Adversarial Attack on CIFAR-100
99.77ASR (Average)DASH
Evaluation results
| Method | Links | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| DASHTarget Model=Cui2024 [14]2025.08 | 99.77 | 0.96 | 100 | 99.9 | 100 | 99.32 | 99.61 | 94.43 | 0.0139 | 41.08 | |
| DASHTarget Model=Wang2023 [44]2025.08 | 99.67 | 0.79 | 100 | 100 | 100 | 99.12 | 99.22 | 94.73 | 0.0141 | 41.59 | |
| DASHTarget Model=Addepalli2022 [1]2025.08 | 99.22 | 0.84 | 100 | 99.9 | 98.93 | 98.63 | 98.63 | 95.05 | 0.0131 | 39.58 | |
| SDMTarget Architecture=ResNet-34, Target Defense Method=VAT, Norm Constraint=l2-norm2026.05 | 84.5 | — | — | — | — | — | — | — | — | — | |
| CWTarget Model=Addepalli2022 [1]2025.08 | 84.18 | 0.13 | 100 | 86.67 | 96.45 | 79.04 | 58.72 | 94.94 | 0.0118 | 27.54 | |
| CWTarget Model=Cui2024 [14]2025.08 | 84.14 | 0.11 | 100 | 87.7 | 96.68 | 78.61 | 57.71 | 94.38 | 0.0153 | 32.49 | |
| CWTarget Model=Wang2023 [44]2025.08 | 83.57 | 0.12 | 100 | 85.74 | 95.31 | 76.95 | 59.86 | 94.55 | 0.0161 | 32.19 | |
| SDMTarget Architecture=WideResNet-28-10, Target Defense Method=VAT, Norm Constraint=l2-norm2026.05 | 82.95 | — | — | — | — | — | — | — | — | — | |
| APGDTarget Architecture=ResNet-34, Target Defense Method=VAT, Norm Constraint=l2-norm2026.05 | 82.81 | — | — | — | — | — | — | — | — | — | |
| SDMTarget Architecture=ResNet-34, Target Defense Method=MART, Norm Constraint=l2-norm2026.05 | 82.38 | — | — | — | — | — | — | — | — | — | |
| PGDTarget Architecture=ResNet-34, Target Defense Method=VAT, Norm Constraint=l2-norm2026.05 | 81.83 | — | — | — | — | — | — | — | — | — | |
| DiffPGDTarget Model=Addepalli2022 [1]2025.08 | 81.8 | 4.27 | 82.5 | 82.2 | 81.8 | 81.6 | 80.9 | 91.05 | 0.0168 | 42.8 | |
| AdvADTarget Model=Addepalli2022 [1]2025.08 | 81.6 | 0.54 | 84.5 | 84 | 83.7 | 84.3 | 70.5 | 83.92 | 0.0291 | 45.63 | |
| DiffAttackTarget Model=Addepalli2022 [1]2025.08 | 81.35 | 12.86 | 81.6 | 81.6 | 81.4 | 81.4 | 81.5 | 91.26 | 0.0163 | 42.15 | |
| APGDTarget Architecture=WideResNet-28-10, Target Defense Method=VAT, Norm Constraint=l2-norm2026.05 | 80.6 | — | — | — | — | — | — | — | — | — | |
| SDMTarget Architecture=WideResNet-28-10, Target Defense Method=MART, Norm Constraint=l2-norm2026.05 | 80.45 | — | — | — | — | — | — | — | — | — | |
| PGDTarget Architecture=WideResNet-28-10, Target Defense Method=VAT, Norm Constraint=l2-norm2026.05 | 79.72 | — | — | — | — | — | — | — | — | — | |
| C&WTarget Architecture=ResNet-34, Target Defense Method=VAT, Norm Constraint=l2-norm2026.05 | 79.71 | — | — | — | — | — | — | — | — | — | |
| SDMTarget Architecture=ResNet-34, Target Defense Method=HAT, Norm Constraint=l2-norm2026.05 | 79.5 | — | — | — | — | — | — | — | — | — | |
| AdvADTarget Model=Cui2024 [14]2025.08 | 79.14 | 0.51 | 82.2 | 82.8 | 81.1 | 81.7 | 67.9 | 83.18 | 0.0288 | 45.67 | |
| C&WTarget Architecture=WideResNet-28-10, Target Defense Method=VAT, Norm Constraint=l2-norm2026.05 | 78.68 | — | — | — | — | — | — | — | — | — | |
| SDMTarget Architecture=WideResNet-28-10, Target Defense Method=HAT, Norm Constraint=l2-norm2026.05 | 78.59 | — | — | — | — | — | — | — | — | — | |
| AutoAttackTarget Model=Wang2023 [44]2025.08 | 78.34 | 0.39 | 83.5 | 82.91 | 81.05 | 81.64 | 62.6 | 91.25 | 0.0189 | 42.19 | |
| APGDTarget Architecture=ResNet-34, Target Defense Method=MART, Norm Constraint=l2-norm2026.05 | 78.18 | — | — | — | — | — | — | — | — | — | |
| AutoAttackTarget Model=Addepalli2022 [1]2025.08 | 77.9 | 0.39 | 83.77 | 82.7 | 81.02 | 80.68 | 61.33 | 93.03 | 0.0147 | 39.59 | |
| AdvADTarget Model=Wang2023 [44]2025.08 | 77.42 | 0.51 | 79.9 | 79.6 | 79.9 | 79.5 | 67.2 | 83.07 | 0.0293 | 47.29 | |
| SDMTarget Architecture=ResNet-34, Target Defense Method=LOAT, Norm Constraint=l2-norm2026.05 | 77.26 | — | — | — | — | — | — | — | — | — | |
| DiffAttackTarget Model=Cui2024 [14]2025.08 | 77.24 | 12.44 | 77.5 | 77.2 | 77.7 | 77.4 | 76.4 | 91.16 | 0.0169 | 42.3 | |
| PGDTarget Architecture=ResNet-34, Target Defense Method=MART, Norm Constraint=l2-norm2026.05 | 77.08 | — | — | — | — | — | — | — | — | — | |
| AutoAttackTarget Model=Cui2024 [14]2025.08 | 76.77 | 0.33 | 82.56 | 81.33 | 79.51 | 80.55 | 59.88 | 92.09 | 0.0167 | 41.68 | |
| DiffAttackTarget Model=Wang2023 [44]2025.08 | 76.53 | 12.96 | 76.9 | 76.6 | 76.4 | 76.8 | 76.3 | 90.9 | 0.0176 | 42.2 | |
| APGDTarget Architecture=WideResNet-28-10, Target Defense Method=MART, Norm Constraint=l2-norm2026.05 | 76.08 | — | — | — | — | — | — | — | — | — | |
| SDMTarget Architecture=WideResNet-28-10, Target Defense Method=LOAT, Norm Constraint=l2-norm2026.05 | 75.89 | — | — | — | — | — | — | — | — | — | |
| DiffPGDTarget Model=Cui2024 [14]2025.08 | 75.8 | 4.21 | 76.2 | 76 | 75.8 | 75.6 | 75.4 | 91.15 | 0.0165 | 43.5 | |
| DiffPGDTarget Model=Wang2023 [44]2025.08 | 75.32 | 4.77 | 79.1 | 76.1 | 74.2 | 73.8 | 73.4 | 91.5 | 0.0161 | 51.8 | |
| PGDTarget Architecture=WideResNet-28-10, Target Defense Method=MART, Norm Constraint=l2-norm2026.05 | 75.32 | — | — | — | — | — | — | — | — | — | |
| APGDTarget Architecture=ResNet-34, Target Defense Method=HAT, Norm Constraint=l2-norm2026.05 | 74.79 | — | — | — | — | — | — | — | — | — | |
| PGDTarget Architecture=ResNet-34, Target Defense Method=HAT, Norm Constraint=l2-norm2026.05 | 74.16 | — | — | — | — | — | — | — | — | — | |
| APGDTarget Architecture=WideResNet-28-10, Target Defense Method=HAT, Norm Constraint=l2-norm2026.05 | 73.74 | — | — | — | — | — | — | — | — | — | |
| PGDTarget Architecture=WideResNet-28-10, Target Defense Method=HAT, Norm Constraint=l2-norm2026.05 | 72.96 | — | — | — | — | — | — | — | — | — | |
| APGDTarget Architecture=ResNet-34, Target Defense Method=LOAT, Norm Constraint=l2-norm2026.05 | 72.85 | — | — | — | — | — | — | — | — | — | |
| PGDTarget Architecture=ResNet-34, Target Defense Method=LOAT, Norm Constraint=l2-norm2026.05 | 72.22 | — | — | — | — | — | — | — | — | — | |
| C&WTarget Architecture=ResNet-34, Target Defense Method=MART, Norm Constraint=l2-norm2026.05 | 72.11 | — | — | — | — | — | — | — | — | — | |
| APGDTarget Architecture=WideResNet-28-10, Target Defense Method=LOAT, Norm Constraint=l2-norm2026.05 | 71.24 | — | — | — | — | — | — | — | — | — | |
| C&WTarget Architecture=WideResNet-28-10, Target Defense Method=MART, Norm Constraint=l2-norm2026.05 | 70.61 | — | — | — | — | — | — | — | — | — | |
| PGDTarget Architecture=WideResNet-28-10, Target Defense Method=LOAT, Norm Constraint=l2-norm2026.05 | 70.51 | — | — | — | — | — | — | — | — | — | |
| DI-FGSMTarget Model=Addepalli2022 [1]2025.08 | 70.24 | 0.18 | 72.09 | 72.13 | 71.84 | 71.74 | 63.42 | 92.05 | 0.0156 | 56.69 | |
| C&WTarget Architecture=ResNet-34, Target Defense Method=HAT, Norm Constraint=l2-norm2026.05 | 69.12 | — | — | — | — | — | — | — | — | — | |
| PI-FGSM++Target Model=Addepalli2022 [1]2025.08 | 68.47 | 0.23 | 71.5 | 71.93 | 70.86 | 71.15 | 56.89 | 91.14 | 0.0192 | 59.94 | |
| C&WTarget Architecture=WideResNet-28-10, Target Defense Method=HAT, Norm Constraint=l2-norm2026.05 | 67.34 | — | — | — | — | — | — | — | — | — | |
| C&WTarget Architecture=ResNet-34, Target Defense Method=LOAT, Norm Constraint=l2-norm2026.05 | 66.75 | — | — | — | — | — | — | — | — | — | |
| C&WTarget Architecture=WideResNet-28-10, Target Defense Method=LOAT, Norm Constraint=l2-norm2026.05 | 65.7 | — | — | — | — | — | — | — | — | — | |
| DI-FGSMTarget Model=Wang2023 [44]2025.08 | 65.22 | 0.17 | 66.46 | 67.01 | 66.07 | 66.72 | 59.86 | 91.96 | 0.0169 | 55.24 | |
| DI-FGSMTarget Model=Cui2024 [14]2025.08 | 63.72 | 0.17 | 65.2 | 65.49 | 65.35 | 65.55 | 57.03 | 92.08 | 0.0168 | 54.93 | |
| PI-FGSM++Target Model=Wang2023 [44]2025.08 | 63.55 | 0.22 | 66.17 | 67.21 | 65.29 | 66.76 | 52.3 | 91.14 | 0.0199 | 57.88 | |
| PI-FGSM++Target Model=Cui2024 [14]2025.08 | 62.2 | 0.22 | 64.41 | 65.78 | 64.32 | 65.64 | 50.86 | 91.12 | 0.0199 | 58.94 |