Targeted Score-based Black-box Attack on ImageNet
100ASRDif++close
Evaluation results
| Method | Links | |||
|---|---|---|---|---|
| Dif++closeVictim Model=Swin-V2-T, Scenario=Query w/ surrogate2024.06 | 100 | 294 | 91 | |
| Dif++openVictim Model=ConvNeXtBase, Scenario=Query w/o surrogate2024.06 | 100 | 1,706 | 1,456 | |
| MCGSquareVictim Model=ConvNeXtBase, Scenario=Query w/ surrogate2024.06 | 100 | 2,762 | 2,429 | |
| Dif++closeVictim Model=ConvNeXtBase, Scenario=Query w/ surrogate2024.06 | 100 | 705 | 421 | |
| DifAttackVictim Model=VGG16, Scenario=Query w/o surrogate2024.06 | 100 | 2,246 | 2,018 | |
| Dif++openVictim Model=VGG16, Scenario=Query w/o surrogate2024.06 | 100 | 1,348 | 1,133 | |
| MCGSquareVictim Model=VGG16, Scenario=Query w/ surrogate2024.06 | 100 | 1,816 | 1,568 | |
| Dif++closeVictim Model=VGG16, Scenario=Query w/ surrogate2024.06 | 100 | 432 | 229 | |
| DifAttackVictim Model=ResNet18, Scenario=Query w/o surrogate2024.06 | 100 | 1,901 | 1,793 | |
| Dif++openVictim Model=ResNet18, Scenario=Query w/o surrogate2024.06 | 100 | 1,351 | 1,189 | |
| Dif++closeVictim Model=ResNet18, Scenario=Query w/ surrogate2024.06 | 100 | 573 | 369 | |
| Dif++closeVictim Model=GoogleNet, Scenario=Query w/ surrogate2024.06 | 99.5 | 1,020 | 541 | |
| MCGSquareVictim Model=ResNet18, Scenario=Query w/ surrogate2024.06 | 99.5 | 1,346 | 1,073 | |
| Dif++closeVictim Model=SqueezeNet, Scenario=Query w/ surrogate2024.06 | 99.5 | 859 | 506 | |
| MCGSquareVictim Model=Swin-V2-T, Scenario=Query w/ surrogate2024.06 | 99 | 2,352 | 1,934 | |
| Dif++openVictim Model=SqueezeNet, Scenario=Query w/o surrogate2024.06 | 99 | 2,085 | 1,796 | |
| MCGSquareVictim Model=SqueezeNet, Scenario=Query w/ surrogate2024.06 | 99 | 1,633 | 1,323 | |
| Dif++openVictim Model=GoogleNet, Scenario=Query w/o surrogate2024.06 | 98.5 | 2,678 | 2,241 | |
| DifAttackVictim Model=SqueezeNet, Scenario=Query w/o surrogate2024.06 | 98 | 2,793 | 2,775 | |
| SimBAVictim Model=VGG16, Scenario=Query w/o surrogate2024.06 | 97.5 | 3,505 | 3,016 | |
| DifAttackVictim Model=ConvNeXtBase, Scenario=Query w/o surrogate2024.06 | 97 | 3,850 | 3,461 | |
| DifAttackVictim Model=GoogleNet, Scenario=Query w/o surrogate2024.06 | 97 | 3,173 | 2,625 | |
| SimBAVictim Model=ResNet18, Scenario=Query w/o surrogate2024.06 | 97 | 3,873 | 3,445 | |
| MCGSquareVictim Model=GoogleNet, Scenario=Query w/ surrogate2024.06 | 96 | 2,937 | 2,132 | |
| Dif++closeVictim Model=EfficientNet-B3, Scenario=Query w/ surrogate2024.06 | 95.5 | 1,669 | 795 | |
| Dif++openVictim Model=Swin-V2-T, Scenario=Query w/o surrogate2024.06 | 95 | 3,516 | 2,611 | |
| MCGSquareVictim Model=EfficientNet-B3, Scenario=Query w/ surrogate2024.06 | 95 | 3,738 | 3,255 | |
| GFCSVictim Model=ResNet18, Scenario=Query w/ surrogate2024.06 | 95 | 3,274 | 2,744 | |
| N-AttackVictim Model=ResNet18, Scenario=Query w/o surrogate2024.06 | 94.5 | 5,324 | 5,101 | |
| Dif++closeVictim Model=ResNet101, Scenario=Query w/ surrogate2024.06 | 94 | 1,460 | 226 | |
| SimBAVictim Model=SqueezeNet, Scenario=Query w/o surrogate2024.06 | 94 | 4,230 | 3,620 | |
| N-AttackVictim Model=VGG16, Scenario=Query w/o surrogate2024.06 | 93.5 | 5,924 | 5,858 | |
| CGAVictim Model=SqueezeNet, Scenario=Query w/o surrogate2024.06 | 93.2 | 3,972 | — | |
| GFCSVictim Model=VGG16, Scenario=Query w/ surrogate2024.06 | 93 | 3,358 | 2,494 | |
| DifAttackVictim Model=Swin-V2-T, Scenario=Query w/o surrogate2024.06 | 92 | 4,291 | 3,729 | |
| CGAVictim Model=ResNet18, Scenario=Query w/o surrogate2024.06 | 91.6 | 4,222 | — | |
| CGAVictim Model=VGG16, Scenario=Query w/o surrogate2024.06 | 91.1 | 4,801 | — | |
| CGAVictim Model=GoogleNet, Scenario=Query w/o surrogate2024.06 | 90.9 | 4,645 | — | |
| SimBAVictim Model=ConvNeXtBase, Scenario=Query w/o surrogate2024.06 | 90 | 4,809 | 4,249 | |
| N-AttackVictim Model=SqueezeNet, Scenario=Query w/o surrogate2024.06 | 90 | 5,644 | 5,202 | |
| Dif++openVictim Model=EfficientNet-B3, Scenario=Query w/o surrogate2024.06 | 87.5 | 4,833 | 4,276 | |
| SimBAVictim Model=Swin-V2-T, Scenario=Query w/o surrogate2024.06 | 84 | 5,822 | 4,064 | |
| SimBAVictim Model=GoogleNet, Scenario=Query w/o surrogate2024.06 | 77.5 | 5,874 | 5,489 | |
| SubspaceVictim Model=ConvNeXtBase, Scenario=Query w/ surrogate2024.06 | 76.9 | 5,206 | 4,297 | |
| N-AttackVictim Model=GoogleNet, Scenario=Query w/o surrogate2024.06 | 76.9 | 6,883 | 7,323 | |
| MCGSquareVictim Model=ResNet101, Scenario=Query w/ surrogate2024.06 | 75.5 | 6,079 | 6,104 | |
| GFCSVictim Model=SqueezeNet, Scenario=Query w/ surrogate2024.06 | 72.5 | 6,127 | 3,161 | |
| GFCSVictim Model=ConvNeXtBase, Scenario=Query w/ surrogate2024.06 | 71 | 4,270 | 2,690 | |
| DifAttackVictim Model=EfficientNet-B3, Scenario=Query w/o surrogate2024.06 | 69 | 6,080 | 5,709 | |
| Dif++openVictim Model=ResNet101, Scenario=Query w/o surrogate2024.06 | 69 | 6,419 | 4,674 | |
| SubspaceVictim Model=VGG16, Scenario=Query w/ surrogate2024.06 | 68.3 | 4,964 | 3,984 | |
| N AttackVictim Model=Swin-V2-T, Scenario=Query w/o surrogate2024.06 | 66.8 | 7,473 | 7,979 | |
| SubspaceVictim Model=ResNet18, Scenario=Query w/ surrogate2024.06 | 66.3 | 4,750 | 3,034 | |
| P-RGFVictim Model=SqueezeNet, Scenario=Query w/ surrogate2024.06 | 65.3 | 5,433 | 4,995 | |
| SimBAVictim Model=EfficientNet-B3, Scenario=Query w/o surrogate2024.06 | 65 | 7,585 | 6,242 | |
| DifAttackVictim Model=ResNet101, Scenario=Query w/o surrogate2024.06 | 62.5 | 6,680 | 6,954 | |
| P-RGFVictim Model=Swin-V2-T, Scenario=Query w/ surrogate2024.06 | 62.3 | 4,610 | 2,264 | |
| GFCSVictim Model=Swin-V2-T, Scenario=Query w/ surrogate2024.06 | 61.5 | 5,683 | 5,479 | |
| SubspaceVictim Model=Swin-V2-T, Scenario=Query w/ surrogate2024.06 | 61.3 | 6,597 | 7,252 | |
| SignHVictim Model=VGG16, Scenario=Query w/o surrogate2024.06 | 60.8 | 7,606 | 8,401 | |
| P-RGFVictim Model=GoogleNet, Scenario=Query w/ surrogate2024.06 | 60.2 | 5,222 | 4,588 | |
| GFCSVictim Model=GoogleNet, Scenario=Query w/ surrogate2024.06 | 60 | 6,359 | 7,101 | |
| P-RGFVictim Model=VGG16, Scenario=Query w/ surrogate2024.06 | 58.3 | 6,093 | 7,043 | |
| P-RGFVictim Model=ConvNeXtBase, Scenario=Query w/ surrogate2024.06 | 57.3 | 5,720 | 7,090 | |
| GFCSVictim Model=EfficientNet-B3, Scenario=Query w/ surrogate2024.06 | 57 | 5,897 | 5,233 | |
| SubspaceVictim Model=EfficientNet-B3, Scenario=Query w/ surrogate2024.06 | 55.3 | 6,834 | 8,757 | |
| NESVictim Model=ResNet18, Scenario=Query w/o surrogate2024.06 | 54.3 | 7,988 | 9,242 | |
| P-RGFVictim Model=ResNet18, Scenario=Query w/ surrogate2024.06 | 51.3 | 6,393 | 9,601 | |
| SubspaceVictim Model=GoogleNet, Scenario=Query w/ surrogate2024.06 | 50.3 | 6,642 | 9,874 | |
| SignHVictim Model=ResNet18, Scenario=Query w/o surrogate2024.06 | 49.8 | 7,935 | 9,950 | |
| P-RGFVictim Model=EfficientNet-B3, Scenario=Query w/ surrogate2024.06 | 49.3 | 6,244 | 10,000 | |
| NESVictim Model=VGG16, Scenario=Query w/o surrogate2024.06 | 47.7 | 8,328 | 10,000 | |
| SignHVictim Model=SqueezeNet, Scenario=Query w/o surrogate2024.06 | 45.7 | 8,315 | 10,000 | |
| NESVictim Model=SqueezeNet, Scenario=Query w/o surrogate2024.06 | 45.7 | 8,235 | 10,000 | |
| SignHVictim Model=Swin-V2-T, Scenario=Query w/o surrogate2024.06 | 44.2 | 8,212 | 10,000 | |
| N AttackVictim Model=ConvNeXtBase, Scenario=Query w/o surrogate2024.06 | 40.7 | 8,609 | 10,000 | |
| NESVictim Model=GoogleNet, Scenario=Query w/o surrogate2024.06 | 37.7 | 8,748 | 10,000 | |
| GFCSVictim Model=ResNet101, Scenario=Query w/ surrogate2024.06 | 36 | 7,577 | 10,000 | |
| SubspaceVictim Model=ResNet101, Scenario=Query w/ surrogate2024.06 | 35.7 | 7,978 | 10,000 | |
| BASESVictim Model=SqueezeNet, Scenario=Query w/ surrogate2024.06 | 35.3 | 7,179 | 10,000 | |
| P-RGFVictim Model=ResNet101, Scenario=Query w/ surrogate2024.06 | 34.7 | 7,256 | 10,000 | |
| SubspaceVictim Model=SqueezeNet, Scenario=Query w/ surrogate2024.06 | 33.2 | 8,063 | 10,000 | |
| N AttackVictim Model=EfficientNet-B3, Scenario=Query w/o surrogate2024.06 | 32.2 | 8,825 | 10,000 | |
| SignHVictim Model=EfficientNet-B3, Scenario=Query w/o surrogate2024.06 | 31.7 | 8,847 | 10,000 | |
| NESVictim Model=Swin-V2-T, Scenario=Query w/o surrogate2024.06 | 30.7 | 8,722 | 10,000 | |
| SimBAVictim Model=ResNet101, Scenario=Query w/o surrogate2024.06 | 30.5 | 8,618 | 10,000 | |
| SignHVictim Model=GoogleNet, Scenario=Query w/o surrogate2024.06 | 28.1 | 9,021 | 10,000 | |
| BASESVictim Model=VGG16, Scenario=Query w/ surrogate2024.06 | 26.7 | 8,229 | 10,000 | |
| N AttackVictim Model=ResNet101, Scenario=Query w/o surrogate2024.06 | 20.6 | 9,128 | 10,000 | |
| SignHVictim Model=ConvNeXtBase, Scenario=Query w/o surrogate2024.06 | 20.6 | 9,216 | 10,000 | |
| NESVictim Model=EfficientNet-B3, Scenario=Query w/o surrogate2024.06 | 15.6 | 9,382 | 10,000 | |
| BASESVictim Model=ResNet18, Scenario=Query w/ surrogate2024.06 | 15.4 | 9,228 | 10,000 | |
| BASESVictim Model=GoogleNet, Scenario=Query w/ surrogate2024.06 | 12.5 | 8,901 | 10,000 | |
| NESVictim Model=ConvNeXtBase, Scenario=Query w/o surrogate2024.06 | 11.1 | 9,471 | 10,000 | |
| NESVictim Model=ResNet101, Scenario=Query w/o surrogate2024.06 | 10.6 | 9,606 | 10,000 | |
| SignHVictim Model=ResNet101, Scenario=Query w/o surrogate2024.06 | 6.5 | 9,744 | 10,000 |