Adversarial Attack Success Rate on ImageNet (Model Suite Evaluation)
100ASR (RN50)P2FA
Evaluation results
| Method | Links | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| P2FASurrogate=ResNet-502026.03 | 100 | 98.8 | 98.2 | 97.8 | 83.1 | 39.4 | 65.5 | 85.1 | 82.5 | 83.4 | |
| GI-FGSMSurrogate=ResNet-502026.03 | 100 | 65 | 72 | 65.3 | 49.2 | 15.7 | 28.1 | 38.3 | 36.2 | 52.2 | |
| LTASurrogate=ResNet-502026.03 | 100 | 96.3 | 92.8 | 91.4 | 82.9 | 71.3 | 91.1 | 92.1 | 91.4 | 89.9 | |
| ANDASurrogate=ResNet-502026.03 | 99.9 | 84.6 | 83.9 | 82.8 | 73.4 | 42.4 | 61.6 | 72 | 66.6 | 74.1 | |
| LTASurrogate=VGG-162026.03 | 99.8 | 99 | 100 | 99.9 | 98.4 | 93.7 | 97.8 | 98.6 | 98.8 | 98.4 | |
| P2FASurrogate=ResNet-1522026.03 | 99.7 | 99.9 | 98.4 | 98.5 | 95.3 | 57.7 | 81.8 | 94.1 | 90 | 90.6 | |
| LTASurrogate=ResNet-1522026.03 | 99.2 | 100 | 90 | 89.6 | 86.1 | 81.7 | 94 | 95.6 | 95.6 | 92.4 | |
| BFASurrogate=ResNet-502026.03 | 98.1 | 94.1 | 93.7 | 92.8 | 85.7 | 49.5 | 72.1 | 86.1 | 83.4 | 82.7 | |
| ILPDSurrogate=ResNet-502026.03 | 97.8 | 82.4 | 88.2 | 86 | 71.1 | 46.1 | 61.7 | 69.7 | 66.5 | 74.4 | |
| BFASurrogate=ResNet-1522026.03 | 96.4 | 98.1 | 93.8 | 93.1 | 89.8 | 66.6 | 83.9 | 91.4 | 88.1 | 89 | |
| MFAASurrogate=ResNet-502026.03 | 95.3 | 83.6 | 86.4 | 84.7 | 70.8 | 24 | 41 | 59.8 | 57 | 67 | |
| ANDASurrogate=ResNet-1522026.03 | 94.3 | 99.8 | 84.9 | 81.7 | 81.7 | 50.5 | 71 | 80.7 | 74.1 | 79.9 | |
| DiffAttackSurrogate=ResNet-502026.03 | 92.7 | 51 | 50.6 | 51.5 | 47 | 29.4 | 43.7 | 46.6 | 47.7 | 51.1 | |
| BFASurrogate=VGG-162026.03 | 92.7 | 84.3 | 100 | 97.4 | 88.6 | 30.4 | 58.8 | 82.8 | 74.8 | 78.9 | |
| ILPDSurrogate=VGG-162026.03 | 91.8 | 83.3 | 99.8 | 97.2 | 86.2 | 32.9 | 60.1 | 83.2 | 79 | 79.3 | |
| ILPDSurrogate=ResNet-1522026.03 | 90 | 96.7 | 87.3 | 85.8 | 76.2 | 55 | 67.9 | 75.8 | 71.5 | 78.5 | |
| GI-FGSMSurrogate=ResNet-1522026.03 | 88.2 | 99.5 | 77.7 | 72.7 | 62.6 | 27.7 | 45.3 | 55.7 | 49.6 | 64.3 | |
| P2FASurrogate=VGG-162026.03 | 86.6 | 70.5 | 100 | 96.7 | 69.8 | 15.2 | 35.6 | 69.9 | 63.4 | 67.5 | |
| MFAASurrogate=ResNet-1522026.03 | 83.4 | 93.9 | 81.7 | 77.6 | 71 | 43.6 | 60 | 69.7 | 66.4 | 71.9 | |
| ANDASurrogate=VGG-162026.03 | 80.1 | 65.4 | 100 | 92 | 80.6 | 24.7 | 45.9 | 67 | 63 | 68.7 | |
| MFAASurrogate=VGG-162026.03 | 79.4 | 64 | 100 | 93.1 | 78.1 | 22 | 36.1 | 61.6 | 54.5 | 65.4 | |
| DiffAttackSurrogate=VGG-162026.03 | 71.5 | 57.7 | 97.1 | 78.8 | 68.5 | 38.8 | 54.4 | 60.4 | 64.2 | 65.7 | |
| DiffAttackSurrogate=ResNet-1522026.03 | 68.1 | 89.3 | 56.4 | 54.7 | 54.9 | 43.1 | 56.5 | 57.9 | 56.9 | 59.8 | |
| GI-FGSMSurrogate=VGG-162026.03 | 66.8 | 47.3 | 99.9 | 87.1 | 63.4 | 16.7 | 31.7 | 49.1 | 49.1 | 56.8 |