Boosting Adversarial Attacks on Neural Networks with Better Optimizer

Table 2

Attack success rates (%) on adversarially trained networks under the ensemble-model setting.

Attack	Inc-v3ens3	Inc-v3ens4	Incres-v2ens	Average
FGSM	18.6	17.3	9.5	15.1
I-FGSM	20.1	16.9	11.4	16.1
MI-FGSM	49.4	43.2	25.9	39.5
NI-FGSM	46.7	41.6	23.0	37.1
AI-FGM (ours)	56.2	50.6	33.0	46.6

The adversarial examples are generated on the ensemble of Inc-v3, Inc-v4, IncRes-v2, and Res-101.