# Adversarial Attack on ImageNet (ASR and Perturbation Norms)

Source: [Adversarial Attack on ImageNet (ASR and Perturbation Norms)](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-asr-and-perturbation-norms>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2026-03-12T09:04:07.774Z

Evaluation of adversarial attack effectiveness on the ImageNet dataset, reporting Attack Success Rate (ASR), Average Query Number (AQN), and the distribution (Average and Standard Deviation) of L2 and L-infinity perturbations.

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

| Scope | Recorded value |
| --- | --- |
| Task | Adversarial Attack |
| Dataset (including any stated split) | ImageNet |
| Metric | ASR |
| Unit | PERCENT |
| Direction | Higher is better |
| Results loaded | 15 of 15 |
| Coverage | All results currently returned for this benchmark |

Evaluation settings may differ between results. The original papers and recorded configurations are needed to establish comparability. A shared metric name alone does not establish an identical protocol.

## Metrics

- [ASR](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-asr-and-perturbation-norms.md?metric=ASR>): Higher is better; unit: PERCENT.

- [AQN](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-asr-and-perturbation-norms.md?metric=AQN>): Lower is better; unit: SCALAR.

- [Avg L2 Norm](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-asr-and-perturbation-norms.md?metric=Avg%20L2%20Norm>): Lower is better; unit: SCALAR.

- [Std Dev L2 Norm](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-asr-and-perturbation-norms.md?metric=Std%20Dev%20L2%20Norm>): Lower is better; unit: SCALAR.

- [Avg LInf Norm](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-asr-and-perturbation-norms.md?metric=Avg%20LInf%20Norm>): Lower is better; unit: SCALAR.

- [Std Dev LInf Norm](<https://www.sota2.com/research/sota/adversarial-attack-on-imagenet-asr-and-perturbation-norms.md?metric=Std%20Dev%20LInf%20Norm>): Lower is better; unit: SCALAR.

## Recorded results

| Method | ASR | Result date | Report paper |
| --- | --- | --- | --- |
| CAC | 100 | Not recorded | 69b248b2d030084c22e2fab9 |
| HOPSKIPJUMP l2 | 100 | Not recorded | 69b248b2d030084c22e2fab9 |
| HOPSKIPJUMP l∞ | 100 | Not recorded | 69b248b2d030084c22e2fab9 |
| SIGNOPT | 100 | Not recorded | 69b248b2d030084c22e2fab9 |
| GEODA | 100 | Not recorded | 69b248b2d030084c22e2fab9 |
| CAC | 100 | Not recorded | 69b248b2d030084c22e2fab9 |
| HopSkipJump | 100 | Not recorded | 69b248b2d030084c22e2fab9 |
| HopSkipJump | 100 | Not recorded | 69b248b2d030084c22e2fab9 |
| SignOPT | 100 | Not recorded | 69b248b2d030084c22e2fab9 |
| GeoDA | 100 | Not recorded | 69b248b2d030084c22e2fab9 |
| PAR | 100 | Not recorded | 69b248b2d030084c22e2fab9 |
| SignOPT + PAR | 100 | Not recorded | 69b248b2d030084c22e2fab9 |
| HopSkipJump + PAR | 100 | Not recorded | 69b248b2d030084c22e2fab9 |
| HopSkipJump + PAR | 100 | Not recorded | 69b248b2d030084c22e2fab9 |
| AdvViT | 75 | Not recorded | 69b248b2d030084c22e2fab9 |

### CAC

ASR: 100. Result ID: 69b280576dbb7075b95d47d6.

[Reporting paper](<https://www.sota2.com/research/paper/69b248b2d030084c22e2fab9.md>)

[Method origin paper](<https://www.sota2.com/research/paper/69b248b2d030084c22e2fab9.md>)

Recorded evaluation configuration: {"Setting":"hard-label","Target Model":"ResNet-50"}. This record does not assert independent reproduction.

### HOPSKIPJUMP l2

ASR: 100. Result ID: 69b280576dbb7075b95d47d7.

[Reporting paper](<https://www.sota2.com/research/paper/69b248b2d030084c22e2fab9.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa56db1e209131ce9a05a4.md>)

Recorded evaluation configuration: {"Setting":"hard-label","Target Model":"ResNet-50"}. This record does not assert independent reproduction.

### HOPSKIPJUMP l∞

ASR: 100. Result ID: 69b280576dbb7075b95d47d8.

[Reporting paper](<https://www.sota2.com/research/paper/69b248b2d030084c22e2fab9.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa56db1e209131ce9a05a4.md>)

Recorded evaluation configuration: {"Setting":"hard-label","Target Model":"ResNet-50"}. This record does not assert independent reproduction.

### SIGNOPT

ASR: 100. Result ID: 69b280576dbb7075b95d47d9.

[Reporting paper](<https://www.sota2.com/research/paper/69b248b2d030084c22e2fab9.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa67091e209131cea14055.md>)

Recorded evaluation configuration: {"Setting":"hard-label","Target Model":"ResNet-50"}. This record does not assert independent reproduction.

### GEODA

ASR: 100. Result ID: 69b280576dbb7075b95d47da.

[Reporting paper](<https://www.sota2.com/research/paper/69b248b2d030084c22e2fab9.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa67331e209131cea14b22.md>)

Recorded evaluation configuration: {"Setting":"hard-label","Target Model":"ResNet-50"}. This record does not assert independent reproduction.

### CAC

ASR: 100. Result ID: 69b280576dbb7075b95d47e3.

[Reporting paper](<https://www.sota2.com/research/paper/69b248b2d030084c22e2fab9.md>)

[Method origin paper](<https://www.sota2.com/research/paper/69b248b2d030084c22e2fab9.md>)

Recorded evaluation configuration: {"Target Model":"ViT-B","Attack Setting":"Hard-label"}. This record does not assert independent reproduction.

### HopSkipJump

ASR: 100. Result ID: 69b280576dbb7075b95d47e4.

[Reporting paper](<https://www.sota2.com/research/paper/69b248b2d030084c22e2fab9.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa56db1e209131ce9a05a4.md>)

Recorded evaluation configuration: {"Target Model":"ViT-B","Attack Setting":"Hard-label","Norm Constraint":"l2"}. This record does not assert independent reproduction.

### HopSkipJump

ASR: 100. Result ID: 69b280576dbb7075b95d47e5.

[Reporting paper](<https://www.sota2.com/research/paper/69b248b2d030084c22e2fab9.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa56db1e209131ce9a05a4.md>)

Recorded evaluation configuration: {"Target Model":"ViT-B","Attack Setting":"Hard-label","Norm Constraint":"l∞"}. This record does not assert independent reproduction.

### SignOPT

ASR: 100. Result ID: 69b280576dbb7075b95d47e6.

[Reporting paper](<https://www.sota2.com/research/paper/69b248b2d030084c22e2fab9.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa67091e209131cea14055.md>)

Recorded evaluation configuration: {"Target Model":"ViT-B","Attack Setting":"Hard-label"}. This record does not assert independent reproduction.

### GeoDA

ASR: 100. Result ID: 69b280576dbb7075b95d47e7.

[Reporting paper](<https://www.sota2.com/research/paper/69b248b2d030084c22e2fab9.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa67331e209131cea14b22.md>)

Recorded evaluation configuration: {"Target Model":"ViT-B","Attack Setting":"Hard-label"}. This record does not assert independent reproduction.

### PAR

ASR: 100. Result ID: 69b280576dbb7075b95d47e8.

[Reporting paper](<https://www.sota2.com/research/paper/69b248b2d030084c22e2fab9.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa6d671e209131cea39927.md>)

Recorded evaluation configuration: {"Target Model":"ViT-B","Attack Setting":"Hard-label"}. This record does not assert independent reproduction.

### SignOPT + PAR

ASR: 100. Result ID: 69b280576dbb7075b95d47ea.

[Reporting paper](<https://www.sota2.com/research/paper/69b248b2d030084c22e2fab9.md>)

Recorded evaluation configuration: {"Target Model":"ViT-B","Attack Setting":"Hard-label"}. This record does not assert independent reproduction.

### HopSkipJump + PAR

ASR: 100. Result ID: 69b280576dbb7075b95d47eb.

[Reporting paper](<https://www.sota2.com/research/paper/69b248b2d030084c22e2fab9.md>)

Recorded evaluation configuration: {"Target Model":"ViT-B","Attack Setting":"Hard-label","Norm Constraint":"l2"}. This record does not assert independent reproduction.

### HopSkipJump + PAR

ASR: 100. Result ID: 69b280576dbb7075b95d47ec.

[Reporting paper](<https://www.sota2.com/research/paper/69b248b2d030084c22e2fab9.md>)

Recorded evaluation configuration: {"Target Model":"ViT-B","Attack Setting":"Hard-label","Norm Constraint":"l∞"}. This record does not assert independent reproduction.

### AdvViT

ASR: 75. Result ID: 69b280576dbb7075b95d47e9.

[Reporting paper](<https://www.sota2.com/research/paper/69b248b2d030084c22e2fab9.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa73ed1e209131cea5ee93.md>)

Recorded evaluation configuration: {"Target Model":"ViT-B","Attack Setting":"Hard-label"}. This record does not assert independent reproduction.

Page 1 of 1. This is an index page, not the full collection.