# of all test samples
#### 4.3.2 Source-Targeted Universal Adversarial Examples
\begin{table}
\begin{tabular}{c c|c c|c c|c c|c c} \hline \multirow{2}{*}{**Target**} & \multirow{2}{*}{**Source**} & \multicolumn{8}{c}{**V Victim Model**} \\
**Class** & & \multicolumn{2}{c}{**AlexNet**} & \multicolumn{2}{c}{**DenseNet121**} & \multicolumn{2}{c}{**RegNet\_x 400 mf**} & \multicolumn{2}{c}{**ResNet18**} \\ \hline
0 & 1 & 89.68\% & 3.61\% & 90.97\% & 3.80\% & 81.29\% & 3.78\% & 94.19\% & 3.82\% \\
8 & 11 & 72.80\% & 4.64\% & 71.20\% & 4.23\% & 72.80\% & 4.74\% & 67.20\% & 3.63\% \\
9 & 1 & 90.97\% & 2.97\% & 94.19\% & 3.01\% & 94.84\% & 3.03\% & 97.42\% & 2.95\% \\
11 & 9 & 88.00\% & 2.74\% & 92.67\% & 2.56\% & 94.00\% & 2.58\% & 99.33\% & 2.78\% \\
13 & 10 & 82.16\% & 2.91\% & 80.54\% & 2.95\% & 80.00\% & 2.91\% & 79.46\% & 2.97\% \\
14 & 13 & 94.29\% & 2.96\% & 93.57\% & 3.13\% & 97.86\% & 3.13\% & 92.86\% & 2.82\% \\
15 & 13 & 97.14\% & 3.58\% & 93.57\% & 3.50\% & 100.00\% & 3.46\% & 97.14\% & 3.46\% \\
16 & 18 & 84.87\% & 3.88\% & 88.11\% & 3.55\% & 91.89\% & 3.78\% & 94.05\% & 4.36\% \\
17 & 13 & 91.43\% & 3.93\% & 92.86\% & 4.01\% & 97.86\% & 4.01\% & 97.86\% & 3.89\% \\
19 & 3 & 90.00\% & 4.33\% & 89.50\% & 4.52\% & 81.00\% & 4.40\% & 92.00\% & 4.42\% \\ \hline \end{tabular}
\end{table} 
Table 4: TSR of STUAE on UCM with four victim models: AlexNet, DenseNet121, RegNet_x 400 mf, and ResNet18. The goal of adversaries is to mislead victim models to recognize images from the **source class** to the **target class**. **SR** (the higher, the better) stands for the ratio of images from the other classes to be predicted as the target class. \begin{table}
\begin{tabular}{c c|c c|c c|c c|c c} \hline \multirow{2}{*}{**Target**} & \multirow{2}{*}{**Source**} & \multicolumn{8}{c}{**V Victim Model**} \\
**Class** & & \multicolumn{2}{c}{**AlexNet**} & \multicolumn{2}{c}{**DenseNet121**} & \multicolumn{2}{c}{**RegNet\_x 400 mf**} & \multicolumn{2}{c}{**ResNet18**} \\ \hline
5 & 9 & 96.33\% & 12.38\% & 98.67\% & 12.35\% & 96.00\% & 12.56\% & 95.00\% & 12.71\% \\
6 & 9 & 83.83\% & 12.38\% & 96.17\% & 12.38\% & 94.00\% & 12.56\% & 97.33\% & 12.69\% \\
4 & 9 & 87.00\% & 12.02\% & 94.20\% & 12.10\% & 89.40\% & 12.31\% & 96.40\% & 12.47\% \\
3 & 4 & 98.20\% & 12.14\% & 98.40\% & 12.12\% & 100.00\% & 12.31\% & 99.40\% & 12.47\% \\
0 & 9 & 97.50\% & 11.84\% & 99.25\% & 11.82\% & 93.75\% & 11.94\% & 98.75\% & 12.20\% \\
4 & 7 & 93.80\% & 12.02\% & 97.80\% & 12.04\% & 87.80\% & 12.08\% & 97.80\% & 12.27\% \\
8 & 9 & 95.50\% & 12.40\% & 97.67\% & 12.38\% & 99.83\% & 12.56\% & 99.67\% & 12.73\% \\
6 & 1 & 92.40\% & 12.08\% & 94.00\% & 12.12\% & 96.80\% & 12.31\% & 98.20\% & 12.43\% \\
3 & 7 & 97.17\% & 12.35\% & 99.67\% & 12.35\% & 98.83\% & 12.56\% & 99.83\% & 12.69\% \\
7 & 4 & 94.67\% & 11.00\% & 97.00\% & 12.40\% & 95.33\% & 12.52\% & 98.50\% & 12.46\% \\ \hline \end{tabular}
\end{table} 
Table 2: TSR of STUAE on EuroSAT with four victim models: AlexNet, DenseNet121, RegNet_x 400 mf, and ResNet18. The goal of the adversaries is to mislead victim models to recognize images from the **source class** to the **target class**. **SR** (the higher, the better) stands for the ratio of images from the other classes to be predicted as the target class. \begin{table}
\begin{tabular}{c c|c c|c c|c c|c c} \hline \multirow{2}{*}{**Target**} & \multirow{2}{*}{**Source**} & \multicolumn{8}{c}{**V Victim Model**} \\
**Class** & & \multicolumn{2}{c}{**AlexNet**} & \multicolumn{2}{c}{**DenseNet121**} & \multicolumn{2}{c}{**RegNet\_x 400 mf**} & \multicolumn{2}{c}{**ResNet18**} \\ \hline
0 & 1 & 89.68\% & 3.61\% & 90.97\% & 3.80\% & 81.29\% & 3.78\% & 94.19\% & 3.82\% \\
8 & 11 & 72.80\% & 4.64\% & 71.20\% & 4.23\% & 72.80\% & 4.74\% & 67.20\% & 3.63