# of all test samples
#### 4.3.2 Source-Targeted Universal Adversarial Examples
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Model** & **Target Class** & **FGSM** & **I-FGSM** & **C\&W** & **PGD** & **TUAE** \\ \hline \multirow{8}{*}{AlexNet} & 0 & 0.00\% & 99.67\% & 39.48\% & 99.69\% & 99.48\% \\  & 1 & 0.02\% & 76.85\% & 23.94\% & 82.11\% & 99.52\% \\  & 2 & 0.00\% & 97.91\% & 35.76\% & 98.57\% & 99.80\% \\  & 3 & 0.54\% & **100.00\%** & 49.06\% & 99.96\% & 99.91\% \\  & 4 & 1.87\% & 94.04\% & 16.94\% & 98.54\% & 99.94\% \\  & 5 & 0.00\% & 98.57\% & 30.50\% & 98.61\% & 99.78\% \\  & 6 & 0.00\% & 99.81\% & 51.81\% & 99.69\% & 99.54\% \\  & 7 & 99.85\% & **100.00\%** & 23.17\% & **100.00\%** & **100.00\%** \\  & 8 & 0.00\% & 99.96\% & 41.61\% & 99.93\% & 97.54\% \\  & 9 & 0.00\% & 92.57\% & 22.94\% & 91.19\% & 99.26\% \\ \hline \multirow{8}{*}{DenseNet121} & 0 & 0.26\% & 99.96\% & 50.94\% & **100.00\%** & **100.00\%** \\  & 1 & 0.00\% & 95.93\% & 47.11\% & 99.19\% & **100.00\%** \\  & 2 & 0.00\% & 98.24\% & 56.33\% & 96.07\% & **100.00\%** \\  & 3 & 0.00\% & 99.93\% & 47.33\% & **100.00\%** & **100.00\%** \\  & 4 & 0.46\% & **100.00\%** & 35.22\% & **100.00\%** & **100.00\%** \\  & 5 & 0.00\% & **100.00\%** & 54.63\% & **100.00\%** & **100.00\%** \\  & 6 & 0.02\% & **100.00\%** & 80.94\% & **100.00\%** & **100.00\%** \\  & 7 & 99.93\% & **100.00\%** & 61.87\% & **100.00\%** & **100.00\%** \\  & 8 & 0.00\% & 99.78\% & 35.37\% & 99.87\% & **100.00\%** \\  & 9 & 0.09\% & **100.00\%** & 34.69\% & **100.00\%** & **100.00\%** \\ \hline \multirow{8}{*}{RegNet\_\_\_400 mf} & 0 & 33.69\% & **100.00\%** & 55.22\% & **100.00\%** & **100.00\%** \\  & 1 & 0.00\% & 84.93\% & 11.43\% & 95.85\% & 99.98\% \\  & 2 & 0.00\% & 93.63\% & 25.56\% & 95.93\% & 99.98\% \\  & 3 & 0.00\% & 99.67\% & 33.61\% & 99.57\% & 99.98\% \\  & 4 & 0.00\% & 99.94\% & 30.87\% & 99.98\% & **100.00\%** \\  & 5 & 0.00\% & **100.00\%** & 29.76\% & 99.98\% & **100.00\%** \\  & 6 & 0.00\% & 99.98\% & 69.63\% & 99.98\% & **100.00\%** \\  & 7 & 0.00\% & **100.00\%** & 67.69\% & **100.00\%** & **100.00\%** \\  & 8 & 0.00\% & **100.00\%** & 32.15\% & **100.00\%** & **100.00\%** \\  & 9 & 66.76\% & **100.00\%** & 34.65\% & **100.00\%** & **100.00\%** \\ \hline \multirow{8}{*}{ResNet18} & 0 & 0.06\% & 96.65\% & 41.46\% & 98.85\% & **100.00\%** \\  & 1 & 7.76\% & 99.98\% & 51.94\% & **100.00\%** & 99.94\% \\  & 2 & 0.00\% & 99.96\% & 50.52\% & 99.96\% & 99.89\% \\  & 3 & 2.46\% & 99.81\% & 48.17\% & 99.98\% & **100.00\%** \\  & 4 & 5.11\% & **100.00\%** & 34.48\% & **100.00\%** & 99.98\% \\  & 5 & 0.00\% & 99.89\% & 42.33\% & 99.65\% & 99.98\% \\  & 6 & 0.00\% & 99.93\% & 61.31\% & 99.91\% & 99.94\% \\  & 7 & 93.74\% & **100.00\%** & 57.24\% & **100.00\%** & **100.00\%** \\  & 8 & 0.22\% & 99.98\% & 41.65\% & 99.98\% & **100.00\%** \\  & 9 & 0.02\% & 99.91\% & 20.48\% & 99.98\% & 99.69\% \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Targeted attack success rate(s) (TSR) of various attacks (FGSM, I-FGSM, PGD, C&W, and our TUAE) on EuroSAT data. TSR is defined as # of test samples predicted to Class t. The higher, the better. The highest TSR in every row is in **bold** text. Figure 2: Targeted adversarial samples generated by various attacks. Numbers on the left side are targeted classes when generating adversarial examples. Here, we used AlexNet as the victim model for visualization.