# Exploiting Frequency Characteristics for Boosting the Invisibility of Adversarial Attacks
## 4 Experimental Results and Analysis
### Evaluation of Image Quality
#### 4.2.2. CIFAR100 and CIFAR10
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Settings** & **Methods** & **L2(\(\downarrow\))** & **PSNR(\(\uparrow\))** & **SSIM(\(\uparrow\))** & **VIF(\(\uparrow\))** & **LPIPS (\(\downarrow\))** & **RMSE(\(\downarrow\))** & **UQI(\(\uparrow\))** & **ERGAS(\(\downarrow\))** \\ \hline \multirow{8}{*}{Targeted CIFAR100} & PGD & 3.9592 & 28.9501 & 0.8506 & 0.4207 & 0.2248 & 0.0357 & 0.9846 & 4861.313 \\  & I-FGSM & 2.212 & 34.0041 & 0.9422 & 0.5856 & 0.1769 & 0.02 & 0.9925 & 2753.327 \\  & DI-FGSM & 2.3564 & 33.459 & 0.9392 & 0.5677 & 0.1988 & 0.0213 & 0.9923 & 2896.558 \\  & TI-DI-FGSM & 2.4783 & 33.0247 & 0.9359 & 0.5492 & 0.1718 & 0.0224 & 0.9907 & 3108.424 \\  & MI-DI-FGSM & 3.1938 & 30.8156 & 0.8981 & 0.4791 & 0.2727 & 0.0288 & 0.9887 & 3833.376 \\  & S\({}^{2}\)I-FGSM & 2.653 & 32.4333 & 0.9253 & 0.5263 & 0.2128 & 0.0239 & 0.9907 & 3291.363 \\  & **Ours** & **1.1808** & **39.555** & **0.985** & **0.7468** & **0.0866** & **0.0107** & **0.9971** & **1554.388** \\ \hline \multirow{8}{*}{Targeted CIFAR10} & PGD & 2.033 & 28.7168 & 0.9544 & 0.4836 & 0.0978 & 0.0367 & 0.9945 & 4020.453 \\  & I-FGSM & 1.4367 & 31.794 & 0.978 & 0.5789 & 0.0861 & 0.0259 & 0.997 & 2826.112 \\  & DI-FGSM & 1.843 & 29.5851 & 0.9651 & 0.5106 & 0.1359 & 0.0333 & 0.9952 & 3630.055 \\  & TI-DI-FGSM & 2.0019 & 28.8683 & 0.9623 & 0.5042 & 0.1334 & 0.0361 & 0.9936 & 3923.169 \\  & MI-DI-FGSM & 2.7379 & 26.1326 & 0.928 & 0.4048 & 0.2124 & 0.0494 & 0.9901 & 5389.967 \\  & S\({}^{2}\)I-FGSM & 1.7697 & 29.9492 & 0.9673 & 0.5151 & 0.1229 & 0.0319 & 0.9956 & 3526.703 \\  & **Ours** & **0.6173** & **39.2151** & **0.9948** & **0.755** & **0.021** & **0.0111** & **0.9992** & **1324.995** \\ \hline \multirow{8}{*}{Untargeted CIFAR100} & PGD & 3.9664 & 28.9342 & 0.8503 & 0.4199 & 0.2278 & 0.0358 & 0.9846 & 4866.471 \\  & I-FGSM & 2.2014 & 34.0471 & 0.9433 & 0.5878 & 0.1725 & 0.0199 & 0.9924 & 2738.272 \\ \cline{1-1}  & DI-FGSM & 2.3082 & 33.64 & 0.9403 & 0.5741 & 0.1925 & 0.0208 & 0.9921 & 2857.357 \\ \cline{1-1}  & TI-DI-FGSM & 2.4504 & 33.126 & 0.9371 & 0.554 & 0.1682 & 0.0221 & 0.991 & 3042.448 \\ \cline{1-1}  & MI-DI-FGSM & 4.8833 & 27.1276 & 0.8064 & 0.351 & 0.3608 & 0.0441 & 0.9793 & 5848.935 \\ \cline{1-1}  & S\({}^{2}\)I-FGSM & 2.7332 & 32.179 & 0.9226 & 0.5176 & 0.2297 & 0.0247 & 0.9903 & 3393.043 \\ \cline{1-1}  & **Ours** & **1.5578** & **37.1052** & **0.9751** & **0.674** & **0.1267** & **0.0141** & **0.9959** & **2023.021** \\ \hline \multirow{8}{*}{Untargeted CIFAR10} & PGD & 2.0425 & 28.6772 & 0.9552 & 0.486 & 0.1005 & 0.0369 & 0.9944 & 4051.093 \\ \cline{1-1}  & I-FGSM & 1.7972 & 29.8239 & 0.9697 & 0.5227 & 0.1191 & 0.0324 & 0.9955 & 3546.147 \\ \cline{1-1}  & DI-FGSM & 1.8363 & 29.6212 & 0.9673 & 0.5155 & 0.1307 & 0.0331 & 0.9952 & 3635.69 \\ \cline{1-1}  & TI-DI-FGSM & 2.0438 & 28.6842 & 0.9625 & 0.5019 & 0.1329 & 0.0369 & 0.9933 & 4006.551 \\ \cline{1-1}  & MI-DI-FGSM & 2.7362 & 26.138 & 0.93 & 0.406 & 0.2075 & 0.0494 & 0.9901 & 5398.472 \\ \cline{1-1}  & S\({}^{2}\)I-FGSM & 1.9634 & 29.0394 & 0.9613 & 0.488 & 0.1528 & 0.0354 & 0.9946 & 3947.055 \\ \cline{1-1}  & **Ours** & **1.1618** & **33.6425** & **0.9825** & **0.5969** & **0.0747** & **0.021** & **0.9976** & **2495.726** \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Performance of different attacking methods in terms of image quality on CIFAR100 and CIFAR10.The best results are presented in bold. main distribution, we can effectively improve the invisibility of the generated adversarial example, which we will continue to prove in later experiments.