Untargeted Adversarial Attack on CIFAR-10 (test)
100ASRBIM
Evaluation results
| Method | Links | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| BIMIteration=10, RunTime (s)=352022.03 | 100 | 0.85 | 0.03 | 14.85 | 0.23 | — | — | — | — | — | — | — | — | — | |
| PGDIteration=10, RunTime (s)=372022.03 | 100 | 1.28 | 0.03 | 27.86 | 0.34 | — | — | — | — | — | — | — | — | — | |
| MIMIteration=10, RunTime (s)=462022.03 | 100 | 1.9 | 0.03 | 26 | 0.48 | — | — | — | — | — | — | — | — | — | |
| AA linfIteration=100, RunTime (s)=1842022.03 | 100 | 1.91 | 0.03 | 34.93 | 0.61 | — | — | — | — | — | — | — | — | — | |
| C&W l2Iteration=1000, RunTime (s)=9912022.03 | 100 | 0.39 | 0.06 | 8.23 | 0.11 | — | — | — | — | — | — | — | — | — | |
| SSAIteration=150, RunTime (s)=1922022.03 | 99.96 | 0.29 | 0.02 | 5.73 | 0.07 | — | — | — | — | — | — | — | — | — | |
| SSAHIteration=150, RunTime (s)=1982022.03 | 99.94 | 0.26 | 0.02 | 5.03 | 0.03 | — | — | — | — | — | — | — | — | — | |
| AdvDropIteration=150, RunTime (s)=3922022.03 | 99.92 | 0.9 | 0.07 | 16.34 | 0.34 | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=PreResNet [85], Target Model Set=ConvNet Set2025.04 | 99.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PerC-ALIteration=1000, RunTime (s)=12212022.03 | 98.29 | 0.86 | 0.18 | 9.58 | 0.15 | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=ResNeXt [83], Target Model Set=ConvNet Set2025.04 | 97.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=MobileNetv2 [61], Target Model Set=ConvNet Set2025.04 | 97.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=WRN-28-10-drop [84], Target Model Set=ConvNet Set2025.04 | 96.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=GoogleNet [59], Target Model Set=ConvNet Set2025.04 | 96.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=DenseNet [58], Target Model Set=ConvNet Set2025.04 | 96.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPSurrogate Models=ResNet-50, ViT, WRN-70-16(AT), Target Model Set=ConvNet Set, Target Model=Average2025.04 | 89.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGNSource Model=VGG-16, Target Model=VGG-192023.06 | 86.73 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGNSource Model=VGG-16, Target Model=MobileNet2023.06 | 85.97 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGNSource Model=VGG-16, Target Model=Inc-v32023.06 | 85.59 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=Swin-S [69], Target Model Set=Metaformer Set2025.04 | 83.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGNSource Model=VGG-16, Target Model=GoogLeNet2023.06 | 82.82 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=DeiT-T [67], Target Model Set=Metaformer Set2025.04 | 81 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPSurrogate Models=ResNet-50, ViT, WRN-70-16(AT), Target Model Set=Metaformer Set, Target Model=Average2025.04 | 80.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=ViT-T [66], Target Model Set=Metaformer Set2025.04 | 80.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=Swin-B [69], Target Model Set=Metaformer Set2025.04 | 79.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RAPSource Model=VGG-16, Target Model=VGG-192023.06 | 78.43 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=DeiT-B [67], Target Model Set=Metaformer Set2025.04 | 78 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RAPSource Model=VGG-16, Target Model=MobileNet2023.06 | 77.98 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RAPSource Model=VGG-16, Target Model=Inc-v32023.06 | 77.86 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGNSource Model=VGG-16, Target Model=DenseNet-1692023.06 | 74.66 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| EMI-FGSMSource Model=VGG-16, Target Model=VGG-192023.06 | 74.36 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RAPSource Model=VGG-16, Target Model=GoogLeNet2023.06 | 73.41 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGNSource Model=VGG-16, Target Model=Res-502023.06 | 72.95 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGNSource Model=VGG-16, Target Model=DenseNet-1212023.06 | 72.48 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGNSource Model=VGG-16, Target Model=Res-342023.06 | 71.62 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| EMI-FGSMSource Model=VGG-16, Target Model=MobileNet2023.06 | 70.69 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| EMI-FGSMSource Model=VGG-16, Target Model=Inc-v32023.06 | 70.56 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RAPSource Model=VGG-16, Target Model=DenseNet-1692023.06 | 69.74 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RAPSource Model=VGG-16, Target Model=DenseNet-1212023.06 | 68.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VMI-FGSMSource Model=VGG-16, Target Model=VGG-192023.06 | 68.05 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| EMI-FGSMSource Model=VGG-16, Target Model=GoogLeNet2023.06 | 66.78 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RAPSource Model=VGG-16, Target Model=Res-502023.06 | 66.27 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VMI-FGSMSource Model=VGG-16, Target Model=MobileNet2023.06 | 66.14 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VMI-FGSMSource Model=VGG-16, Target Model=Inc-v32023.06 | 65.63 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RAPSource Model=VGG-16, Target Model=Res-342023.06 | 65.48 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPSurrogate Models=ResNet-50, ViT, WRN-70-16(AT), Target Model=Overall Average2025.04 | 63.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| EMI-FGSMSource Model=VGG-16, Target Model=DenseNet-1692023.06 | 63.04 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SIASurrogate Models=ResNet-50, ViT, WRN-70-16(AT), Target Model=Overall Average2025.04 | 62 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| EMI-FGSMSource Model=VGG-16, Target Model=Res-502023.06 | 61.83 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGNSurrogate Models=ResNet-50, ViT, WRN-70-16(AT), Target Model=Overall Average2025.04 | 61.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NI-FGSMSource Model=VGG-16, Target Model=VGG-192023.06 | 61.36 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VMI-FGSMSource Model=VGG-16, Target Model=GoogLeNet2023.06 | 60.89 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| EMI-FGSMSource Model=VGG-16, Target Model=Res-342023.06 | 60.47 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SSASurrogate Models=ResNet-50, ViT, WRN-70-16(AT), Target Model=Overall Average2025.04 | 60.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VT-FGSMSurrogate Models=ResNet-50, ViT, WRN-70-16(AT), Target Model=Overall Average2025.04 | 60.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DI2-FGSMSurrogate Models=ResNet-50, ViT, WRN-70-16(AT), Target Model=Overall Average2025.04 | 60 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| EMI-FGSMSource Model=VGG-16, Target Model=DenseNet-1212023.06 | 59.98 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RAPSurrogate Models=ResNet-50, ViT, WRN-70-16(AT), Target Model=Overall Average2025.04 | 59.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AdmixSurrogate Models=ResNet-50, ViT, WRN-70-16(AT), Target Model=Overall Average2025.04 | 59.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MI-FGSMSource Model=VGG-16, Target Model=VGG-192023.06 | 57.56 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SI-FGSMSurrogate Models=ResNet-50, ViT, WRN-70-16(AT), Target Model=Overall Average2025.04 | 57.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VMI-FGSMSource Model=VGG-16, Target Model=DenseNet-1692023.06 | 57.21 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MI-FGSMSurrogate Models=ResNet-50, ViT, WRN-70-16(AT), Target Model=Overall Average2025.04 | 57.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PI-FGSMSurrogate Models=ResNet-50, ViT, WRN-70-16(AT), Target Model=Overall Average2025.04 | 56.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| CWASurrogate Models=ResNet-50, ViT, WRN-70-16(AT), Target Model=Overall Average2025.04 | 56.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VMI-FGSMSource Model=VGG-16, Target Model=Res-502023.06 | 56.46 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NI-FGSMSource Model=VGG-16, Target Model=MobileNet2023.06 | 56.13 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TI-FGSMSurrogate Models=ResNet-50, ViT, WRN-70-16(AT), Target Model=Overall Average2025.04 | 55.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VMI-FGSMSource Model=VGG-16, Target Model=DenseNet-1212023.06 | 55.62 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VMI-FGSMSource Model=VGG-16, Target Model=Res-342023.06 | 55.35 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NI-FGSMSource Model=VGG-16, Target Model=Inc-v32023.06 | 54.87 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| I-FGSMSurrogate Models=ResNet-50, ViT, WRN-70-16(AT), Target Model=Overall Average2025.04 | 54.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SVRESurrogate Models=ResNet-50, ViT, WRN-70-16(AT), Target Model=Overall Average2025.04 | 54 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MI-FGSMSource Model=VGG-16, Target Model=Inc-v32023.06 | 52.74 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MI-FGSMSource Model=VGG-16, Target Model=MobileNet2023.06 | 52.18 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NI-FGSMSource Model=VGG-16, Target Model=GoogLeNet2023.06 | 49.19 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MI-FGSMSource Model=VGG-16, Target Model=GoogLeNet2023.06 | 47.29 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MI-FGSMSource Model=VGG-16, Target Model=DenseNet-1692023.06 | 42.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MI-FGSMSource Model=VGG-16, Target Model=Res-502023.06 | 41.93 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MI-FGSMSource Model=VGG-16, Target Model=Res-342023.06 | 41.72 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=AlexNet [56], Target Model Set=ConvNet Set2025.04 | 41.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MI-FGSMSource Model=VGG-16, Target Model=DenseNet-1212023.06 | 40.96 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NI-FGSMSource Model=VGG-16, Target Model=DenseNet-1692023.06 | 39.74 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NI-FGSMSource Model=VGG-16, Target Model=Res-502023.06 | 38.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NI-FGSMSource Model=VGG-16, Target Model=Res-342023.06 | 38.74 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NI-FGSMSource Model=VGG-16, Target Model=DenseNet-1212023.06 | 37.61 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=PreActResNet-18 [86], Target Model Set=ConvNet(AT) Set2025.04 | 34 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=WideResNet-34-10 [93], Target Model Set=ConvNet(AT) Set2025.04 | 30.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=WideResNet-34-10 [91], Target Model Set=ConvNet(AT) Set2025.04 | 30.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=WideResNet-34-20 [90], Target Model Set=ConvNet(AT) Set2025.04 | 29.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPSurrogate Models=ResNet-50, ViT, WRN-70-16(AT), Target Model Set=ConvNet(AT) Set, Target Model=Average2025.04 | 29.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=ResNet-50 [92], Target Model Set=ConvNet(AT) Set2025.04 | 29.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=WideResNet-28-10 [89], Target Model Set=ConvNet(AT) Set2025.04 | 27.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=WideResNet-28-10 [88], Target Model Set=ConvNet(AT) Set2025.04 | 27 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DRAPTarget Model=WideResNet-28-10 [87], Target Model Set=ConvNet(AT) Set2025.04 | 26.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| EMI-FGSMSource Model=Res-50, Attack Setting=Single model2023.06 | — | — | — | — | — | 80.11 | 78.66 | 77.43 | 76.34 | 78.12 | 79.68 | 80.12 | 77.24 | — | |
| EMI-FGSMSource Model=DenseNet-121, Attack Type=Untargeted, Protocol=Single model setting2023.06 | — | — | — | — | — | 74.36 | 75.66 | 73.54 | 70.41 | 75.23 | — | 78.94 | 73.64 | 77.45 | |
| MI-FGSMSource Model=Res-50, Attack Setting=Single model2023.06 | — | — | — | — | — | 70.42 | 67.37 | 65.8 | 63.06 | 69.02 | 72.39 | 73.34 | 67.78 | — | |
| MI-FGSMSource Model=DenseNet-121, Attack Type=Untargeted, Protocol=Single model setting2023.06 | — | — | — | — | — | 63.47 | 60.64 | 60.08 | 57.39 | 63.35 | — | 71.09 | 61.99 | 67.37 | |
| NI-FGSMSource Model=Res-50, Attack Setting=Single model2023.06 | — | — | — | — | — | 71.97 | 65.57 | 63.76 | 63.28 | 69.13 | 71.03 | 72.78 | 65.02 | — |