Boosting Adversarial Attacks on Neural Networks with Better Optimizer

Table 1

Attack success rates (%) for all seven networks included in the study.

	Attack	Inc-v3	Inc-v4	Incres-v2	Res-101	Inc-v3ens3	Inc-v3ens4	Incres-v2ens
Inc-v3	FGSM	72.2	32.1	31.7	32.3	10.3	10.6	4.2
	I-FGSM	100.0	27.5	23.0	20.9	6.2	4.7	1.8
	PGD	99.8	18.9	14.7	14.4	6.1	6.2	3.2
	MI-FGSM	100.0	54.3	50.6	44.0	13.9	13.3	6.5
	AI-FGM	100.0	60.7	55.8	50.2	17.0	16.8	8.5
Inc-v4	FGSM	39.4	64.9	29.5	33.0	12.2	11.1	5.0
	I-FGSM	43.8	100.0	27.4	23.4	6.1	6.3	2.4
	PGD	32.0	99.8	17.7	16.6	6.4	5.8	3.1
	MI-FGSM	69.9	100.0	57.9	54.1	19.6	17.7	8.7
	AI-FGM	72.9	100.0	60.1	57.1	21.7	19.5	10.3
Incres-v2	FGSM	37.6	31.8	57.9	31.4	13.7	12.0	6.8
	I-FGSM	46.1	35.0	99.4	30.4	7.3	6.7	4.4
	PGD	30.1	23.0	97.3	18.3	6.1	5.7	2.7
	MI-FGSM	73.5	69.3	99.5	60.0	27.0	23.0	16.7
	AI-FGM	74.6	71.1	99.5	61.8	31.3	25.7	20.5
Res-101	FGSM	38.3	33.0	30.2	79.3	14.6	13.3	6.4
	I-FGSM	35.1	28.3	25.1	99.5	8.4	6.7	3.7
	PGD	30.9	22.4	20.9	99.6	7.3	7.2	3.4
	MI-FGSM	60.0	55.3	50.6	99.5	22.9	19.8	11.3
	AI-FGM	64.0	57.7	54.0	99.5	27.2	24.1	15.4

The diagonal blocks indicate white-box attacks, while the off-diagonal blocks indicate black-box attacks.