Adversarial Attack Success Rate (ASR) on CIFAR10
100ASRPDSG (PGD)
Evaluation results
| Method | Links | |
|---|---|---|
| PDSG (PGD)Architecture=ResNet18, Perturbation budget (epsilon)=8/255, Coding=Direct coding2025.03 | 100 | |
| PDSG (PGD)Architecture=VGG11, Perturbation budget (epsilon)=8/255, Coding=Direct coding2025.03 | 99.71 | |
| PDSG (PGD)Architecture=ResNet18, Perturbation budget (epsilon)=2/255, Coding=Direct coding2025.03 | 69.62 | |
| SquareArchitecture=ResNet18, Perturbation budget (epsilon)=8/255, Coding=Direct coding2025.03 | 66.1 | |
| PDSG (PGD)Architecture=ResNet18 (Adv. trained), Perturbation budget (epsilon)=8/255, Coding=Direct coding2025.03 | 62.16 | |
| SDMTarget Model=WideResNet-28-10, Defense=VAT, Norm Constraint=l-infinity2026.05 | 60.31 | |
| SDMTarget Model=ResNet-34, Defense=VAT, Norm Constraint=l-infinity2026.05 | 58.79 | |
| SDMTarget Model=WideResNet-28-10, Defense=MART, Norm Constraint=l-infinity2026.05 | 58.59 | |
| APGDTarget Model=WideResNet-28-10, Defense=VAT, Norm Constraint=l-infinity2026.05 | 58.36 | |
| C&WTarget Model=WideResNet-28-10, Defense=VAT, Norm Constraint=l-infinity2026.05 | 58.14 | |
| PGDTarget Model=WideResNet-28-10, Defense=VAT, Norm Constraint=l-infinity2026.05 | 57.88 | |
| C&WTarget Model=WideResNet-28-10, Defense=MART, Norm Constraint=l-infinity2026.05 | 57.7 | |
| SquareArchitecture=VGG11, Perturbation budget (epsilon)=8/255, Coding=Direct coding2025.03 | 57.42 | |
| APGDTarget Model=ResNet-34, Defense=VAT, Norm Constraint=l-infinity2026.05 | 57.28 | |
| RaySArchitecture=VGG11, Perturbation budget (epsilon)=8/255, Coding=Direct coding2025.03 | 56.92 | |
| PGDTarget Model=ResNet-34, Defense=VAT, Norm Constraint=l-infinity2026.05 | 56.55 | |
| SquareArchitecture=ResNet18 (Adv. trained), Perturbation budget (epsilon)=8/255, Coding=Direct coding2025.03 | 56.54 | |
| C&WTarget Model=ResNet-34, Defense=VAT, Norm Constraint=l-infinity2026.05 | 56.28 | |
| SDMTarget Model=WideResNet-28-10, Defense=HAT, Norm Constraint=l-infinity2026.05 | 54.66 | |
| SDMTarget Model=ResNet-34, Defense=MART, Norm Constraint=l-infinity2026.05 | 54.43 | |
| C&WTarget Model=WideResNet-28-10, Defense=HAT, Norm Constraint=l-infinity2026.05 | 53.96 | |
| C&WTarget Model=ResNet-34, Defense=MART, Norm Constraint=l-infinity2026.05 | 53.7 | |
| RaySArchitecture=ResNet18, Perturbation budget (epsilon)=8/255, Coding=Direct coding2025.03 | 52.96 | |
| SDMTarget Model=ResNet-34, Defense=HAT, Norm Constraint=l-infinity2026.05 | 52.92 | |
| SDMTarget Model=WideResNet-28-10, Defense=LOAT, Norm Constraint=l-infinity2026.05 | 52.68 | |
| APGDTarget Model=WideResNet-28-10, Defense=MART, Norm Constraint=l-infinity2026.05 | 52.46 | |
| PGDTarget Model=WideResNet-28-10, Defense=MART, Norm Constraint=l-infinity2026.05 | 51.5 | |
| SDMTarget Model=ResNet-34, Defense=LOAT, Norm Constraint=l-infinity2026.05 | 51.04 | |
| C&WTarget Model=WideResNet-28-10, Defense=LOAT, Norm Constraint=l-infinity2026.05 | 50.93 | |
| C&WTarget Model=ResNet-34, Defense=HAT, Norm Constraint=l-infinity2026.05 | 50.63 | |
| APGDTarget Model=WideResNet-28-10, Defense=HAT, Norm Constraint=l-infinity2026.05 | 49.62 | |
| APGDTarget Model=ResNet-34, Defense=MART, Norm Constraint=l-infinity2026.05 | 49.37 | |
| C&WTarget Model=ResNet-34, Defense=LOAT, Norm Constraint=l-infinity2026.05 | 49.28 | |
| PGDTarget Model=WideResNet-28-10, Defense=HAT, Norm Constraint=l-infinity2026.05 | 48.79 | |
| PGDTarget Model=ResNet-34, Defense=MART, Norm Constraint=l-infinity2026.05 | 48.47 | |
| APGDTarget Model=ResNet-34, Defense=HAT, Norm Constraint=l-infinity2026.05 | 47.66 | |
| APGDTarget Model=WideResNet-28-10, Defense=LOAT, Norm Constraint=l-infinity2026.05 | 47.54 | |
| PGDTarget Model=ResNet-34, Defense=HAT, Norm Constraint=l-infinity2026.05 | 46.91 | |
| PGDTarget Model=WideResNet-28-10, Defense=LOAT, Norm Constraint=l-infinity2026.05 | 46.85 | |
| APGDTarget Model=ResNet-34, Defense=LOAT, Norm Constraint=l-infinity2026.05 | 45.96 | |
| PGDTarget Model=ResNet-34, Defense=LOAT, Norm Constraint=l-infinity2026.05 | 45.1 | |
| SquareArchitecture=ResNet18 (Adv. trained), Perturbation budget (epsilon)=2/255, Coding=Direct coding2025.03 | 44.79 | |
| PDSG (PGD)Architecture=VGG11, Perturbation budget (epsilon)=2/255, Coding=Direct coding2025.03 | 39.2 | |
| RaySArchitecture=ResNet18 (Adv. trained), Perturbation budget (epsilon)=8/255, Coding=Direct coding2025.03 | 33.3 | |
| SquareArchitecture=ResNet18, Perturbation budget (epsilon)=2/255, Coding=Direct coding2025.03 | 29.79 | |
| SquareArchitecture=VGG11, Perturbation budget (epsilon)=2/255, Coding=Direct coding2025.03 | 26.86 | |
| RaySArchitecture=ResNet18 (Adv. trained), Perturbation budget (epsilon)=2/255, Coding=Direct coding2025.03 | 18.1 | |
| RaySArchitecture=ResNet18, Perturbation budget (epsilon)=2/255, Coding=Direct coding2025.03 | 13.4 | |
| RaySArchitecture=VGG11, Perturbation budget (epsilon)=2/255, Coding=Direct coding2025.03 | 12.81 | |
| PDSG (PGD)Architecture=ResNet18 (Adv. trained), Perturbation budget (epsilon)=2/255, Coding=Direct coding2025.03 | 10.68 |