# Exploiting Frequency Characteristics for Boosting the Invisibility of Adversarial Attacks
## 4 Experimental Results and Analysis
### Evaluation of Image Quality
#### 4.2.1 Tiny-ImageNet
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Settings** & **Methods** & **L2(\(\downarrow\))** & **PSNR(\(\uparrow\))** & **SSIM(\(\uparrow\))** & **VIF(\(\uparrow\))** & **LPIPS (\(\downarrow\))** & **RMSE(\(\downarrow\))** & **UQI(\(\uparrow\))** & **ERGAS(\(\downarrow\))** \\ \hline \multirow{8}{*}{Targeted Res50} & PGD & 3.970 & 28.90 & 0.9219 & 0.4775 & 0.0873 & 0.0359 & 0.9808 & 5477.7 \\  & I-FGSM & 2.403 & 33.29 & 0.9619 & 0.6087 & 0.101 & 0.0217 & 0.9933 & 3551.9 \\  & DI-FGSM & 2.779 & 32.03 & 0.9617 & 0.5727 & 0.1139 & 0.0251 & 0.9888 & 3889.6 \\  & TI-DI-FGSM & 2.728 & 32.19 & 0.9577 & 0.5783 & 0.1091 & 0.0246 & 0.9902 & 4020.1 \\  & MI-DI-FGSM & 3.517 & 29.97 & 0.9309 & 0.5011 & 0.1765 & 0.0317 & 0.9863 & 5145.7 \\  & S\({}^{2}\)I-FGSM & 3.043 & 31.24 & 0.9572 & 0.5444 & 0.1222 & 0.0275 & 0.9885 & 4170.3 \\  & **Ours** & **1.169** & **39.60** & **0.9902** & **0.7894** & **0.0478** & **0.0105** & **0.9991** & **1375.8** \\ \hline \multirow{8}{*}{Targeted VGG19} & PGD & 3.973 & 28.91 & 0.922 & 0.4781 & 0.0946 & 0.0358 & 0.9809 & 5467.3 \\  & I-FGSM & 2.299 & 33.68 & 0.9709 & 0.6273 & 0.1015 & 0.0207 & 0.9923 & 3209.3 \\  & DI-FGSM & 2.593 & 32.64 & 0.9655 & 0.5917 & 0.1258 & 0.0234 & 0.9907 & 3588.3 \\  & TI-DI-FGSM & 2.664 & 32.40 & 0.9651 & 0.5843 & 0.1093 & 0.024 & 0.9891 & 3692.9 \\  & MI-DI-FGSM & 3.426 & 30.20 & 0.9436 & 0.512 & 0.1762 & 0.0309 & 0.9853 & 4717.9 \\  & S\({}^{2}\)I-FGSM & 2.862 & 31.78 & 0.9611 & 0.5646 & 0.1369 & 0.0258 & 0.9898 & 3903.8 \\  & **Ours** & **1.109** & **40.07** & **0.9938** & **0.8062** & **0.0422** & **0.01** & **0.9985** & **1548.0** \\ \hline \multirow{8}{*}{Untargeted Res50} & PGD & 4.002 & 28.85 & 0.9228 & 0.4753 & 0.0916 & 0.0361 & 0.983 & 5378.5 \\  & I-FGSM & 2.775 & 32.10 & 0.9601 & 0.5733 & 0.0918 & 0.025 & 0.9889 & 3723.5 \\  & DI-FGSM & 2.807 & 31.95 & 0.9622 & 0.5686 & 0.107839 & 0.0253 & 0.9888 & 3754.8 \\  & TI-DI-FGSM & 2.960 & 31.50 & 0.9607 & 0.5569 & 0.1026 & 0.0267 & 0.9876 & 3876.3 \\  & MI-DI-FGSM & 5.199 & 26.57 & 0.8888 & 0.3856 & 0.2224 & 0.0469 & 0.9748 & 6738.5 \\  & S\({}^{2}\)I-FGSM & 3.287 & 30.57 & 0.9525 & 0.5207 & 0.1341 & 0.0297 & 0.9872 & 4355.0 \\  & **Ours** & **1.694** & **36.36** & **0.9855** & **0.7005** & **0.0578** & **0.0153** & **0.9946** & **2423.9** \\ \hline \multirow{8}{*}{Untargeted VGG19} & PGD & 4.024 & 28.80 & 0.9208 & 0.4718 & 0.1083 & 0.0363 & 0.9824 & 5452.3 \\  & I-FGSM & 2.979 & 30.88 & 0.9605 & 0.5593 & 0.1348 & 0.0269 & 0.9889 & 3877.1 \\ \cline{1-1}  & DI-FGSM & 3.288 & 30.59 & 0.9534 & 0.525 & 0.1636 & 0.0297 & 0.9873 & 4285.7 \\ \cline{1-1}  & TI-DI-FGSM & 3.382 & 30.36 & 0.9525 & 0.5155 & 0.1428 & 0.0305 & 0.9858 & 4403.9 \\ \cline{1-1}  & MI-DI-FGSM & 5.152 & 26.66 & 0.8916 & 0.3872 & 0.2416 & 0.0465 & 0.975 & 6706.0 \\ \cline{1-1}  & S\({}^{2}\)I-FGSM & 3.724 & 29.50 & 0.9435 & 0.4886 & 0.1988 & 0.0336 & 0.9853 & 4835.8 \\ \cline{1-1}  & **Ours** & **2.097** & **34.61** & **0.9789** & **0.6485** & **0.1170** & **0.0189** & **0.9938** & **2953.4** \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Performance of different attacking methods in terms of image quality on Tiny-ImageNet. The best results are presented in bold. attack scenario and performs well on the invisibility of the adversarial examples in both attack scenarios. In addition, through cross-model comparison of the adversarial examples on different substitute models, it can be found that although there are some differences in the image quality of adversarial attacks on each model due to variations in network structures, the relative performance of all attacking methods is consistent. This indicates that adversarial attacks do not depend on a specific network structure, and our method can be applied to various substitute models.