SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Figure 4: Comparing IR, VT, and TAIG with their corresponding baselines. The dotted lines indicate AAA (lower indicates more powerful attack). The perturbations are constrained under  $\ell_{2}$  norm with  $\epsilon = 5$ .
Figure 4 compares TAIG, VT, and IR with their corresponding baselines under the  $\ell_{2}$  constraint. It can be seen that the they exhibit higher AAA and worse attack performance compared with their baselines, as in the  $\ell_{\infty}$  setting.
B Results of Attacking Other Victim Models
Table 5: Comparing the obtained AA and AAA of some "gradient computation" and "substitute model training" methods on 15 victim models that are distinct from those used to tune the hyper-parameters. Smaller values indicate more powerful attacks. The adversarial examples were generated under an  $\ell_{\infty}$  constraint with  $\epsilon = 8 / 255$
ResNet-50	VGG-19	Inception v3	EffNetV2 -M	ConvNeXt -B	ViT -B	DeiT-B	BEiT-B	Swin-B	Mixer-B	AAA
I-FGSM Back-end
- Baseline
I-FGSM	89.95%	91.13%	95.21%	96.37%	89.53%	93.20%	93.73%	92.68%	95.88%	95.88%	93.36%
- Gradient Computation
TAP (2018) [77]	84.03%	89.09%	93.36%	95.72%	92.93%	94.66%	95.38%	94.66%	96.54%	95.73%	93.21%
NRDM (2018) [37]	83.39%	85.61%	88.15%	97.59%	96.35%	96.55%	96.86%	96.77%	96.77%	93.63%	93.17%
FDA (2019) [11]	86.43%	93.09%	92.23%	98.69%	97.36%	97.51%	96.94%	97.69%	98.09%	97.93%	95.60%
ILA (2019) [20]	77.71%	76.04%	86.88%	91.58%	87.87%	83.89%	87.14%	83.68%	91.37%	90.37%	85.65%
SGM (2020) [65]	76.87%	-	-	85.64%	80.16%	90.84%	92.02%	89.59%	93.42%	93.90%	-
ILA++ (2020) [26]	75.47%	73.55%	91.85%	89.83%	86.53%	81.79%	86.69%	82.42%	90.04%	88.98%	84.71%
LinBP (2020) [14]	78.77%	85.98%	94.84%	98.02%	91.95%	94.27%	94.39%	94.99%	96.69%	97.14%	92.70%
ConBP (2021) [72]	76.61%	84.77%	93.30%	-	-	-	-	-	-	-	-
SE (2021) [38]	-	-	-	-	-	93.74%	93.35%	93.24%	-	94.96%	-
FIA (2021) [61]	74.01%	72.69%	87.48%	90.45%	83.36%	81.52%	84.98%	85.15%	89.70%	86.07%	83.54%
PNA (2022) [62]	-	-	-	-	-	92.25%	92.03%	91.94%	95.27%	-	-
NAA (2022) [74]	74.50%	77.62%	81.59%	86.86%	73.31%	76.57%	78.87%	74.60%	84.58%	84.21%	79.27%
- Substitute Model Training
RFA (2021) [47]	63.93%	-	-	-	-	-	-	-	-	-	-
LGV (2022) [13]	78.37%	-	-	-	-	-	-	-	-	-	-
DRA (2022) [78]	65.76%	-	-	-	-	-	-	-	-	-	-
MoreBayesian (2023) [27]	68.18%	-	-	-	-	-	-	-	-	-	-
New Optimization Back-end
- Baseline
\( UN-DP-DI^2-TI-PI-FGSM \)	52.38%	57.09%	69.70%	55.51%	42.48%	42.13%	48.85%	42.27%	48.68%	67.43%	52.65%
- Gradient Computation
TAP (2018) [77]	71.84%	59.21%	75.30%	71.15%	38.75%	56.97%	63.83%	47.73%	62.06%	74.42%	62.13%
NRDM (2018) [37]	60.78%	63.85%	77.14%	63.83%	51.53%	64.71%	74.27%	61.71%	82.46%	76.11%	67.64%
FDA (2019) [11]	54.96%	55.67%	69.87%	92.98%	77.22%	96.78%	90.49%	86.03%	88.45%	96.69%	80.91%
ILA (2019) [20]	53.28%	51.67%	66.62%	49.89%	41.39%	41.04%	50.83%	40.47%	63.99%	67.31%	52.65%
SGM (2020) [65]	49.87%	-	-	39.61%	33.54%	39.80%	40.91%	37.29%	31.88%	61.79%	-
ILA++ (2020) [26]	53.00%	51.24%	66.27%	50.34%	41.70%	41.19%	51.55%	40.41%	66.93%	66.97%	52.96%
LinBP (2020) [14]	52.97%	56.00%	85.62%	93.87%	30.81%	53.00%	49.74%	54.79%	74.03%	89.76%	64.06%
ConBP (2021) [72]	51.69%	56.04%	77.79%	-	-	-	-	-	-	-	-
SE (2021) [38]	-	-	-	-	-	49.70%	36.42%	38.79%	-	61.26%	-
FIA (2021) [61]	53.63%	59.96%	69.64%	79.53%	57.92%	51.26%	53.32%	64.99%	64.75%	74.17%	62.92%
PNA (2022) [62]	-	-	-	-	-	44.36%	37.73%	41.19%	36.01%	-	-
NAA (2022) [74]	53.93%	57.44%	67.18%	57.69%	41.89%	43.77%	46.53%	49.65%	53.72%	63.04%	53.48%
- Substitute Model Training
RFA (2021) [47]	62.08%	-	-	-	-	-	-	-	-	-	-
LGV (2022) [13]	50.79%	-	-	-	-	-	-	-	-	-	-
DRA (2022) [78]	68.80%	-	-	-	-	-	-	-	-	-	-
MoreBayesian (2023) [27]	47.13%	-	-	-	-	-	-	-	-	-	-
We collected 15 additional victim models, including 7 CNNs (EfficientNet-L2 [50], ConvNeXt V2-L [64], MobileNet V2 [45], DenseNet-161 [18], ResNeXt-101 [68], SENet-154 [17], and RepVGG3 [5]) and 8 vision transformers (ViT-L [8], DeiT-L [54], Swin V2-L [30], BEiT-L [1], CAFormer-B36 [70], MaxViT-L [56], EVA-L [10], EVA02-L [9]), and conducted an experiment on attacking these victim models. For the "substitute model training" methods, the conclusion remains consistent with the observations from Table 1. Specifically, when employing I-FGSM as the back-end, RFA achieves the best AA (i.e.,  $63.93\%$ ), and when applying UN-DP-DI²-TI-PI-FGSM as the back-end, MoreBayesian attains the best AA (i.e.,  $47.13\%$ ). For the "gradient computation" methods, when I-FGSM is applied as the optimization back-end, the conclusion aligns with the findings in Table 1 of the paper. NAA consistently outperforms other methods on most choices of the substitute model, achieving the lowest AAA (i.e.,  $79.27\%$ ). When introducing UN-DP-DI²-TI-PI-FGSM as the optimization back-end, the top four lowest AAs are achieved using ConvNeXt-B, DeiT-B, BEiT-B, and Swin-B as the substitute models, as in Table 1. The best AA is obtained by performing LinBP on the ConvNeXt-B substitute model (i.e.,  $30.81\%$ , which stands as the second-best in Table 1 and is only  $0.20\%$  higher than the best AA), due to slight distribution shift of the tested victim models.
C Results of Attacking Robust Models
Table 6: Comparing the obtained AA and AAA of some "gradient computation" and "substitute model training" methods for attacking robust models. The robust victim models include a robust ConvNeXt-B, a robust Swin-B, and a robust ViT-B-CvSt. Smaller values indicate more powerful attacks. The adversarial examples were generated under an  $\ell_{\infty}$  constraint with  $\epsilon = 8 / 255$
ResNet-50	VGG-19	Inception v3	EffNetV2	ConvNeXt-B	ViT-B	DeiT-B	BEiT-B	Swin-B	Mixer-B	AAA
I-FGSM Back-end
- Baseline
I-FGSM	95.57%	95.68%	96.94%	97.13%	96.24%	96.09%	96.18%	96.21%	96.33%	96.16%	96.25%
- Gradient Computation
TAP (2018) [77]	95.18%	95.48%	96.87%	97.03%	96.17%	96.09%	96.14%	96.19%	96.28%	96.13%	96.16%
NRDM (2018) [37]	95.39%	95.55%	96.79%	97.09%	96.29%	96.15%	96.19%	96.25%	96.05%	95.83%	96.16%
FDA (2019) [11]	94.97%	95.51%	96.64%	97.17%	96.40%	96.34%	96.31%	96.49%	96.50%	96.45%	96.28%
ILA (2019) [20]	95.39%	95.55%	96.68%	97.04%	96.08%	95.75%	95.87%	95.91%	96.00%	95.79%	96.01%
SGM (2020) [65]	95.35%	-	-	96.51%	95.27%	95.66%	95.67%	95.55%	95.90%	95.95%	-
ILA++ (2020) [26]	95.36%	95.51%	96.60%	97.03%	95.97%	95.77%	95.86%	95.89%	96.01%	95.70%	95.97%
LinBP (2020) [14]	95.33%	95.56%	97.00%	97.10%	96.21%	96.10%	96.15%	96.17%	96.33%	95.99%	96.19%
ConBP (2021) [72]	95.41%	95.50%	97.06%	-	-	-	-	-	-	-	-
SE (2021) [38]	-	-	-	-	-	95.96%	96.07%	96.02%	-	95.97%	-
FIA (2021) [61]	94.81%	95.21%	96.47%	96.96%	95.89%	95.49%	95.51%	95.83%	96.07%	95.34%	95.76%
PNA (2022) [62]	-	-	-	-	-	95.86%	95.94%	96.05%	96.27%	-	-
NAA (2022) [74]	94.78%	95.31%	96.01%	96.18%	93.83%	94.05%	93.78%	94.44%	95.01%	94.65%	94.80%
- Substitute Model Training
RFA (2021) [47]	91.83%	-	-	-	-	-	-	-	-	-	-
LGV (2022) [13]	95.31%	-	-	-	-	-	-	-	-	-	-
DRA (2022) [78]	91.35%	-	-	-	-	-	-	-	-	-	-
MoreBayesian (2023) [27]	95.21%	-	-	-	-	-	-	-	-	-	-
New Optimization Back-end
- Baseline
UN-DP-DI2-TI-PI-FGSM	94.17%	95.01%	96.16%	96.24%	94.79%	93.97%	93.55%	93.94%	94.80%	94.61%	94.72%
- Gradient Computation
TAP (2018) [77]	94.77%	95.34%	96.52%	96.57%	95.22%	94.95%	94.73%	94.79%	95.43%	95.31%	95.36%
NRDM (2018) [37]	95.07%	95.44%	96.47%	96.49%	95.24%	95.18%	95.28%	95.31%	95.99%	95.49%	95.60%
FDA (2019) [11]	94.70%	95.07%	96.21%	96.96%	96.19%	96.62%	96.16%	96.05%	96.02%	96.79%	96.08%
ILA (2019) [20]	94.33%	95.11%	96.05%	96.27%	95.17%	94.31%	94.11%	94.13%	95.31%	94.81%	94.96%
SGM (2020) [65]	93.81%	-	-	95.13%	93.33%	93.31%	92.05%	92.70%	93.17%	93.93%	-
ILA++ (2020) [26]	94.37%	95.01%	96.01%	96.22%	94.97%	94.19%	93.79%	94.07%	95.60%	94.63%	94.89%
LinBP (2020) [14]	94.21%	95.00%	96.57%	96.99%	94.74%	94.49%	93.53%	94.38%	95.51%	95.95%	95.14%
ConBP (2021) [72]	94.14%	95.10%	96.29%	-	-	-	-	-	-	-	-
SE (2021) [38]	-	-	-	-	-	94.04%	92.94%	93.81%	-	94.19%	-
FIA (2021) [61]	94.09%	94.99%	95.94%	96.65%	95.18%	94.43%	93.76%	94.94%	95.33%	94.87%	95.02%
PNA (2022) [62]	-	-	-	-	-	93.70%	93.25%	93.63%	94.39%	-	-
NAA (2022) [74]	94.15%	94.97%	95.71%	95.92%	94.17%	93.38%	92.98%	93.25%	94.63%	93.53%	94.27%
- Substitute Model Training
RFA (2021) [47]	86.37%	-	-	-	-	-	-	-	-	-	-
LGV (2022) [13]	93.25%	-	-	-	-	-	-	-	-	-	-
DRA (2022) [78]	88.32%	-	-	-	-	-	-	-	-	-	-
MoreBayesian (2023) [27]	92.97%	-	-	-	-	-	-	-	-	-	-
We also evaluated the performance of different methods in attacking 3 defensive models obtained via adversarial training, i.e., a robust ConvNext-B [29], a robust Swin-B [29], and a robust ViT-B-CvSt [46]. They are all collected from RobustBench [3] and exhibit high robust accuracy against AutoAttack [4]. The results are given in Table 6. It can be seen that when I-FGSM is used as the optimization back-end, NAA and DRA achieve the best AAs among the methods of "gradient computation" and "substitute model training" categories, respectively. When UN-DP-  $\mathrm{DI}^2$  -TI-PIFGSM is employed as the optimization back-end, SGM achieves the best AAs among the "gradient computation" methods for the most of substitute models, and the best AA is achieved by using DeiT-B as the substitute model, i.e.,  $92.05\%$  . For the "substitute model training" methods, RFA instead of MoreBayesian achieves the best AA, i.e.,  $86.37\%$  , since it shares the same training scheme (i.e., adversarial training) with the victim models.
D Results of different  $\epsilon$
Table 7: Comparing the obtained AA and AAA of some "gradient computation" and "substitute model training". Smaller values indicate more powerful attacks. The adversarial examples were generated under an  $\ell_{\infty}$  constraint with  $\epsilon = 16 / 255$ .
ResNet-50	VGG-19	Inception v3	EffNetV2	ConvNeXt -B	ViT-B	DeiT-B	BEiT-B	Swin-B	Mixer-B	AAA
I-FGSM Back-end
- Baseline
I-FGSM	76.99%	80.93%	88.83%	90.96%	77.34%	82.21%	80.46%	80.56%	89.18%	89.61%	83.71%
- Gradient Computation
TAP (2018) [77]	63.83%	74.26%	81.18%	86.52%	75.34%	82.68%	84.08%	84.21%	87.35%	85.15%	80.46%
NRDM (2018) [37]	61.20%	71.48%	66.88%	91.78%	88.04%	88.84%	88.28%	87.02%	84.87%	81.27%	80.97%
FDA (2019) [11]	66.97%	82.68%	77.02%	96.05%	93.12%	93.89%	90.82%	94.39%	95.25%	94.40%	88.46%
ILA (2019) [20]	53.52%	54.72%	66.48%	81.59%	71.90%	56.23%	62.19%	58.08%	75.39%	63.02%	64.31%
SGM (2020) [65]	49.48%	-	-	62.81%	49.83%	72.50%	74.74%	67.57%	78.23%	81.32%	-
ILA++ (2020) [26]	50.58%	51.66%	64.83%	80.31%	72.25%	55.19%	64.59%	58.46%	75.25%	60.12%	63.32%
LinBP (2020) [14]	51.00%	69.69%	81.37%	93.56%	77.26%	84.32%	82.03%	84.74%	90.36%	89.58%	80.39%
ConBP (2021) [72]	46.70%	66.86%	74.49%	-	-	-	-	-	-	-	-
SE (2021) [38]	-	-	-	-	-	80.80%	77.58%	78.43%	-	83.42%	-
FIA (2021) [61]	44.43%	48.30%	68.02%	81.63%	66.31%	58.58%	65.40%	69.84%	79.10%	59.90%	64.15%
PNA (2022) [62]	-	-	-	-	-	76.29%	71.66%	76.48%	85.67%	-	-
NAA (2022) [74]	30.41%	44.44%	47.31%	65.88%	40.72%	34.70%	48.45%	42.29%	57.48%	35.02%	44.67%
- Substitute Model Training
RFA (2021) [47]	15.18%	-	-	-	-	-	-	-	-	-	-
LGV (2022) [13]	52.81%	-	-	-	-	-	-	-	-	-	-
DRA (2022) [78]	13.43%	-	-	-	-	-	-	-	-	-	-
MoreBayesian (2023) [27]	30.89%	-	-	-	-	-	-	-	-	-	-
New Optimization Back-end
- Baseline
UN-DP-DI²-TI-PI-FGSM	15.30%	25.90%	34.86%	34.78%	18.87%	13.16%	20.68%	14.12%	27.66%	21.99%	22.73%
- Gradient Computation
TAP (2018) [77]	40.72%	31.08%	44.02%	45.43%	8.07%	12.47%	17.29%	9.02%	28.59%	21.79%	25.85%
NRDM (2018) [37]	22.14%	32.81%	43.20%	41.30%	20.88%	24.20%	33.59%	16.74%	61.80%	18.81%	31.55%
FDA (2019) [11]	14.84%	23.93%	31.10%	79.50%	49.80%	90.39%	64.71%	60.18%	66.88%	90.22%	57.16%
ILA (2019) [20]	15.40%	19.33%	26.76%	25.69%	13.09%	8.49%	11.18%	9.19%	33.32%	14.46%	17.69%
SGM (2020) [65]	12.57%	-	-	9.36%	6.88%	10.14%	8.79%	7.50%	7.91%	13.67%	-
ILA++ (2020) [26]	14.82%	18.68%	26.84%	26.64%	13.81%	9.11%	12.27%	9.53%	38.84%	14.91%	18.54%
LinBP (2020) [14]	15.39%	24.86%	61.13%	76.05%	5.35%	17.55%	20.55%	23.06%	50.74%	64.17%	35.89%
ConBP (2021) [72]	14.14%	25.15%	46.43%	-	-	-	-	-	-	-	-
SE (2021) [38]	-	-	-	-	-	11.38%	4.36%	5.38%	-	9.24%	-
FIA (2021) [61]	18.08%	31.66%	35.25%	61.36%	36.29%	22.55%	28.36%	43.29%	48.02%	40.62%	36.55%
PNA (2022) [62]	-	-	-	-	-	10.34%	4.60%	9.26%	10.30%	-	-
NAA (2022) [74]	15.24%	23.81%	27.85%	35.26%	16.54%	12.92%	18.99%	25.70%	34.62%	18.35%	22.93%
- Substitute Model Training
RFA (2021) [47]	9.67%	-	-	-	-	-	-	-	-	-	-
LGV (2022) [13]	10.93%	-	-	-	-	-	-	-	-	-	-
DRA (2022) [78]	14.66%	-	-	-	-	-	-	-	-	-	-
MoreBayesian (2023) [27]	6.59%	-	-	-	-	-	-	-	-	-	-
We conducted the evaluation of "gradient computation" methods and "substitute model training" methods under an  $\ell_{\infty}$  constraint with  $\epsilon = 16 / 255$  since it is a common setting that many previous work [6, 28, 58, 74] adopted. The results are shown in Table 7. The conclusion is consistent with
observations from Table 1, except when I-FGSM is applied as the optimization back-end, DRA instead of RFA achieves the lowest AA, i.e.,  $13.43\%$ .
E Detailed Results of Input Augmentations and Optimizers
We show the detailed results of different combinations of input augmentations and optimizers in Table 8. It can be seen that UN-DP-  $\mathrm{DI}^2$  -TI-PI-FGSM achieves the best performance on average, despite the optimal solution on different substitute models are different.  $\ell_2$  results are given in Table 9.
Table 8: Comparing the obtained AA and AAA of some "gradient computation" and "substitute model training" methods for attacking robust models. The robust victim models include a robust ConvNeXt-B, a robust Swin-B, and a robust ViT-B-CvSt. Smaller values indicate more powerful attacks. The adversarial examples were generated under an  $\ell_{\infty}$  constraint with  $\epsilon = 8 / 255$
ResNet-50	VGG-19	Inception v3	EffNetV2 -M	ConvNeXt-B	ViT-B	DeiT-B	BEiT-B	Swin-B	Mixer-B	AAA
PGD	88.36%	91.63%	93.72%	95.74%	88.50%	90.83%	90.71%	89.89%	94.57%	94.46%	91.84%
I-FGSM	87.79%	91.21%	93.71%	95.46%	88.32%	90.28%	90.28%	89.56%	94.81%	94.37%	91.58%
UN-PGD	86.07%	88.03%	93.02%	94.12%	83.11%	89.74%	89.19%	88.56%	92.37%	94.12%	89.83%
UN-I-FGSM	85.01%	86.88%	93.03%	94.04%	82.78%	89.12%	89.20%	87.76%	91.78%	93.62%	89.32%
SI-PGD	86.51%	86.22%	91.97%	89.31%	83.90%	88.96%	85.54%	87.67%	92.52%	92.96%	88.56%
SI-FGSM	86.21%	85.79%	91.74%	89.63%	83.87%	88.79%	84.78%	87.18%	91.87%	92.79%	88.26%
NI-FGSM	82.91%	87.23%	90.63%	92.09%	82.99%	87.14%	85.22%	86.10%	91.66%	91.97%	87.79%
PI-FGSM	82.46%	87.04%	90.24%	91.97%	82.79%	87.06%	85.36%	85.98%	91.32%	92.16%	87.64%
MI-FGSM	82.42%	86.94%	90.44%	91.91%	82.99%	87.14%	85.27%	85.86%	91.36%	92.04%	87.64%
MI-PGD	83.20%	87.59%	90.97%	91.47%	80.93%	87.07%	84.40%	85.62%	90.87%	91.71%	87.38%
......
UN-DP-SI-DI2-TI-PI-PGD	42.88%	50.34%	60.68%	44.19%	32.34%	37.28%	39.33%	35.56%	46.66%	44.47%	43.37%
UN-DP-SI-DI2-TI-NI-FGSM	42.78%	50.40%	60.59%	44.10%	32.33%	36.93%	39.42%	35.83%	46.37%	44.22%	43.30%
UN-DP-SI-DI2-TI-MI-FGSM	42.85%	50.34%	60.42%	44.03%	32.49%	36.73%	39.30%	35.91%	46.52%	44.31%	43.29%
UN-DP-SI-DI2-TI-PI-FGSM	42.92%	50.12%	60.55%	44.00%	32.47%	36.74%	39.57%	35.94%	46.16%	44.30%	43.28%
UN-DP-DI2-TI-PI-PGD	35.68%	49.07%	59.48%	52.40%	33.56%	33.53%	35.58%	34.85%	45.92%	46.30%	42.64%
UN-DP-DI2-TI-MI-PGD	35.57%	48.70%	59.34%	52.34%	33.66%	33.69%	35.75%	34.84%	45.78%	46.45%	42.61%
UN-DP-DI2-TI-NI-PGD	35.34%	48.55%	59.19%	52.20%	33.39%	33.39%	35.72%	34.83%	45.71%	46.42%	42.47%
UN-DP-DI2-TI-MI-FGSM	35.80%	48.86%	59.15%	52.67%	33.22%	33.19%	35.90%	34.14%	45.28%	46.34%	42.46%
UN-DP-DI2-TI-NI-FGSM	35.74%	48.77%	59.06%	52.70%	33.16%	33.26%	35.68%	34.24%	45.46%	46.40%	42.45%
UN-DP-DI2-TI-PI-FGSM	35.70%	48.33%	58.62%	52.98%	33.64%	32.74%	36.58%	33.72%	45.24%	46.60%	42.42%
Table 9: Detailed results of different combinations of input augmentations and optimizers. Smaller values indicate more powerful attacks. The adversarial examples were generated under an  $\ell_2$  constraint with  $\epsilon = 5$ .
ResNet-50	VGG-19	Inception v3	EffNetV2 -M	ConvNeXt-B	ViT-B	DeiT-B	BEiT-B	Swin-B	Mixer-B	AAA
PGD	88.24%	92.73%	94.87%	97.34%	89.59%	90.66%	91.39%	90.26%	95.74%	95.16%	92.60%
NI-FGSM	87.44%	91.47%	94.51%	96.70%	90.03%	91.34%	90.56%	91.02%	95.40%	95.26%	92.37%
NI-PGD	87.37%	91.80%	94.84%	96.74%	89.22%	91.27%	90.74%	91.06%	95.29%	95.38%	92.37%
MI-PGD	87.64%	91.64%	94.60%	96.59%	89.27%	91.31%	90.86%	91.02%	95.07%	95.48%	92.35%
MI-FGSM	87.18%	91.39%	94.49%	96.63%	89.89%	91.53%	90.60%	91.10%	95.21%	95.33%	92.34%
I-FGSM	87.93%	91.82%	94.76%	97.24%	88.96%	91.01%	90.64%	90.18%	95.46%	95.10%	92.31%
PI-PGD	87.52%	91.63%	94.67%	96.69%	89.03%	91.04%	90.73%	91.08%	95.14%	95.36%	92.29%
PI-FGSM	87.20%	91.14%	94.37%	96.69%	89.92%	91.36%	90.50%	90.79%	95.34%	95.27%	92.26%
UN-PGD	86.56%	89.87%	94.66%	96.82%	86.18%	90.82%	90.68%	89.94%	94.42%	95.18%	91.51%
UN-I-FGSM	86.56%	89.64%	94.38%	96.73%	85.83%	90.39%	90.19%	89.26%	94.01%	94.86%	91.18%
......
UN-DP-SI-DI2-TI-NI-PGD	52.20%	59.40%	74.95%	70.55%	42.80%	50.19%	52.94%	44.73%	63.32%	55.88%	56.70%
UN-DP-SI-DI2-TI-NI-FGSM	52.17%	59.24%	75.14%	70.60%	42.63%	50.24%	52.55%	44.73%	63.63%	55.68%	56.66%
UN-DP-DI2-TI-PGD	46.81%	58.84%	74.67%	74.50%	43.99%	46.13%	50.09%	43.75%	61.23%	63.36%	56.34%
UN-DP-DI2-TI-FGSM	46.50%	59.08%	74.34%	74.19%	43.64%	45.81%	49.83%	43.80%	60.22%	63.54%	56.09%
UN-DP-DI2-TI-MI-PGD	42.93%	55.49%	72.58%	74.89%	45.58%	45.01%	51.43%	44.97%	64.73%	61.06%	55.87%
UN-DP-DI2-TI-MI-FGSM	42.72%	55.89%	72.71%	74.67%	45.28%	44.77%	51.01%	44.84%	64.49%	61.20%	55.76%
UN-DP-DI2-TI-NI-PGD	42.70%	55.82%	72.46%	74.84%	45.23%	44.81%	51.10%	44.43%	64.53%	61.08%	55.70%
UN-DP-DI2-TI-PI-PGD	42.91%	55.32%	72.65%	74.76%	45.38%	44.90%	51.43%	44.64%	64.45%	60.58%	55.70%
UN-DP-DI2-TI-NI-FGSM	42.44%	56.09%	72.53%	74.70%	45.14%	44.22%	50.63%	44.59%	64.46%	61.36%	55.62%
UN-DP-DI2-TI-PI-FGSM	43.01%	55.46%	72.46%	74.63%	45.17%	44.74%	51.34%	44.53%	64.21%	60.51%	55.61%
Augmentations and Optimizer. For PGD,  $\mathrm{DI}^2$ -FGSM, MI-FGSM, NI-FGSM, and PI-FGSM, we use the default hyper-parameters. For TI-FGSM, we randomly translate the input with a range of  $[-3, +3]$  since its performance is better than the approximation using a  $7 \times 7$  Gaussian kernel in many implementations [28, 58, 59, 27]. For SI-FGSM and Admix, both of them average the gradients obtained by feeding different augmented inputs into the substitute model, which may lead to unfair comparisons. Therefore, we randomly select one input from the augmented copies, and the hyper-parameters remain the same as in their original papers. For UN, the noise added to the input follows  $\mathcal{U}(-\epsilon, \epsilon)$  and  $\mathcal{U}\left(-\frac{\epsilon}{\sqrt{HW}}, \frac{\epsilon}{\sqrt{HW}}\right)$  (the dimension of inputs is  $3 \times H \times W$ ) for attacks under  $\ell_{\infty}$  and  $\ell_2$  constraints, respectively. For DP, we divide the perturbation into  $16 \times 16$  patches and randomly drop  $50\%$  of the patches at each iteration.
Gradient Computation. For TAIG, VT, IR, TAP, FDA, SE, and PNA, we set the same hyperparameters as in their original papers. For NRDM, ILA, ILA++, LinBP, ConBP, FIA, and NAA, the main hyper-parameter which significantly impacts the performance is the choice of the middle layer. The scaling factor of SGM is also related to the selection of the substitute model. We tune these hyper-parameters by evaluating on a validation set consisting of 500 samples that do not overlap with the samples in the test set, and the best choices are shown in Table 10.
Table 10: The index of the middle layer we chose for each substitute model for each method. For VGG-19, max-pooling layers were considered as the end of blocks.
ResNet-50	VGG-19	Inception v3	EffNetV2-M	ConvNeXt-B	ViT-B	DeiT-B	BEiT-B	Swin-B	Mixer-B
I-FGSM Back-end
NRDM	2	5	5	3	4	8	6	2	2	4
ILA	2	5	5	3	1	4	6	4	2	2
ILA++	2	5	5	3	1	4	6	4	2	2
LinBP	3	8	3	6	4	11	11	11	4	4
ConBP	3	8	3	-	-	-	-	-	-	-
FIA	2	5	5	3	1	2	4	4	2	2
NAA	2	5	5	3	1	4	4	4	2	2
New Optimization Back-end
NRDM	3	6	6	7	4	12	12	10	4	10
ILA	4	7	6	7	4	12	10	12	2	10
ILA++	4	7	6	7	4	12	10	12	4	10
LinBP	4	9	7	6	4	11	11	11	4	11
ConBP	4	9	7	-	-	-	-	-	-	-
FIA	4	8	7	6	4	12	12	12	4	12
NAA	4	8	6	6	3	10	12	10	4	8
Substitute Model Training. In this category of methods, ResNet-50 is commonly chosen as the substitute model, and we collect the models from the GitHub repositories of these methods. For LGV and the MoreBayesian method, we only sample once at each iteration.
Generative Modeling. In this category of methods, all the generators are collected from the GitHub repositories of these methods.