Targeted Transfer Attack on ImageNet (val)
100Attack Success RatecAdv
Evaluation results
| Method | Links | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| cAdvSubstitute Model=ViT-S, Target Model=ViT-S, Attack Type=White-box2022.10 | 100 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| cAdvSubstitute Model=XCiT-N12, Target Model=XCiT-N12, Attack Type=White-box2022.10 | 100 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ACESubstitute Model=ViT-S, Target Model=ViT-S, Attack Type=White-box2022.10 | 99.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ColorFoolSubstitute Model=ViT-S, Target Model=ViT-S, Attack Type=White-box2022.10 | 99.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ACESubstitute Model=XCiT-N12, Target Model=XCiT-N12, Attack Type=White-box2022.10 | 98.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SAESubstitute Model=ViT-S, Target Model=ViT-S, Target Architecture=Transformers, Attack Type=White-box2022.10 | 98.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ReColorAdvSubstitute Model=ViT-S, Target Model=ViT-S, Attack Type=White-box2022.10 | 96.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ReColorAdvSubstitute Model=XCiT-N12, Target Model=XCiT-N12, Attack Type=White-box2022.10 | 95.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NCFSubstitute Model=ViT-S, Target Model=ViT-S, Target Architecture=Transformers, Attack Type=White-box2022.10 | 93.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NCFSubstitute Model=XCiT-N12, Target Model=XCiT-N12, Target Architecture=Transformers, Attack Type=White-box2022.10 | 89.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SAESubstitute Model=XCiT-N12, Target Model=XCiT-N12, Attack Type=White-box2022.10 | 86.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ColorFoolSubstitute Model=XCiT-N12, Target Model=XCiT-N12, Attack Type=White-box2022.10 | 85.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NCFSubstitute Model=XCiT-N12, Target Model=Res-18, Target Architecture=CNNs, Attack Type=Black-box2022.10 | 65.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NCFSubstitute Model=XCiT-N12, Target Model=VGG-19, Target Architecture=CNNs, Attack Type=Black-box2022.10 | 63.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NCFSubstitute Model=ViT-S, Target Model=ViT-B, Target Architecture=Transformers, Attack Type=Black-box2022.10 | 62.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NCFSubstitute Model=XCiT-N12, Target Model=Mobile-v2, Target Architecture=CNNs, Attack Type=Black-box2022.10 | 62.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NCFSubstitute Model=ViT-S, Target Model=Res-18, Target Architecture=CNNs, Attack Type=Black-box2022.10 | 57.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SAESubstitute Model=ViT-S, Target Model=Res-18, Target Architecture=CNNs, Attack Type=Black-box2022.10 | 49.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SAESubstitute Model=ViT-S, Target Model=VGG-19, Target Architecture=CNNs, Attack Type=Black-box2022.10 | 47.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SAESubstitute Model=ViT-S, Target Model=Mobile-v2, Target Architecture=CNNs, Attack Type=Black-box2022.10 | 46.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SAESubstitute Model=ViT-S, Target Model=XCiT-N12, Target Architecture=Transformers, Attack Type=Black-box2022.10 | 38.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SAESubstitute Model=ViT-S, Target Model=ViT-B, Target Architecture=Transformers, Attack Type=Black-box2022.10 | 37.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SAESubstitute Model=ViT-S, Target Model=PiT-Ti, Target Architecture=Transformers, Attack Type=Black-box2022.10 | 34 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SAESubstitute Model=ViT-S, Target Model=DeiT-S, Target Architecture=Transformers, Attack Type=Black-box2022.10 | 24.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SAESubstitute Model=ViT-S, Target Model=Swin-T, Target Architecture=Transformers, Attack Type=Black-box2022.10 | 19.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Admix-RDIsource_model=RN-50, MI-TI=applied2023.05 | — | 20.9 | 74.2 | — | 42.7 | 59.4 | 86.8 | — | — | — | — | 80.7 | 98.7 | 56.1 | 26.7 | 34.1 | 58 | |
| CFM-RDIsource_model=RN-50, MI-TI=applied2023.05 | — | 51.1 | 84.7 | — | 65.5 | 81.5 | 90.3 | — | — | — | — | 88.4 | 98.4 | 78.8 | 48 | 59.3 | 74.6 | |
| DIsource_model=RN-50, MI-TI=applied2023.05 | — | 5.7 | 62.5 | — | 9.2 | 28.2 | 72.3 | — | — | — | — | 56.6 | 98.9 | 29.3 | 4.5 | 9.9 | 37.7 | |
| FDA*Loss function=feature distribution attack, Source robustness (epsilon)=0, Source architecture=ResNet50, l_infinity norm constraint=16/2552021.06 | — | 43.5 | — | — | — | 22.9 | 57.9 | — | — | — | — | — | — | — | — | — | — | |
| LogitLoss function=logit loss, Source robustness (epsilon)=0, Source architecture=ResNet50, l_infinity norm constraint=16/2552021.06 | — | 45.9 | 40 | 15.3 | 43.6 | 22.9 | 77.9 | 60.3 | 39.6 | 3.9 | 0.4 | — | — | — | — | — | — | |
| LogitLoss function=logit loss, Source robustness (epsilon)=0.1, Source architecture=ResNet50, l_infinity norm constraint=16/2552021.06 | — | 77.2 | 78.8 | 64.5 | 73.1 | 52.5 | 84 | 81.6 | 68.9 | 33.4 | 11.2 | — | — | — | — | — | — | |
| LogitLoss function=logit loss, Source robustness (epsilon)=1, Source architecture=ResNet50, l_infinity norm constraint=16/2552021.06 | — | 56.1 | 62.4 | 59.5 | 55 | 47.2 | 67 | 58.3 | 53.6 | 36 | 26.7 | — | — | — | — | — | — | |
| ODIsource_model=RN-50, MI-TI=applied2023.05 | — | 43.8 | 78.3 | — | 65.9 | 67.3 | 87 | — | — | — | — | 77.1 | 97.6 | 70 | 49.5 | 55.4 | 69.2 | |
| Po+TripLoss function=Poincaré distance + triplet loss, Source robustness (epsilon)=0, Source architecture=ResNet50, l_infinity norm constraint=16/2552021.06 | — | 20.8 | 15.2 | 10 | 23 | 11.6 | 59.3 | 31.2 | 14.2 | 1.3 | 0.3 | — | — | — | — | — | — | |
| Po+TripLoss function=Poincaré distance + triplet loss, Source robustness (epsilon)=0.1, Source architecture=ResNet50, l_infinity norm constraint=16/2552021.06 | — | 59.1 | 57.9 | 53 | 56.5 | 39.2 | 78.4 | 72.6 | 45.1 | 11.4 | 3.3 | — | — | — | — | — | — | |
| Po+TripLoss function=Poincaré distance + triplet loss, Source robustness (epsilon)=1, Source architecture=ResNet50, l_infinity norm constraint=16/2552021.06 | — | 48.5 | 54.4 | 60.2 | 49.5 | 39.9 | 62.6 | 53.3 | 48 | 22 | 12.4 | — | — | — | — | — | — | |
| RDIsource_model=RN-50, MI-TI=applied2023.05 | — | 13.1 | 65.4 | — | 30.7 | 46.6 | 81.3 | — | — | — | — | 71.8 | 98 | 46.6 | 16.8 | 23.9 | 49.4 | |
| SI-RDIsource_model=RN-50, MI-TI=applied2023.05 | — | 29.5 | 70.5 | — | 56.4 | 56.2 | 88.9 | — | — | — | — | 79.8 | 98.8 | 66.2 | 37.9 | 43.6 | 62.8 | |
| VT-RDIsource_model=RN-50, MI-TI=applied2023.05 | — | 27.9 | 68.8 | — | 45.8 | 54.5 | 82.5 | — | — | — | — | 78.7 | 98.2 | 56.1 | 32.8 | 37.9 | 58.3 | |
| XentLoss function=cross-entropy, Source robustness (epsilon)=0, Source architecture=ResNet50, l_infinity norm constraint=16/2552021.06 | — | 10.4 | 9.6 | 4.6 | 10.6 | 6.4 | 40.5 | 13.1 | 6.8 | 0.8 | 0.1 | — | — | — | — | — | — | |
| XentLoss function=cross-entropy, Source robustness (epsilon)=0.1, Source architecture=ResNet50, l_infinity norm constraint=16/2552021.06 | — | 54 | 59.4 | 45.8 | 50.8 | 32.1 | 78.8 | 66 | 41.1 | 8.6 | 2.4 | — | — | — | — | — | — | |
| XentLoss function=cross-entropy, Source robustness (epsilon)=1, Source architecture=ResNet50, l_infinity norm constraint=16/2552021.06 | — | 60.4 | 69.3 | 66.6 | 58.2 | 46.7 | 69.9 | 61.3 | 56.9 | 29.9 | 19.9 | — | — | — | — | — | — |