Targeted Adversarial Attack on ImageNet-Compatible
89Avg Success RateRaPA
Evaluation Results
| Method | Links | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| RaPASurrogate Model=RN50, Combined with=MI-TI2025.04 | 89 | 98.2 | — | — | — | — | — | — | — | — | — | 93 | 91 | 82.6 | 88.5 | 93.6 | 90.9 | 82.1 | 85.5 | 85 | |
| CFMSurrogate Model=RN50, Combined with=MI-TI2025.04 | 86.5 | 98 | — | — | — | — | — | — | — | — | — | 92 | 89.5 | 74.8 | 85.6 | 93.4 | 85.2 | 82.6 | 82.5 | 81.7 | |
| RaPASurrogate Model=DN121, Combined with=MI-TI2025.04 | 86 | 90.2 | — | — | — | — | — | — | — | — | — | 89.6 | 85.1 | 77.8 | 84.4 | 97.4 | 84.4 | 83.2 | 84.1 | 83.7 | |
| MUPSurrogate Model=RN50, Combined with=MI-TI2025.04 | 79.3 | 97.7 | — | — | — | — | — | — | — | — | — | 90.3 | 85.6 | 61.8 | 75 | 91.6 | 79.3 | 70.9 | 71.8 | 68.7 | |
| CFMSurrogate Model=DN121, Combined with=MI-TI2025.04 | 75.6 | 88.9 | — | — | — | — | — | — | — | — | — | 82.4 | 78.6 | 60.9 | 69.9 | 98.5 | 60.5 | 73 | 72.7 | 70.3 | |
| ODISurrogate Model=RN50, Combined with=MI-TI2025.04 | 75.5 | 98.9 | — | — | — | — | — | — | — | — | — | 77.5 | 83 | 63.9 | 69.9 | 89.8 | 61.2 | 71 | 71.1 | 69.2 | |
| BSRSurrogate Model=RN50, Combined with=MI-TI2025.04 | 75.1 | 98.5 | — | — | — | — | — | — | — | — | — | 87.9 | 84.1 | 54.9 | 70 | 91.6 | 65.3 | 66.5 | 68.9 | 63.3 | |
| AdmixSurrogate Model=RN50, Combined with=MI-TI2025.04 | 73.2 | 98.1 | — | — | — | — | — | — | — | — | — | 83.2 | 78.1 | 57.1 | 67.8 | 86.8 | 70.3 | 61.9 | 64.4 | 64.5 | |
| SISurrogate Model=RN50, Combined with=MI-TI2025.04 | 72.8 | 98.8 | — | — | — | — | — | — | — | — | — | 82.9 | 73.7 | 60.8 | 66 | 90 | 59.4 | 66.9 | 68.7 | 60.6 | |
| MUPSurrogate Model=DN121, Combined with=MI-TI2025.04 | 69.5 | 86.9 | — | — | — | — | — | — | — | — | — | 79.9 | 75.2 | 50.3 | 60.5 | 97.7 | 51.4 | 65.7 | 66.5 | 61 | |
| SIASurrogate Model=RN50, Combined with=MI-TI2025.04 | 67.7 | 98.3 | — | — | — | — | — | — | — | — | — | 84.5 | 79.3 | 39 | 67.1 | 88.4 | 70.1 | 46 | 53.4 | 50.9 | |
| RaPASource Model=MambaVision-T2025.04 | 63.8 | — | — | — | — | — | — | — | 64.9 | 89.7 | — | — | — | — | — | — | — | — | — | — | |
| AdmixSurrogate Model=DN121, Combined with=MI-TI2025.04 | 63 | 74.3 | — | — | — | — | — | — | — | — | — | 72.4 | 65.8 | 46.9 | 55.1 | 97.9 | 51.2 | 55.5 | 56.6 | 53.9 | |
| RDISurrogate Model=RN50, Combined with=MI-TI2025.04 | 61.7 | 98.7 | — | — | — | — | — | — | — | — | — | 80.6 | 75.4 | 32.8 | 52.6 | 87.4 | 49.6 | 47.8 | 51.1 | 40.7 | |
| ODISurrogate Model=DN121, Combined with=MI-TI2025.04 | 60.6 | 71.5 | — | — | — | — | — | — | — | — | — | 59.6 | 69.6 | 48.1 | 52.2 | 98.9 | 35.5 | 58.1 | 60 | 52.7 | |
| CFM-RDISource model=adv-RN-502023.05 | 58.6 | 98.3 | 29.5 | 69.8 | 41.8 | 52.7 | 59.8 | 3.74 | — | — | — | — | — | — | — | — | — | — | — | — | |
| SIASurrogate Model=DN121, Combined with=MI-TI2025.04 | 58.4 | 79.3 | — | — | — | — | — | — | — | — | — | 69.2 | 66.2 | 34.9 | 54.8 | 98.1 | 45.1 | 40.6 | 51.6 | 44.1 | |
| ODISource model=adv-RN-502023.05 | 51.8 | 97.3 | 22.2 | 57.7 | 38.8 | 40 | 54.9 | 9.04 | — | — | — | — | — | — | — | — | — | — | — | — | |
| BSRSurrogate Model=DN121, Combined with=MI-TI2025.04 | 51.8 | 70.3 | — | — | — | — | — | — | — | — | — | 61.6 | 57.3 | 34.1 | 41.7 | 98.3 | 30.2 | 42.7 | 44.5 | 37.5 | |
| SI-RDISource model=adv-RN-502023.05 | 49.7 | 98.7 | 19.4 | 57.6 | 35.3 | 35.2 | 52.1 | 16.34 | — | — | — | — | — | — | — | — | — | — | — | — | |
| SISurrogate Model=DN121, Combined with=MI-TI2025.04 | 47.9 | 60.9 | — | — | — | — | — | — | — | — | — | 54.8 | 43 | 35.6 | 37.9 | 98.6 | 26.7 | 43.6 | 43.5 | 34.6 | |
| RaPASource Model=ConvNeXtV2-L2025.04 | 46.4 | — | — | — | — | — | — | — | 56.7 | 100 | — | — | — | — | — | — | — | — | — | — | |
| RaPASurrogate Model=ResNet-50, Optimization=MI-TI2025.04 | 45 | — | 33.8 | 75.4 | 27.6 | 59.5 | 57.3 | — | — | — | 15.6 | — | — | — | — | — | — | — | — | — | |
| Admix-RDISource model=adv-RN-502023.05 | 43.5 | 98.9 | 12.1 | 55.5 | 23.1 | 32.4 | 38.9 | 9.86 | — | — | — | — | — | — | — | — | — | — | — | — | |
| DISurrogate Model=RN50, Combined with=MI-TI2025.04 | 41.5 | 98.7 | — | — | — | — | — | — | — | — | — | 60.1 | 64.6 | 8.1 | 28.6 | 77.3 | 28.4 | 13.5 | 21.1 | 15.1 | |
| RaPASource Model=DINOv2-Large2025.04 | 41.4 | — | — | — | — | — | — | — | 49.3 | 98.7 | — | — | — | — | — | — | — | — | — | — | |
| RDISource model=adv-RN-502023.05 | 40.7 | 98.8 | 10.8 | 49.5 | 19.9 | 29.4 | 35.8 | 3.29 | — | — | — | — | — | — | — | — | — | — | — | — | |
| RaPASurrogate Model=DenseNet-121, Optimization=MI-TI2025.04 | 40.3 | — | 27.8 | 69.4 | 23.5 | 53.1 | 54 | — | — | — | 14.1 | — | — | — | — | — | — | — | — | — | |
| RDISurrogate Model=DN121, Combined with=MI-TI2025.04 | 40.2 | 54.4 | — | — | — | — | — | — | — | — | — | 50.9 | 46.7 | 19.3 | 26.9 | 98.6 | 20.6 | 29.8 | 30.5 | 24.7 | |
| VT-RDISource model=adv-RN-502023.05 | 39.5 | 98.5 | 10.6 | 46.3 | 20 | 27.1 | 34.4 | 19.83 | — | — | — | — | — | — | — | — | — | — | — | — | |
| FTMSurrogate Model=ResNet-50, Optimization=MI-TI2025.04 | 33.3 | — | 18 | 67.6 | 16.5 | 47.1 | 41.5 | — | — | — | 9.3 | — | — | — | — | — | — | — | — | — | |
| CFMSurrogate Model=ResNet-50, Optimization=MI-TI2025.04 | 32.2 | — | 17.3 | 65.8 | 14.6 | 47.5 | 39.9 | — | — | — | 7.9 | — | — | — | — | — | — | — | — | — | |
| DISource model=adv-RN-502023.05 | 31.9 | 98.9 | 5.7 | 36.9 | 10.1 | 19.2 | 20.5 | 3.77 | — | — | — | — | — | — | — | — | — | — | — | — | |
| CFM-RDISource model=RN-502023.05 | 30.8 | 75.5 | 4.3 | 46.1 | 8.9 | 25.2 | 24.7 | 3.72 | — | — | — | — | — | — | — | — | — | — | — | — | |
| ODISource model=RN-502023.05 | 27.8 | 64.7 | 5.1 | 37 | 10.7 | 20.1 | 29.1 | 9.05 | — | — | — | — | — | — | — | — | — | — | — | — | |
| DISurrogate Model=DN121, Combined with=MI-TI2025.04 | 26.4 | 36.4 | — | — | — | — | — | — | — | — | — | 28.1 | 35.8 | 6.5 | 14.5 | 99 | 10.1 | 9.8 | 13.9 | 10.1 | |
| ODISurrogate Model=ResNet-50, Optimization=MI-TI2025.04 | 24.8 | — | 15.5 | 49.3 | 11.8 | 31.6 | 35.1 | — | — | — | 5.6 | — | — | — | — | — | — | — | — | — | |
| FTMSurrogate Model=DenseNet-121, Optimization=MI-TI2025.04 | 22.8 | — | 10.7 | 50.4 | 9.4 | 31.1 | 30.4 | — | — | — | 4.8 | — | — | — | — | — | — | — | — | — | |
| CFMSurrogate Model=DenseNet-121, Optimization=MI-TI2025.04 | 22.3 | — | 10.4 | 49 | 8.3 | 30.1 | 30.4 | — | — | — | 5.5 | — | — | — | — | — | — | — | — | — | |
| SI-RDISource model=RN-502023.05 | 22 | 59.9 | 2.9 | 29.4 | 6.3 | 15.5 | 17.9 | 16.16 | — | — | — | — | — | — | — | — | — | — | — | — | |
| VT-RDISource model=RN-502023.05 | 21.6 | 64.2 | 2.9 | 28.1 | 5.2 | 15 | 14 | 19.83 | — | — | — | — | — | — | — | — | — | — | — | — | |
| MUPSurrogate Model=ResNet-50, Optimization=MI-TI2025.04 | 20.7 | — | 7 | 48.3 | 8.2 | 30.7 | 26.5 | — | — | — | 3.6 | — | — | — | — | — | — | — | — | — | |
| CFMSource Model=ConvNeXtV2-L2025.04 | 20.6 | — | — | — | — | — | — | — | 28.4 | 100 | — | — | — | — | — | — | — | — | — | — | |
| CFMSource Model=DINOv2-Large2025.04 | 20 | — | — | — | — | — | — | — | 27.7 | 100 | — | — | — | — | — | — | — | — | — | — | |
| SISurrogate Model=ResNet-50, Optimization=MI-TI2025.04 | 18.4 | — | 8 | 42.9 | 7.7 | 25.1 | 23.3 | — | — | — | 3.7 | — | — | — | — | — | — | — | — | — | |
| BSRSurrogate Model=ResNet-50, Optimization=MI-TI2025.04 | 17.7 | — | 6.8 | 42.4 | 7.7 | 25.3 | 21.9 | — | — | — | 2.3 | — | — | — | — | — | — | — | — | — | |
| ODISurrogate Model=DenseNet-121, Optimization=MI-TI2025.04 | 17.4 | — | 8.5 | 36.3 | — | 19.8 | 26.7 | — | — | — | 4.9 | — | — | — | — | — | — | — | — | — | |
| AdmixSurrogate Model=ResNet-50, Optimization=MI-TI2025.04 | 17.1 | — | 7.2 | 43.4 | 5.9 | 22.7 | 19.4 | — | — | — | 4.2 | — | — | — | — | — | — | — | — | — | |
| MUPSurrogate Model=DenseNet-121, Optimization=MI-TI2025.04 | 16.1 | — | 5.2 | 38.9 | 5 | 23.2 | 20.1 | — | — | — | 4.1 | — | — | — | — | — | — | — | — | — | |
| Admix-RDISource model=RN-502023.05 | 15.9 | 52.4 | 1.3 | 22.5 | 2.5 | 8.5 | 8.4 | 9.73 | — | — | — | — | — | — | — | — | — | — | — | — | |
| AdmixSurrogate Model=DenseNet-121, Optimization=MI-TI2025.04 | 13.8 | — | 4.2 | 33.8 | 4 | 18 | 19.1 | — | — | — | 3.9 | — | — | — | — | — | — | — | — | — | |
| CFMSource Model=MambaVision-T2025.04 | 12.5 | — | — | — | — | — | — | — | 40.2 | 91.9 | — | — | — | — | — | — | — | — | — | — | |
| DWPSurrogate Model=ResNet-50, Optimization=MI-TI2025.04 | 12.1 | — | 3.7 | 32 | 4 | 17.6 | 13.3 | — | — | — | 1.8 | — | — | — | — | — | — | — | — | — | |
| RaPASurrogate Model=CLIP, Combined with=MI-TI2025.04 | 11.6 | 9.5 | — | — | — | — | — | — | — | — | — | 8.8 | 4.9 | 14.6 | 17.5 | 14.9 | 8.5 | 12.5 | 12.8 | 12.4 | |
| SIASurrogate Model=ResNet-50, Optimization=MI-TI2025.04 | 11.2 | — | 3.1 | 28.4 | 3.9 | 16.7 | 13.5 | — | — | — | 1.9 | — | — | — | — | — | — | — | — | — | |
| RDISource model=RN-502023.05 | 10.5 | 34.8 | 0.7 | 13.1 | 1.9 | 5.9 | 6.8 | 3.29 | — | — | — | — | — | — | — | — | — | — | — | — | |
| ODISurrogate Model=CLIP, Combined with=MI-TI2025.04 | 9.9 | 7 | — | — | — | — | — | — | — | — | — | 7.7 | 5.1 | 11 | 13.7 | 13 | 6.5 | 11.3 | 11.8 | 11.5 | |
| SISurrogate Model=DenseNet-121, Optimization=MI-TI2025.04 | 9.4 | — | 3.9 | 21.5 | 4.4 | 10.2 | 14.3 | — | — | — | 2.1 | — | — | — | — | — | — | — | — | — | |
| RDISurrogate Model=ResNet-50, Optimization=MI-TI2025.04 | 9.2 | — | 2.8 | 24 | 4.4 | 12.6 | 10.1 | — | — | — | 1.2 | — | — | — | — | — | — | — | — | — | |
| DWPSurrogate Model=DenseNet-121, Optimization=MI-TI2025.04 | 9.2 | — | 2.7 | 21.1 | 2.9 | 14.3 | 12 | — | — | — | 2.4 | — | — | — | — | — | — | — | — | — | |
| SIASurrogate Model=DenseNet-121, Optimization=MI-TI2025.04 | 9 | — | 2.4 | 24.2 | 2.2 | 12.9 | 11.1 | — | — | — | 1.5 | — | — | — | — | — | — | — | — | — | |
| BSRSurrogate Model=DenseNet-121, Optimization=MI-TI2025.04 | 8.5 | — | 2.7 | 21.6 | 2.7 | 10.6 | 11.9 | — | — | — | 1.2 | — | — | — | — | — | — | — | — | — | |
| RDISurrogate Model=DenseNet-121, Optimization=MI-TI2025.04 | 5.3 | — | 1 | 12 | 2.1 | 6.9 | 8.2 | — | — | — | 1.4 | — | — | — | — | — | — | — | — | — | |
| CFMSurrogate Model=CLIP, Combined with=MI-TI2025.04 | 4.2 | 3.3 | — | — | — | — | — | — | — | — | — | 3.1 | 1.4 | 4.9 | 7.8 | 4.3 | 2.5 | 5.4 | 4.1 | 4.8 | |
| AdmixSurrogate Model=CLIP, Combined with=MI-TI2025.04 | 3.3 | 2.2 | — | — | — | — | — | — | — | — | — | 2.7 | 1.6 | 4.1 | 6 | 3.5 | 2.8 | 2.9 | 3.8 | 3.6 | |
| DISource model=RN-502023.05 | 2.9 | 10.9 | 0.1 | 3.6 | 0.3 | 1.3 | 1.5 | 3.73 | — | — | — | — | — | — | — | — | — | — | — | — | |
| DISurrogate Model=ResNet-50, Optimization=MI-TI2025.04 | 2.3 | — | 0.4 | 6.7 | 0.6 | 3.8 | 1.8 | — | — | — | 0.5 | — | — | — | — | — | — | — | — | — | |
| BSRSurrogate Model=CLIP, Combined with=MI-TI2025.04 | 2 | 1.6 | — | — | — | — | — | — | — | — | — | 1.7 | 0.9 | 1.9 | 3.5 | 2.4 | 1.5 | 1.9 | 2.3 | 2.2 | |
| DISurrogate Model=DenseNet-121, Optimization=MI-TI2025.04 | 1.7 | — | 0.3 | 4 | 1.2 | 2 | 2.1 | — | — | — | 0.3 | — | — | — | — | — | — | — | — | — | |
| SIASurrogate Model=CLIP, Combined with=MI-TI2025.04 | 1.7 | 1 | — | — | — | — | — | — | — | — | — | 0.9 | 0.8 | 1.8 | 3.5 | 1.6 | 1.9 | 1.3 | 1.8 | 2.6 | |
| SISurrogate Model=CLIP, Combined with=MI-TI2025.04 | 1 | 0.5 | — | — | — | — | — | — | — | — | — | 0.6 | 0.6 | 1.4 | 1.6 | 1.4 | 1 | 1 | 0.8 | 1.2 | |
| RDISurrogate Model=CLIP, Combined with=MI-TI2025.04 | 0.4 | 0.4 | — | — | — | — | — | — | — | — | — | 0.5 | 0.2 | 0.4 | 0.9 | 0.4 | 0.3 | 0.4 | 0.2 | 0.7 | |
| DISurrogate Model=CLIP, Combined with=MI-TI2025.04 | 0.1 | 0.1 | — | — | — | — | — | — | — | — | — | 0.1 | 0.1 | 0 | 0 | 0.1 | 0.2 | 0 | 0 | 0.1 |