## 5 Experiments and Results
### Attacking Defenses
#### 5.1.2 Attacking Robust Models  
A model is considered to be robust when some of the input variables are largely perturbed, but the model still makes correct predictions. Recently, several techniques have been proposed to render the models more robust to adversarial attacks. One commonly used technique to improve model robustness is adversarial training. Adversarial training integrates adversarial inputs--generated with other trained models--into the models' training data. Adversarial training has been proved to be one of the most successful defense mechanisms for adversarial attacks [47; 48; 49; 50].  
We conducted an experiment to see how well QuEry Attack performs on robust models. For CIFAR10 we used the robust model, WideResNet-70-16 [51], wherein they used generative models trained only on the original training set in order to enhance adversarial robustness to \(l_{p}\) norm-bounded perturbations. For ImageNet we used WideResNet-50-2 [52], which is a variant of ResNet wherein the depth of the network is decreased and the width of the network is increased. This is achieved through the use of wide residual blocks. Both of these top models were taken from the RobustBench repository [53]. We used the same 200 randomly selected images from our previous experiments, a budget of 84K queries (\(N=70\), \(G=1200\)) for CIFAR10, and a budget of 126K queries (\(N=70\), \(G=1800\)) for ImageNet. As seen in Table 4, QuEry Attack succeeds at breaking those strongly defended models.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multirow{2}{*}{\(\mathbf{\mathcal{E}}\)} & \multicolumn{2}{c}{**ImageNet**} \\ \cline{3-4}  & & **ASR** & **Queries** \\ \hline \multirow{2}{*}{Wide ResNet-50-2} & 12 & 98.0\% & 98 \\  & 6 & 93.5\% & 1187 \\ \hline \multirow{3}{*}{Wide ResNet-70-16} & \multirow{3}{*}{\
\begin{tabular}{c} CIFAR10 \\ 12 \\ \end{tabular} } & \multirow{3}{*}{
\begin{tabular}{c} CIFAR10 \\ 94.5\% \\ 85.0\% \\ \end{tabular} } \\ \cline{1-1}  & & & \\ \hline \hline \end{tabular}
\end{table}
Table 4: QuEry Attack’s performance on robust models over CIFAR10 and ImageNet.  
Figure 4: Examples of spatial-smoothing compression, sorted from left to right by window-size values, ranging from 10 to 1 (original image). (**Top**) images: from ImageNet, (**middle**): CIFAR10, and (**bottom**): MNIST.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Defense**} & \multirow{2}{*}{\(\mathbf{\mathcal{E}}\)} & \multicolumn{2}{c}{**CIFAR10**} & \multicolumn{2}{c}{**ImageNet**} \\ \cline{3-5}  & & **ASR** & **Queries** & **ASR** & **Queries** \\ \hline \multirow{3}{*}{JPEG Compression (\(q=70\))} & 18 & 100\% & 2 & 100\% & 2 \\  & 12 & 98.0\% & 13 & 97.5\% & 14 \\  & 6 & 93.5\% & 287 & 99.5\% & 311 \\ \hline \multirow{3}{*}{Bit-Depth Reduction (\(d=3\))} & 18 & 100\% & 2 & 100\% & 2 \\  & 12 & 99.5\% & 5 & 100\% & 27 \\  & 6 & 96.0\% & 72 & 99.5\% & 145 \\ \hline \multirow{3}{*}{Spatial Smoothing (\(w=5\))} & 18 & 100\% & 1 & 100\% & 1 \\  & 12 & 100\% & 1 & 100\% & 2 \\ \cline{1-1}  & 6 & 99.0\% & 6 & 99.5\% & 144 \\ \hline \hline \end{tabular}
\end{table}
Table 3: QuEry Attack’s resistance to non-differentiable transformation defenses. JPEG compression, bit-depth reduction, and spatial smoothing were tested on CIFAR10 and ImageNet.