## 5 Experiments and Results
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline  & & \multicolumn{6}{c}{**ImageNet**} \\ \hline \multirow{3}{*}{Model} & \multirow{3}{*}{\(\mathcal{E}\)} & \multicolumn{2}{c}{QuEry Attack} & \multicolumn{2}{c}{Square} & \multicolumn{2}{c}{AdversarialPSO} \\ \cline{3-8}  & & ASR & Queries & ASR & Queries & ASR & Queries \\ \hline \multirow{3}{*}{Inception-v3} & 24 & **100\%** & **1** & **100\%** & 5 & 98.5\% & 51 \\  & 18 & **100\%** & **2** & **100\%** & 8 & 98.5\% & 69 \\  & 12 & **100\%** & **22** & 95.5\% & 32 & 97\% & 102 \\  & 6 & **99.5\%** & 276 & 99.0\% & **263** & 95\% & 285 \\ \hline \multirow{3}{*}{ResNet-50} & 24 & **100\%** & 1 & 99.5\% & 5 & 98.5\% & 51 \\  & 18 & **100\%** & **1** & **100\%** & 5 & 98.5\% & 69 \\  & 12 & **100\%** & **13** & **100\%** & 26 & 97\% & 102 \\  & 6 & **100\%** & **211** & 99.0\% & 248 & 95\% & 285 \\ \hline \multirow{3}{*}{VGG-16-BN} & 24 & **100\%** & **1** & **100\%** & 5 & 98.5\% & 51 \\  & 18 & **100\%** & **1** & **100\%** & 5 & 98.5\% & 69 \\  & 12 & **100\%** & **1** & **100\%** & 5 & 97\% & 102 \\  & 6 & **100\%** & **77** & **100\%** & 86 & 95\% & 285 \\ \hline \hline \multicolumn{8}{c}{**CIFAR10**} \\ \hline \multirow{3}{*}{Model} & \multirow{3}{*}{\(\mathcal{E}\)} & \multicolumn{2}{c}{QuEry Attack} & \multicolumn{2}{c}{Square} & \multicolumn{2}{c}{AdversarialPSO} \\ \cline{3-8}  & & ASR & Queries & ASR & Queries & ASR & Queries \\ \hline \multirow{3}{*}{Inception-v3} & 24 & **100\%** & **1** & 89.5\% & 5 & 97.5\% & 31 \\  & 18 & **100\%** & **2** & 92.5\% & 17 & 96.0\% & 41 \\  & 12 & **97.5\%** & **20** & 94.5\% & 77 & 95.0\% & 54 \\  & 6 & 91.0\% & 428 & **95.5\%** & 776 & 94.5\% & **223** \\ \hline \multirow{3}{*}{ResNet-50} & 24 & **100\%** & **2** & 92.0\% & 8 & 97.5\% & 31 \\  & 18 & **100\%** & **8** & 91.0\% & 23 & 96.0\% & 41 \\  & 12 & **100\%** & 96 & 87.0\% & 110 & 95.0\% & **54** \\  & 6 & **99.0\%** & 565 & 87.0\% & 449 & 94.5\% & **223** \\ \hline \multirow{3}{*}{VGG-16-BN} & 24 & **100\%** & **1** & 89.5\% & 5 & 97.5\% & 31 \\  & 18 & **99.0\%** & **2** & 87.0\% & 14 & 96.0\% & 41 \\ \cline{1-1}  & 12 & **98.0\%** & 60 & 87.0\% & 86 & 95.0\% & **54** \\ \cline{1-1}  & 6 & **95.5\%** & 741 & 88.5\% & 890 & 94.5\% & **223** \\ \hline \hline \multicolumn{8}{c}{**MNIST**} \\ \hline \multirow{3}{*}{Model} & \multirow{3}{*}{\(\mathcal{E}\)} & \multicolumn{2}{c}{QuEry Attack} & \multicolumn{2}{c}{Square} & \multicolumn{2}{c}{AdversarialPSO} \\ \cline{3-8}  & & ASR & Queries & ASR & Queries & ASR & Queries \\ \hline \multirow{3}{*}{Conv Net} & 80 & **100\%** & **5** & 86.0\% & 14 & 76\% & 2675 \\  & 60 & 93.5\% & **72** & 93.0\% & 77 & **99\%** & 292 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Experimental results. ASR: Attack Success Rate. Queries: Number of model queries. Each value represents the median of 200 runs (images). Epsilon: \(\mathcal{E}\in\{0\ldots 255\}\) (8-bits pixel values). Top results are marked in boldface. mutations and stripes initialisation, which were shown to be very effective [17]. Further, these architectures serve as a backbone for many other downstream tasks, such as object detection [35], semantic segmentation [36], and image captioning [37]. Recently, vision transformers have beaten CNNs in image classification tasks [38], but they require huge amounts of data and resources that are not available too many (including us). Future work will be dedicated to expand the attack to vision transformers. All accuracy values are over test images. We used the Adversarial Robustness Toolbox (ART) [39] to evaluate QuEry Attack against other attacks. We restricted all attacking algorithms to a maximum of 42K queries to the model (\(N=70\), \(G=600\)) for MNIST and CIFAR10, and 84K queries (\(N=70\), \(G=1200\)) for ImageNet. A query refers to a prediction supplied by the model for a given image. To make the most of the computational resources we had available we prioritized actual, experimental runs over hyperparameter runs, so hyperparameters were chosen through limited trial and error.