Adversarial Attack on ImageNet (ASR and Perturbation Norms)
100ASRCAC
Evaluation Results
| Method | Links | ||||||
|---|---|---|---|---|---|---|---|
| CACSetting=hard-label, Target Model=ResNet-502026.03 | 100 | 487.95 | 35.074 | 18.833 | 0.153 | 0.08 | |
| HOPSKIPJUMP l2Setting=hard-label, Target Model=ResNet-502026.03 | 100 | 500.31 | 48.838 | 29.118 | 0.539 | 0.28 | |
| HOPSKIPJUMP l∞Setting=hard-label, Target Model=ResNet-502026.03 | 100 | 500.01 | 73.255 | 35.856 | 0.361 | 0.202 | |
| SIGNOPTSetting=hard-label, Target Model=ResNet-502026.03 | 100 | 548.24 | 48.047 | 28.467 | 0.551 | 0.283 | |
| GEODASetting=hard-label, Target Model=ResNet-502026.03 | 100 | 524.98 | 49.658 | 31.117 | 0.18 | 0.094 | |
| CACTarget Model=ViT-B, Attack Setting=Hard-label2026.03 | 100 | 488.91 | 49.282 | 26.488 | 0.165 | 0.091 | |
| HopSkipJumpTarget Model=ViT-B, Attack Setting=Hard-label, Norm Constraint=l22026.03 | 100 | 500.34 | 70.122 | 38.343 | 0.685 | 0.318 | |
| HopSkipJumpTarget Model=ViT-B, Attack Setting=Hard-label, Norm Constraint=l∞2026.03 | 100 | 500.01 | 106.142 | 48.455 | 0.563 | 0.292 | |
| SignOPTTarget Model=ViT-B, Attack Setting=Hard-label2026.03 | 100 | 557.31 | 74.744 | 44.85 | 0.708 | 0.338 | |
| GeoDATarget Model=ViT-B, Attack Setting=Hard-label2026.03 | 100 | 540.21 | 65.471 | 40.497 | 0.19 | 0.124 | |
| PARTarget Model=ViT-B, Attack Setting=Hard-label2026.03 | 100 | 322.38 | 38.751 | 25.745 | 0.889 | 0.233 | |
| SignOPT + PARTarget Model=ViT-B, Attack Setting=Hard-label2026.03 | 100 | 467.64 | 51.468 | 37.941 | 0.625 | 0.276 | |
| HopSkipJump + PARTarget Model=ViT-B, Attack Setting=Hard-label, Norm Constraint=l22026.03 | 100 | 500.36 | 56.514 | 40.454 | 0.665 | 0.328 | |
| HopSkipJump + PARTarget Model=ViT-B, Attack Setting=Hard-label, Norm Constraint=l∞2026.03 | 100 | 500.09 | 102.909 | 49.018 | 0.543 | 0.287 | |
| AdvViTTarget Model=ViT-B, Attack Setting=Hard-label2026.03 | 75 | 461.04 | 34.52 | 20.257 | 0.584 | 0.301 |