Table 2 Attack performance comparison of different target models trained on the celeba Dataset. ↑and ↓ respectively symbolize that higher and lower scores give better attack performance.

0.67 ± 0.0025

0.89 ± 0.0016

36.29

1394.55

0.77 ± 0.0464

0.95 ± 0.0216

43.21

1296.26

0.90 ± 0.0136

0.98 ± 0.0610

33.91

1147.41

0.97 ± 0.0001

1. ± 0.0000

18.00

1119.35

0.93 ± 0.0004

0.99 ± 0.0002

23.82

1081.98

0.99 ± 0.0021

1 ± 0.0000

17.00

998.55

1 ± 0.0001

1 ± 0.0000

17.15

983.83

0.73 ± 0.0025

0.93 ± 0.0008

26.24

1320.22

0.82 ± 0.0437

0.97 ± 0.0241

45.02

1254.32

0.92 ± 0.0115

0.98 ± 0.0370

36.78

1138.62

1 ± 0.0000

1 ± 0.0000

22.35

1028.72

0.97 ± 0.0004

0.99 ± 0.0002

25.77

1010.70

1 ± 0.0001

1 ± 0.0000

18.72

1007.35

1 ± 0.0001

1 ± 0.0000

17.69

1005.07

0.74 ± 0.0012

0.94 ± 0.0010

27.92

1310.10

0.82 ± 0.0351

0.93 ± 0.0242

44.07

1257.50

0.93 ± 0.0850

0.99 ± 0.0330

38.69

1154.32

0.99 ± 0.0002

1. ± 0.0000

24.29

1112.76

0.94 ± 0.0003

1 ± 0.0001

28.16

1025.36

1 ± 0.0000

1 ± 0.0000

18.39

1094.78

1 ± 0.0000

1 ± 0.0000

18.40

1083.36