Table 3: Targeted transfer success rates. "Src" indicates the source model. For TTP and ESMA, the numbers in parentheses indicate training duration in seconds.
Src	Attack	→VGG19bn	→Dense121	→Res152	→Inc-v3	→Inc-v4	→IncRes-v2	→ViT	AVG
Res50	MIM	1.33%	3.44%	3.67%	0.51%	0.31%	0.22%	0.16%	1.38%
TIM	13.07%	26.16%	23.82%	5.51%	3.84%	2.96%	0.60%	10.85%
DIM	13.36%	24.96%	23.44%	5.11%	3.80%	2.29%	0.47%	10.49%
SI-NIM	1.07%	1.91%	2.00%	0.40%	0.44%	0.29%	0.07%	0.88%
Po-Ti-Trip	17.93%	33.62%	32.20%	7.73%	5.69%	3.38%	1.07%	14.52%
SI-FGS2M	20.75%	32.68%	30.55%	6.30%	4.42%	2.92%	0.91%	14.08%
S2I-SI-TI-DIM	26.49%	36.36%	36.49%	14.87%	12.67%	10.02%	1.18%	19.72%
Logit	51.60%	77.22%	76.98%	17.62%	12.67%	8.40%	3.09%	35.37%
DTMI-Logit-SU	53.36%	78.91%	79.00%	18.56%	13.36%	8.71%	3.32%	36.46%
RAP-ES	60.04%	83.40%	80.38%	22.16%	17.24%	10.82%	3.80%	39.69%
HGN	63.92%	70.64%	68.43%	22.41%	13.76%	7.31%	12.12%	36.94%
TTP(95339.7)	67.11%	73.67%	72.64%	33.49%	25.27%	11.27%	18.07%	43.07%
ESMA(82060.1)	81.29%	83.89%	81.78%	37.53%	39.29%	17.29%	21.25%	51.76%
Src	Attack	→VGG19bn	→Res50	→Res152	→Inc-v3	→Inc-v4	→IncRes-v2	→ViT	AVG
Dense121	MIM	1.98%	2.33%	1.51%	0.56%	0.40%	0.27%	0.27%	1.05%
TIM	8.98%	12.82%	8.87%	3.44%	3.31%	1.91%	0.71%	5.72%
DIM	10.20%	13.80%	9.18%	3.98%	3.27%	2.29%	0.60%	6.19%
SI-NIM	8.29%	11.42%	6.96%	1.78%	1.71%	1.13%	0.29%	4.51%
Po-Ti-Trip	11.29%	16.80%	11.78%	5.49%	4.84%	2.96%	0.96%	7.73%
SI-FGS2M	12.55%	16.67%	11.70%	5.16%	4.89%	3.58%	0.85%	7.91%
S2I-SI-TI-DIM	25.60%	30.33%	23.98%	13.11%	12.04%	7.93%	1.38%	16.33%
Logit	31.98%	43.49%	31.71%	12.91%	11.51%	7.16%	3.27%	20.29%
DTMI-Logit-SU	33.38%	44.93%	34.16%	13.44%	12.36%	7.75%	3.62%	21.38%
RAP-ES	38.56%	50.67%	38.24%	15.78%	13.96%	9.64%	3.82%	24.38%
HGN	47.81%	56.96%	44.21%	22.75%	19.56%	9.42%	10.62%	30.19%
TTP(109644.6)	52.00%	58.02%	49.24%	29.69%	23.00%	13.24%	17.71%	34.70%
ESMA(96335.6)	56.83%	63.71%	54.70%	33.23%	29.28%	15.97%	18.50%	38.89%
Src	Attack	→Res50	→Dense121	→Res152	→Inc-v3	→Inc-v4	→IncRes-v2	→ViT	AVG
VGG19bn	MIM	0.56%	0.58%	0.29%	0.27%	0.20%	0.04%	0.07%	0.29%
TIM	3.80%	4.58%	1.84%	1.47%	1.09%	0.56%	0.16%	1.93%
DIM	2.98%	4.33%	1.76%	1.09%	1.16%	0.47%	0.16%	1.71%
SI-NIM	0.42%	0.42%	0.29%	0.11%	0.20%	0.18%	0.07%	0.24%
Po-Ti-Trip	4.56%	6.27%	2.42%	1.69%	1.47%	0.87%	0.27%	2.51%
SI-FGS2M	4.12%	5.71%	1.97%	1.56%	1.25%	0.68%	0.25%	2.22%
S2I-SI-TI-DIM	12.09%	14.84%	6.49%	4.87%	5.80%	2.93%	0.31%	6.76%
Logit	22.16%	30.47%	11.51%	5.51%	6.71%	1.91%	0.98%	11.32%
DTMI-Logit-SU	23.47%	31.47%	12.60%	6.13%	7.31%	2.07%	1.11%	12.02%
RAP-ES	24.31%	33.33%	13.56%	6.58%	8.51%	2.78%	1.11%	12.88%
HGN	34.18%	31.00%	19.36%	11.16%	8.87%	1.71%	2.26%	15.51%
TTP(131519.2)	36.76%	34.44%	22.11%	11.82%	10.40%	2.20%	2.58%	17.19%
ESMA(110769.2)	39.61%	47.25%	22.85%	12.98%	11.73%	4.09%	3.35%	20.27%
Src	Attack	→VGG19bn	→Res50	→Dense121	→Inc-v3	→Inc-v4	→IncRes-v2	→ViT	AVG
Res152	MIM	1.11%	5.69%	3.29%	0.69%	0.31%	0.18%	0.18%	1.64%
TIM	9.76%	26.64%	21.56%	5.69%	4.22%	3.04%	1.07%	10.28%
DIM	9.89%	26.27%	20.98%	5.69%	4.11%	2.44%	0.71%	10.01%
SI-NIM	0.82%	1.76%	1.16%	0.36%	0.20%	0.24%	0.11%	0.66%
Po-Ti-Trip	14.53%	35.36%	29.87%	8.93%	6.29%	4.71%	1.36%	14.44%
SI-FGS2M	13.98%	39.22%	24.80%	7.98%	6.11%	4.31%	0.95%	13.91%
S2I-SI-TI-DIM	19.29%	36.64%	30.78%	14.36%	11.42%	10.84%	1.29%	17.80%
Logit	35.44%	75.22%	61.31%	15.33%	10.69%	8.11%	2.76%	29.84%
DTMI-Logit-SU	37.76%	77.47%	62.91%	16.02%	11.51%	8.58%	3.02%	31.04%
RAP-ES	42.36%	83.20%	69.67%	18.82%	14.33%	10.36%	3.20%	34.56%
HGN	61.40%	73.31%	67.89%	33.47%	26.87%	11.31%	13.96%	41.17%
TTP(132223.9)	65.31%	79.73%	74.93%	36.73%	30.11%	13.44%	15.62%	45.12%
ESMA(93977.6)	78.67%	88.18%	79.93%	41.68%	34.38%	14.58%	18.72%	50.88%