# Adversarial Attack on ImageNet-1k (ASR, Perceptual Quality, and Time)

Source: [Adversarial Attack on ImageNet-1k (ASR, Perceptual Quality, and Time)](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-1k-asr-perceptual-quality-and-time>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2026-05-19T07:02:40.275Z

Evaluation of adversarial attack performance on ImageNet-1k, focusing on attack success rates under various conditions (e.g., JPEG, Ensemble), computational time cost, and the perceptual quality of the resulting adversarial examples (measured via SSIM, LPIPS, and FID).

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

| Scope | Recorded value |
| --- | --- |
| Task | Adversarial Attack |
| Dataset (including any stated split) | ImageNet-1k |
| Metric | Time (s) |
| Unit | TIME |
| Direction | Lower is better |
| Results loaded | 8 of 8 |
| Coverage | All results currently returned for this benchmark |

Evaluation settings may differ between results. The original papers and recorded configurations are needed to establish comparability. A shared metric name alone does not establish an identical protocol.

## Metrics

- [Time (s)](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-1k-asr-perceptual-quality-and-time.md?metric=Time%20(s)>): Lower is better; unit: TIME.

- [ASR (Base)](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-1k-asr-perceptual-quality-and-time.md?metric=ASR%20(Base)>): Higher is better; unit: PERCENT.

- [ASR (JPEG)](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-1k-asr-perceptual-quality-and-time.md?metric=ASR%20(JPEG)>): Higher is better; unit: PERCENT.

- [ASR (TVM)](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-1k-asr-perceptual-quality-and-time.md?metric=ASR%20(TVM)>): Higher is better; unit: PERCENT.

- [ASR (Ensemble)](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-1k-asr-perceptual-quality-and-time.md?metric=ASR%20(Ensemble)>): Higher is better; unit: PERCENT.

- [ASR (NRP)](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-1k-asr-perceptual-quality-and-time.md?metric=ASR%20(NRP)>): Higher is better; unit: PERCENT.

- [Average ASR](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-1k-asr-perceptual-quality-and-time.md?metric=Average%20ASR>): Higher is better; unit: PERCENT.

- [SSIM](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-1k-asr-perceptual-quality-and-time.md?metric=SSIM>): Higher is better; unit: PERCENT.

- [LPIPS](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-1k-asr-perceptual-quality-and-time.md?metric=LPIPS>): Lower is better; unit: SCALAR.

- [FID](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-1k-asr-perceptual-quality-and-time.md?metric=FID>): Lower is better; unit: SCALAR.

## Recorded results

| Method | Time (s) | Result date | Report paper |
| --- | --- | --- | --- |
| CW | 0.58 | Not recorded | 68fa7abd1e209131cea84ec6 |
| DI-FGSM | 1.22 | Not recorded | 68fa7abd1e209131cea84ec6 |
| PI-FGSM++ | 1.75 | Not recorded | 68fa7abd1e209131cea84ec6 |
| AutoAttack | 2.22 | Not recorded | 68fa7abd1e209131cea84ec6 |
| DASH | 5.35 | Not recorded | 68fa7abd1e209131cea84ec6 |
| AdvAD | 5.61 | Not recorded | 68fa7abd1e209131cea84ec6 |
| DiffPGD | 10.4 | Not recorded | 68fa7abd1e209131cea84ec6 |
| DiffAttack | 20.33 | Not recorded | 68fa7abd1e209131cea84ec6 |

### CW

Time (s): 0.58. Result ID: 6a0c0af2fbc373592c018eb1.

[Reporting paper](<https://www.sota2.com/research/paper/68fa7abd1e209131cea84ec6.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa63321e209131ce9fd4c7.md>)

Recorded evaluation configuration: {"Target Model":"Salman2020 \[39\]"}. This record does not assert independent reproduction.

### DI-FGSM

Time (s): 1.22. Result ID: 6a0c0af2fbc373592c018eb0.

[Reporting paper](<https://www.sota2.com/research/paper/68fa7abd1e209131cea84ec6.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa65dc1e209131cea0ceaa.md>)

Recorded evaluation configuration: {"Target Model":"Salman2020 \[39\]"}. This record does not assert independent reproduction.

### PI-FGSM++

Time (s): 1.75. Result ID: 6a0c0af2fbc373592c018eb2.

[Reporting paper](<https://www.sota2.com/research/paper/68fa7abd1e209131cea84ec6.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa6a241e209131cea264fe.md>)

Recorded evaluation configuration: {"Target Model":"Salman2020 \[39\]"}. This record does not assert independent reproduction.

### AutoAttack

Time (s): 2.22. Result ID: 6a0c0af2fbc373592c018eb3.

[Reporting paper](<https://www.sota2.com/research/paper/68fa7abd1e209131cea84ec6.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa67f91e209131cea19894.md>)

Recorded evaluation configuration: {"Target Model":"Salman2020 \[39\]"}. This record does not assert independent reproduction.

### DASH

Time (s): 5.35. Result ID: 6a0c0af2fbc373592c018eb7.

[Reporting paper](<https://www.sota2.com/research/paper/68fa7abd1e209131cea84ec6.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa7abd1e209131cea84ec6.md>)

Recorded evaluation configuration: {"Target Model":"Salman2020 \[39\]"}. This record does not assert independent reproduction.

### AdvAD

Time (s): 5.61. Result ID: 6a0c0af2fbc373592c018eb6.

[Reporting paper](<https://www.sota2.com/research/paper/68fa7abd1e209131cea84ec6.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa77671e209131cea730fd.md>)

[Implementation](<https://github.com/XianguiKang/AdvAD>)

Recorded evaluation configuration: {"Target Model":"Salman2020 \[39\]"}. This record does not assert independent reproduction.

### DiffPGD

Time (s): 10.4. Result ID: 6a0c0af2fbc373592c018eb4.

[Reporting paper](<https://www.sota2.com/research/paper/68fa7abd1e209131cea84ec6.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa71dd1e209131cea536c6.md>)

Recorded evaluation configuration: {"Target Model":"Salman2020 \[39\]"}. This record does not assert independent reproduction.

### DiffAttack

Time (s): 20.33. Result ID: 6a0c0af2fbc373592c018eb5.

[Reporting paper](<https://www.sota2.com/research/paper/68fa7abd1e209131cea84ec6.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa715a1e209131cea50c7c.md>)

Recorded evaluation configuration: {"Target Model":"Salman2020 \[39\]"}. This record does not assert independent reproduction.

Page 1 of 1. This is an index page, not the full collection.