Attack Success Rate on ImageNet (Untargeted Attack)
87.2Attack Success Rate (ASR)DRAP
Evaluation results
| Method | Links | |
|---|---|---|
| DRAPTarget Model Set=ConvNet Set, Target Model=MobileNetV2 [61], Surrogate Models=ResNet-50 and ViT-B2025.04 | 87.2 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=MNASNet [63], Surrogate Models=ResNet-50 and ViT-B2025.04 | 86.3 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=MobileNetV2 [61], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 84.4 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=ShuffleNetV2 [60], Surrogate Models=ResNet-50 and ViT-B2025.04 | 84.1 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=MNASNet [63], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 84 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=ShuffleNetV2 [60], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 82.4 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=VGG-16-BN [57], Surrogate Models=ResNet-50 and ViT-B2025.04 | 82.3 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=DenseNet-201 [58], Surrogate Models=ResNet-50 and ViT-B2025.04 | 82.1 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=MobileNetV3-L [62], Surrogate Models=ResNet-50 and ViT-B2025.04 | 79.5 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=DenseNet-201 [58], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 78.5 | |
| BayesianTarget Model Set=ConvNet Set, Target Model=MobileNetV2 [61], Surrogate Models=ResNet-50 and ViT-B2025.04 | 78.5 | |
| BayesianTarget Model Set=ConvNet Set, Target Model=MNASNet [63], Surrogate Models=ResNet-50 and ViT-B2025.04 | 76.4 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=VGG-16-BN [57], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 76.2 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=GoogLeNet [59], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 75.6 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=GoogLeNet [59], Surrogate Models=ResNet-50 and ViT-B2025.04 | 75.2 | |
| BayesianTarget Model Set=ConvNet Set, Target Model=ShuffleNetV2 [60], Surrogate Models=ResNet-50 and ViT-B2025.04 | 74.8 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=MobileNetV3-L [62], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 74.8 | |
| BayesianTarget Model Set=ConvNet Set, Target Model=VGG-16-BN [57], Surrogate Models=ResNet-50 and ViT-B2025.04 | 73 | |
| BayesianTarget Model Set=ConvNet Set, Target Model=DenseNet-201 [58], Surrogate Models=ResNet-50 and ViT-B2025.04 | 72 | |
| BayesianTarget Model Set=ConvNet Set, Target Model=MobileNetV3-L [62], Surrogate Models=ResNet-50 and ViT-B2025.04 | 69 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=AlexNet [56], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 66 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=EfficientNet [64], Surrogate Models=ResNet-50 and ViT-B2025.04 | 64.7 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=AlexNet [56], Surrogate Models=ResNet-50 and ViT-B2025.04 | 63.6 | |
| BayesianTarget Model Set=ConvNet Set, Target Model=GoogLeNet [59], Surrogate Models=ResNet-50 and ViT-B2025.04 | 63.3 | |
| NAATarget Model Set=ConvNet Set, Target Model=VGG-16-BN [57], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 60.9 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=EfficientNet [64], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 60.4 | |
| DRAPTarget Model Set=Metaformer Set, Target Model=PoolFormer-S [49], Surrogate Models=ResNet-50 and ViT-B2025.04 | 60.1 | |
| NAATarget Model Set=ConvNet Set, Target Model=MobileNetV2 [61], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 59.5 | |
| NAATarget Model Set=ConvNet Set, Target Model=DenseNet-201 [58], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 57.9 | |
| DRAPTarget Model Set=Metaformer Set, Target Model=DeiT-S [67], Surrogate Models=ResNet-50 and ViT-B2025.04 | 55.8 | |
| NAATarget Model Set=ConvNet Set, Target Model=MNASNet [63], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 55.6 | |
| BayesianTarget Model Set=ConvNet Set, Target Model=AlexNet [56], Surrogate Models=ResNet-50 and ViT-B2025.04 | 55.3 | |
| BayesianTarget Model Set=ConvNet Set, Target Model=EfficientNet [64], Surrogate Models=ResNet-50 and ViT-B2025.04 | 53.8 | |
| NAATarget Model Set=ConvNet Set, Target Model=ShuffleNetV2 [60], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 51.9 | |
| DRAPTarget Model Set=ConvNet(AT) Set, Target Model=ResNet-50 [74], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 51.3 | |
| DRAPTarget Model Set=Metaformer Set, Target Model=PoolFormer-S [49], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 48.6 | |
| BayesianTarget Model Set=Metaformer Set, Target Model=PoolFormer-S [49], Surrogate Models=ResNet-50 and ViT-B2025.04 | 48.1 | |
| NAATarget Model Set=ConvNet Set, Target Model=AlexNet [56], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 47.8 | |
| NAATarget Model Set=ConvNet Set, Target Model=GoogLeNet [59], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 47.3 | |
| FIATarget Model Set=ConvNet Set, Target Model=AlexNet [56], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 46.7 | |
| DRAPTarget Model Set=Metaformer Set, Target Model=TNT-S [68], Surrogate Models=ResNet-50 and ViT-B2025.04 | 44.2 | |
| BayesianTarget Model Set=Metaformer Set, Target Model=DeiT-S [67], Surrogate Models=ResNet-50 and ViT-B2025.04 | 43.8 | |
| NAATarget Model Set=ConvNet Set, Target Model=MobileNetV3-L [62], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 43.5 | |
| FIATarget Model Set=ConvNet Set, Target Model=MobileNetV2 [61], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 42.5 | |
| FIATarget Model Set=ConvNet Set, Target Model=VGG-16-BN [57], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 42.3 | |
| FIATarget Model Set=ConvNet Set, Target Model=ShuffleNetV2 [60], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 42.2 | |
| GhostNetTarget Model Set=ConvNet Set, Target Model=AlexNet [56], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 42.1 | |
| NAATarget Model Set=ConvNet Set, Target Model=EfficientNet [64], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 41.7 | |
| DRAPTarget Model Set=ConvNet(AT) Set, Target Model=ResNet-50 [74], Surrogate Models=ResNet-50 and ViT-B2025.04 | 41.2 | |
| FIATarget Model Set=ConvNet(AT) Set, Target Model=ResNet-50 [74], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 40.8 | |
| NAATarget Model Set=ConvNet(AT) Set, Target Model=ResNet-50 [74], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 40.4 | |
| GhostNetTarget Model Set=ConvNet Set, Target Model=VGG-16-BN [57], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 40.3 | |
| DRAPTarget Model Set=Metaformer Set, Target Model=ViT-S [66], Surrogate Models=ResNet-50 and ViT-B2025.04 | 40.1 | |
| BayesianTarget Model Set=ConvNet(AT) Set, Target Model=ResNet-50 [74], Surrogate Models=ResNet-50 and ViT-B2025.04 | 39.9 | |
| GhostNetTarget Model Set=ConvNet(AT) Set, Target Model=ResNet-50 [74], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 39.1 | |
| FIATarget Model Set=ConvNet Set, Target Model=MNASNet [63], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 39 | |
| GhostNetTarget Model Set=ConvNet Set, Target Model=ShuffleNetV2 [60], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 37 | |
| GhostNetTarget Model Set=ConvNet Set, Target Model=MobileNetV2 [61], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 36.6 | |
| FIATarget Model Set=ConvNet Set, Target Model=DenseNet-201 [58], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 35.3 | |
| NAATarget Model Set=Metaformer Set, Target Model=PoolFormer-S [49], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 33.7 | |
| GhostNetTarget Model Set=ConvNet Set, Target Model=MNASNet [63], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 33.6 | |
| BayesianTarget Model Set=Metaformer Set, Target Model=TNT-S [68], Surrogate Models=ResNet-50 and ViT-B2025.04 | 33.5 | |
| DRAPTarget Model Set=ConvNet(AT) Set, Target Model=WideResNet-50-2 [73], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 33 | |
| GhostNetTarget Model Set=ConvNet Set, Target Model=DenseNet-201 [58], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 32.1 | |
| FIATarget Model Set=ConvNet Set, Target Model=MobileNetV3-L [62], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 31.4 | |
| FIATarget Model Set=ConvNet Set, Target Model=GoogLeNet [59], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 31 | |
| FIATarget Model Set=ConvNet Set, Target Model=EfficientNet [64], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 29.6 | |
| GhostNetTarget Model Set=ConvNet Set, Target Model=GoogLeNet [59], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 27.3 | |
| BayesianTarget Model Set=Metaformer Set, Target Model=ViT-S [66], Surrogate Models=ResNet-50 and ViT-B2025.04 | 27 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=ConvNeXt-L [65], Surrogate Models=ResNet-50 and ViT-B2025.04 | 26.2 | |
| GhostNetTarget Model Set=ConvNet Set, Target Model=EfficientNet [64], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 25 | |
| GhostNetTarget Model Set=ConvNet Set, Target Model=MobileNetV3-L [62], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 24.8 | |
| DRAPTarget Model Set=ConvNet(AT) Set, Target Model=RaWideResNet-101-2 [72], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 24.6 | |
| DRAPTarget Model Set=Metaformer Set, Target Model=DeiT-S [67], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 23.5 | |
| DRAPTarget Model Set=Metaformer(AT) Set, Target Model=XCiT-L [78], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 23 | |
| FIATarget Model Set=ConvNet(AT) Set, Target Model=WideResNet-50-2 [73], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 22.9 | |
| DRAPTarget Model Set=ConvNet(AT) Set, Target Model=WideResNet-50-2 [73], Surrogate Models=ResNet-50 and ViT-B2025.04 | 22.9 | |
| DRAPTarget Model Set=Metaformer Set, Target Model=XCiT-S [70], Surrogate Models=ResNet-50 and ViT-B2025.04 | 21.8 | |
| NAATarget Model Set=ConvNet(AT) Set, Target Model=WideResNet-50-2 [73], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 21.7 | |
| BayesianTarget Model Set=ConvNet(AT) Set, Target Model=WideResNet-50-2 [73], Surrogate Models=ResNet-50 and ViT-B2025.04 | 21.4 | |
| DRAPTarget Model Set=ConvNet(AT) Set, Target Model=Inc-v3_ens4 [77], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 21.3 | |
| DRAPTarget Model Set=Metaformer Set, Target Model=TNT-S [68], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 21.1 | |
| GhostNetTarget Model Set=ConvNet(AT) Set, Target Model=WideResNet-50-2 [73], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 20.5 | |
| DRAPTarget Model Set=ConvNet(AT) Set, Target Model=Inc-v3_ens4 [77], Surrogate Models=ResNet-50 and ViT-B2025.04 | 20.4 | |
| DRAPTarget Model Set=Metaformer Set, Target Model=Swin-S [69], Surrogate Models=ResNet-50 and ViT-B2025.04 | 19.3 | |
| NAATarget Model Set=ConvNet Set, Target Model=ConvNeXt-L [65], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 18.7 | |
| BayesianTarget Model Set=ConvNet Set, Target Model=ConvNeXt-L [65], Surrogate Models=ResNet-50 and ViT-B2025.04 | 18.6 | |
| DRAPTarget Model Set=ConvNet(AT) Set, Target Model=Inc-v3_ens3 [77], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 18.4 | |
| DRAPTarget Model Set=Metaformer Set, Target Model=ViT-S [66], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 18 | |
| DRAPTarget Model Set=ConvNet(AT) Set, Target Model=ConvNeXt-B-ConvStem [76], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 17.9 | |
| DRAPTarget Model Set=Metaformer Set, Target Model=CaiT-S [71], Surrogate Models=ResNet-50 and ViT-B2025.04 | 17.7 | |
| FIATarget Model Set=Metaformer Set, Target Model=PoolFormer-S [49], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 17.4 | |
| FIATarget Model Set=ConvNet(AT) Set, Target Model=RaWideResNet-101-2 [72], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 17.3 | |
| DRAPTarget Model Set=ConvNet(AT) Set, Target Model=RaWideResNet-101-2 [72], Surrogate Models=ResNet-50 and ViT-B2025.04 | 17.3 | |
| DRAPTarget Model Set=ConvNet(AT) Set, Target Model=Inc-v3_ens3 [77], Surrogate Models=ResNet-50 and ViT-B2025.04 | 17.2 | |
| DRAPTarget Model Set=ConvNet Set, Target Model=ConvNeXt-L [65], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 17 | |
| NAATarget Model Set=ConvNet(AT) Set, Target Model=RaWideResNet-101-2 [72], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 17 | |
| BayesianTarget Model Set=ConvNet(AT) Set, Target Model=RaWideResNet-101-2 [72], Surrogate Models=ResNet-50 and ViT-B2025.04 | 16.9 | |
| GhostNetTarget Model Set=Metaformer Set, Target Model=PoolFormer-S [49], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 16.4 | |
| DRAPTarget Model Set=ConvNet(AT) Set, Target Model=ConvNeXt-B [75], Surrogate Models=ResNet-50 and ResNet-50(AT)2025.04 | 16.3 |