# Attacking Robot Vision Models Efficiently Based on Improved Fast Gradient Sign Method
## 3 Our Technique
### Adversarial Attack Based on CIFAR-100  
In experiment 2, we also perform a white-box attack with the methods in experiment 1, but we use the CIFAR-100 dataset on Alexnet and Resnet-101, respectively. Tables 2 and 3 show the results of experiment 2 on the CIFAR-100 dataset and two different models. From the experimental results in Table 2, when the EPS is 0.05, the \(l_{2}\) of the FGSM is 1319.89, which is smaller than those of other methods. However, the \(l_{2}\) of the FGSM far exceeds those of other methods as the EPS changes, resulting in a large perturbation on the adversarial example images. The \(l_{2}\) in the BIM, MI-FGSM, and NI-FGSM methods slightly changes as EPS increases but stably remains around 2400 in the RMS-FGSM. In Table 2, we also observe that the RMS-FGSM has the highest average attack success rate of 94.6% on Alexnet, while the FGSM, BIM, MI-FGSM, and NI-FGSM methods obtain an average attack success rate of 72.4%, 83.5%, 90.2%, and 92.8%, respectively. The average perturbation value of the RMS-FGSM is 2140.7 on Alexnet, which has a smaller perturbation on adversarial images. Then, Table 3 shows the results of experiment 2 on Resnet-101. It can be seen that the \(l_{2}\) of the FGSM increases rapidly as the EPS changes; there is also a slight increase for the BIM, MI-FGSM, and NI-FGSM methods, while the \(l_{2}\) of the RMS-FGSM is always maintained at a small value. In addition, the RMS-FGSM reaches a slightly higher average attack success rate of 99.9% on Resnet-101 compared with 99.1% and 99.6% in the MI-FGSM and NI-FGSM. However, our attack method obtains a significantly lower average perturbation value of 2148.39 compared with other methods. Figure 2: The prediction accuracy in the FGSM (**a**) and RMS-FGSM (**b**) methods when attacking the LeNet model. Accuracy represents the proportion of test samples that predicted correctly over all test samples; the lower prediction accuracy of the model indicates the higher attack success rate of the adversarial method. As EPS increases, the accuracy in RMS-FGSM decreases faster than that in FGSM and tends to converge. \begin{table}
\begin{tabular}{l c c c c c c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**EPS**} & \multirow{2}{*}{**Input**} & \multirow{2}{*}{**La**} & \multicolumn{2}{c}{**FGSM**} & \multicolumn{2}{c}{**BIM**} & \multicolumn{3}{c}{**MI-FGSM**} & \multicolumn{3}{c}{**NI-FGSM**} & \multicolumn{3}{c}{**RMS-FGSM**} \\ \cline{3-14}  & & **Adv** & **Ar** & \(I_{2}\) & **Adv** & **Ar** & \(I_{2}\) & **Adv** & **Ar** & \(I_{2}\) & **Adv** & **Ar** & \(I_{2}\) & **Adv** & **Ar** & \(I_{2}\) \\ \hline
0 & 11 & 11 & 0 & 11 & 0 & 11 & 0 & 11 & 0 & 11 & 0 & 11 & 0 & 11 & 0 & 11 & 0 \\ \hline
0.05 & 23 & 83 & 1319.89 & 52 & 2168.72 & 43 & 2749.18 & 71 & 2883.94 & 7 & 2331.99 & 7 & 2331.99 \\ \hline
0.1 & 38 & 88 & 2631.59 & 57 & 2373.98 & 55 & 2950.84 & 66 & 3004.96 & 36 & 2422.59 \\ \hline
0.15 & 42 & 28 & 3959.67 & 94 & 2584.86 & 67 & 2989.19 & 4 & 3041.01 & 46 & 2425.45 \\ \hline
0.2 & 51 & 39 & 5278.10 & 47 & 2832.27 & 13 & 3055.10 & 48 & 3076.21 & 39 & 2422.92 \\ \hline
0.25 & 65 & 48 & 6439.86 & 55 & 3084.59 & 73 & 3024.25 & 52 & 3103.83 & 60 & 2392.04 \\ \hline
0.3 & 74 & 29 & 7917.18 & 74 & 3113.83 & 85 & 3078.15 & 22 & 3064.81 & 65 & 2413.65 \\ \hline
0.35 & 88 & 41 & 9239.20 & 54 & 3152.67 & 93 & 3126.84 & 32 & 3105.91 & 83 & 2433.23 \\ \hline
0.4 & 96 & 3 & 10,304.54 & 79 & 3088.63 & 66 & 3093.78 & 52 & 3093.25 & 45 & 2242.46 \\ \hline Avg asr & & 72.4\% & & 83.5\% & & 90.2\% & & 92.8\% & & 94.6\% & & \\ \hline Avg per & & 5232.22 & & 2488.83 & & 2674.14 & & 2708.21 & & 2140.7 & & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The experimental results of experiment 2 based on CIFAR-100 and Alexnet. Such experimental results suggest that the RMS-FGSM finds the global optimum point in the process of generating adversarial examples and produces an imperceptible perturbation so that there is only an extremely small difference between the adversarial example and the original example.