Adversarial Attack on ImageNet (Distortion and Success Rate)
99Attack Success RateMDCS-OPS
Evaluation results
| Method | Links | ||
|---|---|---|---|
| MDCS-OPSTarget Model/Defense=Bit-Red2026.02 | 99 | — | |
| MDCS-OPSTarget Model/Defense=JPEG2026.02 | 98.9 | — | |
| OPSTarget Model/Defense=JPEG2026.02 | 98.5 | — | |
| OPSTarget Model/Defense=Bit-Red2026.02 | 98.1 | — | |
| MDCS-OPSTarget Model/Defense=HGD2026.02 | 98 | — | |
| MDCS-OPSTarget Model/Defense=Inc-v3_ens32026.02 | 97.5 | — | |
| MDCS-OPSTarget Model/Defense=Inc-v3_ens42026.02 | 97.5 | — | |
| OPSTarget Model/Defense=HGD2026.02 | 97.2 | — | |
| OPSTarget Model/Defense=Inc-v3_ens32026.02 | 96.8 | — | |
| OPSTarget Model/Defense=Inc-v3_ens42026.02 | 96.7 | — | |
| MDCS-OPSTarget Model/Defense=IncRes-v2_ens2026.02 | 96 | — | |
| OPSTarget Model/Defense=IncRes-v2_ens2026.02 | 95.3 | — | |
| MDCS-MEFTarget Model/Defense=JPEG2026.02 | 88.5 | — | |
| AdaNCSSource Model=Res34, Target Model/Defense=JPEG2025.12 | 88.2 | — | |
| MEFTarget Model/Defense=JPEG2026.02 | 86.2 | — | |
| NCSSource Model=Res34, Target Model/Defense=JPEG2025.12 | 84.8 | — | |
| MDCS-MEFTarget Model/Defense=Bit-Red2026.02 | 84.7 | — | |
| MEFTarget Model/Defense=Bit-Red2026.02 | 81.2 | — | |
| GRASource Model=Res34, Target Model/Defense=JPEG2025.12 | 81 | — | |
| PARS-OPTQuery Budget=10K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet50 & ConViT2025.12 | 78.8 | 8.38 | |
| PARS-OPTQuery Budget=8K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet50 & ConViT2025.12 | 76 | 9.07 | |
| VMISource Model=Res34, Target Model/Defense=JPEG2025.12 | 75 | — | |
| MDCS-MEFTarget Model/Defense=HGD2026.02 | 74.6 | — | |
| MEFTarget Model/Defense=HGD2026.02 | 74.5 | — | |
| MDCS-MEFTarget Model/Defense=Inc-v3_ens32026.02 | 74.5 | — | |
| MEFTarget Model/Defense=Inc-v3_ens32026.02 | 73.6 | — | |
| Prior-OPTQuery Budget=10K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet50 & ConViT2025.12 | 73.4 | 10.43 | |
| PARS-OPTQuery Budget=6K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet50 & ConViT2025.12 | 72.6 | 10.16 | |
| Prior-OPTQuery Budget=8K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet50 & ConViT2025.12 | 72.2 | 10.72 | |
| MEFTarget Model/Defense=Inc-v3_ens42026.02 | 71.6 | — | |
| MDCS-MEFTarget Model/Defense=Inc-v3_ens42026.02 | 71.5 | — | |
| Prior-OPTQuery Budget=6K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet50 & ConViT2025.12 | 70.2 | 11.22 | |
| PARS-OPTQuery Budget=10K, Victim Backbone=ViT-L/14, Prior Backbone=ConViT2025.12 | 69.1 | 10.61 | |
| MDCS-OPSTarget Model/Defense=RS2026.02 | 66.6 | — | |
| PARS-OPTQuery Budget=8K, Victim Backbone=ViT-L/14, Prior Backbone=ConViT2025.12 | 66.5 | 11.47 | |
| MEFTarget Model/Defense=IncRes-v2_ens2026.02 | 66.3 | — | |
| MDCS-MEFTarget Model/Defense=IncRes-v2_ens2026.02 | 66.3 | — | |
| PARS-OPTQuery Budget=10K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet502025.12 | 65.8 | 11.55 | |
| Prior-OPTQuery Budget=4K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet50 & ConViT2025.12 | 65.6 | 12.66 | |
| OPSTarget Model/Defense=RS2026.02 | 65.3 | — | |
| PARS-OPTQuery Budget=4K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet50 & ConViT2025.12 | 65.1 | 12.25 | |
| AdaMISource Model=Res34, Target Model/Defense=JPEG2025.12 | 62.8 | — | |
| PARS-OPTQuery Budget=8K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet502025.12 | 62.2 | 12.69 | |
| AdaNCSSource Model=Res34, Target Model/Defense=NRP2025.12 | 62.2 | — | |
| PARS-OPTQuery Budget=6K, Victim Backbone=ViT-L/14, Prior Backbone=ConViT2025.12 | 62 | 12.68 | |
| MISource Model=Res34, Target Model/Defense=JPEG2025.12 | 61.5 | — | |
| NISource Model=Res34, Target Model/Defense=JPEG2025.12 | 61.4 | — | |
| NCSSource Model=Res34, Target Model/Defense=NRP2025.12 | 61.4 | — | |
| GRASource Model=Res34, Target Model/Defense=NRP2025.12 | 59.8 | — | |
| Prior-OPTQuery Budget=10K, Victim Backbone=ViT-L/14, Prior Backbone=ConViT2025.12 | 58.9 | 14.36 | |
| Prior-OPTQuery Budget=8K, Victim Backbone=ViT-L/14, Prior Backbone=ConViT2025.12 | 58.8 | 14.62 | |
| MDCS-OPSTarget Model/Defense=AT2026.02 | 58.5 | — | |
| OPSTarget Model/Defense=AT2026.02 | 58.3 | — | |
| Prior-OPTQuery Budget=6K, Victim Backbone=ViT-L/14, Prior Backbone=ConViT2025.12 | 57.5 | 15.14 | |
| PARS-OPTQuery Budget=4K, Victim Backbone=ViT-L/14, Prior Backbone=ConViT2025.12 | 57 | 14.89 | |
| PARS-OPTQuery Budget=6K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet502025.12 | 56.8 | 14.45 | |
| PISource Model=Res34, Target Model/Defense=JPEG2025.12 | 56 | — | |
| Prior-OPTQuery Budget=4K, Victim Backbone=ViT-L/14, Prior Backbone=ConViT2025.12 | 54.7 | 16.54 | |
| AdaNCSSource Model=Res34, Target Model=Efficient-B02025.12 | 54.3 | — | |
| AdaNCSSource Model=Res34, Target Model=Inc-v3adv2025.12 | 53 | — | |
| NCSSource Model=Res34, Target Model=Efficient-B02025.12 | 52.2 | — | |
| MDCS-MITarget Model/Defense=JPEG2026.02 | 52.2 | — | |
| Prior-OPTQuery Budget=10K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet502025.12 | 51.4 | 18.15 | |
| NCSSource Model=Res34, Target Model=Inc-v3adv2025.12 | 51.1 | — | |
| AdaNCSSource Model=Res34, Target Model=Efficient-B12025.12 | 50.9 | — | |
| Prior-OPTQuery Budget=8K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet502025.12 | 50.6 | 18.52 | |
| MITarget Model/Defense=JPEG2026.02 | 50.2 | — | |
| Prior-OPTQuery Budget=2K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet50 & ConViT2025.12 | 50.1 | 18.09 | |
| PARS-OPTQuery Budget=4K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet502025.12 | 49.8 | 17.65 | |
| Prior-OPTQuery Budget=6K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet502025.12 | 48.7 | 19.34 | |
| PARS-OPTQuery Budget=2K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet50 & ConViT2025.12 | 48.7 | 18.67 | |
| NCSSource Model=Res34, Target Model/Defense=HGD2025.12 | 48.1 | — | |
| AdaNCSSource Model=Res34, Target Model/Defense=HGD2025.12 | 48.1 | — | |
| NCSSource Model=Res34, Target Model=Efficient-B12025.12 | 47 | — | |
| GRASource Model=Res34, Target Model=Inc-v3adv2025.12 | 46.7 | — | |
| GRASource Model=Res34, Target Model=Efficient-B02025.12 | 46 | — | |
| MDCS-MEFTarget Model/Defense=AT2026.02 | 45.5 | — | |
| MEFTarget Model/Defense=AT2026.02 | 45.4 | — | |
| VMISource Model=Res34, Target Model/Defense=NRP2025.12 | 45.1 | — | |
| Prior-OPTQuery Budget=4K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet502025.12 | 44.9 | 21.52 | |
| Prior-OPTQuery Budget=2K, Victim Backbone=ViT-L/14, Prior Backbone=ConViT2025.12 | 43.3 | 21.27 | |
| PARS-OPTQuery Budget=2K, Victim Backbone=ViT-L/14, Prior Backbone=ConViT2025.12 | 43.3 | 20.8 | |
| PISource Model=Res34, Target Model/Defense=NRP2025.12 | 43 | — | |
| MDCS-MITarget Model/Defense=Bit-Red2026.02 | 42.6 | — | |
| GRASource Model=Res34, Target Model=Efficient-B12025.12 | 41.3 | — | |
| MDCS-MITarget Model/Defense=AT2026.02 | 41.1 | — | |
| MITarget Model/Defense=AT2026.02 | 40.7 | — | |
| GRASource Model=Res34, Target Model/Defense=HGD2025.12 | 39.9 | — | |
| AdaMISource Model=Res34, Target Model/Defense=NRP2025.12 | 39.3 | — | |
| NISource Model=Res34, Target Model/Defense=NRP2025.12 | 39 | — | |
| MITarget Model/Defense=Bit-Red2026.02 | 38.9 | — | |
| MEFTarget Model/Defense=RS2026.02 | 37.4 | — | |
| MDCS-MEFTarget Model/Defense=RS2026.02 | 37.2 | — | |
| AdaNCSSource Model=Res34, Target Model=IncRes-v2ens2025.12 | 36.7 | — | |
| PARS-OPTQuery Budget=2K, Victim Backbone=ViT-L/14, Prior Backbone=ResNet502025.12 | 36.2 | 26.18 | |
| VMISource Model=Res34, Target Model=Inc-v3adv2025.12 | 35.9 | — | |
| NCSSource Model=Res34, Target Model/Defense=AT2025.12 | 35.8 | — | |
| AdaNCSSource Model=Res34, Target Model/Defense=AT2025.12 | 35.8 | — | |
| MISource Model=Res34, Target Model/Defense=NRP2025.12 | 35.7 | — | |
| GRASource Model=Res34, Target Model/Defense=AT2025.12 | 35.5 | — |