Adversarial Attack on ImageNet (val) with Generative Quality Metrics
100Attack Success Rate (ResNet-50)AA
Evaluation results
| Method | Links | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| AASurrogate Model=RN-502025.05 | 100 | 13.3 | 10 | 3.9 | 8.8 | 10.5 | 5.4 | 5.6 | 8 | 18.4 | — | — | — | |
| AdvClassSurrogate Model=RN-50, Targeting Strategy=Similarity (U)2025.05 | 99.9 | 42.5 | 44.3 | 38.7 | 41.1 | 29.7 | 37.6 | 38.4 | 39.1 | 45.7 | 38.5 | 50.2 | 92.7 | |
| AdvClassSurrogate Model=RN-50, Targeting Strategy=Random (T)2025.05 | 99.6 | 35 | 32.1 | 31.4 | 33.5 | 25.8 | 30 | 30.8 | 32.8 | 39 | 38.3 | 48.9 | 92.4 | |
| PGDSurrogate Model=RN-502025.05 | 99.4 | 11.8 | 5.2 | 4.9 | 8.1 | 10.5 | 4.4 | 5.5 | 8.2 | 17.6 | — | — | — | |
| NatADiffSurrogate Model=RN-50, Targeting Strategy=Similarity (U)2025.05 | 99.3 | 68.3 | 72.1 | 65.3 | 66.8 | 45.3 | 64.1 | 65.2 | 67 | 68.2 | 43.2 | 51.4 | 95.9 | |
| NatADiffSurrogate Model=RN-50, Targeting Strategy=Random (T)2025.05 | 96.9 | 60.1 | 56.5 | 55.3 | 58.9 | 36.8 | 45.3 | 49 | 52.3 | 56.8 | 26 | 66.5 | 77.3 | |
| DiffAttackSurrogate Model=RN-502025.05 | 92.5 | 47.1 | 52.5 | 35.3 | 43.3 | 28.4 | 44.6 | 42.4 | 38.9 | 47.2 | 26.8 | 64.1 | 76.8 | |
| ACASurrogate Model=RN-502025.05 | 78.8 | 53.3 | 52.7 | 49.8 | 53.1 | 41.8 | 46.4 | 49.3 | 50.6 | 52.9 | 23.9 | 65 | 77.9 | |
| NCFSurrogate Model=RN-502025.05 | 74.8 | 33.4 | 37.3 | 28.2 | 31.2 | 17.2 | 24 | 31.7 | 37.2 | 35 | 30.4 | 69.7 | 85.5 | |
| NatADiffSurrogate Model=ViT-H, Targeting Strategy=Random (T)2025.05 | 70.7 | 73.5 | 68.4 | 71.3 | 72.1 | 98.5 | 65.7 | 66.9 | 71.7 | 73.2 | 15.3 | 88 | 93.5 | |
| NatADiffSurrogate Model=Inc-v3, Targeting Strategy=Similarity (U)2025.05 | 67.4 | 99.4 | 65.7 | 70.1 | 75.7 | 44.4 | 60.3 | 60.2 | 63.1 | 67.4 | 47 | 50.5 | 98.9 | |
| NatADiffSurrogate Model=ViT-H, Targeting Strategy=Similarity (U)2025.05 | 66.8 | 67 | 65.3 | 64.9 | 65.8 | 99.6 | 63.9 | 65.4 | 68.6 | 69.7 | 31.9 | 53.9 | 96.2 | |
| NatADiffSurrogate Model=Inc-v3, Targeting Strategy=Random (T)2025.05 | 53.4 | 97.9 | 49.4 | 57.3 | 62.6 | 35.4 | 44.4 | 45.1 | 50.8 | 55.2 | 27.7 | 66.6 | 78.2 | |
| ACASurrogate Model=Inc-v32025.05 | 50.9 | 67.8 | 48.2 | 54.2 | 60.1 | 43.6 | 45.1 | 48.8 | 51.3 | 52.2 | 23.1 | 68 | 78.8 | |
| ACASurrogate Model=ViT-H2025.05 | 50.5 | 54.5 | 48.1 | 49.1 | 52.8 | 75.8 | 47.5 | 49.7 | 50.5 | 53.2 | 25.5 | 64.2 | 80.9 | |
| AdvClassSurrogate Model=Inc-v3, Targeting Strategy=Similarity (U)2025.05 | 38 | 99.9 | 38.7 | 40.4 | 44.2 | 30 | 36 | 36.6 | 38.9 | 44.8 | 39.7 | 49.4 | 93.3 | |
| AdvClassSurrogate Model=ViT-H, Targeting Strategy=Similarity (U)2025.05 | 35.2 | 37.5 | 35.8 | 35.2 | 36 | 98.7 | 33.9 | 34.9 | 37.7 | 42.8 | 39.2 | 48.5 | 98.8 | |
| AdvClassSurrogate Model=Inc-v3, Targeting Strategy=Random (T)2025.05 | 35.1 | 99.6 | 34.5 | 35.6 | 39.5 | 28.8 | 32.4 | 34 | 35.7 | 41.7 | 33.7 | 51 | 89.2 | |
| AdvClassSurrogate Model=ViT-H, Targeting Strategy=Random (T)2025.05 | 33.9 | 35.9 | 33.4 | 34.4 | 34.4 | 92.6 | 31.9 | 33.4 | 36 | 40.7 | 38.9 | 48.5 | 95.2 | |
| NCFSurrogate Model=Inc-v32025.05 | 31 | 66.7 | 23.1 | 29 | 36.3 | 15.8 | 18.3 | 20.4 | 30.5 | 30.1 | 31.7 | 69.1 | 83 | |
| DiffAttackSurrogate Model=Inc-v32025.05 | 29 | 74.6 | 23.7 | 30 | 39.9 | 18.9 | 22.9 | 26.5 | 25.8 | 32.4 | 33.2 | 63.7 | 78.2 | |
| DiffAttackSurrogate Model=ViT-H2025.05 | 20.5 | 25 | 17.2 | 18.9 | 22.4 | 73.2 | 18.1 | 22.3 | 20.6 | 26.5 | 35.2 | 63.4 | 80 | |
| NCFSurrogate Model=ViT-H2025.05 | 20 | 19.4 | 14.8 | 15.4 | 18.5 | 50.6 | 11.9 | 15.6 | 21.2 | 20.8 | 39.8 | 63.1 | 86.4 | |
| AASurrogate Model=Inc-v32025.05 | 7.3 | 100 | 4.9 | 4.8 | 12.8 | 10.6 | 5.7 | 6.1 | 8 | 17.8 | — | — | — | |
| AASurrogate Model=ViT-H2025.05 | 6.5 | 9.8 | 3.9 | 4.3 | 8.6 | 100 | 4.5 | 5.9 | 9.9 | 17 | — | — | — | |
| PGDSurrogate Model=Inc-v32025.05 | 6 | 99.7 | 4 | 5.1 | 10.4 | 10.2 | 4.1 | 5.6 | 7.4 | 16.9 | — | — | — | |
| PGDSurrogate Model=ViT-H2025.05 | 5.8 | 11 | 3.6 | 4 | 7.8 | 96.2 | 4.5 | 5.4 | 9.2 | 16.4 | — | — | — | |
| CleanSurrogate Model=N/A, Attack=None2025.05 | 5.3 | 7.6 | 2.9 | 3 | 5.8 | 10.9 | 3.8 | 4.5 | 7.4 | 5.7 | 55 | 58 | 94.7 |