# Exploiting Frequency Characteristics for Boosting the Invisibility of Adversarial Attacks
## 4 Experimental Results and Analysis
### Evaluation of Transferability  
To verify the transferability of our proposed attack methods, we tested all comparative attacking methods' transfer success rates on black-box models. In the same way as in the experiments above, we tested on three datasets with the substitute model Res50 to test the performance of each method in targeted and untargeted attack scenarios.  
Table 3 shows the transfer success rates of the black-box models in the targeted attack scenario using different attacking methods; the results of the experiments on Tiny-ImageNet, CIFAR100, and CIFAR10 are shown from top to bottom. Each row represents the transfer success rate on different black-box models.  
The experimental results in the table show that in the challenging targeted attack scenario, the adversarial examples generated by our method have good transferability, which indicates that our proposed adversarial attack method has a good performance on the invisibility of adversarial examples and good transferability.  
In the untargeted attack scenario, the DNN's classification of the adversarial sample only needs to deviate from the original label to determine the success of the adversarial attack, which significantly reduces the attack difficulty compared to the targeted attack scenario. Table 3 shows the transfer success rates of attacking methods in an untargeted attack scenario; the results of the experiments on Tiny-ImageNet, CIFAR100, and CIFAR10 are shown from top to bottom. The data in the table show that our method also has significantly higher transferability success rates compared to the TI-DI-FGSM, which is one of the most transferable adversarial attacks available, indicating that our method also outperforms others in an untargeted attack scenario.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline  & \multicolumn{4}{c}{**Targeted Attack**} \\ \hline
**Methods** & **Res18** & **VGG19** & **Dense** & **W-Res50** \\ \hline PGD & 3.20\% & 0.45\% & 0.05\% & 0.15\% \\ I-FGSM & 1.50\% & 0.10\% & 0.50\% & 0.50\% \\ TI-DI-FGSM & 18.50\% & 1.20\% & 3.00\% & 13.50\% \\ Ours & **21.00\%** & **10.00\%** & **6.00\%** & **16.50\%** \\ \hline PGD & 4.05\% & 3.55\% & 4.65\% & 0.95\% \\ I-FGSM & 8.45\% & 4.90\% & 8.30\% & 2.60\% \\ TI-DI-FGSM & 27.85\% & 20.40\% & 30.25\% & 10.55\% \\ Ours & **28.85\%** & **22.10\%** & **32.15\%** & **12.90\%** \\ \hline PGD & 6.89\% & 6.61\% & 7.22\% & 7.44\% \\ I-FGSM & 15.11\% & 11.89\% & 13.56\% & 15.94\% \\ TI-DI-FGSM & 22.94\% & 17.39\% & 21.44\% & 19.94\% \\ Ours & **32.22\%** & **27.78\%** & **28.44\%** & **32.22\%** \\ \hline \hline  & \multicolumn{4}{c}{**Untargeted Attack**} \\ \hline PGD & 40.05\% & 11.25\% & 1.15\% & 4.10\% \\ I-FGSM & 50.45\% & 20.15\% & 4.80\% & 17.70\% \\ TI-DI-FGSM & 63.54\% & 40.82\% & 20.52\% & 47.02\% \\ Ours & **69.15\%** & **41.10\%** & **21.40\%** & **48.65\%** \\ \hline PGD & 46.50\% & 52.00\% & 54.00\% & 12.50\% \\ I-FGSM & 54.00\% & 47.50\% & 59.00\% & 21.00\% \\ TI-DI-FGSM & 66.33\% & 66.83\% & 73.92\% & 31.21\% \\ Ours & **67.00\%** & **68.50\%** & **75.50\%** & **35.50\%** \\ \hline PGD & 31.50\% & 37.00\% & 33.50\% & 34.50\% \\ I-FGSM & 58.50\% & 56.50\% & 60.50\% & 62.50\% \\ TI-DI-FGSM & 53.50\% & 46.00\% & 57.00\% & 58.00\% \\ Ours & **69.00\%** & **61.50\%** & **63.00\%** & **68.50\%** \\ \hline \hline \end{tabular}
\end{table}
Table 3: Transfer success rate of attacking methods on three datasets (from top to bottom: Tiny-ImageNet, CIFAR100, and CIFAR10).