Adversarial Attack on ImageNet (test)
99.7Success RateMDSE
Evaluation results
| Method | Links | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MDSEAttack Steps=19, Max Epsilon=0.0312022.09 | 99.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| M-DI-FGSM-EnsembleAttack Steps=19, Max Epsilon=0.0312022.09 | 99.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NCFVictim Model=ResNet 50, Attack Scenario=White-box2023.06 | 94.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| cAdvVictim Model=ResNet 50, Attack Scenario=White-box2023.06 | 93.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AdvPPHyperparameter c=20, Victim Model=ResNet 50, Attack Scenario=White-box2023.06 | 91.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ACEVictim Model=ResNet 50, Attack Scenario=White-box2023.06 | 91.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ColorFoolVictim Model=ResNet 50, Attack Scenario=White-box2023.06 | 90.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AdvPPHyperparameter c=10, Victim Model=ResNet 50, Attack Scenario=White-box2023.06 | 88.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AdvPPHyperparameter c=5, Victim Model=ResNet 50, Attack Scenario=White-box2023.06 | 84.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NCFVictim Model=VGG19, Attack Scenario=Transferability2023.06 | 83.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ACEVictim Model=VGG19, Attack Scenario=Transferability2023.06 | 73.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NCFVictim Model=EfficientNet B7, Attack Scenario=Transferability2023.06 | 72.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ColorFoolVictim Model=VGG19, Attack Scenario=Transferability2023.06 | 72.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NCFVictim Model=Inception V3, Attack Scenario=Transferability2023.06 | 72.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NCFVictim Model=ResNet 152, Attack Scenario=Transferability2023.06 | 71.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| cAdvVictim Model=VGG19, Attack Scenario=Transferability2023.06 | 71 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SAGAAttack Steps=19, Max Epsilon=0.0312022.09 | 69.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FMNModel=VGG, Norm=l2, Epsilon=0.152021.02 | 66.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NCFAggregation=Average2023.06 | 66.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FMNModel=ResNet18, Norm=l2, Epsilon=0.152021.02 | 65.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NCFVictim Model=DenseNet 161, Attack Scenario=Transferability2023.06 | 63.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ColorFoolVictim Model=EfficientNet B7, Attack Scenario=Transferability2023.06 | 62.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| M-DI-FGSMAttack Steps=19, Max Epsilon=0.0312022.09 | 62 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGDModel=ResNet18, Norm=l2, Epsilon=0.152021.02 | 61.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGDModel=VGG, Norm=l2, Epsilon=0.152021.02 | 61.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NCFVictim Model=Inception V3 Adv, Attack Scenario=Adversarial Defence2023.06 | 61.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| cAdvVictim Model=ResNet 152, Attack Scenario=Transferability2023.06 | 61.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| cAdvVictim Model=Inception V3, Attack Scenario=Transferability2023.06 | 60.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AdvPPHyperparameter c=20, Aggregation=Average2023.06 | 59.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| cAdvVictim Model=EfficientNet B7, Attack Scenario=Transferability2023.06 | 58 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ACEVictim Model=Inception V3, Attack Scenario=Transferability2023.06 | 57.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ColorFoolVictim Model=Inception V3, Attack Scenario=Transferability2023.06 | 57.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MultiANDASource model=ResNet-50, Target model=PiT-B2022.09 | 56.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ACEVictim Model=EfficientNet B7, Attack Scenario=Transferability2023.06 | 56.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AdvPPHyperparameter c=10, Aggregation=Average2023.06 | 55.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ACEVictim Model=ResNet 152, Attack Scenario=Transferability2023.06 | 55.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FMNModel=ResNet18, Norm=l_inf, Epsilon=4e-42021.02 | 55.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| cAdvAggregation=Average2023.06 | 55.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ColorFoolVictim Model=ResNet 152, Attack Scenario=Transferability2023.06 | 54.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| cAdvVictim Model=DenseNet 161, Attack Scenario=Transferability2023.06 | 54 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NCFVictim Model=Ensemble IncRes V2, Attack Scenario=Adversarial Defence2023.06 | 53.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MultiANDASource model=IncRes-v2, Target model=PiT-B2022.09 | 53.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANDASource model=ResNet-50, Target model=PiT-B2022.09 | 52.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AdvPPHyperparameter c=5, Aggregation=Average2023.06 | 51.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGDModel=ResNet18, Norm=l_inf, Epsilon=4e-42021.02 | 51 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NCFVictim Model=EfficientNet B7 Adv, Attack Scenario=Adversarial Defence2023.06 | 50.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ColorFoolAggregation=Average2023.06 | 50.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANDASource model=IncRes-v2, Target model=PiT-B2022.09 | 49.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ACEAggregation=Average2023.06 | 49.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGDModel=VGG, Norm=l_inf, Epsilon=4e-42021.02 | 49 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FMNModel=VGG, Norm=l_inf, Epsilon=4e-42021.02 | 49 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| cAdvVictim Model=Inception V3 Adv, Attack Scenario=Adversarial Defence2023.06 | 48.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MultiANDASource model=ResNet-50, Target model=DeiT3-B/162022.09 | 46.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| cAdvVictim Model=Ensemble IncRes V2, Attack Scenario=Adversarial Defence2023.06 | 45.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ACEVictim Model=DenseNet 161, Attack Scenario=Transferability2023.06 | 45.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANDASource model=ResNet-50, Target model=DeiT3-B/162022.09 | 45 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MultiANDASource model=IncRes-v2, Target model=DeiT3-B/162022.09 | 43.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| cAdvVictim Model=EfficientNet B7 Adv, Attack Scenario=Adversarial Defence2023.06 | 42.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ColorFoolVictim Model=Inception V3 Adv, Attack Scenario=Adversarial Defence2023.06 | 41.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANDASource model=IncRes-v2, Target model=DeiT3-B/162022.09 | 41.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ColorFoolVictim Model=DenseNet 161, Attack Scenario=Transferability2023.06 | 41.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ACEVictim Model=Inception V3 Adv, Attack Scenario=Adversarial Defence2023.06 | 40.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FMNModel=VGG, Norm=l1, Epsilon=1.02021.02 | 39.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MultiANDASource model=ResNet-50, Target model=Swin-B/42022.09 | 39.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANDASource model=ResNet-50, Target model=Swin-B/42022.09 | 38.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VMI-FGSMSource model=IncRes-v2, Target model=PiT-B2022.09 | 38.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FMNModel=ResNet18, Norm=l1, Epsilon=1.02021.02 | 38.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MultiANDASource model=IncRes-v2, Target model=Swin-B/42022.09 | 38.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ACEVictim Model=Ensemble IncRes V2, Attack Scenario=Adversarial Defence2023.06 | 36.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANDASource model=IncRes-v2, Target model=Swin-B/42022.09 | 36.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ColorFoolVictim Model=EfficientNet B7 Adv, Attack Scenario=Adversarial Defence2023.06 | 36.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ColorFoolVictim Model=Ensemble IncRes V2, Attack Scenario=Adversarial Defence2023.06 | 35.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ACEVictim Model=EfficientNet B7 Adv, Attack Scenario=Adversarial Defence2023.06 | 34.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Max PGDAttack Steps=19, Max Epsilon=0.0312022.09 | 34.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VMI-FGSMSource model=ResNet-50, Target model=PiT-B2022.09 | 34.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGDModel=ResNet18, Norm=l1, Epsilon=1.02021.02 | 31.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AdvPPHyperparameter c=5, Victim Model=Human Anno., Category=Human Assessment2023.06 | 31.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VMI-FGSMSource model=IncRes-v2, Target model=DeiT3-B/162022.09 | 30.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MultiANDASource model=IncRes-v2, Target model=ViT-L/162022.09 | 30.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MultiANDASource model=ResNet-50, Target model=ViT-L/162022.09 | 30.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGDModel=VGG, Norm=l1, Epsilon=1.02021.02 | 30.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Max AutoAttack Steps=19, Max Epsilon=0.0312022.09 | 30 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VMI-FGSMSource model=IncRes-v2, Target model=Swin-B/42022.09 | 29.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VMI-FGSMSource model=ResNet-50, Target model=DeiT3-B/162022.09 | 29.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VMI-FGSMSource model=IncRes-v2, Target model=ViT-L/162022.09 | 29 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MultiANDASource model=VGG-19, Target model=PiT-B2022.09 | 28.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANDASource model=ResNet-50, Target model=ViT-L/162022.09 | 28.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANDASource model=IncRes-v2, Target model=ViT-L/162022.09 | 28.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AdvPPHyperparameter c=10, Victim Model=Human Anno., Category=Human Assessment2023.06 | 28.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANDASource model=VGG-19, Target model=PiT-B2022.09 | 26.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AdvPPHyperparameter c=20, Victim Model=Human Anno., Category=Human Assessment2023.06 | 25.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VMI-FGSMSource model=ResNet-50, Target model=Swin-B/42022.09 | 24.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VMI-FGSMSource model=VGG-19, Target model=PiT-B2022.09 | 24.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VMI-FGSMSource model=ResNet-50, Target model=ViT-L/162022.09 | 23.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MultiANDASource model=VGG-19, Target model=Swin-B/42022.09 | 22.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANDASource model=VGG-19, Target model=Swin-B/42022.09 | 21.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VMI-FGSMSource model=VGG-19, Target model=Swin-B/42022.09 | 20.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MultiANDASource model=VGG-19, Target model=DeiT3-B/162022.09 | 16.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| cAdvVictim Model=Human Anno., Category=Human Assessment2023.06 | 16.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANDASource model=VGG-19, Target model=DeiT3-B/162022.09 | 16.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — |