Boosting Adversarial Attacks on Neural Networks with Better Optimizer

Table 3

Comparison of combined methods and original methods on attack success rates (%) against adversarially trained networks under the single-model setting.

Attack	Inc-v3ens3	Inc-v3ens4	Incres-v2ens	Average
SI-NI-TI	54.7	52.3	34.4	47.1
SI-AI-TI (ours)	56.3	54.4	39.4	50.0
SI-NI-DI	39.5	37.2	19.3	32.0
SI-AI-DI (ours)	50.8	51.5	27.7	43.3
SI-NI-TI-DI	62.3	59.3	41.7	54.4
SI-AI-TI-DI (ours)	72.6	69.8	53.0	65.1

The adversarial examples are generated on the ensemble of Inc-v3, Inc-v4, Incres-v2, and Res-101.