Adversarial Attack Success Rate on MNIST (test)
100ASRAdvPP
Evaluation results
| Method | Links | |
|---|---|---|
| AdvPPEvaluation Protocol=White-box, Victim Model=MadryNet Adv2023.06 | 100 | |
| AdvPPEvaluation Protocol=Human Annotation, Victim Model=Human2023.06 | 92.6 | |
| stAdvEvaluation Protocol=Human Annotation, Victim Model=Human2023.06 | 90.1 | |
| ProbCWEvaluation Protocol=Human Annotation, Victim Model=Human2023.06 | 89.3 | |
| PGDEvaluation Protocol=Human Annotation, Victim Model=Human2023.06 | 88.4 | |
| AdvPPEvaluation Protocol=Transferability, Victim Model=MadryNet noAdv2023.06 | 61.4 | |
| AdvPPEvaluation Protocol=Adv. Defence, Victim Model=Certified Def2023.06 | 39.2 | |
| ProbCWEvaluation Protocol=White-box, Victim Model=MadryNet Adv2023.06 | 30.2 | |
| stAdvEvaluation Protocol=White-box, Victim Model=MadryNet Adv2023.06 | 29.4 | |
| PGDEvaluation Protocol=White-box, Victim Model=MadryNet Adv2023.06 | 25.3 | |
| AdvPPEvaluation Protocol=Transferability, Victim Model=ResNet noAdv2023.06 | 24.3 | |
| stAdvEvaluation Protocol=Adv. Defence, Victim Model=Certified Def2023.06 | 20.8 | |
| AdvPPEvaluation Protocol=Adv. Defence, Victim Model=ResNet Adv2023.06 | 18.5 | |
| ProbCWEvaluation Protocol=Transferability, Victim Model=MadryNet noAdv2023.06 | 17.4 | |
| stAdvEvaluation Protocol=Transferability, Victim Model=MadryNet noAdv2023.06 | 16.3 | |
| PGDEvaluation Protocol=Transferability, Victim Model=MadryNet noAdv2023.06 | 15.1 | |
| stAdvEvaluation Protocol=Transferability, Victim Model=ResNet noAdv2023.06 | 12.5 | |
| ProbCWEvaluation Protocol=Adv. Defence, Victim Model=Certified Def2023.06 | 12.3 | |
| stAdvEvaluation Protocol=Adv. Defence, Victim Model=ResNet Adv2023.06 | 11.5 | |
| ProbCWEvaluation Protocol=Transferability, Victim Model=ResNet noAdv2023.06 | 10.9 | |
| PGDEvaluation Protocol=Adv. Defence, Victim Model=Certified Def2023.06 | 10.7 | |
| PGDEvaluation Protocol=Transferability, Victim Model=ResNet noAdv2023.06 | 10.2 | |
| ProbCWEvaluation Protocol=Adv. Defence, Victim Model=ResNet Adv2023.06 | 8.8 | |
| PGDEvaluation Protocol=Adv. Defence, Victim Model=ResNet Adv2023.06 | 7.2 |