Adversarial Attack Transferability on CIFAR-100
99.77Average ASRDASH
Evaluation results
| Method | Links | |||||
|---|---|---|---|---|---|---|
| DASHSurrogate Model=[14], Target Model=[14]2025.08 | 99.77 | — | — | — | 94.43 | |
| DASHSurrogate Model=[44], Target Model=[44]2025.08 | 99.67 | — | — | — | 94.73 | |
| DASHSurrogate Model=[15], Target Model=[15]2025.08 | 99.57 | — | — | — | 94.57 | |
| DASHSurrogate Model=[1], Target Model=[1]2025.08 | 99.22 | — | — | — | 95.05 | |
| DASHSurrogate Model=[44], Target Model=[14]2025.08 | 94.53 | — | — | — | 94.73 | |
| DASHSurrogate Model=[14], Target Model=[44]2025.08 | 89.55 | — | — | — | 94.43 | |
| DASHSurrogate Model=[44]2025.08 | 87.59 | 94.53 | 99.67 | 80.64 | 94.73 | |
| DASHSurrogate Model=[14]2025.08 | 84.62 | 99.77 | 89.55 | 79.69 | 94.43 | |
| CWSurrogate Model=[1], Target Model=[1]2025.08 | 84.18 | — | — | — | 94.96 | |
| CWSurrogate Model=[14], Target Model=[14]2025.08 | 84.14 | — | — | — | 94.38 | |
| CWSurrogate Model=[44], Target Model=[44]2025.08 | 83.57 | — | — | — | 94.55 | |
| DASHSurrogate Model=[44], Target Model=Avg.2025.08 | 82.79 | — | — | — | 94.73 | |
| AdvADSurrogate Model=[1], Target Model=[1]2025.08 | 81.6 | — | — | — | 83.92 | |
| DiffAttackSurrogate Model=[1], Target Model=[1]2025.08 | 81.35 | — | — | — | 91.26 | |
| DASHSurrogate Model=[44], Target Model=[1]2025.08 | 80.64 | — | — | — | 94.73 | |
| DASHSurrogate Model=[14], Target Model=Avg.2025.08 | 79.95 | — | — | — | 94.43 | |
| CWSurrogate Model=[15], Target Model=[15]2025.08 | 79.9 | — | — | — | 94.3 | |
| DASHSurrogate Model=[14], Target Model=[1]2025.08 | 79.69 | — | — | — | 94.43 | |
| AdvADSurrogate Model=[14], Target Model=[14]2025.08 | 79.14 | — | — | — | 83.18 | |
| DASHSurrogate Model=[15], Target Model=[1]2025.08 | 78.87 | — | — | — | 94.57 | |
| AutoAttackSurrogate Model=[44], Target Model=[44]2025.08 | 78.34 | — | — | — | 91.25 | |
| AutoAttackSurrogate Model=[1], Target Model=[1]2025.08 | 77.9 | — | — | — | 93.03 | |
| AdvADSurrogate Model=[44], Target Model=[44]2025.08 | 77.42 | — | — | — | 83.07 | |
| DiffAttackSurrogate Model=[14], Target Model=[14]2025.08 | 77.24 | — | — | — | 91.16 | |
| AutoAttackSurrogate Model=[14], Target Model=[14]2025.08 | 76.77 | — | — | — | 92.09 | |
| DiffAttackSurrogate Model=[44], Target Model=[44]2025.08 | 76.53 | — | — | — | 90.9 | |
| AutoAttackSurrogate Model=[15], Target Model=[15]2025.08 | 76.25 | — | — | — | 93.22 | |
| DASHSurrogate Model=[15], Target Model=Avg.2025.08 | 75.64 | — | — | — | 94.57 | |
| DiffAttackSurrogate Model=[44], Target Model=[14]2025.08 | 75.38 | — | — | — | 90.9 | |
| DiffAttackSurrogate Model=[44]2025.08 | 75.04 | 75.38 | 76.53 | 74.7 | 90.9 | |
| DiffAttackSurrogate Model=[14], Target Model=[44]2025.08 | 74.76 | — | — | — | 91.16 | |
| DiffAttackSurrogate Model=[14]2025.08 | 74.74 | 77.24 | 74.76 | 74.72 | 91.16 | |
| DiffAttackSurrogate Model=[14], Target Model=[1]2025.08 | 74.72 | — | — | — | 91.16 | |
| DiffAttackSurrogate Model=[44], Target Model=[1]2025.08 | 74.7 | — | — | — | 90.9 | |
| AdvADSurrogate Model=[15], Target Model=[15]2025.08 | 74.52 | — | — | — | 87.28 | |
| DASHSurrogate Model=[15], Target Model=[44]2025.08 | 74.47 | — | — | — | 94.57 | |
| AdvADSurrogate Model=[14], Target Model=[44]2025.08 | 73.84 | — | — | — | 83.18 | |
| DASHSurrogate Model=[15], Target Model=[14]2025.08 | 73.59 | — | — | — | 94.57 | |
| AdvADSurrogate Model=[14]2025.08 | 73.27 | 79.14 | 73.84 | 72.7 | 83.18 | |
| DASHSurrogate Model=[44], Target Model=[15]2025.08 | 73.2 | — | — | — | 94.73 | |
| AdvADSurrogate Model=[44], Target Model=[14]2025.08 | 72.98 | — | — | — | 83.07 | |
| AdvADSurrogate Model=[14], Target Model=[1]2025.08 | 72.7 | — | — | — | 83.18 | |
| AdvADSurrogate Model=[44]2025.08 | 72.61 | 72.98 | 77.42 | 72.24 | 83.07 | |
| DiffAttackSurrogate Model=[1], Target Model=[14]2025.08 | 72.44 | — | — | — | 91.26 | |
| AdvADSurrogate Model=[44], Target Model=[1]2025.08 | 72.24 | — | — | — | 83.07 | |
| DiffAttackSurrogate Model=[15], Target Model=[15]2025.08 | 72.24 | — | — | — | 93.87 | |
| DASHSurrogate Model=[14], Target Model=[15]2025.08 | 70.61 | — | — | — | 94.43 | |
| AdvADSurrogate Model=[44], Target Model=Avg.2025.08 | 70.54 | — | — | — | 83.07 | |
| AdvADSurrogate Model=[14], Target Model=Avg.2025.08 | 70.29 | — | — | — | 83.18 | |
| DiffAttackSurrogate Model=[44], Target Model=Avg.2025.08 | 69.19 | — | — | — | 90.9 | |
| DiffAttackSurrogate Model=[14], Target Model=Avg.2025.08 | 68.86 | — | — | — | 91.16 | |
| PI-FGSM++Surrogate Model=[1], Target Model=[1]2025.08 | 68.47 | — | — | — | 91.14 | |
| PI-FGSM++Surrogate Model=[15], Target Model=[15]2025.08 | 68.03 | — | — | — | 91.3 | |
| DiffAttackSurrogate Model=[15], Target Model=[1]2025.08 | 67.22 | — | — | — | 93.87 | |
| AdvADSurrogate Model=[15], Target Model=[1]2025.08 | 66.54 | — | — | — | 87.28 | |
| AdvADSurrogate Model=[44], Target Model=[15]2025.08 | 66.4 | — | — | — | 83.07 | |
| AutoAttackSurrogate Model=[14], Target Model=[44]2025.08 | 65.98 | — | — | — | 92.09 | |
| AutoAttackSurrogate Model=[14]2025.08 | 65.12 | 76.77 | 65.98 | 64.26 | 92.09 | |
| AdvADSurrogate Model=[1], Target Model=[44]2025.08 | 64.82 | — | — | — | 83.92 | |
| AdvADSurrogate Model=[1]2025.08 | 64.7 | 64.58 | 64.82 | 81.6 | 83.92 | |
| AdvADSurrogate Model=[1], Target Model=[14]2025.08 | 64.58 | — | — | — | 83.92 | |
| AdvADSurrogate Model=[14], Target Model=[15]2025.08 | 64.32 | — | — | — | 83.18 | |
| AutoAttackSurrogate Model=[14], Target Model=[1]2025.08 | 64.26 | — | — | — | 92.09 | |
| AutoAttackSurrogate Model=[44], Target Model=[1]2025.08 | 64.26 | — | — | — | 91.25 | |
| AutoAttackSurrogate Model=[44]2025.08 | 64.12 | 63.98 | 78.34 | 64.26 | 91.25 | |
| AutoAttackSurrogate Model=[14], Target Model=Avg.2025.08 | 64.12 | — | — | — | 92.09 | |
| AutoAttackSurrogate Model=[44], Target Model=[14]2025.08 | 63.98 | — | — | — | 91.25 | |
| DiffAttackSurrogate Model=[15], Target Model=Avg.2025.08 | 63.96 | — | — | — | 93.87 | |
| AdvADSurrogate Model=[1], Target Model=Avg.2025.08 | 63.7 | — | — | — | 83.92 | |
| PI-FGSM++Surrogate Model=[44], Target Model=[44]2025.08 | 63.55 | — | — | — | 91.14 | |
| DASHSurrogate Model=[1], Target Model=[14]2025.08 | 63.5 | — | — | — | 95.05 | |
| AutoAttackSurrogate Model=[44], Target Model=Avg.2025.08 | 63.38 | — | — | — | 91.25 | |
| DiffAttackSurrogate Model=[1]2025.08 | 63.37 | 72.44 | 54.3 | 81.35 | 91.26 | |
| DASHSurrogate Model=[1]2025.08 | 63.3 | 63.5 | 63.09 | 99.22 | 95.05 | |
| DiffAttackSurrogate Model=[15], Target Model=[44]2025.08 | 63.2 | — | — | — | 93.87 | |
| DASHSurrogate Model=[1], Target Model=Avg.2025.08 | 63.14 | — | — | — | 95.05 | |
| DASHSurrogate Model=[1], Target Model=[44]2025.08 | 63.09 | — | — | — | 95.05 | |
| DASHSurrogate Model=[1], Target Model=[15]2025.08 | 62.83 | — | — | — | 95.05 | |
| AdvADSurrogate Model=[15], Target Model=Avg.2025.08 | 62.67 | — | — | — | 87.28 | |
| PI-FGSM++Surrogate Model=[14], Target Model=[14]2025.08 | 62.2 | — | — | — | 91.12 | |
| AutoAttackSurrogate Model=[14], Target Model=[15]2025.08 | 62.11 | — | — | — | 92.09 | |
| AutoAttackSurrogate Model=[44], Target Model=[15]2025.08 | 61.91 | — | — | — | 91.25 | |
| AdvADSurrogate Model=[1], Target Model=[15]2025.08 | 61.7 | — | — | — | 83.92 | |
| DiffAttackSurrogate Model=[15], Target Model=[14]2025.08 | 61.46 | — | — | — | 93.87 | |
| PI-FGSM++Surrogate Model=[44], Target Model=[1]2025.08 | 61.43 | — | — | — | 91.14 | |
| AdvADSurrogate Model=[15], Target Model=[44]2025.08 | 61.04 | — | — | — | 87.28 | |
| PI-FGSM++Surrogate Model=[44]2025.08 | 60.7 | 59.96 | 63.55 | 61.43 | 91.14 | |
| AutoAttackSurrogate Model=[15], Target Model=[1]2025.08 | 60.53 | — | — | — | 93.22 | |
| DiffAttackSurrogate Model=[1], Target Model=Avg.2025.08 | 60.48 | — | — | — | 91.26 | |
| AdvADSurrogate Model=[15], Target Model=[14]2025.08 | 60.42 | — | — | — | 87.28 | |
| PI-FGSM++Surrogate Model=[44], Target Model=Avg.2025.08 | 60.4 | — | — | — | 91.14 | |
| PI-FGSM++Surrogate Model=[15], Target Model=[1]2025.08 | 60.29 | — | — | — | 91.3 | |
| PI-FGSM++Surrogate Model=[14], Target Model=[1]2025.08 | 60.01 | — | — | — | 91.12 | |
| PI-FGSM++Surrogate Model=[44], Target Model=[14]2025.08 | 59.96 | — | — | — | 91.14 | |
| PI-FGSM++Surrogate Model=[44], Target Model=[15]2025.08 | 59.82 | — | — | — | 91.14 | |
| PI-FGSM++Surrogate Model=[14], Target Model=[15]2025.08 | 59.71 | — | — | — | 91.12 | |
| PI-FGSM++Surrogate Model=[14], Target Model=Avg.2025.08 | 59.66 | — | — | — | 91.12 | |
| PI-FGSM++Surrogate Model=[14]2025.08 | 59.63 | 62.2 | 59.25 | 60.01 | 91.12 | |
| PI-FGSM++Surrogate Model=[14], Target Model=[44]2025.08 | 59.25 | — | — | — | 91.12 | |
| AutoAttackSurrogate Model=[1], Target Model=[15]2025.08 | 58.22 | — | — | — | 93.03 |