Adversarial Robustness Evaluation on MNIST (Classification)
0.51Clean Error RateA^5/O
Evaluation results
| Method | Links | |||
|---|---|---|---|---|
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.3, evaluation_attack_epsilon_ε=0.12023.05 | 0.51 | 0.57 | 0.7 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.4, evaluation_attack_epsilon_ε=0.12023.05 | 0.52 | 0.53 | 0.6 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.2, evaluation_attack_epsilon_ε=0.12023.05 | 0.56 | 0.78 | 1.04 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.05, evaluation_attack_epsilon_ε=02023.05 | 0.71 | 100 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.1, evaluation_attack_epsilon_ε=0.12023.05 | 0.72 | 1.21 | 1.92 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.1, evaluation_attack_epsilon_ε=02023.05 | 0.72 | 100 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.2, evaluation_attack_epsilon_ε=02023.05 | 0.72 | 100 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.3, evaluation_attack_epsilon_ε=02023.05 | 0.73 | 100 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.05, evaluation_attack_epsilon_ε=02023.05 | 0.79 | 87.09 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.1, evaluation_attack_epsilon_ε=02023.05 | 0.79 | 86.51 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.4, evaluation_attack_epsilon_ε=02023.05 | 0.81 | 100 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.05, evaluation_attack_epsilon_ε=0.12023.05 | 0.82 | 1.51 | 2.89 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.4, evaluation_attack_epsilon_ε=0.12023.05 | 0.85 | 83.49 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.1, evaluation_attack_epsilon_ε=0.12023.05 | 0.88 | 95.32 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.2, evaluation_attack_epsilon_ε=0.12023.05 | 0.88 | 90.62 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.2, evaluation_attack_epsilon_ε=02023.05 | 0.89 | 86.4 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.3, evaluation_attack_epsilon_ε=0.12023.05 | 0.89 | 86.28 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.3, evaluation_attack_epsilon_ε=02023.05 | 0.93 | 86.44 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.05, evaluation_attack_epsilon_ε=0.12023.05 | 0.93 | 97.18 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.4, evaluation_attack_epsilon_ε=02023.05 | 0.99 | 85.93 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.2, evaluation_attack_epsilon_ε=0.22023.05 | 1.13 | 1.18 | 1.21 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.3, evaluation_attack_epsilon_ε=0.22023.05 | 1.14 | 1.16 | 1.17 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.4, evaluation_attack_epsilon_ε=0.22023.05 | 1.14 | 1.16 | 1.16 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.1, evaluation_attack_epsilon_ε=0.22023.05 | 1.15 | 1.43 | 1.49 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.05, evaluation_attack_epsilon_ε=0.22023.05 | 1.22 | 1.64 | 1.86 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.3, evaluation_attack_epsilon_ε=0.32023.05 | 1.31 | 2.91 | 3.4 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.2, evaluation_attack_epsilon_ε=0.32023.05 | 1.32 | 3.21 | 3.77 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.4, evaluation_attack_epsilon_ε=0.32023.05 | 1.32 | 2.74 | 3.2 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.1, evaluation_attack_epsilon_ε=0.32023.05 | 1.33 | 4.12 | 5.19 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.05, evaluation_attack_epsilon_ε=0.32023.05 | 1.34 | 1.76 | 1.87 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.1, evaluation_attack_epsilon_ε=0.32023.05 | 1.34 | 1.5 | 1.58 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.3, evaluation_attack_epsilon_ε=0.32023.05 | 1.34 | 1.37 | 1.37 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.05, evaluation_attack_epsilon_ε=0.22023.05 | 1.34 | 99.17 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.2, evaluation_attack_epsilon_ε=0.32023.05 | 1.35 | 1.37 | 1.38 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.4, evaluation_attack_epsilon_ε=0.32023.05 | 1.35 | 1.38 | 1.38 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.05, evaluation_attack_epsilon_ε=0.32023.05 | 1.35 | 5.16 | 6.97 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.1, evaluation_attack_epsilon_ε=0.22023.05 | 1.36 | 98.58 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.2, evaluation_attack_epsilon_ε=0.22023.05 | 1.41 | 96.21 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.3, evaluation_attack_epsilon_ε=0.22023.05 | 1.41 | 94.18 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.4, evaluation_attack_epsilon_ε=0.22023.05 | 1.42 | 92.63 | 100 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.4, evaluation_attack_epsilon_ε=0.42023.05 | 2.28 | 4.16 | 4.29 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.3, evaluation_attack_epsilon_ε=0.42023.05 | 2.32 | 4.66 | 4.81 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.2, evaluation_attack_epsilon_ε=0.42023.05 | 2.35 | 5.02 | 5.22 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.05, evaluation_attack_epsilon_ε=0.42023.05 | 2.38 | 2.91 | 2.92 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.3, evaluation_attack_epsilon_ε=0.42023.05 | 2.38 | 2.52 | 2.52 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.2, evaluation_attack_epsilon_ε=0.42023.05 | 2.4 | 2.55 | 2.55 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.1, evaluation_attack_epsilon_ε=0.42023.05 | 2.41 | 2.71 | 2.74 | |
| A^5/Otraining_attack_epsilon_εA=0.1, defense_epsilon_εD=0.4, evaluation_attack_epsilon_ε=0.42023.05 | 2.44 | 2.51 | 2.51 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.1, evaluation_attack_epsilon_ε=0.42023.05 | 2.49 | 5.54 | 5.85 | |
| A^5/Otraining_attack_epsilon_εA=0.3, defense_epsilon_εD=0.05, evaluation_attack_epsilon_ε=0.42023.05 | 2.55 | 6 | 6.42 |