Adversarial Attack Success Rate (ASR) on CIFAR10 (test)
99ASRMDSE
Evaluation Results
| Method | Links | |||
|---|---|---|---|---|
| MDSEAttack Steps=19, Max Epsilon=0.0592022.09 | 99 | — | — | |
| M-DI-FGSM-EnsembleAttack Steps=19, Max Epsilon=0.0592022.09 | 92.1 | — | — | |
| MDSEAttack Steps=40, Max Epsilon=0.0312022.09 | 90.4 | — | — | |
| MDSEAttack Steps=19, Max Epsilon=0.0312022.09 | 88.4 | — | — | |
| M-DI-FGSM-EnsembleAttack Steps=40, Max Epsilon=0.0312022.09 | 86.6 | — | — | |
| M-DI-FGSM-EnsembleAttack Steps=19, Max Epsilon=0.0312022.09 | 82.8 | — | — | |
| SAGAAttack Steps=19, Max Epsilon=0.0592022.09 | 60.4 | — | — | |
| M-DI-FGSMAttack Steps=19, Max Epsilon=0.0592022.09 | 58.9 | — | — | |
| MoCo-EASetting=Obfuscated gradients, Norm=l_inf2026.05 | 53.8 | — | — | |
| Max AutoAttack Steps=19, Max Epsilon=0.0592022.09 | 51.5 | — | — | |
| Max PGDAttack Steps=19, Max Epsilon=0.0592022.09 | 44.2 | — | — | |
| MoCo-EASetting=Robust model, Norm=l_inf2026.05 | 40.5 | — | — | |
| AASetting=Robust model, Norm=l_inf2026.05 | 40.3 | — | — | |
| PGDSetting=Robust model, Norm=l_inf2026.05 | 39.6 | — | — | |
| AAASetting=Robust model, Norm=l_inf2026.05 | 39.1 | — | — | |
| MI-FGSMSetting=Robust model, Norm=l_inf2026.05 | 38.7 | — | — | |
| SAGAAttack Steps=19, Max Epsilon=0.0312022.09 | 31.9 | — | — | |
| SAGAAttack Steps=40, Max Epsilon=0.0312022.09 | 26.6 | — | — | |
| M-DI-FGSMAttack Steps=19, Max Epsilon=0.0312022.09 | 24.9 | — | — | |
| M-DI-FGSMAttack Steps=40, Max Epsilon=0.0312022.09 | 23.3 | — | — | |
| Max PGDAttack Steps=19, Max Epsilon=0.0312022.09 | 16.4 | — | — | |
| Max PGDAttack Steps=40, Max Epsilon=0.0312022.09 | 15.4 | — | — | |
| Max AutoAttack Steps=19, Max Epsilon=0.0312022.09 | 15.3 | — | — | |
| Max AutoAttack Steps=40, Max Epsilon=0.0312022.09 | 15 | — | — | |
| PGDSetting=Obfuscated gradients, Norm=l_inf2026.05 | 13.5 | — | — | |
| MI-FGSMSetting=Obfuscated gradients, Norm=l_inf2026.05 | 13.3 | — | — | |
| AAASetting=Obfuscated gradients, Norm=l_inf2026.05 | 12.8 | — | — | |
| AASetting=Obfuscated gradients, Norm=l_inf2026.05 | 0 | — | — | |
| HARTArchitecture=ResNet18, Attack=APGD, Input Coding=Direct coding2025.03 | — | 71.49 | 98.54 | |
| HARTArchitecture=ResNet18 (Adv. trained), Attack=APGD, Input Coding=Direct coding2025.03 | — | 21.2 | 70.74 | |
| HARTArchitecture=VGG11, Attack=APGD, Input Coding=Direct coding2025.03 | — | 54.82 | 98.13 | |
| PDSGArchitecture=ResNet18, Attack=APGD, Input Coding=Direct coding2025.03 | — | 75.18 | 99.97 | |
| PDSGArchitecture=ResNet18 (Adv. trained), Attack=APGD, Input Coding=Direct coding2025.03 | — | 21.56 | 71.92 | |
| PDSGArchitecture=VGG11, Attack=APGD, Input Coding=Direct coding2025.03 | — | 45.58 | 99.84 | |
| RGAArchitecture=ResNet18, Attack=APGD, Input Coding=Direct coding2025.03 | — | 67.04 | 94.77 | |
| RGAArchitecture=ResNet18 (Adv. trained), Attack=APGD, Input Coding=Direct coding2025.03 | — | 17.93 | 57.37 | |
| RGAArchitecture=VGG11, Attack=APGD, Input Coding=Direct coding2025.03 | — | 46.4 | 88.51 | |
| STBPArchitecture=ResNet18, Attack=APGD, Input Coding=Direct coding2025.03 | — | 71.36 | 99.67 | |
| STBPArchitecture=ResNet18 (Adv. trained), Attack=APGD, Input Coding=Direct coding2025.03 | — | 14.34 | 41.39 | |
| STBPArchitecture=VGG11, Attack=APGD, Input Coding=Direct coding2025.03 | — | 46.96 | 99.25 |