Table 13 Comparison of multiple defense methods on CIFAR-10.
From: Universal attention guided adversarial defense using feature pyramid and non-local mechanisms
Attack algorithm | GridMask | ALP | TRADES | AAD | Boosting (GridMask,ALP) | Boosting (GridMask,AAD) | Boosting (ALP,AAD) | Boosting (FPAS,ANL) |
|---|---|---|---|---|---|---|---|---|
Clean | 84.6% | 86.5% | 81.0% | 85.5% | 86.6% | 86.6% | 85.5% | 86.8% |
FGSM | 20.1% | 52.6% | 14.9% | 48.3% | 50.8% | 46.4% | 48.3% | 53.3% |
I-FGSM | 11.0% | 58.1% | 14.4% | 54.7% | 56.3% | 51.2% | 54.7% | 61.8% |
PGD | 5.8% | 63.7% | 11.7% | 60.3% | 61.7% | 57.7% | 60.3% | 66.7% |
MI-FGSM | 16.1% | 55.0% | 20.5% | 52.1% | 53.7% | 48.1% | 52.1% | 58.9% |
\(\hbox {DI}^2\)-FGSM | 11.0% | 57.2% | 14.8% | 53.5% | 56.6% | 50.3% | 53.5% | 62.1% |
TI-FGSM | 34.6% | 50.8% | 38.3% | 49.6% | 50.8% | 51.4% | 49.6% | 54.6% |
Deepfool | 64.8% | 85.6% | 67.2% | 84.2% | 85.5% | 85.3% | 84.2% | 85.9% |
C&W | 75.2% | 85.8% | 74.5% | 84.6% | 85.8% | 85.8% | 84.6% | 86.7% |
Square | 40.4% | 68.1% | 41.0% | 67.1% | 66.2% | 67.5% | 67.1% | 70.5% |
