57 | 50.45 | 90.45 | 0.0203 | 63.21 | |
| DiffAttackTarget Model=Bartold2024 [5]2025.08 | — | 15.91 | 73.6 | 73.3 | 73.6 | 73.5 | 72.9 | 73.38 | 82.9 | 0.0369 | 51.6 | |
| DiffAttackTarget Model=Cui2024 [14]2025.08 | — | 12.88 | 82.8 | 82.5 | 83.1 | 82.7 | 82.2 | 82.66 | 81.36 | 0.0404 | 58.24 | |
| DiffAttackTarget Model=Wang2023 [44]2025.08 | — | 13.49 | 82.5 | 82.4 | 82.5 | 82.4 | 82.1 | 82.38 | 80.12 | 0.0429 | 57.22 | |
| DiffPGDTarget Model=Bartold2024 [5]2025.08 | — | 4.8 | 53.2 | 52.4 | 52.6 | 52.4 | 52.8 | 52.68 | 91.6 | 0.0165 | 54.2 | |
| DiffPGDTarget Model=Cui2024 [14]2025.08 | — | 5.3 | 76.2 | 75.8 | 76.5 | 76.1 | 75.4 | 76 | 79.8 | 0.035 | 60.5 | |
| DiffPGDTarget Model=Wang2023 [44]2025.08 | — | 5.13 | 75.8 | 75.4 | 76.1 | 75.6 | 75.1 | 75.6 | 79.5 | 0.0345 | 60.8 | |
| PI-FGSM++Target Model=Bartold2024 [5]2025.08 | — | 0.83 | 45.8 | 48.46 | 46.72 | 48.89 | 23.24 | 42.62 | 88.74 | 0.0278 | 66.91 | |
| PI-FGSM++Target Model=Cui2024 [14]2025.08 | — | 0.21 | 55.76 | 57.09 | 56.05 | 56.84 | 31.07 | 51.36 | 88.71 | 0.0272 | 68.81 | |
| PI-FGSM++Target Model=Wang2023 [44]2025.08 | — | 0.22 | 55.29 | 57.11 | 54.61 | 56.27 | 29.61 | 50.58 | 88.72 | 0.0265 | 70.71 |