adv-results-cifar-l2.json

{"0": {"1": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.5355, 0.5352, 0.5349999999999999, 0.5344, 0.5339, 0.5331, 0.532, 0.5281, 0.5197, 0.5119, 0.45409999999999995, 0.3067, 0.19630000000000003, 0.05249999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.5355, 0.5353, 0.5352, 0.5347, 0.534, 0.5336000000000001, 0.5322, 0.5291, 0.5224, 0.5151, 0.4657, 0.33089999999999997, 0.2198, 0.05449999999999999], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.5355, 0.5352, 0.5349999999999999, 0.5344, 0.5339, 0.5331, 0.5319, 0.528, 0.5197, 0.5118, 0.45199999999999996, 0.2962, 0.1723, 0.02839999999999998], "L2AdditiveUniformNoiseAttack()": [0.5355, 0.5355, 0.5355, 0.5355, 0.5355, 0.5355, 0.5355, 0.5354, 0.5355, 0.5356000000000001, 0.5357000000000001, 0.5362, 0.5347999999999999, 0.5354], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.5355, 0.5352, 0.5349999999999999, 0.534, 0.5338, 0.5328999999999999, 0.5312, 0.5272, 0.5176000000000001, 0.5091, 0.4433, 0.2793, 0.1634, 0.03149999999999997], "robust_accuracy": [0.5355, 0.5352, 0.5349999999999999, 0.534, 0.5338, 0.5328999999999999, 0.5312, 0.5272, 0.5176000000000001, 0.5091, 0.4433, 0.2783, 0.16000000000000003, 0.025699999999999945]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.544, 0.5434, 0.5428999999999999, 0.5423, 0.5419, 0.5412, 0.5395, 0.5355, 0.5276000000000001, 0.5201, 0.45809999999999995, 0.3054, 0.19189999999999996, 0.05789999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.544, 0.5436000000000001, 0.5429999999999999, 0.5424, 0.5422, 0.5413, 0.54, 0.536, 0.5297000000000001, 0.5235000000000001, 0.4698, 0.3284, 0.21419999999999995, 0.05700000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.544, 0.5434, 0.5428999999999999, 0.5423, 0.5419, 0.5412, 0.5394, 0.5355, 0.5276000000000001, 0.5197, 0.4565, 0.29179999999999995, 0.1634, 0.029200000000000004], "L2AdditiveUniformNoiseAttack()": [0.544, 0.544, 0.5439, 0.544, 0.544, 0.544, 0.544, 0.544, 0.5441, 0.5441, 0.5443, 0.5432, 0.5441, 0.5448999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.544, 0.5434, 0.5426, 0.5422, 0.5413, 0.5406, 0.5386, 0.5345, 0.5256000000000001, 0.5157, 0.44610000000000005, 0.27669999999999995, 0.15500000000000003, 0.032299999999999995], "robust_accuracy": [0.544, 0.5434, 0.5426, 0.5422, 0.5413, 0.5406, 0.5386, 0.5345, 0.5256000000000001, 0.5157, 0.44599999999999995, 0.2751, 0.1511, 0.02639999999999998]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.5426, 0.5425, 0.5419, 0.5415, 0.5412, 0.5405, 0.5392, 0.5356000000000001, 0.5271, 0.5202, 0.46499999999999997, 0.31810000000000005, 0.20889999999999997, 0.06369999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.5426, 0.5425, 0.5419, 0.5416000000000001, 0.5414, 0.5406, 0.5395, 0.5367, 0.5295000000000001, 0.5228999999999999, 0.4766, 0.34030000000000005, 0.23650000000000004, 0.06659999999999999], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.5426, 0.5425, 0.5419, 0.5415, 0.5411, 0.5405, 0.5391, 0.5356000000000001, 0.5271, 0.5201, 0.46340000000000003, 0.30889999999999995, 0.1875, 0.037699999999999956], "L2AdditiveUniformNoiseAttack()": [0.5426, 0.5426, 0.5426, 0.5426, 0.5426, 0.5426, 0.5427, 0.5427, 0.5428, 0.5427, 0.5427, 0.5427, 0.5419, 0.5414], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.5426, 0.5425, 0.5418000000000001, 0.5413, 0.5409999999999999, 0.5403, 0.5387, 0.5347, 0.5255000000000001, 0.5174000000000001, 0.4547, 0.2963, 0.17900000000000005, 0.04290000000000005], "robust_accuracy": [0.5426, 0.5425, 0.5418000000000001, 0.5413, 0.5409999999999999, 0.5403, 0.5387, 0.5347, 0.5255000000000001, 0.5174000000000001, 0.4545, 0.2955, 0.1755, 0.034399999999999986]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.5459, 0.5456, 0.5454, 0.5449999999999999, 0.5444, 0.5435, 0.5414, 0.5379, 0.53, 0.5217, 0.4629, 0.32099999999999995, 0.2107, 0.06730000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.5459, 0.5456, 0.5455, 0.5450999999999999, 0.5448, 0.5438000000000001, 0.5421, 0.5393, 0.5318, 0.5248999999999999, 0.47619999999999996, 0.3468, 0.2339, 0.06879999999999997], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.5459, 0.5456, 0.5454, 0.5449999999999999, 0.5444, 0.5435, 0.5414, 0.5379, 0.53, 0.5216000000000001, 0.46199999999999997, 0.3115, 0.1885, 0.03859999999999997], "L2AdditiveUniformNoiseAttack()": [0.5459, 0.5459, 0.5459, 0.5459, 0.5459, 0.546, 0.5459, 0.5459, 0.546, 0.5459, 0.5464, 0.5461, 0.5469999999999999, 0.5466], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.5459, 0.5456, 0.5454, 0.5448999999999999, 0.5443, 0.5432, 0.5407, 0.5368999999999999, 0.5285, 0.5194, 0.4544, 0.29600000000000004, 0.17710000000000004, 0.04359999999999997], "robust_accuracy": [0.5459, 0.5456, 0.5454, 0.5448999999999999, 0.5443, 0.5432, 0.5407, 0.5368999999999999, 0.5285, 0.5193, 0.4544, 0.2952, 0.1735, 0.035499999999999976]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.5388, 0.5382, 0.5379, 0.5373, 0.5371, 0.536, 0.5343, 0.5307, 0.5231, 0.5151, 0.4606, 0.3245, 0.20850000000000002, 0.0635], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.5388, 0.5383, 0.5379, 0.5376000000000001, 0.5372, 0.5365, 0.5349999999999999, 0.5321, 0.5247999999999999, 0.5193, 0.4719, 0.34619999999999995, 0.23419999999999996, 0.06899999999999995], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.5388, 0.5382, 0.5379, 0.5373, 0.5371, 0.536, 0.5343, 0.5307, 0.523, 0.5151, 0.45940000000000003, 0.3126, 0.18810000000000004, 0.03639999999999999], "L2AdditiveUniformNoiseAttack()": [0.5388, 0.5388, 0.5388, 0.5388, 0.5388, 0.5388999999999999, 0.5388, 0.5387, 0.5388, 0.5386, 0.5387, 0.538, 0.5389999999999999, 0.5374], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.5388, 0.5382, 0.5379, 0.5372, 0.5366, 0.5358, 0.5339, 0.5297000000000001, 0.5216000000000001, 0.5125, 0.45009999999999994, 0.2992, 0.17820000000000003, 0.04090000000000005], "robust_accuracy": [0.5388, 0.5382, 0.5379, 0.5372, 0.5366, 0.5358, 0.5339, 0.5297000000000001, 0.5216000000000001, 0.5125, 0.45009999999999994, 0.29790000000000005, 0.17559999999999998, 0.03420000000000001]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.5586, 0.5583, 0.5577, 0.5576, 0.5575, 0.5567, 0.5559000000000001, 0.5524, 0.544, 0.5348999999999999, 0.4747, 0.31499999999999995, 0.20009999999999994, 0.05489999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.5586, 0.5583, 0.5578000000000001, 0.5576, 0.5576, 0.5571999999999999, 0.5561, 0.5532, 0.5466, 0.5391, 0.487, 0.3407, 0.22330000000000005, 0.05520000000000003], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.5586, 0.5583, 0.5577, 0.5576, 0.5575, 0.5567, 0.5559000000000001, 0.5524, 0.5438000000000001, 0.5347999999999999, 0.47330000000000005, 0.3034, 0.17589999999999995, 0.02639999999999998], "L2AdditiveUniformNoiseAttack()": [0.5586, 0.5586, 0.5586, 0.5586, 0.5586, 0.5586, 0.5586, 0.5586, 0.5588, 0.5586, 0.5590999999999999, 0.5595, 0.5591999999999999, 0.5583], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.5586, 0.5583, 0.5576, 0.5576, 0.5573, 0.5565, 0.5554, 0.5512, 0.5416000000000001, 0.5318, 0.46309999999999996, 0.2893, 0.16690000000000005, 0.02980000000000005], "robust_accuracy": [0.5586, 0.5583, 0.5576, 0.5576, 0.5573, 0.5565, 0.5554, 0.5512, 0.5416000000000001, 0.5318, 0.4628, 0.28800000000000003, 0.16269999999999996, 0.0242]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.5481, 0.5477000000000001, 0.5474, 0.5468999999999999, 0.5462, 0.5447, 0.5428, 0.5377000000000001, 0.528, 0.521, 0.4627, 0.3196, 0.20130000000000003, 0.05900000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.5481, 0.5477000000000001, 0.5475, 0.5473, 0.5467, 0.5455, 0.5437000000000001, 0.5393, 0.5315, 0.5236000000000001, 0.4746, 0.344, 0.22760000000000002, 0.059699999999999975], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.5481, 0.5477000000000001, 0.5474, 0.5468999999999999, 0.5462, 0.5447, 0.5427, 0.5377000000000001, 0.528, 0.5207999999999999, 0.4609, 0.30900000000000005, 0.17810000000000004, 0.029100000000000015], "L2AdditiveUniformNoiseAttack()": [0.5481, 0.5481, 0.5481, 0.5481, 0.5481, 0.548, 0.5481, 0.548, 0.5482, 0.5481, 0.5477000000000001, 0.5466, 0.5469999999999999, 0.5463], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.5481, 0.5477000000000001, 0.5473, 0.5466, 0.546, 0.5444, 0.5424, 0.5365, 0.5259, 0.5175000000000001, 0.4525, 0.29259999999999997, 0.16820000000000002, 0.03210000000000002], "robust_accuracy": [0.5481, 0.5477000000000001, 0.5473, 0.5466, 0.546, 0.5444, 0.5424, 0.5365, 0.5259, 0.5175000000000001, 0.4524, 0.2914, 0.16479999999999995, 0.026000000000000023]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.5448, 0.5441, 0.5433, 0.5428999999999999, 0.5428, 0.5421, 0.5406, 0.5357000000000001, 0.5257000000000001, 0.5172, 0.46230000000000004, 0.3103, 0.20040000000000002, 0.05620000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.5448, 0.5441, 0.5435, 0.5432, 0.5428, 0.5424, 0.5414, 0.5374, 0.5294, 0.5199, 0.4726, 0.3355, 0.2249, 0.05630000000000002], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.5448, 0.5441, 0.5433, 0.5428999999999999, 0.5428, 0.5421, 0.5406, 0.5356000000000001, 0.5258, 0.517, 0.4608, 0.2993, 0.17579999999999996, 0.028699999999999948], "L2AdditiveUniformNoiseAttack()": [0.5448, 0.5448, 0.5448, 0.5447, 0.5448, 0.5448, 0.5447, 0.5446, 0.5445, 0.5443, 0.5449999999999999, 0.5442, 0.5442, 0.5459], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.5448, 0.544, 0.5432, 0.5428, 0.5428, 0.5418000000000001, 0.5398000000000001, 0.5342, 0.5226999999999999, 0.5126, 0.45020000000000004, 0.28590000000000004, 0.16490000000000005, 0.03420000000000001], "robust_accuracy": [0.5448, 0.544, 0.5432, 0.5428, 0.5428, 0.5418000000000001, 0.5398000000000001, 0.5342, 0.5226999999999999, 0.5126, 0.45020000000000004, 0.28459999999999996, 0.16169999999999995, 0.026499999999999968]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.542, 0.5417000000000001, 0.5414, 0.5411, 0.5405, 0.5399, 0.5377000000000001, 0.5322, 0.524, 0.5164, 0.4586, 0.3124, 0.1946, 0.05620000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.542, 0.5417000000000001, 0.5416000000000001, 0.5412, 0.5409999999999999, 0.5402, 0.5381, 0.5342, 0.5264, 0.5203, 0.47, 0.3366, 0.21650000000000003, 0.05669999999999997], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.542, 0.5417000000000001, 0.5414, 0.5411, 0.5405, 0.5398000000000001, 0.5377000000000001, 0.5322, 0.5239, 0.5163, 0.4575, 0.30089999999999995, 0.1714, 0.02939999999999998], "L2AdditiveUniformNoiseAttack()": [0.542, 0.542, 0.542, 0.542, 0.542, 0.5419, 0.5419, 0.542, 0.542, 0.5419, 0.5416000000000001, 0.5417000000000001, 0.5402, 0.5396000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.542, 0.5416000000000001, 0.5413, 0.5408999999999999, 0.5402, 0.5391, 0.5368999999999999, 0.5311, 0.5223, 0.5129, 0.44799999999999995, 0.28480000000000005, 0.16149999999999998, 0.031100000000000017], "robust_accuracy": [0.542, 0.5416000000000001, 0.5413, 0.5408999999999999, 0.5402, 0.5391, 0.5368999999999999, 0.5311, 0.5223, 0.5129, 0.4478, 0.28369999999999995, 0.15710000000000002, 0.026499999999999968]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.5398000000000001, 0.5395, 0.5389999999999999, 0.5388, 0.538, 0.5369999999999999, 0.5355, 0.5303, 0.5224, 0.5135000000000001, 0.4575, 0.31989999999999996, 0.20579999999999998, 0.06289999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.5398000000000001, 0.5395, 0.5391, 0.5388, 0.5384, 0.5374, 0.5361, 0.5318, 0.5247999999999999, 0.5166999999999999, 0.4696, 0.3448, 0.22729999999999995, 0.06269999999999998], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.5398000000000001, 0.5395, 0.5389999999999999, 0.5388, 0.538, 0.5369999999999999, 0.5355, 0.5303, 0.5223, 0.5136000000000001, 0.4565, 0.3084, 0.18389999999999995, 0.035499999999999976], "L2AdditiveUniformNoiseAttack()": [0.5398000000000001, 0.5398000000000001, 0.5399, 0.54, 0.5399, 0.5399, 0.5398000000000001, 0.54, 0.5399, 0.54, 0.5395, 0.5407, 0.5401, 0.5395], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.5398000000000001, 0.5395, 0.5388999999999999, 0.5387, 0.5377000000000001, 0.5367999999999999, 0.5351, 0.5295000000000001, 0.5199, 0.5105999999999999, 0.4486, 0.29390000000000005, 0.1754, 0.040100000000000025], "robust_accuracy": [0.5398000000000001, 0.5395, 0.5388999999999999, 0.5387, 0.5377000000000001, 0.5367999999999999, 0.5351, 0.5295000000000001, 0.5199, 0.5105999999999999, 0.4484, 0.2925, 0.1723, 0.03259999999999996]}}, "2": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6024, 0.6021000000000001, 0.6013999999999999, 0.601, 0.6005, 0.5996, 0.5976, 0.5933999999999999, 0.5860000000000001, 0.5774, 0.5107999999999999, 0.35619999999999996, 0.23009999999999997, 0.06699999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6024, 0.6021000000000001, 0.6016, 0.6013, 0.601, 0.6002000000000001, 0.5983, 0.5945, 0.5889, 0.5812999999999999, 0.5251, 0.38339999999999996, 0.25370000000000004, 0.06620000000000004], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6024, 0.6021000000000001, 0.6013999999999999, 0.601, 0.6005, 0.5996, 0.5976, 0.5935, 0.5857, 0.5772999999999999, 0.5093, 0.34299999999999997, 0.20009999999999994, 0.03290000000000004], "L2AdditiveUniformNoiseAttack()": [0.6024, 0.6024, 0.6024, 0.6024, 0.6024, 0.6024, 0.6024, 0.6026, 0.6025, 0.6021000000000001, 0.6023000000000001, 0.6023000000000001, 0.6024, 0.602], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6024, 0.6021000000000001, 0.6013999999999999, 0.601, 0.6004, 0.5991, 0.5973999999999999, 0.5923, 0.5840000000000001, 0.5748, 0.5014000000000001, 0.3329, 0.1987, 0.041100000000000025], "robust_accuracy": [0.6024, 0.6021000000000001, 0.6013999999999999, 0.601, 0.6004, 0.5991, 0.5973999999999999, 0.5923, 0.5840000000000001, 0.5748, 0.5012, 0.33009999999999995, 0.1894, 0.03090000000000004]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.5983, 0.5974999999999999, 0.5971, 0.5964, 0.5959, 0.5952999999999999, 0.5938, 0.5893999999999999, 0.5796, 0.5694, 0.5087999999999999, 0.3488, 0.22540000000000004, 0.0595], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.5983, 0.5978, 0.5972, 0.5966, 0.5963, 0.5957, 0.5942000000000001, 0.5912, 0.5824, 0.5742, 0.5203, 0.37370000000000003, 0.24719999999999998, 0.06000000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.5983, 0.5974999999999999, 0.5971, 0.5964, 0.5959, 0.5952999999999999, 0.5938, 0.5893999999999999, 0.5795, 0.5692999999999999, 0.5076, 0.3365, 0.19540000000000002, 0.030000000000000027], "L2AdditiveUniformNoiseAttack()": [0.5983, 0.5983, 0.5984, 0.5984, 0.5983, 0.5986, 0.5985, 0.5984, 0.5983, 0.5985, 0.599, 0.5987, 0.5987, 0.5973999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.5983, 0.5974999999999999, 0.5967, 0.5963, 0.5957, 0.5949, 0.5935, 0.5880000000000001, 0.5783, 0.5664, 0.5001, 0.3266, 0.1894, 0.03490000000000004], "robust_accuracy": [0.5983, 0.5974999999999999, 0.5967, 0.5963, 0.5957, 0.5949, 0.5935, 0.5880000000000001, 0.5783, 0.5664, 0.5001, 0.32420000000000004, 0.1824, 0.027900000000000036]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6002000000000001, 0.5993999999999999, 0.5986, 0.598, 0.5976, 0.5966, 0.5948, 0.5899, 0.5803, 0.5698, 0.5105, 0.3516, 0.22860000000000003, 0.0625], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6002000000000001, 0.5994999999999999, 0.599, 0.5983, 0.5978, 0.597, 0.5953999999999999, 0.5916, 0.5833999999999999, 0.5732999999999999, 0.5238, 0.3761, 0.2499, 0.06440000000000001], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6002000000000001, 0.5993999999999999, 0.5986, 0.598, 0.5976, 0.5966, 0.5949, 0.5899, 0.5803, 0.5696, 0.5091, 0.33899999999999997, 0.19879999999999998, 0.03180000000000005], "L2AdditiveUniformNoiseAttack()": [0.6002000000000001, 0.6002000000000001, 0.6002000000000001, 0.6002000000000001, 0.6002000000000001, 0.6002000000000001, 0.6002000000000001, 0.6001000000000001, 0.5999, 0.5999, 0.5993999999999999, 0.5986, 0.5992, 0.6008], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6002000000000001, 0.5992999999999999, 0.5984, 0.598, 0.5972999999999999, 0.5963, 0.5941000000000001, 0.589, 0.5771, 0.5660000000000001, 0.5013000000000001, 0.3265, 0.19169999999999998, 0.037799999999999945], "robust_accuracy": [0.6002000000000001, 0.5992999999999999, 0.5984, 0.598, 0.5972999999999999, 0.5963, 0.5941000000000001, 0.589, 0.5771, 0.5660000000000001, 0.5013000000000001, 0.3246, 0.18620000000000003, 0.029299999999999993]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.5866, 0.5857, 0.585, 0.5848, 0.5846, 0.5836, 0.5812999999999999, 0.577, 0.5700000000000001, 0.5635, 0.5043, 0.35219999999999996, 0.2278, 0.06720000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.5866, 0.5858, 0.5852999999999999, 0.5849, 0.5848, 0.5843, 0.5824, 0.5782, 0.5729, 0.5661, 0.5179, 0.38029999999999997, 0.2528, 0.07310000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.5866, 0.5857, 0.585, 0.5848, 0.5846, 0.5836, 0.5811999999999999, 0.577, 0.5699000000000001, 0.5633, 0.5019, 0.34009999999999996, 0.20650000000000002, 0.040200000000000014], "L2AdditiveUniformNoiseAttack()": [0.5866, 0.5866, 0.5867, 0.5866, 0.5867, 0.5865, 0.5864, 0.5865, 0.5862, 0.5861000000000001, 0.5858, 0.5861000000000001, 0.5853999999999999, 0.5856], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.5866, 0.5857, 0.585, 0.5848, 0.5844, 0.5831999999999999, 0.5807, 0.5762, 0.5680000000000001, 0.5601, 0.49350000000000005, 0.3278, 0.19910000000000005, 0.04390000000000005], "robust_accuracy": [0.5866, 0.5857, 0.585, 0.5848, 0.5844, 0.5831999999999999, 0.5807, 0.5762, 0.5680000000000001, 0.5601, 0.49350000000000005, 0.32630000000000003, 0.1956, 0.03749999999999998]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.5759000000000001, 0.575, 0.5739000000000001, 0.5734, 0.573, 0.5716, 0.5696, 0.5644, 0.5564, 0.5482, 0.4927, 0.3347, 0.20889999999999997, 0.05820000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.5759000000000001, 0.5752999999999999, 0.5740000000000001, 0.5735, 0.5732999999999999, 0.5723, 0.5704, 0.5653, 0.5583, 0.552, 0.5033000000000001, 0.36160000000000003, 0.23219999999999996, 0.05879999999999996], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.5759000000000001, 0.575, 0.5739000000000001, 0.5734, 0.573, 0.5716, 0.5696, 0.5643, 0.5563, 0.5478000000000001, 0.4909, 0.32110000000000005, 0.18300000000000005, 0.030299999999999994], "L2AdditiveUniformNoiseAttack()": [0.5759000000000001, 0.5759000000000001, 0.5759000000000001, 0.5758, 0.5759000000000001, 0.5757, 0.5758, 0.5758, 0.5762, 0.5752999999999999, 0.5756, 0.5745, 0.575, 0.5719000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.5759000000000001, 0.5747, 0.5737, 0.5732999999999999, 0.5729, 0.5716, 0.569, 0.5635, 0.5543, 0.5447, 0.4827, 0.3085, 0.17830000000000001, 0.034599999999999964], "robust_accuracy": [0.5759000000000001, 0.5747, 0.5737, 0.5732999999999999, 0.5729, 0.5716, 0.569, 0.5635, 0.5543, 0.5447, 0.48260000000000003, 0.30720000000000003, 0.17310000000000003, 0.02839999999999998]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.5864, 0.5860000000000001, 0.5855, 0.5849, 0.5845, 0.5838, 0.5818, 0.5774, 0.5673, 0.5581, 0.49770000000000003, 0.3408, 0.2146, 0.058699999999999974], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.5864, 0.5860000000000001, 0.5858, 0.5851999999999999, 0.5847, 0.5843, 0.5826, 0.5784, 0.5701, 0.5619000000000001, 0.5091, 0.36750000000000005, 0.24050000000000005, 0.0635], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.5864, 0.5860000000000001, 0.5855, 0.5848, 0.5845, 0.5838, 0.5817, 0.5775, 0.567, 0.5575, 0.4961, 0.3295, 0.19279999999999997, 0.03320000000000001], "L2AdditiveUniformNoiseAttack()": [0.5864, 0.5864, 0.5864, 0.5864, 0.5864, 0.5864, 0.5864, 0.5866, 0.5864, 0.5862, 0.5862, 0.5856, 0.5858, 0.5835], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.5864, 0.5860000000000001, 0.5855, 0.5847, 0.5845, 0.5833999999999999, 0.5811, 0.5760000000000001, 0.5647, 0.5543, 0.48760000000000003, 0.3144, 0.18479999999999996, 0.038799999999999946], "robust_accuracy": [0.5864, 0.5860000000000001, 0.5855, 0.5847, 0.5845, 0.5833999999999999, 0.5811, 0.5760000000000001, 0.5647, 0.5543, 0.48760000000000003, 0.3134, 0.18079999999999996, 0.03049999999999997]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.5647, 0.5645, 0.5641, 0.5640000000000001, 0.5638000000000001, 0.5631999999999999, 0.5609, 0.5569, 0.5492, 0.5408999999999999, 0.4821, 0.3155, 0.2037, 0.0615], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.5647, 0.5646, 0.5642, 0.5641, 0.5640000000000001, 0.5635, 0.5614, 0.5579000000000001, 0.5512, 0.5442, 0.49550000000000005, 0.3407, 0.2247, 0.06430000000000002], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.5647, 0.5645, 0.5641, 0.5640000000000001, 0.5638000000000001, 0.5631999999999999, 0.5609, 0.5569999999999999, 0.5492, 0.5405, 0.4798, 0.3015, 0.17859999999999998, 0.035599999999999965], "L2AdditiveUniformNoiseAttack()": [0.5647, 0.5647, 0.5647, 0.5647, 0.5647, 0.5647, 0.5647, 0.5650999999999999, 0.5650999999999999, 0.5647, 0.5648, 0.5653, 0.5630999999999999, 0.5646], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.5647, 0.5645, 0.5641, 0.5640000000000001, 0.5638000000000001, 0.5625, 0.5604, 0.5557000000000001, 0.5476, 0.5382, 0.47209999999999996, 0.2891, 0.17669999999999997, 0.04190000000000005], "robust_accuracy": [0.5647, 0.5645, 0.5641, 0.5640000000000001, 0.5638000000000001, 0.5625, 0.5604, 0.5557000000000001, 0.5476, 0.5381, 0.472, 0.2881, 0.17190000000000005, 0.03420000000000001]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.5900000000000001, 0.5893999999999999, 0.5886, 0.5880000000000001, 0.5876, 0.5869, 0.5851999999999999, 0.5807, 0.5720000000000001, 0.5645, 0.506, 0.33440000000000003, 0.20709999999999995, 0.060699999999999976], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.5900000000000001, 0.5893999999999999, 0.5888, 0.5881000000000001, 0.5879, 0.587, 0.5857, 0.5820000000000001, 0.5748, 0.5669, 0.5171, 0.3611, 0.23129999999999995, 0.059599999999999986], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.5900000000000001, 0.5893999999999999, 0.5886, 0.5880000000000001, 0.5876, 0.5869, 0.5851999999999999, 0.5806, 0.5720000000000001, 0.5644, 0.5041, 0.3206, 0.1805, 0.030299999999999994], "L2AdditiveUniformNoiseAttack()": [0.5900000000000001, 0.5900000000000001, 0.5900000000000001, 0.5900000000000001, 0.5900000000000001, 0.5900000000000001, 0.5900000000000001, 0.5899, 0.5900000000000001, 0.5893999999999999, 0.5900000000000001, 0.5892999999999999, 0.589, 0.5909], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.5900000000000001, 0.5892999999999999, 0.5885, 0.5879, 0.5875, 0.5867, 0.5846, 0.5801000000000001, 0.5701, 0.5618000000000001, 0.49750000000000005, 0.31079999999999997, 0.17789999999999995, 0.036900000000000044], "robust_accuracy": [0.5900000000000001, 0.5892999999999999, 0.5885, 0.5879, 0.5875, 0.5867, 0.5846, 0.5801000000000001, 0.5701, 0.5618000000000001, 0.49750000000000005, 0.30900000000000005, 0.17159999999999997, 0.028100000000000014]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.5828, 0.5827, 0.5826, 0.5816, 0.5812999999999999, 0.5807, 0.5788, 0.5743, 0.5680000000000001, 0.5598000000000001, 0.5035000000000001, 0.35329999999999995, 0.23629999999999995, 0.07040000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.5828, 0.5827, 0.5826, 0.5822, 0.5813999999999999, 0.581, 0.5791, 0.5754, 0.5692999999999999, 0.5644, 0.515, 0.38, 0.25970000000000004, 0.07330000000000003], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.5828, 0.5827, 0.5826, 0.5816, 0.5812999999999999, 0.5806, 0.5788, 0.5743, 0.5679000000000001, 0.5595, 0.5019, 0.34199999999999997, 0.2108, 0.04259999999999997], "L2AdditiveUniformNoiseAttack()": [0.5828, 0.5828, 0.5828, 0.5828, 0.5828, 0.583, 0.5829, 0.583, 0.5829, 0.5829, 0.5828, 0.5833999999999999, 0.5812999999999999, 0.5822], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.5828, 0.5827, 0.5826, 0.5812999999999999, 0.5811999999999999, 0.5802, 0.5784, 0.573, 0.5666, 0.5575, 0.49429999999999996, 0.3317, 0.20299999999999996, 0.0484], "robust_accuracy": [0.5828, 0.5827, 0.5826, 0.5812999999999999, 0.5811999999999999, 0.5802, 0.5784, 0.573, 0.5666, 0.5575, 0.49429999999999996, 0.33030000000000004, 0.19920000000000004, 0.04149999999999998]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6009, 0.6005, 0.6002000000000001, 0.5998, 0.599, 0.598, 0.597, 0.5928, 0.5822, 0.5731999999999999, 0.5109, 0.352, 0.22819999999999996, 0.0655], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6009, 0.6006, 0.6002000000000001, 0.6, 0.5993999999999999, 0.5985, 0.5974999999999999, 0.5941000000000001, 0.5853999999999999, 0.577, 0.5266, 0.38039999999999996, 0.2508, 0.06710000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6009, 0.6005, 0.6002000000000001, 0.5998, 0.599, 0.598, 0.597, 0.5927, 0.5821000000000001, 0.5729, 0.51, 0.3419, 0.1996, 0.03810000000000002], "L2AdditiveUniformNoiseAttack()": [0.6009, 0.6009, 0.6009, 0.6009, 0.6009, 0.601, 0.6009, 0.6009, 0.601, 0.6011, 0.6007, 0.6009, 0.6012, 0.6027], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6009, 0.6005, 0.6, 0.5994999999999999, 0.5988, 0.5979, 0.5967, 0.5922000000000001, 0.5805, 0.5714, 0.5044, 0.3304, 0.1955, 0.043399999999999994], "robust_accuracy": [0.6009, 0.6005, 0.6, 0.5994999999999999, 0.5988, 0.5979, 0.5967, 0.5922000000000001, 0.5805, 0.5712999999999999, 0.5044, 0.32920000000000005, 0.1894, 0.035599999999999965]}}, "4": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6203000000000001, 0.6199, 0.6195999999999999, 0.6192, 0.619, 0.6181, 0.6161, 0.612, 0.6026, 0.5944, 0.5306, 0.3577, 0.21930000000000005, 0.052100000000000035], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6203000000000001, 0.6199, 0.6195999999999999, 0.6194, 0.6191, 0.6188, 0.6171, 0.6135999999999999, 0.6059, 0.5983, 0.5417000000000001, 0.38539999999999996, 0.24409999999999998, 0.053200000000000025], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6203000000000001, 0.6199, 0.6195999999999999, 0.6192, 0.619, 0.6181, 0.6161, 0.612, 0.6026, 0.5943, 0.5279, 0.34119999999999995, 0.18689999999999996, 0.02400000000000002], "L2AdditiveUniformNoiseAttack()": [0.6203000000000001, 0.6203000000000001, 0.6203000000000001, 0.6203000000000001, 0.6203000000000001, 0.6203000000000001, 0.6203000000000001, 0.6203000000000001, 0.6203000000000001, 0.6203000000000001, 0.6202, 0.6205, 0.6205, 0.6172], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6203000000000001, 0.6199, 0.6195999999999999, 0.6192, 0.6188, 0.6178, 0.6157, 0.6113999999999999, 0.601, 0.5912999999999999, 0.5212, 0.33499999999999996, 0.18810000000000004, 0.030399999999999983], "robust_accuracy": [0.6203000000000001, 0.6199, 0.6195999999999999, 0.6192, 0.6188, 0.6178, 0.6157, 0.6113999999999999, 0.601, 0.5912999999999999, 0.521, 0.3319, 0.17959999999999998, 0.022599999999999953]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6395, 0.6388, 0.6382, 0.6377999999999999, 0.6369, 0.636, 0.6341, 0.6296999999999999, 0.6199, 0.6119, 0.5464, 0.3607, 0.21750000000000003, 0.05030000000000001], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6395, 0.6389, 0.6384000000000001, 0.6379, 0.6376, 0.6366, 0.6349, 0.6317999999999999, 0.6228, 0.6153, 0.5607, 0.3889, 0.2398, 0.0484], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6395, 0.6388, 0.6382, 0.6377999999999999, 0.6369, 0.6359, 0.634, 0.6296999999999999, 0.6196999999999999, 0.6119, 0.5435, 0.3415, 0.18259999999999998, 0.02190000000000003], "L2AdditiveUniformNoiseAttack()": [0.6395, 0.6395, 0.6395, 0.6395, 0.6395, 0.6395, 0.6395, 0.6394, 0.6394, 0.6393, 0.6391, 0.6387, 0.6383, 0.636], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6395, 0.6388, 0.6381, 0.6376, 0.6368, 0.6356999999999999, 0.6339, 0.6292, 0.6188, 0.6093999999999999, 0.5367999999999999, 0.3315, 0.18030000000000002, 0.02749999999999997], "robust_accuracy": [0.6395, 0.6388, 0.6381, 0.6376, 0.6368, 0.6356999999999999, 0.6339, 0.6292, 0.6188, 0.6093999999999999, 0.5367, 0.3297, 0.17359999999999998, 0.02070000000000005]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6654, 0.6647000000000001, 0.6642, 0.6639999999999999, 0.6638, 0.6631, 0.6617, 0.6583, 0.6484, 0.6388, 0.5726, 0.39180000000000004, 0.24660000000000004, 0.06820000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6654, 0.6648000000000001, 0.6643, 0.6641, 0.6638, 0.6633, 0.6618999999999999, 0.6593, 0.6517999999999999, 0.6422, 0.5858, 0.4234, 0.27180000000000004, 0.0696], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6654, 0.6647000000000001, 0.6642, 0.6639999999999999, 0.6638, 0.6631, 0.6617, 0.6583, 0.6484, 0.6387, 0.5699000000000001, 0.37470000000000003, 0.2127, 0.03500000000000003], "L2AdditiveUniformNoiseAttack()": [0.6654, 0.6654, 0.6654, 0.6654, 0.6654, 0.6653, 0.6654, 0.6653, 0.6652, 0.6651, 0.6649, 0.6664, 0.6654, 0.6657], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6654, 0.6647000000000001, 0.6641, 0.6638, 0.6637, 0.6628000000000001, 0.6613, 0.6575, 0.6463, 0.6359, 0.5631999999999999, 0.3658, 0.21350000000000002, 0.042100000000000026], "robust_accuracy": [0.6654, 0.6647000000000001, 0.6641, 0.6638, 0.6637, 0.6628000000000001, 0.6613, 0.6575, 0.6463, 0.6359, 0.563, 0.3631, 0.20309999999999995, 0.03269999999999995]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6633, 0.6626000000000001, 0.6623, 0.6619999999999999, 0.6615, 0.6603, 0.6575, 0.6537, 0.6453, 0.6369, 0.5707, 0.39959999999999996, 0.25539999999999996, 0.06269999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6633, 0.6627000000000001, 0.6624, 0.6621, 0.6618999999999999, 0.6612, 0.6586000000000001, 0.6546000000000001, 0.6482, 0.6401, 0.5861000000000001, 0.4283, 0.2782, 0.06389999999999996], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6633, 0.6626000000000001, 0.6623, 0.6619999999999999, 0.6615, 0.6603, 0.6575, 0.6537, 0.645, 0.6368, 0.569, 0.382, 0.22040000000000004, 0.032299999999999995], "L2AdditiveUniformNoiseAttack()": [0.6633, 0.6633, 0.6633, 0.6633, 0.6633, 0.6633, 0.6632, 0.6631, 0.663, 0.6635, 0.6636, 0.6633, 0.6628000000000001, 0.6637], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6633, 0.6626000000000001, 0.6623, 0.6618999999999999, 0.6614, 0.6599999999999999, 0.657, 0.6526000000000001, 0.6428, 0.6343, 0.5630999999999999, 0.37270000000000003, 0.21989999999999998, 0.03859999999999997], "robust_accuracy": [0.6633, 0.6626000000000001, 0.6623, 0.6618999999999999, 0.6614, 0.6599999999999999, 0.657, 0.6526000000000001, 0.6428, 0.6343, 0.5628, 0.3702, 0.21199999999999997, 0.030000000000000027]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6377999999999999, 0.6372, 0.6371, 0.6368, 0.6365000000000001, 0.6356999999999999, 0.6337999999999999, 0.6303000000000001, 0.6211, 0.6115999999999999, 0.5474, 0.38670000000000004, 0.2542, 0.08009999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6377999999999999, 0.6372, 0.6371, 0.6369, 0.6367, 0.6362, 0.6343, 0.6315999999999999, 0.6241, 0.6165, 0.5618000000000001, 0.4122, 0.2793, 0.08240000000000003], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6377999999999999, 0.6372, 0.6371, 0.6368, 0.6365000000000001, 0.6355999999999999, 0.6337999999999999, 0.6303000000000001, 0.6211, 0.6113, 0.5461, 0.3728, 0.22740000000000005, 0.048799999999999955], "L2AdditiveUniformNoiseAttack()": [0.6377999999999999, 0.6377999999999999, 0.6377999999999999, 0.6377999999999999, 0.6377999999999999, 0.6376, 0.6377999999999999, 0.6376, 0.638, 0.6376, 0.6385000000000001, 0.6376999999999999, 0.6393, 0.6367], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6377999999999999, 0.6372, 0.6371, 0.6368, 0.6365000000000001, 0.6355, 0.6335, 0.6294, 0.6201, 0.6095999999999999, 0.54, 0.36650000000000005, 0.2288, 0.05669999999999997], "robust_accuracy": [0.6377999999999999, 0.6372, 0.6371, 0.6368, 0.6365000000000001, 0.6355, 0.6335, 0.6294, 0.6201, 0.6095999999999999, 0.5399, 0.3638, 0.22150000000000003, 0.04679999999999995]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6486000000000001, 0.6482, 0.6473, 0.6469, 0.6463, 0.6454, 0.6437999999999999, 0.6396, 0.6299, 0.6222, 0.5530999999999999, 0.38549999999999995, 0.2471, 0.06479999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6486000000000001, 0.6482, 0.6476999999999999, 0.6472, 0.6466000000000001, 0.6456999999999999, 0.6442, 0.6406000000000001, 0.633, 0.6258, 0.5683, 0.41180000000000005, 0.27090000000000003, 0.062100000000000044], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6486000000000001, 0.6482, 0.6473, 0.6469, 0.6463, 0.6454, 0.6437999999999999, 0.6396, 0.6299, 0.6219, 0.5512, 0.37039999999999995, 0.2137, 0.03180000000000005], "L2AdditiveUniformNoiseAttack()": [0.6486000000000001, 0.6486000000000001, 0.6486000000000001, 0.6486000000000001, 0.6486000000000001, 0.6486000000000001, 0.6486000000000001, 0.6486000000000001, 0.6488, 0.6482, 0.6483, 0.6484, 0.6482, 0.646], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6486000000000001, 0.6482, 0.6472, 0.6468, 0.6461, 0.6452, 0.6431, 0.6384000000000001, 0.6284000000000001, 0.6191, 0.5446, 0.36429999999999996, 0.2156, 0.039100000000000024], "robust_accuracy": [0.6486000000000001, 0.6482, 0.6472, 0.6468, 0.6461, 0.6452, 0.6431, 0.6384000000000001, 0.6284000000000001, 0.6191, 0.5444, 0.3609, 0.20720000000000005, 0.029900000000000038]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6191, 0.6188, 0.6185, 0.6182000000000001, 0.6177, 0.6167, 0.6152, 0.6102000000000001, 0.6019, 0.5921000000000001, 0.5292, 0.36660000000000004, 0.22940000000000005, 0.06130000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6191, 0.6189, 0.6186, 0.6184000000000001, 0.618, 0.617, 0.6159, 0.6113, 0.604, 0.5964, 0.5423, 0.391, 0.2551, 0.06120000000000003], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6191, 0.6188, 0.6185, 0.6182000000000001, 0.6177, 0.6167, 0.6152, 0.6102000000000001, 0.6018, 0.5919, 0.5268999999999999, 0.35029999999999994, 0.1996, 0.03159999999999996], "L2AdditiveUniformNoiseAttack()": [0.6191, 0.6191, 0.6191, 0.6191, 0.6191, 0.619, 0.6191, 0.619, 0.6191, 0.6189, 0.6187, 0.6189, 0.6192, 0.6168], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6191, 0.6188, 0.6185, 0.6181, 0.6174, 0.6167, 0.6144000000000001, 0.6093, 0.6, 0.5893999999999999, 0.5205, 0.3405, 0.19779999999999998, 0.035699999999999954], "robust_accuracy": [0.6191, 0.6188, 0.6185, 0.6181, 0.6174, 0.6167, 0.6144000000000001, 0.6093, 0.6, 0.5893999999999999, 0.5205, 0.33809999999999996, 0.19140000000000001, 0.029100000000000015]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6224000000000001, 0.6221, 0.6214, 0.6209, 0.6203000000000001, 0.6194, 0.6182000000000001, 0.6137, 0.6052, 0.5979, 0.5383, 0.3781, 0.24139999999999995, 0.06369999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6224000000000001, 0.6221, 0.6218, 0.6211, 0.6206, 0.6194999999999999, 0.6185, 0.615, 0.6077, 0.601, 0.5492, 0.4021, 0.2651, 0.062100000000000044], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6224000000000001, 0.6221, 0.6214, 0.6209, 0.6203000000000001, 0.6194, 0.6182000000000001, 0.6137, 0.6052, 0.5978, 0.5366, 0.36019999999999996, 0.2087, 0.028100000000000014], "L2AdditiveUniformNoiseAttack()": [0.6224000000000001, 0.6224000000000001, 0.6224000000000001, 0.6224000000000001, 0.6224000000000001, 0.6224000000000001, 0.6225, 0.6225, 0.6224000000000001, 0.6223000000000001, 0.6223000000000001, 0.6216999999999999, 0.6222, 0.62], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6224000000000001, 0.6221, 0.6213, 0.6205, 0.62, 0.6194, 0.6178, 0.613, 0.6036, 0.5961000000000001, 0.5321, 0.3547, 0.21109999999999995, 0.03710000000000002], "robust_accuracy": [0.6224000000000001, 0.6221, 0.6213, 0.6205, 0.62, 0.6194, 0.6178, 0.613, 0.6036, 0.5961000000000001, 0.532, 0.3517, 0.20109999999999995, 0.026699999999999946]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6569, 0.6565, 0.6558999999999999, 0.6556, 0.6554, 0.6548, 0.6524, 0.6476999999999999, 0.638, 0.6288, 0.5586, 0.3808, 0.241, 0.06269999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6569, 0.6567000000000001, 0.6562, 0.6557999999999999, 0.6554, 0.655, 0.6535, 0.6496, 0.6408, 0.6322, 0.5737, 0.4122, 0.26549999999999996, 0.06240000000000001], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6569, 0.6565, 0.6558999999999999, 0.6556, 0.6554, 0.6548, 0.6524, 0.6476, 0.638, 0.6288, 0.5571999999999999, 0.36429999999999996, 0.20650000000000002, 0.03080000000000005], "L2AdditiveUniformNoiseAttack()": [0.6569, 0.6569, 0.6569, 0.6569, 0.6569, 0.657, 0.6569, 0.6569, 0.6566000000000001, 0.6568, 0.6566000000000001, 0.6565, 0.6564, 0.6557], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6569, 0.6564, 0.6558999999999999, 0.6555, 0.6553, 0.6546000000000001, 0.6522, 0.6471, 0.6362, 0.6269, 0.5505, 0.3569, 0.20809999999999995, 0.03739999999999999], "robust_accuracy": [0.6569, 0.6564, 0.6558999999999999, 0.6555, 0.6553, 0.6546000000000001, 0.6522, 0.6471, 0.6362, 0.6269, 0.5505, 0.35409999999999997, 0.19910000000000005, 0.028200000000000003]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6636, 0.6633, 0.6624, 0.6618999999999999, 0.6612, 0.6601, 0.6586000000000001, 0.6544, 0.646, 0.6364000000000001, 0.5732999999999999, 0.395, 0.24950000000000006, 0.0665], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6636, 0.6634, 0.6625, 0.6622, 0.6617, 0.6602, 0.6592, 0.656, 0.6485000000000001, 0.6404000000000001, 0.587, 0.4255, 0.27680000000000005, 0.06679999999999997], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6636, 0.6633, 0.6624, 0.6618999999999999, 0.6612, 0.6601, 0.6586000000000001, 0.6544, 0.6457999999999999, 0.6364000000000001, 0.5722, 0.3819, 0.21450000000000002, 0.03280000000000005], "L2AdditiveUniformNoiseAttack()": [0.6636, 0.6636, 0.6636, 0.6636, 0.6636, 0.6636, 0.6636, 0.6635, 0.6635, 0.6637, 0.6634, 0.6622, 0.6622, 0.6613], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6636, 0.6629, 0.6624, 0.6618999999999999, 0.661, 0.6596, 0.6586000000000001, 0.6534, 0.644, 0.6337999999999999, 0.565, 0.3729, 0.2138, 0.04069999999999996], "robust_accuracy": [0.6636, 0.6629, 0.6624, 0.6618999999999999, 0.661, 0.6596, 0.6586000000000001, 0.6534, 0.644, 0.6337999999999999, 0.5649, 0.37039999999999995, 0.2047, 0.03159999999999996]}}, "8": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6819, 0.6814, 0.681, 0.6804, 0.6800999999999999, 0.6791, 0.6776, 0.6733, 0.6642, 0.6547000000000001, 0.5876, 0.3993, 0.25170000000000003, 0.06569999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6819, 0.6815, 0.6811, 0.6805, 0.6804, 0.6793, 0.6780999999999999, 0.6745, 0.667, 0.6588, 0.6013999999999999, 0.43089999999999995, 0.2722, 0.06110000000000004], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6819, 0.6814, 0.681, 0.6804, 0.6800999999999999, 0.6791, 0.6776, 0.6732, 0.6641, 0.6546000000000001, 0.5853999999999999, 0.3789, 0.20720000000000005, 0.029000000000000026], "L2AdditiveUniformNoiseAttack()": [0.6819, 0.6819, 0.6819999999999999, 0.6819, 0.6819, 0.6819999999999999, 0.6819, 0.6820999999999999, 0.6819999999999999, 0.6819999999999999, 0.6824, 0.6827, 0.6823, 0.6827], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6819, 0.6814, 0.6809000000000001, 0.6803, 0.6799999999999999, 0.6789000000000001, 0.6772, 0.6726, 0.6628000000000001, 0.6528, 0.5802, 0.3752, 0.21299999999999997, 0.038000000000000034], "robust_accuracy": [0.6819, 0.6814, 0.6809000000000001, 0.6803, 0.6799999999999999, 0.6789000000000001, 0.6772, 0.6726, 0.6628000000000001, 0.6528, 0.5799000000000001, 0.37160000000000004, 0.20030000000000003, 0.0262]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6813, 0.6808000000000001, 0.6805, 0.6800999999999999, 0.6796, 0.6783, 0.6763, 0.6714, 0.6631, 0.6551, 0.5891, 0.406, 0.2641, 0.06679999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6813, 0.6808000000000001, 0.6806, 0.6803, 0.6799999999999999, 0.6791, 0.6772, 0.6727000000000001, 0.6664, 0.6585, 0.6016, 0.4345, 0.2894, 0.06420000000000003], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6813, 0.6808000000000001, 0.6805, 0.6800999999999999, 0.6796, 0.6783, 0.6763, 0.6714, 0.6629, 0.6547000000000001, 0.5873999999999999, 0.3912, 0.2237, 0.02949999999999997], "L2AdditiveUniformNoiseAttack()": [0.6813, 0.6813, 0.6813, 0.6813, 0.6813, 0.6812, 0.6813, 0.6816, 0.6814, 0.6811, 0.6814, 0.6815, 0.6804, 0.6800999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6813, 0.6808000000000001, 0.6805, 0.6800999999999999, 0.6795, 0.6780999999999999, 0.6759, 0.6704, 0.6616, 0.6532, 0.5808, 0.38670000000000004, 0.23029999999999995, 0.03920000000000001], "robust_accuracy": [0.6813, 0.6808000000000001, 0.6805, 0.6800999999999999, 0.6795, 0.6780999999999999, 0.6759, 0.6704, 0.6616, 0.6532, 0.5808, 0.3833, 0.21789999999999998, 0.027900000000000036]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6788000000000001, 0.6783, 0.6779, 0.6775, 0.6767000000000001, 0.6752, 0.6739999999999999, 0.669, 0.6597999999999999, 0.6496, 0.5791999999999999, 0.3902, 0.24560000000000004, 0.06169999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6788000000000001, 0.6784, 0.6779999999999999, 0.6776, 0.677, 0.6758, 0.6744, 0.6707000000000001, 0.6632, 0.6541, 0.5957, 0.4204, 0.2672, 0.05879999999999996], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6788000000000001, 0.6783, 0.6779, 0.6775, 0.6766, 0.6751, 0.6739999999999999, 0.669, 0.6597999999999999, 0.6488, 0.5776, 0.36819999999999997, 0.20330000000000004, 0.026100000000000012], "L2AdditiveUniformNoiseAttack()": [0.6788000000000001, 0.6788000000000001, 0.6788000000000001, 0.6788000000000001, 0.6787000000000001, 0.6788000000000001, 0.6787000000000001, 0.6788000000000001, 0.6788000000000001, 0.679, 0.6789000000000001, 0.6791, 0.6792, 0.6773], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6788000000000001, 0.6782, 0.6778, 0.6771, 0.6763, 0.675, 0.6737, 0.6685, 0.6582, 0.6475, 0.5720000000000001, 0.3641, 0.21089999999999998, 0.033299999999999996], "robust_accuracy": [0.6788000000000001, 0.6782, 0.6778, 0.6771, 0.6763, 0.675, 0.6737, 0.6685, 0.6582, 0.6475, 0.5719000000000001, 0.35950000000000004, 0.1985, 0.023599999999999954]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6901999999999999, 0.6900999999999999, 0.6898, 0.6897, 0.6893, 0.6886, 0.6861999999999999, 0.6807000000000001, 0.6733, 0.6638999999999999, 0.5981000000000001, 0.41080000000000005, 0.25780000000000003, 0.06820000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6901999999999999, 0.6900999999999999, 0.6899, 0.6898, 0.6894, 0.6890000000000001, 0.6872, 0.6827, 0.6756, 0.6686000000000001, 0.6112, 0.43920000000000003, 0.2811, 0.062000000000000055], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6901999999999999, 0.6900999999999999, 0.6898, 0.6897, 0.6893, 0.6886, 0.6861999999999999, 0.6807000000000001, 0.6731, 0.6638, 0.5959, 0.38870000000000005, 0.21450000000000002, 0.02859999999999996], "L2AdditiveUniformNoiseAttack()": [0.6901999999999999, 0.6901999999999999, 0.6901999999999999, 0.6901999999999999, 0.6901999999999999, 0.6903, 0.6901999999999999, 0.6903, 0.6901999999999999, 0.6907, 0.6909000000000001, 0.6895, 0.6905, 0.6891], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6901999999999999, 0.69, 0.6898, 0.6897, 0.6892, 0.6886, 0.6859999999999999, 0.6799, 0.6725, 0.6615, 0.5897, 0.38570000000000004, 0.2207, 0.03849999999999998], "robust_accuracy": [0.6901999999999999, 0.69, 0.6898, 0.6897, 0.6892, 0.6886, 0.6859999999999999, 0.6799, 0.6725, 0.6615, 0.5893999999999999, 0.38139999999999996, 0.20799999999999996, 0.026900000000000035]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6989000000000001, 0.6981999999999999, 0.6971, 0.6965, 0.6961999999999999, 0.6953, 0.6940999999999999, 0.6883, 0.6786, 0.6679999999999999, 0.5997, 0.4061, 0.2511, 0.06230000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6989000000000001, 0.6982999999999999, 0.6974, 0.6967, 0.6962999999999999, 0.6957, 0.6944, 0.6901999999999999, 0.6814, 0.6722, 0.6132, 0.4335, 0.2764, 0.05610000000000004], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6989000000000001, 0.6981999999999999, 0.6971, 0.6965, 0.6961999999999999, 0.6953, 0.6940999999999999, 0.6883, 0.6784, 0.6678, 0.5972999999999999, 0.3829, 0.21099999999999997, 0.024700000000000055], "L2AdditiveUniformNoiseAttack()": [0.6989000000000001, 0.6989000000000001, 0.6989000000000001, 0.6989000000000001, 0.6989000000000001, 0.6990000000000001, 0.6989000000000001, 0.6989000000000001, 0.6990000000000001, 0.6990000000000001, 0.6981999999999999, 0.6974, 0.6981999999999999, 0.6970000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6989000000000001, 0.6980999999999999, 0.6971, 0.6964, 0.6958, 0.6953, 0.694, 0.6875, 0.6766, 0.6656, 0.5903, 0.3791, 0.21550000000000002, 0.03300000000000003], "robust_accuracy": [0.6989000000000001, 0.6980999999999999, 0.6971, 0.6964, 0.6958, 0.6953, 0.694, 0.6875, 0.6766, 0.6656, 0.5901000000000001, 0.37460000000000004, 0.2047, 0.0232]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6617, 0.6607000000000001, 0.6602, 0.6598999999999999, 0.6591, 0.6579999999999999, 0.6561, 0.6513, 0.6402, 0.631, 0.5668, 0.3842, 0.2398, 0.06479999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6617, 0.6607000000000001, 0.6602, 0.6602, 0.6594, 0.6585, 0.6569, 0.6531, 0.6441, 0.6355999999999999, 0.5791, 0.4125, 0.2601, 0.06059999999999999], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6617, 0.6607000000000001, 0.6602, 0.6598999999999999, 0.6591, 0.6579999999999999, 0.656, 0.6512, 0.6401, 0.6309, 0.565, 0.36660000000000004, 0.20399999999999996, 0.026499999999999968], "L2AdditiveUniformNoiseAttack()": [0.6617, 0.6617, 0.6617, 0.6617, 0.6616, 0.6616, 0.6615, 0.6617, 0.6614, 0.6615, 0.6613, 0.661, 0.6615, 0.6583], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6617, 0.6607000000000001, 0.6602, 0.6597, 0.659, 0.6579999999999999, 0.6556, 0.6508, 0.639, 0.6294, 0.5611999999999999, 0.36250000000000004, 0.2106, 0.03700000000000003], "robust_accuracy": [0.6617, 0.6607000000000001, 0.6602, 0.6597, 0.659, 0.6579999999999999, 0.6556, 0.6508, 0.639, 0.6294, 0.5607, 0.3587, 0.19910000000000005, 0.025499999999999967]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6683, 0.6678, 0.6674, 0.6672, 0.6667000000000001, 0.6655, 0.6638999999999999, 0.6583, 0.6507000000000001, 0.6416, 0.5759000000000001, 0.38849999999999996, 0.23750000000000004, 0.06259999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6683, 0.6678999999999999, 0.6674, 0.6673, 0.6669, 0.6658999999999999, 0.6644, 0.6605, 0.6531, 0.6463, 0.5897, 0.41490000000000005, 0.2583, 0.05710000000000004], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6683, 0.6678, 0.6674, 0.6672, 0.6667000000000001, 0.6655, 0.6638999999999999, 0.6583, 0.6507000000000001, 0.6413, 0.5732999999999999, 0.3667, 0.19789999999999996, 0.024800000000000044], "L2AdditiveUniformNoiseAttack()": [0.6683, 0.6683, 0.6683, 0.6683, 0.6683, 0.6683, 0.6683, 0.6683, 0.6682, 0.6681, 0.6679999999999999, 0.6677, 0.6681, 0.6686000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6683, 0.6678, 0.6674, 0.6671, 0.6665, 0.6653, 0.6637, 0.6578999999999999, 0.6494, 0.6402, 0.5700000000000001, 0.3661, 0.20650000000000002, 0.03839999999999999], "robust_accuracy": [0.6683, 0.6678, 0.6674, 0.6671, 0.6665, 0.6653, 0.6637, 0.6578999999999999, 0.6494, 0.6401, 0.5697, 0.3598, 0.19279999999999997, 0.023700000000000054]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.681, 0.6806, 0.6800999999999999, 0.6799, 0.6795, 0.6783, 0.6760999999999999, 0.6709, 0.6606000000000001, 0.652, 0.5905, 0.42569999999999997, 0.28290000000000004, 0.09360000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.681, 0.6807000000000001, 0.6802, 0.6799999999999999, 0.6797, 0.6789000000000001, 0.6767000000000001, 0.6722, 0.6643, 0.6555, 0.6033999999999999, 0.45089999999999997, 0.30379999999999996, 0.08540000000000003], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.681, 0.6806, 0.6800999999999999, 0.6799, 0.6794, 0.6783, 0.6760999999999999, 0.6708000000000001, 0.6607000000000001, 0.652, 0.5886, 0.40549999999999997, 0.24350000000000005, 0.043300000000000005], "L2AdditiveUniformNoiseAttack()": [0.681, 0.681, 0.681, 0.6809000000000001, 0.681, 0.681, 0.681, 0.681, 0.6807000000000001, 0.6809000000000001, 0.6804, 0.6797, 0.6800999999999999, 0.6767000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.681, 0.6806, 0.6800999999999999, 0.6798, 0.6791, 0.6779999999999999, 0.6757, 0.6703, 0.6593, 0.6498999999999999, 0.5832999999999999, 0.39980000000000004, 0.24880000000000002, 0.05589999999999995], "robust_accuracy": [0.681, 0.6806, 0.6800999999999999, 0.6798, 0.6791, 0.6779999999999999, 0.6757, 0.6703, 0.6593, 0.6498999999999999, 0.5829, 0.39570000000000005, 0.23740000000000006, 0.04159999999999997]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6517, 0.6509, 0.6504, 0.6498999999999999, 0.6492, 0.6484, 0.6469, 0.64, 0.6315999999999999, 0.6226, 0.5529999999999999, 0.36829999999999996, 0.23070000000000002, 0.060699999999999976], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6517, 0.6509, 0.6506000000000001, 0.65, 0.6496999999999999, 0.6488, 0.6472, 0.6427, 0.6341, 0.626, 0.5675, 0.39359999999999995, 0.2522, 0.05940000000000001], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6517, 0.6509, 0.6504, 0.6498999999999999, 0.6492, 0.6484, 0.6469, 0.64, 0.6313, 0.622, 0.5512, 0.3469, 0.19469999999999998, 0.03090000000000004], "L2AdditiveUniformNoiseAttack()": [0.6517, 0.6517, 0.6517, 0.6517, 0.6517, 0.6517, 0.6517, 0.6515, 0.6516, 0.6516, 0.6513, 0.6506000000000001, 0.6513, 0.6476999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6517, 0.6509, 0.6503, 0.6496, 0.6491, 0.6484, 0.6462, 0.6394, 0.6299, 0.6209, 0.5482, 0.3498, 0.20489999999999997, 0.03920000000000001], "robust_accuracy": [0.6517, 0.6509, 0.6503, 0.6496, 0.6491, 0.6484, 0.6462, 0.6394, 0.6299, 0.6208, 0.5477000000000001, 0.3429, 0.19240000000000002, 0.029200000000000004]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6743, 0.6738999999999999, 0.673, 0.6728000000000001, 0.6723, 0.6713, 0.6694, 0.6648000000000001, 0.6556, 0.6468, 0.5831, 0.4072, 0.2692, 0.08130000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6743, 0.6742, 0.6732, 0.6729, 0.6727000000000001, 0.6717, 0.6700999999999999, 0.6667000000000001, 0.6581, 0.6505000000000001, 0.5946, 0.43010000000000004, 0.2853, 0.06979999999999997], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6743, 0.6738999999999999, 0.673, 0.6728000000000001, 0.6723, 0.6713, 0.6693, 0.6647000000000001, 0.6555, 0.6468, 0.5806, 0.3873, 0.22040000000000004, 0.0353], "L2AdditiveUniformNoiseAttack()": [0.6743, 0.6743, 0.6743, 0.6743, 0.6743, 0.6743, 0.6743, 0.6743, 0.6744, 0.6739999999999999, 0.6738, 0.675, 0.6746, 0.6719999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6743, 0.6738, 0.673, 0.6727000000000001, 0.6719999999999999, 0.671, 0.6692, 0.6641, 0.6538999999999999, 0.6441, 0.5756, 0.38560000000000005, 0.2308, 0.04610000000000003], "robust_accuracy": [0.6743, 0.6738, 0.673, 0.6727000000000001, 0.6719999999999999, 0.671, 0.6692, 0.6641, 0.6538999999999999, 0.6441, 0.575, 0.3808, 0.2156, 0.03369999999999995]}}, "16": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7048, 0.7041999999999999, 0.7035, 0.7033, 0.7027, 0.7013, 0.6990000000000001, 0.6941999999999999, 0.6843, 0.6735, 0.5992, 0.40280000000000005, 0.255, 0.07420000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7048, 0.7042999999999999, 0.7036, 0.7035, 0.7030000000000001, 0.7021, 0.6995, 0.6954, 0.6876, 0.6780999999999999, 0.6148, 0.4274, 0.26880000000000004, 0.06030000000000002], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7048, 0.7041999999999999, 0.7035, 0.7033, 0.7027, 0.7013, 0.6990000000000001, 0.6940999999999999, 0.6840999999999999, 0.6734, 0.5965, 0.3758, 0.2077, 0.02629999999999999], "L2AdditiveUniformNoiseAttack()": [0.7048, 0.7048, 0.7048, 0.7049000000000001, 0.7049000000000001, 0.7048, 0.7049000000000001, 0.7049000000000001, 0.7048, 0.7046, 0.7051000000000001, 0.7037, 0.704, 0.7048], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7048, 0.7041999999999999, 0.7035, 0.7031000000000001, 0.7024, 0.7010000000000001, 0.6988, 0.6936, 0.683, 0.6715, 0.5925, 0.377, 0.21799999999999997, 0.04039999999999999], "robust_accuracy": [0.7048, 0.7041999999999999, 0.7035, 0.7031000000000001, 0.7024, 0.7010000000000001, 0.6988, 0.6936, 0.683, 0.6715, 0.5922000000000001, 0.37039999999999995, 0.20240000000000002, 0.025599999999999956]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7002999999999999, 0.7001, 0.6997, 0.6990000000000001, 0.6987, 0.6977, 0.6960999999999999, 0.6919, 0.6820999999999999, 0.6716, 0.6067, 0.42390000000000005, 0.2762, 0.08620000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7002999999999999, 0.7001, 0.6997, 0.6993, 0.6987, 0.6979, 0.6968, 0.6932, 0.6855, 0.6762, 0.6201, 0.4487, 0.28959999999999997, 0.07140000000000002], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7002999999999999, 0.7001, 0.6997, 0.6990000000000001, 0.6987, 0.6977, 0.6960999999999999, 0.6919, 0.6820999999999999, 0.6712, 0.604, 0.3992, 0.2258, 0.03510000000000002], "L2AdditiveUniformNoiseAttack()": [0.7002999999999999, 0.7002999999999999, 0.7002999999999999, 0.7002999999999999, 0.7001999999999999, 0.7002999999999999, 0.7004, 0.7002999999999999, 0.7002999999999999, 0.7002999999999999, 0.6999, 0.7004, 0.7014, 0.698], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7002999999999999, 0.7001, 0.6996, 0.6988, 0.6984, 0.6977, 0.6959, 0.6916, 0.6802, 0.6694, 0.5989, 0.39790000000000003, 0.23950000000000005, 0.04710000000000003], "robust_accuracy": [0.7002999999999999, 0.7001, 0.6996, 0.6988, 0.6984, 0.6977, 0.6959, 0.6916, 0.6802, 0.6694, 0.5984, 0.39170000000000005, 0.22109999999999996, 0.03320000000000001]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6914, 0.6904, 0.69, 0.6895, 0.6893, 0.6884, 0.6867, 0.6819, 0.6713, 0.6612, 0.5889, 0.39390000000000003, 0.2429, 0.06579999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6914, 0.6906, 0.6900999999999999, 0.6898, 0.6894, 0.6888000000000001, 0.6873, 0.6831, 0.6739999999999999, 0.6658999999999999, 0.6011, 0.42010000000000003, 0.2609, 0.05359999999999998], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6914, 0.6903, 0.69, 0.6895, 0.6893, 0.6884, 0.6867, 0.6819, 0.6713, 0.661, 0.5861000000000001, 0.36850000000000005, 0.19430000000000003, 0.023399999999999976], "L2AdditiveUniformNoiseAttack()": [0.6914, 0.6914, 0.6914, 0.6914, 0.6914, 0.6915, 0.6914, 0.6913, 0.6916, 0.6914, 0.6912, 0.6916, 0.6908000000000001, 0.6903], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6914, 0.6903, 0.69, 0.6895, 0.6891, 0.6881999999999999, 0.6863, 0.6814, 0.6698, 0.6588, 0.5789, 0.36339999999999995, 0.20030000000000003, 0.03249999999999997], "robust_accuracy": [0.6914, 0.6903, 0.69, 0.6895, 0.6891, 0.6881999999999999, 0.6863, 0.6814, 0.6698, 0.6588, 0.5785, 0.35729999999999995, 0.18689999999999996, 0.022599999999999953]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6938, 0.6930000000000001, 0.6928000000000001, 0.6926, 0.6917, 0.6906, 0.6893, 0.6851, 0.6759999999999999, 0.6673, 0.597, 0.4113, 0.268, 0.07920000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6938, 0.6931, 0.6928000000000001, 0.6928000000000001, 0.6924, 0.6909000000000001, 0.6899, 0.6863, 0.679, 0.6705, 0.6099, 0.43410000000000004, 0.2844, 0.06410000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6938, 0.6930000000000001, 0.6928000000000001, 0.6926, 0.6917, 0.6906, 0.6893, 0.6851, 0.6759, 0.667, 0.5943, 0.3889, 0.21699999999999997, 0.029299999999999993], "L2AdditiveUniformNoiseAttack()": [0.6938, 0.6938, 0.6938, 0.6938, 0.6938, 0.6938, 0.6938, 0.6939, 0.6938, 0.6935, 0.694, 0.6930000000000001, 0.6930000000000001, 0.6903], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6938, 0.6930000000000001, 0.6928000000000001, 0.6925, 0.6915, 0.6905, 0.6889000000000001, 0.6846, 0.6744, 0.6649, 0.5891, 0.38380000000000003, 0.2267, 0.041100000000000025], "robust_accuracy": [0.6938, 0.6930000000000001, 0.6928000000000001, 0.6925, 0.6915, 0.6905, 0.6889000000000001, 0.6846, 0.6744, 0.6649, 0.5889, 0.37860000000000005, 0.2106, 0.028100000000000014]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6799999999999999, 0.6798, 0.6795, 0.6789000000000001, 0.6786, 0.6774, 0.6753, 0.671, 0.6624, 0.6527000000000001, 0.5777, 0.3832, 0.23360000000000003, 0.053200000000000025], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6799999999999999, 0.6798, 0.6796, 0.6794, 0.6788000000000001, 0.6779999999999999, 0.6760999999999999, 0.6725, 0.6644, 0.6577, 0.5917, 0.4123, 0.2491, 0.04200000000000004], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6799999999999999, 0.6798, 0.6795, 0.6789000000000001, 0.6786, 0.6774, 0.6753, 0.671, 0.6623, 0.6526000000000001, 0.5747, 0.36129999999999995, 0.18769999999999998, 0.016900000000000026], "L2AdditiveUniformNoiseAttack()": [0.6799999999999999, 0.6799999999999999, 0.6799999999999999, 0.6799999999999999, 0.6799999999999999, 0.6799, 0.6799, 0.6800999999999999, 0.6799999999999999, 0.6798, 0.6795, 0.6805, 0.6799999999999999, 0.6802], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6799999999999999, 0.6798, 0.6795, 0.6788000000000001, 0.6786, 0.6772, 0.6752, 0.6705, 0.6614, 0.6517, 0.5717, 0.36150000000000004, 0.19779999999999998, 0.023499999999999965], "robust_accuracy": [0.6799999999999999, 0.6798, 0.6795, 0.6788000000000001, 0.6786, 0.6772, 0.6752, 0.6705, 0.6614, 0.6517, 0.5712999999999999, 0.3547, 0.18279999999999996, 0.015199999999999991]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7161, 0.7161, 0.7159, 0.7154, 0.7148, 0.7145, 0.7121, 0.7075, 0.6968, 0.6876, 0.6148, 0.4145, 0.2572, 0.0655], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7161, 0.7161, 0.7159, 0.7155, 0.7152000000000001, 0.7147, 0.7128, 0.7094, 0.6999, 0.6921999999999999, 0.629, 0.44320000000000004, 0.27859999999999996, 0.05459999999999998], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7161, 0.7161, 0.7159, 0.7154, 0.7148, 0.7145, 0.7121, 0.7075, 0.6967, 0.6874, 0.613, 0.38849999999999996, 0.20889999999999997, 0.0232], "L2AdditiveUniformNoiseAttack()": [0.7161, 0.7161, 0.7161, 0.7161, 0.7162, 0.7162, 0.7162, 0.7162999999999999, 0.7162999999999999, 0.7162999999999999, 0.7167, 0.716, 0.7168, 0.7179], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7161, 0.7161, 0.7158, 0.7152000000000001, 0.7148, 0.7145, 0.712, 0.7071000000000001, 0.6962999999999999, 0.6852, 0.6087, 0.38549999999999995, 0.21709999999999996, 0.03510000000000002], "robust_accuracy": [0.7161, 0.7161, 0.7158, 0.7152000000000001, 0.7148, 0.7145, 0.712, 0.7071000000000001, 0.6962999999999999, 0.6852, 0.6085, 0.37970000000000004, 0.20320000000000005, 0.022499999999999964]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6961999999999999, 0.6955, 0.6949000000000001, 0.6942999999999999, 0.6940999999999999, 0.6931, 0.6915, 0.6861999999999999, 0.6772, 0.6667000000000001, 0.5913999999999999, 0.38749999999999996, 0.23609999999999998, 0.0665], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6961999999999999, 0.6955, 0.6951, 0.6948, 0.6942999999999999, 0.6937, 0.6919, 0.6877, 0.6806, 0.6720999999999999, 0.6066, 0.4173, 0.25339999999999996, 0.058699999999999974], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6961999999999999, 0.6955, 0.6949000000000001, 0.6942999999999999, 0.6940999999999999, 0.6931, 0.6915, 0.6861999999999999, 0.6771, 0.6666000000000001, 0.5878, 0.3638, 0.19279999999999997, 0.028200000000000003], "L2AdditiveUniformNoiseAttack()": [0.6961999999999999, 0.6961999999999999, 0.6961999999999999, 0.6961999999999999, 0.6962999999999999, 0.6959, 0.696, 0.6959, 0.6961999999999999, 0.6961999999999999, 0.6960999999999999, 0.6961999999999999, 0.6961999999999999, 0.6938], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6961999999999999, 0.6955, 0.6949000000000001, 0.6942999999999999, 0.6940999999999999, 0.6931, 0.6912, 0.6858, 0.6758, 0.6645, 0.5849, 0.362, 0.20420000000000005, 0.03969999999999996], "robust_accuracy": [0.6961999999999999, 0.6955, 0.6949000000000001, 0.6942999999999999, 0.6940999999999999, 0.6931, 0.6912, 0.6858, 0.6758, 0.6645, 0.5842, 0.356, 0.18930000000000002, 0.027000000000000024]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7008, 0.6999, 0.6995, 0.6989000000000001, 0.6985, 0.6973, 0.6957, 0.6903, 0.6795, 0.6707000000000001, 0.5924, 0.38780000000000003, 0.24260000000000004, 0.0605], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7008, 0.7001, 0.6997, 0.6992, 0.6986, 0.6979, 0.6966, 0.6917, 0.6833, 0.6752, 0.6078, 0.4154, 0.2562, 0.0484], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7008, 0.6999, 0.6995, 0.6989000000000001, 0.6985, 0.6973, 0.6957, 0.6903, 0.6796, 0.6705, 0.5899, 0.36229999999999996, 0.19330000000000003, 0.02070000000000005], "L2AdditiveUniformNoiseAttack()": [0.7008, 0.7008, 0.7008, 0.7008, 0.7008, 0.7008, 0.7007, 0.7010000000000001, 0.7011000000000001, 0.7008, 0.7006, 0.7001999999999999, 0.7008, 0.7009000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7008, 0.6999, 0.6994, 0.6987, 0.6981999999999999, 0.6973, 0.6954, 0.6899, 0.6782, 0.6686000000000001, 0.5863, 0.36360000000000003, 0.20689999999999997, 0.03159999999999996], "robust_accuracy": [0.7008, 0.6999, 0.6994, 0.6987, 0.6981999999999999, 0.6973, 0.6954, 0.6899, 0.6782, 0.6685, 0.5861000000000001, 0.357, 0.1895, 0.01980000000000004]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6956, 0.6954, 0.6947, 0.6942999999999999, 0.6937, 0.6929000000000001, 0.6914, 0.6868000000000001, 0.6749, 0.6642, 0.5954999999999999, 0.4094, 0.25770000000000004, 0.0686], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6956, 0.6954, 0.6948, 0.6944, 0.694, 0.6933, 0.6919, 0.6884, 0.6785, 0.6689, 0.6089, 0.43779999999999997, 0.2783, 0.05989999999999995], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6956, 0.6954, 0.6947, 0.6942999999999999, 0.6937, 0.6928000000000001, 0.6914, 0.6868000000000001, 0.6748000000000001, 0.6641, 0.593, 0.38759999999999994, 0.21599999999999997, 0.026100000000000012], "L2AdditiveUniformNoiseAttack()": [0.6956, 0.6956, 0.6956, 0.6956, 0.6956, 0.6956, 0.6956, 0.6957, 0.6957, 0.6959, 0.6953, 0.6958, 0.6958, 0.6927], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6956, 0.6954, 0.6945, 0.6940999999999999, 0.6937, 0.6927, 0.6912, 0.6855, 0.6737, 0.6629, 0.5889, 0.38580000000000003, 0.22529999999999994, 0.03269999999999995], "robust_accuracy": [0.6956, 0.6954, 0.6945, 0.6940999999999999, 0.6937, 0.6927, 0.6912, 0.6855, 0.6737, 0.6629, 0.5889, 0.38029999999999997, 0.21199999999999997, 0.024599999999999955]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6858, 0.6854, 0.6852, 0.6845, 0.6840999999999999, 0.6835, 0.6818, 0.6786, 0.6688000000000001, 0.6575, 0.5918, 0.4024, 0.2579, 0.06669999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6858, 0.6854, 0.6853, 0.6846, 0.6843, 0.6836, 0.6819999999999999, 0.6797, 0.6726, 0.6621, 0.6052, 0.4304, 0.2784, 0.05879999999999996], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6858, 0.6854, 0.6852, 0.6845, 0.6840999999999999, 0.6835, 0.6818, 0.6786, 0.6688000000000001, 0.6573, 0.5896, 0.37960000000000005, 0.20909999999999995, 0.028000000000000025], "L2AdditiveUniformNoiseAttack()": [0.6858, 0.6858, 0.6858, 0.6858, 0.6858, 0.6859, 0.6858, 0.6859, 0.6857, 0.6859, 0.6856, 0.6847, 0.6859999999999999, 0.6860999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6858, 0.6853, 0.6851, 0.6843, 0.6839, 0.6832, 0.6818, 0.6776, 0.6666000000000001, 0.6548, 0.5820000000000001, 0.3692, 0.20950000000000002, 0.03520000000000001], "robust_accuracy": [0.6858, 0.6853, 0.6851, 0.6843, 0.6839, 0.6832, 0.6818, 0.6776, 0.6666000000000001, 0.6548, 0.5817, 0.36629999999999996, 0.1986, 0.025900000000000034]}}, "32": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7090000000000001, 0.7088, 0.7075, 0.7071000000000001, 0.7062999999999999, 0.7048, 0.7031000000000001, 0.6996, 0.6897, 0.6794, 0.6079, 0.41269999999999996, 0.259, 0.06620000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7090000000000001, 0.7089, 0.708, 0.7074, 0.7069, 0.7055, 0.7036, 0.7004, 0.6925, 0.6838, 0.623, 0.4405, 0.27270000000000005, 0.049699999999999966], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7090000000000001, 0.7088, 0.7075, 0.7071000000000001, 0.7062999999999999, 0.7048, 0.7031000000000001, 0.6995, 0.6897, 0.6794, 0.6054999999999999, 0.38670000000000004, 0.20130000000000003, 0.02100000000000002], "L2AdditiveUniformNoiseAttack()": [0.7090000000000001, 0.7090000000000001, 0.7090000000000001, 0.7090000000000001, 0.7091000000000001, 0.7090000000000001, 0.7090000000000001, 0.7091000000000001, 0.7090000000000001, 0.7090000000000001, 0.7087, 0.7078, 0.7069, 0.7071000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7090000000000001, 0.7087, 0.7075, 0.7070000000000001, 0.7061, 0.7048, 0.7029000000000001, 0.6990000000000001, 0.6888000000000001, 0.6779999999999999, 0.601, 0.3872, 0.21689999999999998, 0.033499999999999974], "robust_accuracy": [0.7090000000000001, 0.7087, 0.7075, 0.7070000000000001, 0.7061, 0.7048, 0.7029000000000001, 0.6990000000000001, 0.6888000000000001, 0.6779999999999999, 0.6006, 0.37970000000000004, 0.19669999999999999, 0.020199999999999996]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6891, 0.6888000000000001, 0.6884, 0.6879, 0.6874, 0.6868000000000001, 0.6848000000000001, 0.6804, 0.6712, 0.6617, 0.5953999999999999, 0.42090000000000005, 0.278, 0.09870000000000001], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6891, 0.6890000000000001, 0.6885, 0.6883, 0.6877, 0.687, 0.6856, 0.6823, 0.6734, 0.665, 0.6091, 0.44210000000000005, 0.29200000000000004, 0.08050000000000002], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6891, 0.6888000000000001, 0.6884, 0.6879, 0.6874, 0.6868000000000001, 0.6848000000000001, 0.6804, 0.6712, 0.6613, 0.5932999999999999, 0.3942, 0.23029999999999995, 0.04049999999999998], "L2AdditiveUniformNoiseAttack()": [0.6891, 0.6891, 0.6891, 0.6891, 0.6891, 0.6891, 0.6892, 0.6893, 0.6895, 0.6893, 0.6895, 0.6894, 0.6883, 0.6859999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6891, 0.6888000000000001, 0.6884, 0.6879, 0.6872, 0.6866, 0.6847, 0.6792, 0.6697, 0.6592, 0.5884, 0.39480000000000004, 0.24109999999999998, 0.05610000000000004], "robust_accuracy": [0.6891, 0.6888000000000001, 0.6884, 0.6879, 0.6872, 0.6866, 0.6847, 0.6792, 0.6697, 0.6591, 0.5883, 0.3873, 0.22629999999999995, 0.03939999999999999]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6776, 0.6776, 0.6774, 0.6765, 0.6762, 0.6751, 0.6734, 0.6682, 0.657, 0.6477999999999999, 0.581, 0.3819, 0.2339, 0.05830000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6776, 0.6776, 0.6775, 0.677, 0.6765, 0.6753, 0.6738999999999999, 0.6697, 0.6612, 0.6517, 0.5954999999999999, 0.4075, 0.2489, 0.044399999999999995], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6776, 0.6776, 0.6774, 0.6765, 0.6760999999999999, 0.6751, 0.6734, 0.6682, 0.657, 0.6476, 0.5778, 0.35850000000000004, 0.18320000000000003, 0.017800000000000038], "L2AdditiveUniformNoiseAttack()": [0.6776, 0.6776, 0.6776, 0.6776, 0.6776, 0.6776, 0.6776, 0.6778, 0.6779999999999999, 0.6783, 0.6780999999999999, 0.6779999999999999, 0.6773, 0.6752], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6776, 0.6776, 0.6774, 0.6765, 0.6758, 0.675, 0.673, 0.6676, 0.6561, 0.6461, 0.5739000000000001, 0.36219999999999997, 0.20099999999999996, 0.026800000000000046], "robust_accuracy": [0.6776, 0.6776, 0.6774, 0.6765, 0.6758, 0.675, 0.673, 0.6676, 0.6561, 0.6461, 0.5734, 0.3549, 0.18030000000000002, 0.017000000000000015]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.733, 0.7327, 0.7323999999999999, 0.7321, 0.7314, 0.7308, 0.7293000000000001, 0.724, 0.714, 0.704, 0.6299, 0.43100000000000005, 0.26559999999999995, 0.06730000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.733, 0.7328, 0.7323999999999999, 0.7323999999999999, 0.7317, 0.731, 0.7298, 0.7255, 0.7171000000000001, 0.7089, 0.6451, 0.45840000000000003, 0.2823, 0.05600000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.733, 0.7327, 0.7323999999999999, 0.7321, 0.7314, 0.7308, 0.7293000000000001, 0.724, 0.714, 0.7038, 0.6274, 0.40459999999999996, 0.21430000000000005, 0.024499999999999966], "L2AdditiveUniformNoiseAttack()": [0.733, 0.733, 0.733, 0.733, 0.733, 0.733, 0.733, 0.733, 0.7329, 0.733, 0.7334, 0.7332000000000001, 0.7321, 0.7318], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.733, 0.7327, 0.7323999999999999, 0.7318, 0.7313000000000001, 0.7306, 0.7287, 0.7226, 0.7128, 0.7017, 0.6207, 0.39859999999999995, 0.2177, 0.032299999999999995], "robust_accuracy": [0.733, 0.7327, 0.7323999999999999, 0.7318, 0.7313000000000001, 0.7306, 0.7287, 0.7226, 0.7128, 0.7017, 0.6207, 0.39249999999999996, 0.2047, 0.02300000000000002]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6845, 0.6836, 0.6831, 0.6825, 0.6823, 0.6815, 0.6800999999999999, 0.6764, 0.6676, 0.6583, 0.5906, 0.4113, 0.26780000000000004, 0.07850000000000001], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6845, 0.6839, 0.6832, 0.6828000000000001, 0.6825, 0.6820999999999999, 0.6806, 0.6774, 0.6704, 0.6618999999999999, 0.6038, 0.43579999999999997, 0.2841, 0.06359999999999999], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6845, 0.6836, 0.6831, 0.6825, 0.6823, 0.6815, 0.6800999999999999, 0.6763, 0.6676, 0.6579999999999999, 0.5879, 0.39049999999999996, 0.21899999999999997, 0.028299999999999992], "L2AdditiveUniformNoiseAttack()": [0.6845, 0.6845, 0.6845, 0.6845, 0.6845, 0.6845, 0.6844, 0.6844, 0.6845, 0.6841999999999999, 0.6840999999999999, 0.6838, 0.6847, 0.6846], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6845, 0.6835, 0.683, 0.6825, 0.6821999999999999, 0.6813, 0.6798, 0.6759999999999999, 0.6663, 0.6567000000000001, 0.5840000000000001, 0.39070000000000005, 0.23350000000000004, 0.041000000000000036], "robust_accuracy": [0.6845, 0.6835, 0.683, 0.6825, 0.6821999999999999, 0.6813, 0.6798, 0.6759999999999999, 0.6663, 0.6567000000000001, 0.5836, 0.38470000000000004, 0.21519999999999995, 0.02639999999999998]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7091000000000001, 0.7086, 0.7082999999999999, 0.7078, 0.7073, 0.7059, 0.7039, 0.6994, 0.69, 0.6798, 0.6041000000000001, 0.39859999999999995, 0.23409999999999997, 0.05049999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7091000000000001, 0.7088, 0.7082999999999999, 0.7081, 0.7076, 0.7063999999999999, 0.7047, 0.7007, 0.692, 0.6841999999999999, 0.6177, 0.4276, 0.25560000000000005, 0.042200000000000015], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7091000000000001, 0.7086, 0.7082999999999999, 0.7078, 0.7073, 0.7059, 0.7039, 0.6991, 0.6898, 0.6798, 0.6027, 0.37270000000000003, 0.1856, 0.01639999999999997], "L2AdditiveUniformNoiseAttack()": [0.7091000000000001, 0.7091000000000001, 0.7091000000000001, 0.7092, 0.7091000000000001, 0.7091000000000001, 0.7091000000000001, 0.7092, 0.7089, 0.7091000000000001, 0.7089, 0.7086, 0.7079, 0.7076], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7091000000000001, 0.7086, 0.7081999999999999, 0.7078, 0.7070000000000001, 0.7056, 0.7037, 0.6984, 0.6886, 0.6778, 0.5985, 0.37439999999999996, 0.20109999999999995, 0.022700000000000053], "robust_accuracy": [0.7091000000000001, 0.7086, 0.7081999999999999, 0.7078, 0.7070000000000001, 0.7056, 0.7037, 0.6984, 0.6886, 0.6778, 0.5981000000000001, 0.3671, 0.18169999999999997, 0.01539999999999997]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6918, 0.6915, 0.6906, 0.6901999999999999, 0.6897, 0.6884, 0.6859, 0.6820999999999999, 0.671, 0.6616, 0.5956, 0.40880000000000005, 0.26859999999999995, 0.07989999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6918, 0.6915, 0.6909000000000001, 0.6901999999999999, 0.6897, 0.6889000000000001, 0.6871, 0.6834, 0.6735, 0.6655, 0.6084, 0.43389999999999995, 0.28669999999999995, 0.06930000000000003], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6918, 0.6915, 0.6906, 0.6901999999999999, 0.6897, 0.6884, 0.6859, 0.6819999999999999, 0.6711, 0.6616, 0.5929, 0.38839999999999997, 0.22040000000000004, 0.03169999999999995], "L2AdditiveUniformNoiseAttack()": [0.6918, 0.6918, 0.6918, 0.6918, 0.6918, 0.6918, 0.6918, 0.6918, 0.6918, 0.6915, 0.6913, 0.6914, 0.6881999999999999, 0.6901999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6918, 0.6914, 0.6905, 0.6899, 0.6895, 0.6881999999999999, 0.6855, 0.6815, 0.6706, 0.6606000000000001, 0.5908, 0.39459999999999995, 0.23970000000000002, 0.045399999999999996], "robust_accuracy": [0.6918, 0.6914, 0.6905, 0.6899, 0.6895, 0.6881999999999999, 0.6855, 0.6815, 0.6706, 0.6606000000000001, 0.5904, 0.3863, 0.21789999999999998, 0.02980000000000005]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7025, 0.7021, 0.7013, 0.7010000000000001, 0.7001999999999999, 0.6993, 0.6974, 0.6927, 0.6826, 0.6724, 0.6034999999999999, 0.41169999999999995, 0.2632, 0.07479999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7025, 0.7021, 0.7015, 0.7013, 0.7009000000000001, 0.6999, 0.6980999999999999, 0.6944, 0.6849000000000001, 0.6765, 0.6187, 0.4397, 0.28169999999999995, 0.06499999999999995], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7025, 0.7021, 0.7013, 0.7010000000000001, 0.7001999999999999, 0.6993, 0.6974, 0.6925, 0.6825, 0.6722, 0.6013999999999999, 0.3913, 0.2148, 0.029200000000000004], "L2AdditiveUniformNoiseAttack()": [0.7025, 0.7026, 0.7026, 0.7026, 0.7025, 0.7024, 0.7026, 0.7025, 0.7026, 0.7026, 0.7033, 0.7031000000000001, 0.7026, 0.7039], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7025, 0.7021, 0.7013, 0.7010000000000001, 0.7001, 0.6991, 0.6968, 0.6923, 0.6819999999999999, 0.6712, 0.5993999999999999, 0.39390000000000003, 0.23229999999999995, 0.04090000000000005], "robust_accuracy": [0.7025, 0.7021, 0.7013, 0.7010000000000001, 0.7001, 0.6991, 0.6968, 0.6923, 0.6819999999999999, 0.6711, 0.5989, 0.3871, 0.2107, 0.027100000000000013]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7137, 0.7133, 0.7129, 0.7122999999999999, 0.712, 0.7109, 0.7090000000000001, 0.7042999999999999, 0.694, 0.6858, 0.6179, 0.4303, 0.278, 0.08150000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7137, 0.7134, 0.7131000000000001, 0.7128, 0.7121999999999999, 0.7115, 0.7097, 0.7056, 0.6965, 0.6896, 0.6309, 0.4524, 0.2942, 0.06330000000000002], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7137, 0.7133, 0.7129, 0.7122999999999999, 0.712, 0.7109, 0.7090000000000001, 0.7042999999999999, 0.6939, 0.6858, 0.615, 0.40269999999999995, 0.22509999999999997, 0.029299999999999993], "L2AdditiveUniformNoiseAttack()": [0.7137, 0.7137, 0.7137, 0.7137, 0.7137, 0.7137, 0.7138, 0.7138, 0.7134, 0.7137, 0.7136, 0.7133, 0.7121999999999999, 0.7111000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7137, 0.7132000000000001, 0.7128, 0.7121999999999999, 0.7118, 0.7107, 0.7085, 0.7029000000000001, 0.6925, 0.6838, 0.6075999999999999, 0.40090000000000003, 0.23329999999999995, 0.04169999999999996], "robust_accuracy": [0.7137, 0.7132000000000001, 0.7128, 0.7121999999999999, 0.7118, 0.7107, 0.7085, 0.7029000000000001, 0.6925, 0.6838, 0.6069, 0.39449999999999996, 0.21860000000000002, 0.027599999999999958]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7203999999999999, 0.7198, 0.7195, 0.719, 0.7183999999999999, 0.7179, 0.7158, 0.7106, 0.7022999999999999, 0.6920999999999999, 0.6196999999999999, 0.41659999999999997, 0.2613, 0.06799999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7203999999999999, 0.7199, 0.7196, 0.7192000000000001, 0.7187, 0.7182, 0.7168, 0.7121999999999999, 0.7045, 0.6967, 0.6334, 0.4434, 0.27580000000000005, 0.057499999999999996], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7203999999999999, 0.7198, 0.7195, 0.719, 0.7183999999999999, 0.7179, 0.7158, 0.7105, 0.7021999999999999, 0.6918, 0.6177, 0.39139999999999997, 0.20750000000000002, 0.02429999999999999], "L2AdditiveUniformNoiseAttack()": [0.7203999999999999, 0.7203999999999999, 0.7202999999999999, 0.7202999999999999, 0.7202999999999999, 0.7204999999999999, 0.7202999999999999, 0.7203999999999999, 0.7206, 0.7202, 0.7202999999999999, 0.7194, 0.7208, 0.7188], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7203999999999999, 0.7198, 0.7195, 0.7189, 0.7183999999999999, 0.7178, 0.7157, 0.7101, 0.7009000000000001, 0.6907, 0.6149, 0.3974, 0.2268, 0.0383], "robust_accuracy": [0.7203999999999999, 0.7198, 0.7195, 0.7189, 0.7183999999999999, 0.7178, 0.7157, 0.7101, 0.7009000000000001, 0.6907, 0.6143000000000001, 0.38849999999999996, 0.2037, 0.023299999999999987]}}}, "1": {"1": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6782, 0.6779, 0.6773, 0.6769000000000001, 0.6763, 0.675, 0.6731, 0.6664, 0.6535, 0.6413, 0.5581, 0.3345, 0.1835, 0.033499999999999974], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6782, 0.6779, 0.6774, 0.6771, 0.6768000000000001, 0.6754, 0.6738, 0.6682, 0.6579999999999999, 0.6471, 0.5754, 0.36250000000000004, 0.19630000000000003, 0.022299999999999986], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6782, 0.6779, 0.6773, 0.6769000000000001, 0.6763, 0.675, 0.6731, 0.6664, 0.6533, 0.6411, 0.5557000000000001, 0.3064, 0.13290000000000002, 0.008000000000000007], "L2AdditiveUniformNoiseAttack()": [0.6782, 0.6782, 0.6782, 0.6782, 0.6782, 0.6782, 0.6782, 0.6783, 0.6780999999999999, 0.6782, 0.679, 0.6783, 0.6794, 0.6784], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6782, 0.6779, 0.6773, 0.6768000000000001, 0.6760999999999999, 0.6746, 0.6725, 0.6655, 0.6513, 0.6392, 0.5485, 0.3026, 0.14670000000000005, 0.014399999999999968], "robust_accuracy": [0.6782, 0.6779, 0.6773, 0.6768000000000001, 0.6760999999999999, 0.6746, 0.6725, 0.6655, 0.6512, 0.6392, 0.5482, 0.29600000000000004, 0.12870000000000004, 0.007399999999999962]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6768000000000001, 0.6759999999999999, 0.6757, 0.6754, 0.675, 0.6739999999999999, 0.6712, 0.6647000000000001, 0.6544, 0.6446000000000001, 0.5649, 0.3477, 0.19120000000000004, 0.035499999999999976], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6768000000000001, 0.6760999999999999, 0.6758, 0.6755, 0.6753, 0.6742, 0.6725, 0.6666000000000001, 0.6569, 0.6485000000000001, 0.5821000000000001, 0.37229999999999996, 0.2037, 0.023599999999999954], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6768000000000001, 0.6759999999999999, 0.6757, 0.6754, 0.675, 0.6739999999999999, 0.6712, 0.6646000000000001, 0.6542, 0.6443, 0.5621, 0.3196, 0.13649999999999995, 0.006900000000000017], "L2AdditiveUniformNoiseAttack()": [0.6768000000000001, 0.6768000000000001, 0.6769000000000001, 0.6768000000000001, 0.6769000000000001, 0.6768000000000001, 0.6768000000000001, 0.6767000000000001, 0.6768000000000001, 0.6771, 0.6774, 0.6764, 0.6763, 0.6775], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6768000000000001, 0.6759999999999999, 0.6756, 0.6754, 0.6747000000000001, 0.6734, 0.6705, 0.6641, 0.6525000000000001, 0.6406000000000001, 0.5537000000000001, 0.31579999999999997, 0.14939999999999998, 0.01319999999999999], "robust_accuracy": [0.6768000000000001, 0.6759999999999999, 0.6756, 0.6754, 0.6747000000000001, 0.6734, 0.6705, 0.6641, 0.6525000000000001, 0.6406000000000001, 0.5536, 0.3087, 0.1321, 0.00649999999999995]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6769000000000001, 0.6767000000000001, 0.6762, 0.6758, 0.6751, 0.6742, 0.6724, 0.6685, 0.6583, 0.6467, 0.5695, 0.362, 0.20940000000000003, 0.0504], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6769000000000001, 0.6767000000000001, 0.6764, 0.6762, 0.6754, 0.6746, 0.6731, 0.6698, 0.6618999999999999, 0.6527000000000001, 0.5860000000000001, 0.38870000000000005, 0.22460000000000002, 0.037799999999999945], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6769000000000001, 0.6767000000000001, 0.6762, 0.6758, 0.6751, 0.6740999999999999, 0.6724, 0.6684, 0.6582, 0.6465000000000001, 0.5668, 0.33630000000000004, 0.16290000000000004, 0.014100000000000001], "L2AdditiveUniformNoiseAttack()": [0.6769000000000001, 0.6769000000000001, 0.6769000000000001, 0.6769000000000001, 0.677, 0.6769000000000001, 0.6769000000000001, 0.6769000000000001, 0.677, 0.677, 0.6773, 0.6764, 0.6779, 0.6758], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6769000000000001, 0.6767000000000001, 0.6762, 0.6757, 0.675, 0.6737, 0.6723, 0.6677, 0.657, 0.6449, 0.5614, 0.33620000000000005, 0.1764, 0.024399999999999977], "robust_accuracy": [0.6769000000000001, 0.6767000000000001, 0.6762, 0.6757, 0.675, 0.6737, 0.6723, 0.6677, 0.657, 0.6449, 0.5609999999999999, 0.32809999999999995, 0.1583, 0.0131]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6897, 0.6887, 0.6880999999999999, 0.6871, 0.6868000000000001, 0.6859, 0.6839999999999999, 0.6791, 0.6656, 0.6538999999999999, 0.5686, 0.3328, 0.17879999999999996, 0.047599999999999976], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6897, 0.6888000000000001, 0.6883, 0.6876, 0.687, 0.6863, 0.6848000000000001, 0.6804, 0.6697, 0.6588, 0.5855, 0.3549, 0.17190000000000005, 0.013499999999999956], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6897, 0.6887, 0.6880999999999999, 0.6871, 0.6868000000000001, 0.6859, 0.6839999999999999, 0.679, 0.6655, 0.6536, 0.5638000000000001, 0.29200000000000004, 0.10760000000000003, 0.0031999999999999806], "L2AdditiveUniformNoiseAttack()": [0.6897, 0.6897, 0.6897, 0.6896, 0.6897, 0.6896, 0.6895, 0.6898, 0.6896, 0.6896, 0.6895, 0.6900999999999999, 0.688, 0.6885], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6897, 0.6886, 0.6879, 0.687, 0.6867, 0.6855, 0.6836, 0.6783, 0.6637, 0.6514, 0.5553, 0.2944, 0.12519999999999998, 0.006900000000000017], "robust_accuracy": [0.6897, 0.6886, 0.6879, 0.687, 0.6867, 0.6855, 0.6836, 0.6783, 0.6637, 0.6514, 0.5545, 0.2815, 0.10389999999999999, 0.0030000000000000027]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6807000000000001, 0.6799999999999999, 0.6794, 0.6791, 0.6787000000000001, 0.6779999999999999, 0.6753, 0.6705, 0.6602, 0.6505000000000001, 0.5742, 0.35740000000000005, 0.19779999999999998, 0.039100000000000024], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6807000000000001, 0.6799999999999999, 0.6796, 0.6791, 0.6789000000000001, 0.6780999999999999, 0.6759, 0.6717, 0.6642, 0.6546000000000001, 0.5892, 0.3873, 0.2117, 0.028699999999999948], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6807000000000001, 0.6799999999999999, 0.6794, 0.6791, 0.6787000000000001, 0.6779999999999999, 0.6753, 0.6705, 0.6602, 0.6497999999999999, 0.5708, 0.33140000000000003, 0.14749999999999996, 0.009399999999999964], "L2AdditiveUniformNoiseAttack()": [0.6807000000000001, 0.6807000000000001, 0.6807000000000001, 0.6808000000000001, 0.6807000000000001, 0.6809000000000001, 0.6808000000000001, 0.6809000000000001, 0.681, 0.6807000000000001, 0.6803, 0.6803, 0.6809000000000001, 0.6808000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6807000000000001, 0.6799, 0.6792, 0.6789000000000001, 0.6785, 0.6773, 0.6746, 0.6696, 0.6585, 0.6465000000000001, 0.5637, 0.3286, 0.16200000000000003, 0.01539999999999997], "robust_accuracy": [0.6807000000000001, 0.6799, 0.6792, 0.6789000000000001, 0.6785, 0.6773, 0.6746, 0.6696, 0.6585, 0.6465000000000001, 0.5633, 0.32130000000000003, 0.1431, 0.008399999999999963]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6834, 0.6827, 0.6825, 0.6819999999999999, 0.6816, 0.6804, 0.6776, 0.6720999999999999, 0.6619999999999999, 0.6511, 0.5775, 0.3671, 0.20579999999999998, 0.046699999999999964], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6834, 0.6828000000000001, 0.6826, 0.6824, 0.6819, 0.6809000000000001, 0.6782, 0.6739999999999999, 0.6651, 0.6552, 0.5921000000000001, 0.39370000000000005, 0.22399999999999998, 0.03410000000000002], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6834, 0.6827, 0.6825, 0.6819999999999999, 0.6816, 0.6804, 0.6776, 0.6720999999999999, 0.6616, 0.651, 0.5743, 0.3379, 0.15949999999999998, 0.011099999999999999], "L2AdditiveUniformNoiseAttack()": [0.6834, 0.6833, 0.6834, 0.6834, 0.6833, 0.6835, 0.6834, 0.6834, 0.6834, 0.6833, 0.6839, 0.6837, 0.6828000000000001, 0.6819999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6834, 0.6827, 0.6825, 0.6819999999999999, 0.6812, 0.6797, 0.6772, 0.6709, 0.6598999999999999, 0.6489, 0.5678000000000001, 0.3355, 0.16920000000000002, 0.020100000000000007], "robust_accuracy": [0.6834, 0.6827, 0.6825, 0.6819999999999999, 0.6812, 0.6797, 0.6772, 0.6709, 0.6597999999999999, 0.6489, 0.567, 0.32820000000000005, 0.15349999999999997, 0.010099999999999998]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.681, 0.6804, 0.6800999999999999, 0.6797, 0.6794, 0.6786, 0.6766, 0.6706, 0.6606000000000001, 0.6508, 0.5708, 0.35719999999999996, 0.2025, 0.043300000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.681, 0.6805, 0.6802, 0.6798, 0.6795, 0.6791, 0.6775, 0.6727000000000001, 0.6638999999999999, 0.655, 0.5872999999999999, 0.38570000000000004, 0.2138, 0.028900000000000037], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.681, 0.6804, 0.6800999999999999, 0.6796, 0.6794, 0.6786, 0.6766, 0.6706, 0.6602, 0.6504, 0.5679000000000001, 0.32620000000000005, 0.1483, 0.01200000000000001], "L2AdditiveUniformNoiseAttack()": [0.681, 0.681, 0.681, 0.6809000000000001, 0.681, 0.6809000000000001, 0.681, 0.6809000000000001, 0.6809000000000001, 0.6809000000000001, 0.6813, 0.6804, 0.6808000000000001, 0.6808000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.681, 0.6804, 0.6800999999999999, 0.6796, 0.6793, 0.6782, 0.6759, 0.6699999999999999, 0.6582, 0.648, 0.5598000000000001, 0.3224, 0.15500000000000003, 0.016800000000000037], "robust_accuracy": [0.681, 0.6804, 0.6800999999999999, 0.6796, 0.6793, 0.6782, 0.6759, 0.6699999999999999, 0.6582, 0.648, 0.5595, 0.31520000000000004, 0.14039999999999997, 0.010299999999999976]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6644, 0.6638, 0.6632, 0.6624, 0.6618999999999999, 0.6612, 0.6588, 0.652, 0.6414, 0.6296999999999999, 0.5486, 0.33209999999999995, 0.18130000000000002, 0.0383], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6644, 0.6638999999999999, 0.6634, 0.6629, 0.6623, 0.6613, 0.6595, 0.6538999999999999, 0.6437999999999999, 0.6346, 0.5654, 0.35740000000000005, 0.1876, 0.01880000000000004], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6644, 0.6638, 0.6632, 0.6624, 0.6618999999999999, 0.6612, 0.6588, 0.652, 0.6414, 0.6293, 0.5443, 0.3024, 0.127, 0.006800000000000028], "L2AdditiveUniformNoiseAttack()": [0.6644, 0.6645, 0.6643, 0.6645, 0.6644, 0.6644, 0.6645, 0.6644, 0.6647000000000001, 0.6643, 0.665, 0.6644, 0.6642, 0.6625], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6644, 0.6638, 0.663, 0.6621, 0.6617999999999999, 0.6608, 0.6581, 0.6508, 0.6394, 0.6267, 0.5371, 0.3042, 0.14549999999999996, 0.012700000000000045], "robust_accuracy": [0.6644, 0.6638, 0.663, 0.6621, 0.6617999999999999, 0.6608, 0.6581, 0.6508, 0.6394, 0.6267, 0.5364, 0.29359999999999997, 0.12250000000000005, 0.005900000000000016]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6736, 0.6731, 0.6725, 0.6722, 0.6715, 0.6702, 0.6683, 0.6642, 0.6541, 0.6436999999999999, 0.5631999999999999, 0.3609, 0.21499999999999997, 0.05410000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6736, 0.6732, 0.6728000000000001, 0.6723, 0.6718, 0.6709, 0.6688000000000001, 0.6655, 0.6566000000000001, 0.6475, 0.5777, 0.38670000000000004, 0.2259, 0.03839999999999999], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6736, 0.6731, 0.6725, 0.6722, 0.6715, 0.6702, 0.6683, 0.6642, 0.6538999999999999, 0.6433, 0.5609, 0.3359, 0.16649999999999998, 0.01629999999999998], "L2AdditiveUniformNoiseAttack()": [0.6736, 0.6736, 0.6736, 0.6736, 0.6737, 0.6736, 0.6735, 0.6737, 0.6737, 0.6738, 0.6738, 0.6744, 0.6729, 0.6717], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6736, 0.6731, 0.6724, 0.6720999999999999, 0.6711, 0.6698999999999999, 0.6677, 0.663, 0.6517999999999999, 0.6401, 0.5550999999999999, 0.3339, 0.17669999999999997, 0.02429999999999999], "robust_accuracy": [0.6736, 0.6731, 0.6724, 0.6720999999999999, 0.6711, 0.6698999999999999, 0.6677, 0.663, 0.6517999999999999, 0.6401, 0.5549, 0.32730000000000004, 0.16159999999999997, 0.01529999999999998]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6792, 0.6787000000000001, 0.6779999999999999, 0.6774, 0.6766, 0.6748000000000001, 0.6719999999999999, 0.6659999999999999, 0.6537, 0.6436999999999999, 0.5649, 0.34319999999999995, 0.1885, 0.035800000000000054], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6792, 0.6788000000000001, 0.6783, 0.6776, 0.6771, 0.6757, 0.6727000000000001, 0.6681, 0.6566000000000001, 0.6481, 0.5813999999999999, 0.3732, 0.20109999999999995, 0.021700000000000053], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6792, 0.6787000000000001, 0.6779999999999999, 0.6774, 0.6766, 0.6748000000000001, 0.6719999999999999, 0.6659999999999999, 0.6536, 0.6434, 0.5617, 0.3164, 0.13880000000000003, 0.007600000000000051], "L2AdditiveUniformNoiseAttack()": [0.6792, 0.6792, 0.6792, 0.6792, 0.6792, 0.6792, 0.6791, 0.6792, 0.6791, 0.6794, 0.679, 0.6784, 0.6785, 0.6778], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6792, 0.6787000000000001, 0.6779, 0.6772, 0.6764, 0.6744, 0.6717, 0.6651, 0.6518999999999999, 0.6419, 0.5557000000000001, 0.3153, 0.1553, 0.012800000000000034], "robust_accuracy": [0.6792, 0.6787000000000001, 0.6779, 0.6772, 0.6764, 0.6744, 0.6717, 0.6651, 0.6518999999999999, 0.6419, 0.5550999999999999, 0.30779999999999996, 0.13439999999999996, 0.007399999999999962]}}, "2": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.683, 0.6829000000000001, 0.6819999999999999, 0.6818, 0.6814, 0.6807000000000001, 0.6782, 0.6723, 0.6635, 0.6532, 0.5786, 0.3732, 0.22040000000000004, 0.05059999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.683, 0.6829000000000001, 0.6824, 0.6819, 0.6816, 0.6812, 0.6794, 0.6743, 0.6666000000000001, 0.6577999999999999, 0.5917, 0.40159999999999996, 0.23309999999999997, 0.038000000000000034], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.683, 0.6829000000000001, 0.6819999999999999, 0.6818, 0.6814, 0.6807000000000001, 0.6782, 0.6720999999999999, 0.6634, 0.6526000000000001, 0.5759000000000001, 0.3459, 0.1693, 0.014100000000000001], "L2AdditiveUniformNoiseAttack()": [0.683, 0.683, 0.683, 0.683, 0.683, 0.683, 0.683, 0.6834, 0.6836, 0.6834, 0.6840999999999999, 0.6834, 0.6834, 0.6807000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.683, 0.6829000000000001, 0.6819999999999999, 0.6818, 0.6813, 0.6804, 0.6777, 0.6712, 0.6615, 0.6504, 0.5681, 0.34199999999999997, 0.18010000000000004, 0.021499999999999964], "robust_accuracy": [0.683, 0.6829000000000001, 0.6819999999999999, 0.6818, 0.6813, 0.6804, 0.6777, 0.6712, 0.6615, 0.6503, 0.5677, 0.33530000000000004, 0.16459999999999997, 0.01319999999999999]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6910000000000001, 0.6900999999999999, 0.6895, 0.6889000000000001, 0.688, 0.6873, 0.6852, 0.6809000000000001, 0.6704, 0.6602, 0.5775, 0.36160000000000003, 0.20379999999999998, 0.04169999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6910000000000001, 0.6901999999999999, 0.6896, 0.6893, 0.6887, 0.6876, 0.6859, 0.6827, 0.6744, 0.665, 0.594, 0.39059999999999995, 0.22140000000000004, 0.033299999999999996], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6910000000000001, 0.6900999999999999, 0.6895, 0.6889000000000001, 0.688, 0.6872, 0.6852, 0.6809000000000001, 0.6704, 0.6598999999999999, 0.5744, 0.3358, 0.1582, 0.012499999999999956], "L2AdditiveUniformNoiseAttack()": [0.6910000000000001, 0.6910000000000001, 0.6910000000000001, 0.6909000000000001, 0.6910000000000001, 0.6910000000000001, 0.6911, 0.6912, 0.6909000000000001, 0.6908000000000001, 0.6909000000000001, 0.6905, 0.6916, 0.6916], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6910000000000001, 0.69, 0.6895, 0.6888000000000001, 0.6879, 0.6871, 0.6851, 0.6804, 0.6695, 0.6589, 0.5696, 0.3395, 0.17179999999999995, 0.019499999999999962], "robust_accuracy": [0.6910000000000001, 0.69, 0.6895, 0.6888000000000001, 0.6879, 0.6871, 0.6851, 0.6804, 0.6695, 0.6589, 0.569, 0.3296, 0.15500000000000003, 0.011900000000000022]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6592, 0.6588, 0.6581, 0.6576, 0.6569, 0.6563, 0.6545000000000001, 0.6502, 0.6405000000000001, 0.6303000000000001, 0.5622, 0.36040000000000005, 0.2157, 0.052000000000000046], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6592, 0.6589, 0.6583, 0.6576, 0.6573, 0.6567000000000001, 0.6553, 0.6516, 0.6434, 0.6349, 0.5764, 0.38449999999999995, 0.22829999999999995, 0.038900000000000046], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6592, 0.6588, 0.6581, 0.6576, 0.6569, 0.6563, 0.6545000000000001, 0.6501, 0.6403, 0.6303000000000001, 0.5601, 0.33409999999999995, 0.17010000000000003, 0.015499999999999958], "L2AdditiveUniformNoiseAttack()": [0.6592, 0.6592, 0.6592, 0.6592, 0.6593, 0.6592, 0.6592, 0.6594, 0.6593, 0.6592, 0.6592, 0.6586000000000001, 0.6589, 0.6601], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6592, 0.6588, 0.6578999999999999, 0.6575, 0.6569, 0.6558999999999999, 0.6541, 0.6496, 0.6386000000000001, 0.6286, 0.5533, 0.3336, 0.18079999999999996, 0.0252], "robust_accuracy": [0.6592, 0.6588, 0.6578999999999999, 0.6575, 0.6569, 0.6558999999999999, 0.6541, 0.6496, 0.6386000000000001, 0.6286, 0.5530999999999999, 0.32620000000000005, 0.16459999999999997, 0.014800000000000035]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6907, 0.6901999999999999, 0.6896, 0.6887, 0.6884, 0.688, 0.6863, 0.6819, 0.6718999999999999, 0.6601, 0.5900000000000001, 0.3843, 0.22829999999999995, 0.053100000000000036], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6907, 0.6901999999999999, 0.6898, 0.6894, 0.6887, 0.6880999999999999, 0.6872, 0.6832, 0.6754, 0.6651, 0.6048, 0.41390000000000005, 0.24760000000000004, 0.04479999999999995], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6907, 0.6901999999999999, 0.6896, 0.6887, 0.6884, 0.688, 0.6863, 0.6819, 0.6717, 0.6593, 0.5872999999999999, 0.36040000000000005, 0.18179999999999996, 0.01849999999999996], "L2AdditiveUniformNoiseAttack()": [0.6907, 0.6907, 0.6907, 0.6907, 0.6907, 0.6907, 0.6907, 0.6907, 0.6907, 0.6906, 0.6903, 0.6909000000000001, 0.6925, 0.6921999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6907, 0.6900999999999999, 0.6896, 0.6887, 0.6881999999999999, 0.6877, 0.6859999999999999, 0.6812, 0.6705, 0.6567000000000001, 0.5826, 0.35760000000000003, 0.19279999999999997, 0.027100000000000013], "robust_accuracy": [0.6907, 0.6900999999999999, 0.6896, 0.6887, 0.6881999999999999, 0.6877, 0.6859999999999999, 0.6812, 0.6705, 0.6566000000000001, 0.5823, 0.35129999999999995, 0.17600000000000005, 0.017199999999999993]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6935, 0.6932, 0.6926, 0.6921999999999999, 0.6913, 0.69, 0.6877, 0.6811, 0.6718, 0.661, 0.5921000000000001, 0.3909, 0.23970000000000002, 0.06310000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6935, 0.6932, 0.6926, 0.6924, 0.6919, 0.6909000000000001, 0.6889000000000001, 0.6838, 0.6739999999999999, 0.6654, 0.6074999999999999, 0.41900000000000004, 0.25260000000000005, 0.05049999999999999], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6935, 0.6932, 0.6926, 0.6921999999999999, 0.6913, 0.69, 0.6877, 0.6809000000000001, 0.6716, 0.661, 0.5889, 0.36429999999999996, 0.18869999999999998, 0.02190000000000003], "L2AdditiveUniformNoiseAttack()": [0.6935, 0.6935, 0.6935, 0.6935, 0.6935, 0.6936, 0.6935, 0.6934, 0.6935, 0.6935, 0.6936, 0.6910000000000001, 0.6930000000000001, 0.6912], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6935, 0.6931, 0.6926, 0.6918, 0.6911, 0.6898, 0.6866, 0.6799999999999999, 0.6698, 0.6588, 0.5829, 0.36229999999999996, 0.19979999999999998, 0.032399999999999984], "robust_accuracy": [0.6935, 0.6931, 0.6926, 0.6918, 0.6911, 0.6898, 0.6866, 0.6799999999999999, 0.6698, 0.6588, 0.5825, 0.3547, 0.18269999999999997, 0.02080000000000004]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6874, 0.6869000000000001, 0.6860999999999999, 0.6857, 0.6851, 0.6839999999999999, 0.6812, 0.6767000000000001, 0.6636, 0.6534, 0.5749, 0.3648, 0.20889999999999997, 0.04259999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6874, 0.6869000000000001, 0.6863, 0.6859, 0.6856, 0.6843, 0.6819999999999999, 0.6778, 0.6673, 0.6577999999999999, 0.5896, 0.3881, 0.22340000000000004, 0.03469999999999995], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6874, 0.6869000000000001, 0.6860999999999999, 0.6857, 0.6851, 0.6839999999999999, 0.6811, 0.6766, 0.6635, 0.6531, 0.5721, 0.33919999999999995, 0.1593, 0.012399999999999967], "L2AdditiveUniformNoiseAttack()": [0.6874, 0.6874, 0.6874, 0.6875, 0.6874, 0.6875, 0.6875, 0.6875, 0.6875, 0.6871, 0.6879, 0.6873, 0.6872, 0.6849000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6874, 0.6868000000000001, 0.6860999999999999, 0.6857, 0.6846, 0.6837, 0.6809000000000001, 0.6758, 0.6621, 0.6498999999999999, 0.5684, 0.3408, 0.17500000000000004, 0.020399999999999974], "robust_accuracy": [0.6874, 0.6868000000000001, 0.6860999999999999, 0.6857, 0.6846, 0.6837, 0.6809000000000001, 0.6758, 0.6621, 0.6498999999999999, 0.5682, 0.3335, 0.1552, 0.011499999999999955]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6933, 0.6927, 0.6921999999999999, 0.6919, 0.6910000000000001, 0.6900999999999999, 0.6880999999999999, 0.6838, 0.6738999999999999, 0.6631, 0.5852999999999999, 0.37870000000000004, 0.2217, 0.057699999999999974], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6933, 0.6929000000000001, 0.6924, 0.6920999999999999, 0.6915, 0.6909000000000001, 0.6888000000000001, 0.6851, 0.6773, 0.6689, 0.6023000000000001, 0.40700000000000003, 0.24, 0.04820000000000002], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6933, 0.6927, 0.6921999999999999, 0.6919, 0.6910000000000001, 0.6900999999999999, 0.6880999999999999, 0.6838, 0.6738, 0.6626000000000001, 0.583, 0.35129999999999995, 0.17390000000000005, 0.021399999999999975], "L2AdditiveUniformNoiseAttack()": [0.6933, 0.6933, 0.6933, 0.6933, 0.6933, 0.6933, 0.6933, 0.6934, 0.6933, 0.6932, 0.6921999999999999, 0.6925, 0.6933, 0.6939], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6933, 0.6926, 0.6920999999999999, 0.6916, 0.6909000000000001, 0.6898, 0.6879, 0.6835, 0.6728000000000001, 0.6603, 0.5768, 0.3507, 0.18610000000000004, 0.03259999999999996], "robust_accuracy": [0.6933, 0.6926, 0.6920999999999999, 0.6916, 0.6909000000000001, 0.6898, 0.6879, 0.6835, 0.6727000000000001, 0.6603, 0.5766, 0.34340000000000004, 0.17010000000000003, 0.02059999999999995]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6749, 0.6746, 0.6744, 0.6738, 0.6736, 0.6726, 0.6704, 0.6664, 0.6573, 0.6456999999999999, 0.5747, 0.3699, 0.22350000000000003, 0.05800000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6749, 0.6748000000000001, 0.6746, 0.6740999999999999, 0.6738, 0.6731, 0.6711, 0.6674, 0.6596, 0.6517999999999999, 0.5903, 0.4001, 0.2398, 0.047599999999999976], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6749, 0.6746, 0.6744, 0.6738, 0.6736, 0.6726, 0.6704, 0.6664, 0.6571, 0.6455, 0.5722, 0.3469, 0.1795, 0.02070000000000005], "L2AdditiveUniformNoiseAttack()": [0.6749, 0.6749, 0.6749, 0.675, 0.675, 0.675, 0.6749, 0.675, 0.6749, 0.6749, 0.6751, 0.6745, 0.6749, 0.6760999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6749, 0.6746, 0.6743, 0.6737, 0.6735, 0.6722, 0.6702, 0.6661, 0.6555, 0.6435, 0.5650999999999999, 0.3409, 0.18689999999999996, 0.030299999999999994], "robust_accuracy": [0.6749, 0.6746, 0.6743, 0.6737, 0.6735, 0.6722, 0.6702, 0.6661, 0.6555, 0.6435, 0.5647, 0.3355, 0.17279999999999995, 0.01980000000000004]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6942999999999999, 0.6939, 0.6937, 0.6934, 0.6932, 0.6917, 0.6897, 0.6854, 0.6754, 0.6641, 0.5889, 0.37770000000000004, 0.21740000000000004, 0.05069999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6942999999999999, 0.6940999999999999, 0.6938, 0.6936, 0.6934, 0.6924, 0.6903, 0.6863, 0.6785, 0.6689, 0.6026, 0.40480000000000005, 0.23209999999999997, 0.03990000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6942999999999999, 0.6939, 0.6937, 0.6934, 0.6932, 0.6917, 0.6897, 0.6854, 0.6754, 0.6638, 0.5869, 0.35209999999999997, 0.16869999999999996, 0.016000000000000014], "L2AdditiveUniformNoiseAttack()": [0.6942999999999999, 0.6942999999999999, 0.6944, 0.6944, 0.6944, 0.6942999999999999, 0.6944, 0.6944, 0.6944, 0.6944, 0.6942999999999999, 0.6945, 0.6942999999999999, 0.6932], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6942999999999999, 0.6939, 0.6937, 0.6934, 0.6929000000000001, 0.6915, 0.6895, 0.6849000000000001, 0.6745, 0.663, 0.5827, 0.35240000000000005, 0.18159999999999998, 0.026800000000000046], "robust_accuracy": [0.6942999999999999, 0.6939, 0.6937, 0.6934, 0.6929000000000001, 0.6915, 0.6895, 0.6849000000000001, 0.6745, 0.663, 0.5825, 0.34509999999999996, 0.16469999999999996, 0.014399999999999968]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6854, 0.685, 0.6844, 0.6841999999999999, 0.683, 0.6818, 0.6791, 0.6731, 0.6633, 0.6537999999999999, 0.5766, 0.3599, 0.20740000000000003, 0.04920000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6854, 0.685, 0.6846, 0.6841999999999999, 0.6839, 0.6820999999999999, 0.6800999999999999, 0.6752, 0.6662, 0.6575, 0.5927, 0.38580000000000003, 0.2157, 0.03500000000000003], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6854, 0.685, 0.6844, 0.6841999999999999, 0.683, 0.6818, 0.6791, 0.6731, 0.663, 0.6537999999999999, 0.5728, 0.3276, 0.15700000000000003, 0.015100000000000002], "L2AdditiveUniformNoiseAttack()": [0.6854, 0.6854, 0.6854, 0.6854, 0.6854, 0.6855, 0.6855, 0.6855, 0.6857, 0.6855, 0.6852, 0.6849000000000001, 0.6854, 0.6821999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6854, 0.685, 0.6843, 0.6839999999999999, 0.6828000000000001, 0.6816, 0.6783, 0.6726, 0.6618999999999999, 0.6515, 0.5688, 0.3346, 0.17179999999999995, 0.023599999999999954], "robust_accuracy": [0.6854, 0.685, 0.6843, 0.6839999999999999, 0.6828000000000001, 0.6816, 0.6783, 0.6726, 0.6618999999999999, 0.6515, 0.5681, 0.32220000000000004, 0.15349999999999997, 0.01429999999999998]}}, "4": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6915, 0.6910000000000001, 0.6907, 0.6906, 0.6905, 0.6897, 0.6875, 0.683, 0.6725, 0.6617999999999999, 0.5888, 0.38, 0.22740000000000005, 0.05259999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6915, 0.6911, 0.6908000000000001, 0.6906, 0.6905, 0.69, 0.688, 0.6844, 0.6757, 0.6671, 0.6038, 0.40690000000000004, 0.23619999999999997, 0.038799999999999946], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6915, 0.6910000000000001, 0.6907, 0.6906, 0.6905, 0.6897, 0.6875, 0.6828000000000001, 0.6720999999999999, 0.6617999999999999, 0.5863, 0.35340000000000005, 0.17500000000000004, 0.015700000000000047], "L2AdditiveUniformNoiseAttack()": [0.6915, 0.6915, 0.6915, 0.6915, 0.6915, 0.6915, 0.6915, 0.6915, 0.6916, 0.6918, 0.692, 0.692, 0.6929000000000001, 0.692], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6915, 0.6910000000000001, 0.6906, 0.6906, 0.6905, 0.6896, 0.6873, 0.6821999999999999, 0.6709, 0.6595, 0.5808, 0.35419999999999996, 0.19079999999999997, 0.02510000000000001], "robust_accuracy": [0.6915, 0.6910000000000001, 0.6906, 0.6906, 0.6905, 0.6896, 0.6873, 0.6821999999999999, 0.6709, 0.6595, 0.5804, 0.34709999999999996, 0.17190000000000005, 0.014499999999999957]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7004, 0.6997, 0.6989000000000001, 0.6987, 0.6978, 0.6967, 0.6948, 0.6904, 0.6803, 0.6695, 0.5961000000000001, 0.38660000000000005, 0.2309, 0.05900000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7004, 0.6997, 0.6995, 0.6988, 0.6985, 0.6972, 0.6955, 0.6917, 0.6836, 0.6749, 0.6115999999999999, 0.4141, 0.24609999999999999, 0.04479999999999995], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7004, 0.6997, 0.6989000000000001, 0.6987, 0.6978, 0.6967, 0.6948, 0.6904, 0.6799999999999999, 0.669, 0.5933999999999999, 0.35819999999999996, 0.18130000000000002, 0.018900000000000028], "L2AdditiveUniformNoiseAttack()": [0.7004, 0.7004, 0.7004, 0.7004, 0.7004, 0.7004, 0.7004, 0.7004, 0.7001, 0.7006, 0.7001, 0.6999, 0.7001999999999999, 0.7005], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7004, 0.6996, 0.6989000000000001, 0.6987, 0.6977, 0.6967, 0.6946, 0.69, 0.6795, 0.6678999999999999, 0.5901000000000001, 0.36250000000000004, 0.1946, 0.02859999999999996], "robust_accuracy": [0.7004, 0.6996, 0.6989000000000001, 0.6987, 0.6977, 0.6967, 0.6946, 0.69, 0.6794, 0.6678999999999999, 0.5892, 0.3526, 0.17700000000000005, 0.017800000000000038]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6807000000000001, 0.6803, 0.6797, 0.6792, 0.6791, 0.6782, 0.6769000000000001, 0.6727000000000001, 0.6624, 0.6513, 0.5723, 0.3748, 0.23440000000000005, 0.062100000000000044], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6807000000000001, 0.6803, 0.6798, 0.6794, 0.6792, 0.6786, 0.6776, 0.6738, 0.6651, 0.656, 0.5869, 0.3984, 0.24560000000000004, 0.047599999999999976], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6807000000000001, 0.6803, 0.6797, 0.6792, 0.679, 0.6782, 0.6768000000000001, 0.6727000000000001, 0.6622, 0.6508, 0.5698, 0.3497, 0.1844, 0.01870000000000005], "L2AdditiveUniformNoiseAttack()": [0.6807000000000001, 0.6807000000000001, 0.6807000000000001, 0.6807000000000001, 0.6808000000000001, 0.6808000000000001, 0.6809000000000001, 0.6809000000000001, 0.6807000000000001, 0.6809000000000001, 0.681, 0.6811, 0.681, 0.6828000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6807000000000001, 0.6803, 0.6796, 0.6792, 0.6789000000000001, 0.6782, 0.6766, 0.6724, 0.6607000000000001, 0.6485000000000001, 0.5625, 0.346, 0.1946, 0.03080000000000005], "robust_accuracy": [0.6807000000000001, 0.6803, 0.6796, 0.6792, 0.6789000000000001, 0.6782, 0.6766, 0.6724, 0.6607000000000001, 0.6485000000000001, 0.5619000000000001, 0.3395, 0.17920000000000003, 0.017800000000000038]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7162, 0.7152000000000001, 0.7143999999999999, 0.714, 0.7133, 0.7123999999999999, 0.7101, 0.7052, 0.6940999999999999, 0.6843, 0.6026, 0.38980000000000004, 0.22809999999999997, 0.05469999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7162, 0.7153, 0.7146, 0.714, 0.7137, 0.7128, 0.7108, 0.7067, 0.6969000000000001, 0.6876, 0.618, 0.41279999999999994, 0.236, 0.036800000000000055], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7162, 0.7152000000000001, 0.7143999999999999, 0.714, 0.7133, 0.7123999999999999, 0.7101, 0.7051000000000001, 0.694, 0.6840999999999999, 0.5989, 0.35719999999999996, 0.16769999999999996, 0.0131], "L2AdditiveUniformNoiseAttack()": [0.7162, 0.7162, 0.7162, 0.7162, 0.7162, 0.7162, 0.7162, 0.7162, 0.7158, 0.7158, 0.716, 0.7165, 0.7143999999999999, 0.7133], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7162, 0.7152000000000001, 0.7143999999999999, 0.7139, 0.7131000000000001, 0.712, 0.7097, 0.7042999999999999, 0.6928000000000001, 0.6818, 0.5954999999999999, 0.36339999999999995, 0.18799999999999994, 0.022700000000000053], "robust_accuracy": [0.7162, 0.7152000000000001, 0.7143999999999999, 0.7139, 0.7131000000000001, 0.712, 0.7097, 0.7042999999999999, 0.6928000000000001, 0.6818, 0.5947, 0.35219999999999996, 0.16549999999999998, 0.01200000000000001]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6945, 0.6941999999999999, 0.6939, 0.6936, 0.6934, 0.6926, 0.6905, 0.685, 0.6763, 0.6658, 0.5900000000000001, 0.3862, 0.2359, 0.06630000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6945, 0.6941999999999999, 0.6939, 0.6938, 0.6936, 0.6933, 0.6912, 0.6866, 0.6783, 0.6712, 0.6053999999999999, 0.41100000000000003, 0.2469, 0.05230000000000001], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6945, 0.6941999999999999, 0.6939, 0.6936, 0.6934, 0.6926, 0.6905, 0.6851, 0.6762, 0.6656, 0.5862, 0.3578, 0.18500000000000005, 0.023299999999999987], "L2AdditiveUniformNoiseAttack()": [0.6945, 0.6944, 0.6944, 0.6942999999999999, 0.6942999999999999, 0.6944, 0.6942999999999999, 0.6942999999999999, 0.6947, 0.6948, 0.6950000000000001, 0.6964, 0.6961999999999999, 0.694], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6945, 0.6941999999999999, 0.6939, 0.6936, 0.6933, 0.6923, 0.6903, 0.6845, 0.6752, 0.6644, 0.5819, 0.36150000000000004, 0.1976, 0.03359999999999996], "robust_accuracy": [0.6945, 0.6941999999999999, 0.6939, 0.6936, 0.6933, 0.6923, 0.6903, 0.6845, 0.6752, 0.6644, 0.5815, 0.352, 0.1814, 0.022199999999999998]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7007, 0.6998, 0.6994, 0.6992, 0.6991, 0.6985, 0.6967, 0.6909000000000001, 0.6799999999999999, 0.6681, 0.5915, 0.37960000000000005, 0.2207, 0.0534], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7007, 0.7001, 0.6996, 0.6992, 0.6992, 0.6986, 0.6975, 0.6918, 0.6836, 0.6726, 0.6054999999999999, 0.4091, 0.23809999999999998, 0.03649999999999998], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7007, 0.6998, 0.6994, 0.6992, 0.6991, 0.6985, 0.6967, 0.6908000000000001, 0.6797, 0.6679999999999999, 0.5883, 0.3506, 0.16949999999999998, 0.014100000000000001], "L2AdditiveUniformNoiseAttack()": [0.7007, 0.7007, 0.7007, 0.7007, 0.7007, 0.7008, 0.7006, 0.7006, 0.7005, 0.7002999999999999, 0.7002999999999999, 0.7007, 0.7010000000000001, 0.6990000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7007, 0.6998, 0.6992, 0.6992, 0.6991, 0.6984, 0.6961999999999999, 0.6896, 0.6784, 0.6656, 0.5847, 0.3538, 0.18600000000000005, 0.022599999999999953], "robust_accuracy": [0.7007, 0.6998, 0.6992, 0.6992, 0.6991, 0.6984, 0.6961999999999999, 0.6896, 0.6784, 0.6656, 0.5840000000000001, 0.3448, 0.16579999999999995, 0.013399999999999967]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6915, 0.6911, 0.6910000000000001, 0.6906, 0.6901999999999999, 0.6896, 0.688, 0.6816, 0.6719999999999999, 0.6614, 0.5831999999999999, 0.379, 0.22599999999999998, 0.05669999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6915, 0.6911, 0.6911, 0.6907, 0.6904, 0.6897, 0.6887, 0.6833, 0.675, 0.6661, 0.5984, 0.40080000000000005, 0.23360000000000003, 0.04349999999999998], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6915, 0.6911, 0.6910000000000001, 0.6906, 0.6901999999999999, 0.6895, 0.688, 0.6816, 0.6718, 0.6611, 0.5798, 0.3478, 0.16869999999999996, 0.017900000000000027], "L2AdditiveUniformNoiseAttack()": [0.6915, 0.6915, 0.6916, 0.6916, 0.6916, 0.6916, 0.6916, 0.6918, 0.6919, 0.6916, 0.6921999999999999, 0.6931, 0.6915, 0.6917], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6915, 0.6911, 0.6910000000000001, 0.6905, 0.69, 0.6895, 0.6877, 0.6814, 0.6703, 0.6599999999999999, 0.5761000000000001, 0.3546, 0.18679999999999997, 0.027200000000000002], "robust_accuracy": [0.6915, 0.6911, 0.6910000000000001, 0.6905, 0.69, 0.6895, 0.6877, 0.6814, 0.6703, 0.6599999999999999, 0.5751999999999999, 0.3426, 0.16559999999999997, 0.016700000000000048]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6857, 0.6852, 0.685, 0.6841999999999999, 0.6839, 0.6828000000000001, 0.6808000000000001, 0.6763, 0.6684, 0.6585, 0.5906, 0.3881, 0.24560000000000004, 0.08109999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6857, 0.6853, 0.685, 0.6848000000000001, 0.6840999999999999, 0.6834, 0.6817, 0.6777, 0.6712, 0.663, 0.6048, 0.4145, 0.25870000000000004, 0.06889999999999996], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6857, 0.6852, 0.685, 0.6841999999999999, 0.6839, 0.6828000000000001, 0.6808000000000001, 0.6763, 0.6684, 0.6585, 0.5886, 0.36419999999999997, 0.19789999999999996, 0.03180000000000005], "L2AdditiveUniformNoiseAttack()": [0.6857, 0.6857, 0.6857, 0.6857, 0.6857, 0.6857, 0.6856, 0.6856, 0.6858, 0.6855, 0.6856, 0.6854, 0.6871, 0.6889000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6857, 0.6852, 0.685, 0.6840999999999999, 0.6838, 0.6826, 0.6806, 0.6757, 0.6674, 0.6577999999999999, 0.5841000000000001, 0.36539999999999995, 0.21319999999999995, 0.04749999999999999], "robust_accuracy": [0.6857, 0.6852, 0.685, 0.6840999999999999, 0.6838, 0.6826, 0.6806, 0.6757, 0.6674, 0.6577999999999999, 0.5837, 0.35760000000000003, 0.19430000000000003, 0.030299999999999994]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6927, 0.6925, 0.6920999999999999, 0.6915, 0.6913, 0.6906, 0.6887, 0.6831, 0.6737, 0.6635, 0.5884, 0.3993, 0.252, 0.0716], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6927, 0.6926, 0.6921999999999999, 0.6919, 0.6915, 0.6909000000000001, 0.6894, 0.6851, 0.6765, 0.6687000000000001, 0.6012, 0.42079999999999995, 0.25639999999999996, 0.04749999999999999], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6927, 0.6925, 0.6920999999999999, 0.6915, 0.6913, 0.6906, 0.6887, 0.6832, 0.6734, 0.663, 0.5849, 0.36839999999999995, 0.19089999999999996, 0.021700000000000053], "L2AdditiveUniformNoiseAttack()": [0.6927, 0.6927, 0.6926, 0.6927, 0.6928000000000001, 0.6928000000000001, 0.6926, 0.6929000000000001, 0.6927, 0.6930000000000001, 0.6933, 0.6924, 0.6927, 0.6912], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6927, 0.6924, 0.6920999999999999, 0.6915, 0.6911, 0.6904, 0.6886, 0.6821999999999999, 0.6723, 0.6599999999999999, 0.5819, 0.37170000000000003, 0.20930000000000004, 0.03320000000000001], "robust_accuracy": [0.6927, 0.6924, 0.6920999999999999, 0.6915, 0.6911, 0.6904, 0.6885, 0.6821999999999999, 0.6723, 0.6599999999999999, 0.5808, 0.3618, 0.18630000000000002, 0.02070000000000005]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6840999999999999, 0.6837, 0.6833, 0.6831, 0.6823, 0.6813, 0.6778, 0.6732, 0.6625, 0.6504, 0.5726, 0.36350000000000005, 0.2066, 0.05010000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6840999999999999, 0.6837, 0.6833, 0.6832, 0.6828000000000001, 0.6819, 0.6791, 0.6743, 0.6662, 0.6567000000000001, 0.5866, 0.389, 0.2219, 0.0383], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6840999999999999, 0.6837, 0.6833, 0.6831, 0.6823, 0.6813, 0.6778, 0.6732, 0.6623, 0.6501, 0.5685, 0.33440000000000003, 0.16049999999999998, 0.01539999999999997], "L2AdditiveUniformNoiseAttack()": [0.6840999999999999, 0.6840999999999999, 0.6840999999999999, 0.6839999999999999, 0.6839999999999999, 0.6839999999999999, 0.6839, 0.6839, 0.6841999999999999, 0.6841999999999999, 0.6838, 0.6843, 0.6835, 0.6815], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6840999999999999, 0.6837, 0.6833, 0.6829000000000001, 0.6823, 0.681, 0.6776, 0.6723, 0.6607000000000001, 0.648, 0.5623, 0.3339, 0.16859999999999997, 0.02410000000000001], "robust_accuracy": [0.6840999999999999, 0.6837, 0.6833, 0.6829000000000001, 0.6823, 0.681, 0.6776, 0.6723, 0.6607000000000001, 0.6478999999999999, 0.5617, 0.32609999999999995, 0.15610000000000002, 0.014399999999999968]}}, "8": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7130000000000001, 0.7125, 0.7117, 0.7109, 0.7101, 0.7085, 0.7071000000000001, 0.7030000000000001, 0.6906, 0.6780999999999999, 0.5932999999999999, 0.3711, 0.2198, 0.06000000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7130000000000001, 0.7128, 0.7122999999999999, 0.7113, 0.7105, 0.7090000000000001, 0.7078, 0.7039, 0.6944, 0.6832, 0.6071, 0.38460000000000005, 0.20750000000000002, 0.022700000000000053], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7130000000000001, 0.7125, 0.7117, 0.7109, 0.7101, 0.7083999999999999, 0.7071000000000001, 0.7029000000000001, 0.6904, 0.6778, 0.5866, 0.3245, 0.14280000000000004, 0.007499999999999951], "L2AdditiveUniformNoiseAttack()": [0.7130000000000001, 0.7130000000000001, 0.7130000000000001, 0.7130000000000001, 0.7130000000000001, 0.7130000000000001, 0.7130000000000001, 0.7129, 0.7131000000000001, 0.7128, 0.7126, 0.7133, 0.7136, 0.7131000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7130000000000001, 0.7122999999999999, 0.7117, 0.7108, 0.7098, 0.7081999999999999, 0.7070000000000001, 0.7024, 0.6889000000000001, 0.6759999999999999, 0.5839, 0.33320000000000005, 0.16690000000000005, 0.015199999999999991], "robust_accuracy": [0.7130000000000001, 0.7122999999999999, 0.7117, 0.7108, 0.7098, 0.7081999999999999, 0.7070000000000001, 0.7024, 0.6888000000000001, 0.6758, 0.5816, 0.31899999999999995, 0.1391, 0.007099999999999995]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6843, 0.6836, 0.6829000000000001, 0.6823, 0.6821999999999999, 0.6811, 0.6794, 0.6754, 0.6649, 0.6549, 0.5817, 0.3839, 0.24370000000000003, 0.07140000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6843, 0.6838, 0.683, 0.6825, 0.6823, 0.6815, 0.6798, 0.6772, 0.6678, 0.6589, 0.5961000000000001, 0.4062, 0.25039999999999996, 0.0534], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6843, 0.6836, 0.6829000000000001, 0.6823, 0.6821999999999999, 0.6811, 0.6794, 0.6754, 0.6647000000000001, 0.6546000000000001, 0.579, 0.355, 0.18979999999999997, 0.02190000000000003], "L2AdditiveUniformNoiseAttack()": [0.6843, 0.6843, 0.6843, 0.6843, 0.6841999999999999, 0.6841999999999999, 0.6843, 0.6844, 0.6843, 0.6839999999999999, 0.6847, 0.6839, 0.6840999999999999, 0.683], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6843, 0.6835, 0.6829000000000001, 0.6823, 0.6818, 0.681, 0.6791, 0.6744, 0.663, 0.651, 0.5702, 0.34850000000000003, 0.19720000000000004, 0.031299999999999994], "robust_accuracy": [0.6843, 0.6835, 0.6829000000000001, 0.6823, 0.6818, 0.681, 0.6791, 0.6744, 0.663, 0.651, 0.5700000000000001, 0.3428, 0.18189999999999995, 0.020199999999999996]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7115, 0.7110000000000001, 0.7106, 0.7094, 0.7090000000000001, 0.7086, 0.7061, 0.7014, 0.6873, 0.6760999999999999, 0.5946, 0.37960000000000005, 0.22760000000000002, 0.06340000000000001], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7115, 0.7110000000000001, 0.7107, 0.7098, 0.7094, 0.7087, 0.7072, 0.7027, 0.6912, 0.6809000000000001, 0.6108, 0.40149999999999997, 0.22970000000000002, 0.0373], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7115, 0.7110000000000001, 0.7106, 0.7094, 0.7090000000000001, 0.7086, 0.7061, 0.7014, 0.6872, 0.6757, 0.5900000000000001, 0.3408, 0.16479999999999995, 0.015499999999999958], "L2AdditiveUniformNoiseAttack()": [0.7115, 0.7115, 0.7115, 0.7115, 0.7116, 0.7115, 0.7115, 0.7117, 0.7116, 0.7116, 0.7111000000000001, 0.7117, 0.7128, 0.7132000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7115, 0.7110000000000001, 0.7105, 0.7094, 0.7089, 0.7081, 0.7057, 0.7005, 0.6861999999999999, 0.6740999999999999, 0.5860000000000001, 0.3437, 0.17979999999999996, 0.025000000000000022], "robust_accuracy": [0.7115, 0.7110000000000001, 0.7105, 0.7094, 0.7089, 0.7081, 0.7057, 0.7005, 0.6861999999999999, 0.6738999999999999, 0.5847, 0.33309999999999995, 0.15969999999999995, 0.014700000000000046]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7002999999999999, 0.7001, 0.6999, 0.6993, 0.6988, 0.6978, 0.6962999999999999, 0.6909000000000001, 0.6813, 0.6716, 0.6019, 0.4113, 0.26739999999999997, 0.08860000000000001], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7002999999999999, 0.7001, 0.7, 0.6998, 0.6990000000000001, 0.6987, 0.6969000000000001, 0.6923, 0.6840999999999999, 0.6759, 0.6151, 0.4323, 0.27690000000000003, 0.06659999999999999], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7002999999999999, 0.7001, 0.6999, 0.6993, 0.6988, 0.6978, 0.6961999999999999, 0.6909000000000001, 0.6813, 0.6716, 0.5988, 0.38260000000000005, 0.20740000000000003, 0.03390000000000004], "L2AdditiveUniformNoiseAttack()": [0.7002999999999999, 0.7002999999999999, 0.7002999999999999, 0.7002999999999999, 0.7002999999999999, 0.7002999999999999, 0.7002999999999999, 0.7005, 0.7002999999999999, 0.7002999999999999, 0.7002999999999999, 0.6997, 0.7006, 0.6991], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7002999999999999, 0.7001, 0.6998, 0.6990000000000001, 0.6987, 0.6977, 0.6958, 0.6907, 0.6800999999999999, 0.6696, 0.5943, 0.3843, 0.22109999999999996, 0.04530000000000001], "robust_accuracy": [0.7002999999999999, 0.7001, 0.6998, 0.6990000000000001, 0.6987, 0.6977, 0.6958, 0.6907, 0.6800999999999999, 0.6696, 0.5939, 0.37639999999999996, 0.20309999999999995, 0.032399999999999984]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7194, 0.7187, 0.7182, 0.7176, 0.7171000000000001, 0.716, 0.7136, 0.7074, 0.6960999999999999, 0.6860999999999999, 0.6073999999999999, 0.39359999999999995, 0.2359, 0.05669999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7194, 0.7188, 0.7185, 0.7179, 0.7175, 0.7165, 0.7147, 0.7093, 0.6987, 0.6907, 0.6231, 0.41879999999999995, 0.2439, 0.04039999999999999], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7194, 0.7187, 0.7182, 0.7176, 0.7171000000000001, 0.716, 0.7136, 0.7074, 0.696, 0.6856, 0.603, 0.35960000000000003, 0.17579999999999996, 0.014900000000000024], "L2AdditiveUniformNoiseAttack()": [0.7194, 0.7194, 0.7195, 0.7194, 0.7193, 0.7193, 0.7193, 0.7193, 0.7192000000000001, 0.719, 0.7192000000000001, 0.719, 0.7189, 0.7166], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7194, 0.7187, 0.7182, 0.7176, 0.7170000000000001, 0.7158, 0.7133, 0.7068, 0.6952, 0.6840999999999999, 0.5997, 0.3668, 0.19789999999999996, 0.026599999999999957], "robust_accuracy": [0.7194, 0.7187, 0.7182, 0.7176, 0.7170000000000001, 0.7158, 0.7133, 0.7068, 0.6952, 0.6839999999999999, 0.5988, 0.355, 0.1735, 0.014100000000000001]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.719, 0.7183999999999999, 0.718, 0.7175, 0.7168, 0.7158, 0.7141, 0.7085, 0.6965, 0.6866, 0.6048, 0.3882, 0.23609999999999998, 0.06110000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.719, 0.7186, 0.7181, 0.7175, 0.7171000000000001, 0.7162999999999999, 0.7148, 0.7103999999999999, 0.6997, 0.6908000000000001, 0.621, 0.41169999999999995, 0.24219999999999997, 0.03920000000000001], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.719, 0.7183999999999999, 0.718, 0.7175, 0.7168, 0.7158, 0.7141, 0.7085, 0.6962999999999999, 0.6860999999999999, 0.6016, 0.355, 0.1713, 0.01529999999999998], "L2AdditiveUniformNoiseAttack()": [0.719, 0.719, 0.719, 0.7189, 0.7189, 0.7191000000000001, 0.7191000000000001, 0.7191000000000001, 0.719, 0.7189, 0.7192000000000001, 0.7194, 0.7202999999999999, 0.7203999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.719, 0.7183999999999999, 0.7179, 0.7173, 0.7167, 0.7157, 0.7136, 0.7078, 0.6948, 0.6849000000000001, 0.5966, 0.3588, 0.19179999999999997, 0.025599999999999956], "robust_accuracy": [0.719, 0.7183999999999999, 0.7179, 0.7173, 0.7167, 0.7157, 0.7136, 0.7078, 0.6948, 0.6847, 0.5962000000000001, 0.34930000000000005, 0.16820000000000002, 0.014700000000000046]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7083999999999999, 0.7076, 0.7070000000000001, 0.7068, 0.7066, 0.7054, 0.7041, 0.6984, 0.6886, 0.6808000000000001, 0.6033, 0.3973, 0.23950000000000005, 0.06940000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7083999999999999, 0.7076, 0.7072, 0.7068, 0.7068, 0.706, 0.7044, 0.7001999999999999, 0.6916, 0.6836, 0.619, 0.4203, 0.24760000000000004, 0.04820000000000002], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7083999999999999, 0.7076, 0.7070000000000001, 0.7068, 0.7066, 0.7054, 0.7041, 0.6984, 0.6886, 0.6803, 0.6004, 0.364, 0.18669999999999998, 0.018000000000000016], "L2AdditiveUniformNoiseAttack()": [0.7083999999999999, 0.7082999999999999, 0.7083999999999999, 0.7083999999999999, 0.7085, 0.7083999999999999, 0.7083999999999999, 0.7082999999999999, 0.7083999999999999, 0.7082999999999999, 0.7087, 0.7072, 0.7068, 0.7054], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7083999999999999, 0.7076, 0.7069, 0.7068, 0.7066, 0.7051000000000001, 0.7034, 0.6977, 0.6874, 0.6779, 0.5941000000000001, 0.36519999999999997, 0.19710000000000005, 0.02959999999999996], "robust_accuracy": [0.7083999999999999, 0.7076, 0.7069, 0.7068, 0.7066, 0.7051000000000001, 0.7034, 0.6977, 0.6874, 0.6779, 0.5939, 0.35509999999999997, 0.18179999999999996, 0.016700000000000048]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7118, 0.7113, 0.7109, 0.7105, 0.7098, 0.7085, 0.7062999999999999, 0.7017, 0.6915, 0.681, 0.6013, 0.3991, 0.252, 0.07450000000000001], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7118, 0.7113, 0.7109, 0.7106, 0.7101, 0.7093, 0.7069, 0.7022999999999999, 0.6948, 0.6852, 0.6149, 0.4152, 0.2459, 0.043200000000000016], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7118, 0.7113, 0.7109, 0.7105, 0.7098, 0.7085, 0.7062999999999999, 0.7017, 0.6913, 0.6805, 0.5965, 0.3591, 0.18369999999999997, 0.017800000000000038], "L2AdditiveUniformNoiseAttack()": [0.7118, 0.7118, 0.7117, 0.7117, 0.7117, 0.7117, 0.7117, 0.7116, 0.7117, 0.7117, 0.7118, 0.7127, 0.7112, 0.7125], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7118, 0.7113, 0.7108, 0.7103999999999999, 0.7096, 0.7081999999999999, 0.7059, 0.7007, 0.6900999999999999, 0.6779, 0.5927, 0.3677, 0.20599999999999996, 0.029100000000000015], "robust_accuracy": [0.7118, 0.7113, 0.7108, 0.7103999999999999, 0.7096, 0.7081999999999999, 0.7059, 0.7007, 0.6900999999999999, 0.6778, 0.591, 0.35350000000000004, 0.18020000000000003, 0.016599999999999948]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6789000000000001, 0.6783, 0.6779999999999999, 0.6779, 0.6773, 0.6763, 0.6740999999999999, 0.6687000000000001, 0.6585, 0.6478999999999999, 0.5740000000000001, 0.37829999999999997, 0.2248, 0.05689999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6789000000000001, 0.6785, 0.6782, 0.6779999999999999, 0.6779, 0.6769000000000001, 0.6747000000000001, 0.6702, 0.661, 0.653, 0.589, 0.4034, 0.2378, 0.043200000000000016], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6789000000000001, 0.6783, 0.6779999999999999, 0.6779, 0.6773, 0.6763, 0.6740999999999999, 0.6687000000000001, 0.6585, 0.6478999999999999, 0.5706, 0.3508, 0.17120000000000002, 0.017900000000000027], "L2AdditiveUniformNoiseAttack()": [0.6789000000000001, 0.6789000000000001, 0.6789000000000001, 0.6789000000000001, 0.6789000000000001, 0.6789000000000001, 0.6788000000000001, 0.6789000000000001, 0.6789000000000001, 0.6789000000000001, 0.6788000000000001, 0.6799999999999999, 0.6797, 0.6795], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6789000000000001, 0.6783, 0.6779999999999999, 0.6779, 0.6771, 0.6759999999999999, 0.6738999999999999, 0.6683, 0.657, 0.647, 0.5662, 0.354, 0.1866, 0.029900000000000038], "robust_accuracy": [0.6789000000000001, 0.6783, 0.6779999999999999, 0.6779, 0.6771, 0.6759999999999999, 0.6738999999999999, 0.6683, 0.657, 0.6469, 0.5654, 0.3456, 0.16759999999999997, 0.01759999999999995]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7103999999999999, 0.7098, 0.7090000000000001, 0.7083999999999999, 0.7076, 0.7062999999999999, 0.7041999999999999, 0.6990000000000001, 0.6869000000000001, 0.6769000000000001, 0.5912, 0.38070000000000004, 0.22740000000000005, 0.06289999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7103999999999999, 0.7098, 0.7095, 0.7085, 0.7081, 0.7067, 0.7048, 0.7008, 0.6909000000000001, 0.6815, 0.6054999999999999, 0.3929, 0.21809999999999996, 0.031299999999999994], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7103999999999999, 0.7098, 0.7090000000000001, 0.7083999999999999, 0.7076, 0.7063999999999999, 0.7041999999999999, 0.6989000000000001, 0.6868000000000001, 0.6763, 0.5856, 0.33309999999999995, 0.15539999999999998, 0.009000000000000008], "L2AdditiveUniformNoiseAttack()": [0.7103999999999999, 0.7103999999999999, 0.7103999999999999, 0.7103999999999999, 0.7103999999999999, 0.7103999999999999, 0.7105, 0.7102999999999999, 0.7102999999999999, 0.7101999999999999, 0.7101, 0.7096, 0.7085, 0.7059], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7103999999999999, 0.7098, 0.7089, 0.7081999999999999, 0.7072, 0.706, 0.7039, 0.6978, 0.6857, 0.6747000000000001, 0.5804, 0.34130000000000005, 0.17300000000000004, 0.019199999999999995], "robust_accuracy": [0.7103999999999999, 0.7098, 0.7089, 0.7081999999999999, 0.7072, 0.706, 0.7039, 0.6978, 0.6857, 0.6746, 0.5792999999999999, 0.3264, 0.15139999999999998, 0.008399999999999963]}}, "16": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6843, 0.6834, 0.6832, 0.6829000000000001, 0.6825, 0.6811, 0.6779999999999999, 0.6729, 0.6615, 0.6509, 0.5737, 0.37160000000000004, 0.2277, 0.05740000000000001], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6843, 0.6836, 0.6832, 0.683, 0.6827, 0.6819, 0.6796, 0.6740999999999999, 0.6642, 0.6552, 0.5886, 0.38859999999999995, 0.2248, 0.032299999999999995], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6843, 0.6834, 0.6832, 0.6829000000000001, 0.6825, 0.6811, 0.6779999999999999, 0.6728000000000001, 0.6613, 0.6506000000000001, 0.5690999999999999, 0.3369, 0.1593, 0.010099999999999998], "L2AdditiveUniformNoiseAttack()": [0.6843, 0.6843, 0.6843, 0.6843, 0.6843, 0.6843, 0.6843, 0.6840999999999999, 0.6841999999999999, 0.6839, 0.6841999999999999, 0.6844, 0.6834, 0.6823], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6843, 0.6834, 0.6831, 0.6827, 0.6821999999999999, 0.6808000000000001, 0.6775, 0.6718, 0.6597999999999999, 0.6477999999999999, 0.5643, 0.33899999999999997, 0.1775, 0.01980000000000004], "robust_accuracy": [0.6843, 0.6834, 0.6831, 0.6827, 0.6821999999999999, 0.6808000000000001, 0.6775, 0.6718, 0.6597, 0.6477999999999999, 0.5633, 0.33009999999999995, 0.15469999999999995, 0.009800000000000031]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6824, 0.6818, 0.6815, 0.6809000000000001, 0.6804, 0.6796, 0.6777, 0.673, 0.6615, 0.6503, 0.5650999999999999, 0.3478, 0.1985, 0.046599999999999975], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6824, 0.6819, 0.6816, 0.6812, 0.6807000000000001, 0.6799, 0.6784, 0.6748000000000001, 0.6651, 0.6557, 0.5837, 0.37029999999999996, 0.20530000000000004, 0.03049999999999997], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6824, 0.6818, 0.6815, 0.6809000000000001, 0.6804, 0.6796, 0.6777, 0.6729, 0.6615, 0.6503, 0.5622, 0.3155, 0.14539999999999997, 0.013599999999999945], "L2AdditiveUniformNoiseAttack()": [0.6824, 0.6824, 0.6824, 0.6824, 0.6824, 0.6824, 0.6823, 0.6823, 0.6824, 0.6831, 0.6833, 0.6833, 0.6831, 0.6838], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6824, 0.6818, 0.6815, 0.6806, 0.6804, 0.6794, 0.6777, 0.6724, 0.6613, 0.6491, 0.5602, 0.3268, 0.16369999999999996, 0.01980000000000004], "robust_accuracy": [0.6824, 0.6818, 0.6815, 0.6806, 0.6804, 0.6794, 0.6777, 0.6724, 0.6613, 0.6491, 0.5594, 0.31310000000000004, 0.14329999999999998, 0.012700000000000045]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7134, 0.7130000000000001, 0.7121999999999999, 0.7119, 0.7113, 0.7103999999999999, 0.7083999999999999, 0.7028, 0.6930000000000001, 0.6793, 0.5963, 0.37939999999999996, 0.22960000000000003, 0.06799999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7134, 0.7131000000000001, 0.7123999999999999, 0.7121, 0.7118, 0.7106, 0.7090000000000001, 0.704, 0.696, 0.6847, 0.6133, 0.3991, 0.22419999999999995, 0.03720000000000001], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7134, 0.7130000000000001, 0.7121999999999999, 0.7119, 0.7113, 0.7103999999999999, 0.7082999999999999, 0.7028, 0.6929000000000001, 0.6788000000000001, 0.5924, 0.33930000000000005, 0.15759999999999996, 0.014000000000000012], "L2AdditiveUniformNoiseAttack()": [0.7134, 0.7134, 0.7134, 0.7134, 0.7134, 0.7134, 0.7134, 0.7134, 0.7132000000000001, 0.7138, 0.7143999999999999, 0.7131000000000001, 0.712, 0.7090000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7134, 0.7130000000000001, 0.7121999999999999, 0.7119, 0.7112, 0.7103999999999999, 0.7079, 0.7021, 0.6917, 0.6774, 0.5896, 0.3488, 0.18079999999999996, 0.02410000000000001], "robust_accuracy": [0.7134, 0.7130000000000001, 0.7121999999999999, 0.7119, 0.7112, 0.7103999999999999, 0.7079, 0.7021, 0.6917, 0.6774, 0.5888, 0.33299999999999996, 0.1543, 0.013000000000000012]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.6906, 0.6899, 0.6893, 0.6887, 0.6884, 0.6873, 0.6845, 0.6784, 0.667, 0.6542, 0.5778, 0.36719999999999997, 0.2229, 0.06669999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.6906, 0.6899, 0.6895, 0.6889000000000001, 0.6886, 0.6876, 0.6857, 0.6807000000000001, 0.6697, 0.6604, 0.5921000000000001, 0.3872, 0.21750000000000003, 0.034399999999999986], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.6906, 0.6899, 0.6893, 0.6887, 0.6884, 0.6873, 0.6845, 0.6783, 0.667, 0.6541, 0.573, 0.32799999999999996, 0.15359999999999996, 0.011900000000000022], "L2AdditiveUniformNoiseAttack()": [0.6906, 0.6906, 0.6906, 0.6906, 0.6906, 0.6905, 0.6906, 0.6905, 0.6903, 0.6906, 0.6903, 0.6896, 0.6893, 0.6854], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.6906, 0.6899, 0.6893, 0.6886, 0.6881999999999999, 0.687, 0.6844, 0.6775, 0.6652, 0.6525000000000001, 0.5696, 0.33599999999999997, 0.17259999999999998, 0.023299999999999987], "robust_accuracy": [0.6906, 0.6899, 0.6893, 0.6886, 0.6881999999999999, 0.687, 0.6844, 0.6775, 0.6652, 0.6525000000000001, 0.5686, 0.3225, 0.15039999999999998, 0.011299999999999977]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7249, 0.7242, 0.7231000000000001, 0.7224999999999999, 0.7219, 0.721, 0.7185, 0.7138, 0.7035, 0.6914, 0.6077, 0.396, 0.24360000000000004, 0.07740000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7249, 0.7244999999999999, 0.7235, 0.7227, 0.7224999999999999, 0.7216, 0.7194, 0.7152000000000001, 0.7068, 0.6979, 0.6227, 0.41259999999999997, 0.23129999999999995, 0.041200000000000014], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7249, 0.7242, 0.723, 0.7224999999999999, 0.7219, 0.721, 0.7183999999999999, 0.7138, 0.7035, 0.6910000000000001, 0.6022000000000001, 0.355, 0.1632, 0.016100000000000003], "L2AdditiveUniformNoiseAttack()": [0.7249, 0.7249, 0.7248, 0.7249, 0.7248, 0.7248, 0.7248, 0.7248, 0.7248, 0.7249, 0.7244999999999999, 0.7244999999999999, 0.7244999999999999, 0.722], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7249, 0.7242, 0.723, 0.7224999999999999, 0.7218, 0.7207, 0.7182999999999999, 0.7133, 0.7025, 0.6896, 0.5989, 0.364, 0.18710000000000004, 0.028000000000000025], "robust_accuracy": [0.7249, 0.7242, 0.723, 0.7224999999999999, 0.7218, 0.7207, 0.7182999999999999, 0.7133, 0.7025, 0.6896, 0.597, 0.3489, 0.16000000000000003, 0.01539999999999997]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.685, 0.6847, 0.6839999999999999, 0.6834, 0.6829000000000001, 0.6821999999999999, 0.6809000000000001, 0.6758, 0.6658999999999999, 0.6583, 0.5797, 0.37829999999999997, 0.23309999999999997, 0.07099999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.685, 0.6847, 0.6841999999999999, 0.6839, 0.6834, 0.6825, 0.681, 0.6775, 0.669, 0.6623, 0.596, 0.3981, 0.23640000000000005, 0.045599999999999974], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.685, 0.6847, 0.6839999999999999, 0.6834, 0.6829000000000001, 0.6821999999999999, 0.6809000000000001, 0.6758, 0.6658999999999999, 0.6577999999999999, 0.5754, 0.346, 0.17700000000000005, 0.018000000000000016], "L2AdditiveUniformNoiseAttack()": [0.685, 0.685, 0.685, 0.6851, 0.685, 0.6851, 0.685, 0.6852, 0.685, 0.6852, 0.6853, 0.6852, 0.6858, 0.6853], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.685, 0.6846, 0.6839, 0.6834, 0.6828000000000001, 0.6819999999999999, 0.6805, 0.6754, 0.665, 0.6557999999999999, 0.5676, 0.34430000000000005, 0.18569999999999998, 0.02749999999999997], "robust_accuracy": [0.685, 0.6846, 0.6839, 0.6834, 0.6828000000000001, 0.6819999999999999, 0.6805, 0.6754, 0.665, 0.6557, 0.5673, 0.3368, 0.16969999999999996, 0.01649999999999996]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7253000000000001, 0.7247, 0.7242, 0.7238, 0.7236, 0.723, 0.7204999999999999, 0.7145, 0.7028, 0.6919, 0.6087, 0.39690000000000003, 0.24319999999999997, 0.06710000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7253000000000001, 0.7248, 0.7244999999999999, 0.7239, 0.7237, 0.7234, 0.7214, 0.716, 0.7057, 0.6959, 0.6267, 0.41400000000000003, 0.24070000000000003, 0.03920000000000001], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7253000000000001, 0.7247, 0.7242, 0.7238, 0.7236, 0.723, 0.7204999999999999, 0.7145, 0.7027, 0.6917, 0.604, 0.3589, 0.17300000000000004, 0.015100000000000002], "L2AdditiveUniformNoiseAttack()": [0.7253000000000001, 0.7253000000000001, 0.7253000000000001, 0.7253000000000001, 0.7254, 0.7253000000000001, 0.7252000000000001, 0.7253000000000001, 0.7255, 0.7253000000000001, 0.7251000000000001, 0.7248, 0.7259, 0.7237], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7253000000000001, 0.7247, 0.7242, 0.7236, 0.7234, 0.7229, 0.7197, 0.7132000000000001, 0.7007, 0.6887, 0.5981000000000001, 0.36050000000000004, 0.18669999999999998, 0.023900000000000032], "robust_accuracy": [0.7253000000000001, 0.7247, 0.7242, 0.7236, 0.7234, 0.7229, 0.7197, 0.7132000000000001, 0.7007, 0.6887, 0.5972, 0.35, 0.16700000000000004, 0.01419999999999999]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7257, 0.7253000000000001, 0.725, 0.7242, 0.7236, 0.7226, 0.7201, 0.7155, 0.7041, 0.6920999999999999, 0.6111, 0.39970000000000006, 0.2379, 0.057699999999999974], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7257, 0.7253000000000001, 0.7251000000000001, 0.7244999999999999, 0.724, 0.7232000000000001, 0.7213, 0.7170000000000001, 0.7075, 0.6986, 0.6285000000000001, 0.42210000000000003, 0.24280000000000002, 0.0383], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7257, 0.7253000000000001, 0.725, 0.7242, 0.7236, 0.7226, 0.72, 0.7155, 0.7038, 0.6918, 0.6083000000000001, 0.3668, 0.1743, 0.014499999999999957], "L2AdditiveUniformNoiseAttack()": [0.7257, 0.7257, 0.7257, 0.7257, 0.7257, 0.7257, 0.7258, 0.7257, 0.726, 0.7257, 0.726, 0.7263999999999999, 0.7263, 0.7261], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7257, 0.7253000000000001, 0.7249, 0.7241, 0.7235, 0.7223999999999999, 0.72, 0.7150000000000001, 0.7029000000000001, 0.6899, 0.605, 0.373, 0.19589999999999996, 0.025900000000000034], "robust_accuracy": [0.7257, 0.7253000000000001, 0.7249, 0.7241, 0.7235, 0.7223999999999999, 0.72, 0.7150000000000001, 0.7029000000000001, 0.6899, 0.6045, 0.36160000000000003, 0.17169999999999996, 0.014000000000000012]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7359, 0.7354, 0.7351, 0.7345999999999999, 0.7343, 0.7332000000000001, 0.7313000000000001, 0.7263, 0.7155, 0.7035, 0.6238, 0.402, 0.24839999999999995, 0.07340000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7359, 0.7355, 0.7352000000000001, 0.7348, 0.7345999999999999, 0.7336, 0.732, 0.7276, 0.7181, 0.7090000000000001, 0.638, 0.4182, 0.243, 0.041100000000000025], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7359, 0.7354, 0.7351, 0.7345999999999999, 0.7343, 0.7332000000000001, 0.7313000000000001, 0.7263, 0.7154, 0.7032, 0.6179, 0.3577, 0.17600000000000005, 0.016599999999999948], "L2AdditiveUniformNoiseAttack()": [0.7359, 0.7359, 0.7359, 0.7359, 0.7359, 0.7359, 0.7358, 0.7358, 0.7358, 0.736, 0.7363, 0.7347, 0.736, 0.7359], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7359, 0.7354, 0.7351, 0.7345999999999999, 0.7341, 0.7331, 0.7309, 0.7256, 0.714, 0.7022999999999999, 0.6159, 0.3698, 0.1976, 0.028100000000000014], "robust_accuracy": [0.7359, 0.7354, 0.7351, 0.7345999999999999, 0.7341, 0.7331, 0.7309, 0.7256, 0.714, 0.7022999999999999, 0.6142000000000001, 0.35240000000000005, 0.17290000000000005, 0.016000000000000014]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7123999999999999, 0.712, 0.7112, 0.7106, 0.7103999999999999, 0.7093, 0.7073, 0.7031000000000001, 0.6937, 0.6829000000000001, 0.6022000000000001, 0.38639999999999997, 0.22340000000000004, 0.05049999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7123999999999999, 0.712, 0.7117, 0.7108, 0.7106, 0.7098, 0.7078, 0.7041999999999999, 0.6965, 0.6883, 0.6204000000000001, 0.41490000000000005, 0.2368, 0.03759999999999997], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7123999999999999, 0.712, 0.7112, 0.7106, 0.7103999999999999, 0.7093, 0.7073, 0.7029000000000001, 0.6935, 0.6825, 0.5988, 0.35750000000000004, 0.16879999999999995, 0.011800000000000033], "L2AdditiveUniformNoiseAttack()": [0.7123999999999999, 0.7123999999999999, 0.7123999999999999, 0.7123999999999999, 0.7123999999999999, 0.7123999999999999, 0.7123999999999999, 0.7123999999999999, 0.7127, 0.7129, 0.712, 0.7128, 0.7135, 0.7143999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7123999999999999, 0.712, 0.7111000000000001, 0.7106, 0.7102999999999999, 0.7092, 0.7073, 0.7027, 0.6928000000000001, 0.6821999999999999, 0.5977, 0.3658, 0.19079999999999997, 0.024399999999999977], "robust_accuracy": [0.7123999999999999, 0.712, 0.7111000000000001, 0.7106, 0.7102999999999999, 0.7092, 0.7073, 0.7027, 0.6928000000000001, 0.6820999999999999, 0.5969, 0.35440000000000005, 0.16679999999999995, 0.011199999999999988]}}, "32": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7283, 0.7282, 0.7274, 0.727, 0.7266, 0.7255, 0.7229, 0.7185, 0.7081999999999999, 0.6985, 0.6191, 0.40800000000000003, 0.2538, 0.07569999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7283, 0.7282, 0.7275, 0.7271000000000001, 0.7268, 0.726, 0.7236, 0.7193, 0.712, 0.7027, 0.6353, 0.4246, 0.24950000000000006, 0.04090000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7283, 0.7282, 0.7274, 0.727, 0.7266, 0.7255, 0.7229, 0.7185, 0.7081, 0.6985, 0.6137, 0.3687, 0.17369999999999997, 0.014700000000000046], "L2AdditiveUniformNoiseAttack()": [0.7283, 0.7283, 0.7283, 0.7283, 0.7283, 0.7283, 0.7283, 0.7282, 0.7283, 0.7283999999999999, 0.7286, 0.7284999999999999, 0.7304999999999999, 0.7268], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7283, 0.7282, 0.7273000000000001, 0.7268, 0.7264999999999999, 0.725, 0.7228, 0.7179, 0.7067, 0.6964, 0.6064, 0.37150000000000005, 0.1906, 0.025599999999999956], "robust_accuracy": [0.7283, 0.7282, 0.7273000000000001, 0.7268, 0.7264999999999999, 0.725, 0.7228, 0.7179, 0.7067, 0.6964, 0.6059, 0.3618, 0.16849999999999998, 0.01419999999999999]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.736, 0.7356, 0.7351, 0.7344999999999999, 0.7336, 0.7322, 0.7294, 0.725, 0.7142, 0.7017, 0.6189, 0.40900000000000003, 0.25470000000000004, 0.08150000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.736, 0.7356, 0.7351, 0.7348, 0.7342, 0.7328, 0.7308, 0.7261, 0.7176, 0.7063999999999999, 0.6342, 0.42779999999999996, 0.24719999999999998, 0.041000000000000036], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.736, 0.7356, 0.7351, 0.7344999999999999, 0.7336, 0.7322, 0.7294, 0.725, 0.7139, 0.7013, 0.6131, 0.3668, 0.17820000000000003, 0.014700000000000046], "L2AdditiveUniformNoiseAttack()": [0.736, 0.7359, 0.736, 0.736, 0.736, 0.7359, 0.7359, 0.7361, 0.7358, 0.7362, 0.7359, 0.7363, 0.736, 0.7337], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.736, 0.7356, 0.735, 0.7341, 0.7334, 0.7322, 0.7291000000000001, 0.7247, 0.7121999999999999, 0.7001999999999999, 0.609, 0.3768, 0.19820000000000004, 0.02510000000000001], "robust_accuracy": [0.736, 0.7356, 0.735, 0.7341, 0.7334, 0.7322, 0.7291000000000001, 0.7247, 0.7121, 0.7001999999999999, 0.6079, 0.3617, 0.17490000000000006, 0.013700000000000045]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7364999999999999, 0.7361, 0.7359, 0.7358, 0.735, 0.7342, 0.7313000000000001, 0.7272000000000001, 0.7169, 0.7059, 0.6344000000000001, 0.42669999999999997, 0.2662, 0.0786], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7364999999999999, 0.7363, 0.736, 0.7358, 0.7354, 0.7343, 0.7319, 0.7283, 0.7192000000000001, 0.7108, 0.6476999999999999, 0.4477, 0.26870000000000005, 0.049699999999999966], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7364999999999999, 0.7361, 0.7359, 0.7358, 0.735, 0.7342, 0.7313000000000001, 0.7272000000000001, 0.7170000000000001, 0.7057, 0.6301, 0.38970000000000005, 0.19840000000000002, 0.02070000000000005], "L2AdditiveUniformNoiseAttack()": [0.7364999999999999, 0.7364999999999999, 0.7364999999999999, 0.7364999999999999, 0.7367, 0.7364999999999999, 0.7364999999999999, 0.7367, 0.7365999999999999, 0.7367, 0.7371, 0.7365999999999999, 0.7367, 0.7376], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7364999999999999, 0.7361, 0.7358, 0.7358, 0.7348, 0.7338, 0.7311000000000001, 0.7271000000000001, 0.716, 0.7049000000000001, 0.6261, 0.39990000000000003, 0.2218, 0.03290000000000004], "robust_accuracy": [0.7364999999999999, 0.7361, 0.7358, 0.7358, 0.7348, 0.7338, 0.7311000000000001, 0.7271000000000001, 0.716, 0.7048, 0.6255999999999999, 0.38560000000000005, 0.19479999999999997, 0.019100000000000006]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7483, 0.7479, 0.7473000000000001, 0.747, 0.7464999999999999, 0.7449, 0.7435, 0.7379, 0.726, 0.7149, 0.6276999999999999, 0.38660000000000005, 0.22499999999999998, 0.0695], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7483, 0.7479, 0.7475, 0.7471, 0.7469, 0.7455, 0.7441, 0.7398, 0.7306, 0.7204999999999999, 0.6438999999999999, 0.40880000000000005, 0.22440000000000004, 0.03280000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7483, 0.7479, 0.7473000000000001, 0.747, 0.7464999999999999, 0.7449, 0.7435, 0.7379, 0.726, 0.7143999999999999, 0.623, 0.3429, 0.15080000000000005, 0.011900000000000022], "L2AdditiveUniformNoiseAttack()": [0.7483, 0.7483, 0.7483, 0.7483, 0.7483, 0.7483, 0.7484999999999999, 0.7484, 0.7484999999999999, 0.7481, 0.7484, 0.7485999999999999, 0.7484, 0.7472], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7483, 0.7479, 0.7473000000000001, 0.7469, 0.7463, 0.7446999999999999, 0.7433000000000001, 0.7375, 0.7253000000000001, 0.714, 0.6232, 0.3589, 0.18179999999999996, 0.019399999999999973], "robust_accuracy": [0.7483, 0.7479, 0.7473000000000001, 0.7469, 0.7463, 0.7446999999999999, 0.7433000000000001, 0.7375, 0.7253000000000001, 0.7139, 0.621, 0.3407, 0.14859999999999995, 0.010099999999999998]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.759, 0.7584, 0.7579, 0.757, 0.7567, 0.756, 0.7541, 0.75, 0.7392000000000001, 0.7272000000000001, 0.648, 0.41969999999999996, 0.255, 0.06930000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.759, 0.7584, 0.758, 0.7573, 0.7567, 0.7564, 0.7554, 0.7513, 0.7419, 0.7324999999999999, 0.6623, 0.44010000000000005, 0.2501, 0.03710000000000002], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.759, 0.7584, 0.7579, 0.757, 0.7567, 0.756, 0.7541, 0.7499, 0.7388, 0.7267, 0.6436, 0.3788, 0.17469999999999997, 0.01419999999999999], "L2AdditiveUniformNoiseAttack()": [0.759, 0.759, 0.759, 0.759, 0.759, 0.7591, 0.7591, 0.7591, 0.7587, 0.759, 0.7581, 0.7592, 0.7594, 0.7577], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.759, 0.7584, 0.7578, 0.757, 0.7564, 0.756, 0.7539, 0.7493000000000001, 0.7376, 0.7253000000000001, 0.6396999999999999, 0.39059999999999995, 0.20089999999999997, 0.023700000000000054], "robust_accuracy": [0.759, 0.7584, 0.7578, 0.757, 0.7564, 0.756, 0.7539, 0.7493000000000001, 0.7376, 0.7252000000000001, 0.639, 0.375, 0.17179999999999995, 0.0131]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.706, 0.7059, 0.7051000000000001, 0.7047, 0.7042999999999999, 0.7038, 0.7018, 0.6964, 0.6846, 0.6736, 0.5924, 0.38859999999999995, 0.24329999999999996, 0.07709999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.706, 0.7059, 0.7055, 0.7047, 0.7046, 0.7039, 0.7025, 0.6978, 0.6880999999999999, 0.6777, 0.6069, 0.4063, 0.23829999999999996, 0.042200000000000015], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.706, 0.7059, 0.7051000000000001, 0.7047, 0.7042999999999999, 0.7038, 0.7018, 0.6962999999999999, 0.6844, 0.6729, 0.5877, 0.3509, 0.16749999999999998, 0.014599999999999946], "L2AdditiveUniformNoiseAttack()": [0.706, 0.706, 0.706, 0.706, 0.706, 0.706, 0.706, 0.7061, 0.7059, 0.7065, 0.7063999999999999, 0.7069, 0.7034, 0.704], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.706, 0.7058, 0.7050000000000001, 0.7046, 0.7042999999999999, 0.7037, 0.7016, 0.6957, 0.6829000000000001, 0.6713, 0.5839, 0.36050000000000004, 0.19599999999999995, 0.0262], "robust_accuracy": [0.706, 0.7058, 0.7050000000000001, 0.7046, 0.7042999999999999, 0.7037, 0.7016, 0.6957, 0.6829000000000001, 0.6713, 0.5829, 0.34709999999999996, 0.16559999999999997, 0.013800000000000034]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7193, 0.719, 0.7181, 0.7170000000000001, 0.7165, 0.7153, 0.7130000000000001, 0.7070000000000001, 0.6940999999999999, 0.6835, 0.5994999999999999, 0.38870000000000005, 0.23860000000000003, 0.08140000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7193, 0.7191000000000001, 0.7183999999999999, 0.7178, 0.7168, 0.7157, 0.7139, 0.7092, 0.6989000000000001, 0.6884, 0.6154999999999999, 0.40569999999999995, 0.22829999999999995, 0.043300000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7193, 0.719, 0.7181, 0.7170000000000001, 0.7165, 0.7153, 0.7130000000000001, 0.7069, 0.6940999999999999, 0.6829000000000001, 0.5951, 0.34550000000000003, 0.15980000000000005, 0.017800000000000038], "L2AdditiveUniformNoiseAttack()": [0.7193, 0.7193, 0.7193, 0.7193, 0.7193, 0.7193, 0.7193, 0.7194, 0.7193, 0.7194, 0.7191000000000001, 0.7192000000000001, 0.7191000000000001, 0.7181], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7193, 0.719, 0.718, 0.7169, 0.7163999999999999, 0.7153, 0.7129, 0.7063999999999999, 0.6926, 0.6811, 0.5917, 0.35550000000000004, 0.18230000000000002, 0.028100000000000014], "robust_accuracy": [0.7193, 0.719, 0.718, 0.7169, 0.7163999999999999, 0.7153, 0.7129, 0.7063999999999999, 0.6926, 0.681, 0.5908, 0.3396, 0.15700000000000003, 0.015599999999999947]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7108, 0.7101999999999999, 0.7099, 0.7092, 0.7088, 0.7078, 0.7057, 0.702, 0.6901999999999999, 0.6795, 0.5991, 0.38180000000000003, 0.23319999999999996, 0.07669999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7108, 0.7102999999999999, 0.7099, 0.7096, 0.7091000000000001, 0.7081999999999999, 0.7061999999999999, 0.7034, 0.6942999999999999, 0.6847, 0.6133, 0.3992, 0.22240000000000004, 0.038000000000000034], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7108, 0.7101999999999999, 0.7099, 0.7092, 0.7088, 0.7078, 0.7057, 0.7019, 0.69, 0.6789000000000001, 0.5937, 0.3365, 0.1552, 0.014800000000000035], "L2AdditiveUniformNoiseAttack()": [0.7108, 0.7108, 0.7107, 0.7108, 0.7108, 0.7108, 0.7108, 0.7108, 0.7108, 0.7109, 0.7108, 0.7110000000000001, 0.7101, 0.7090000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7108, 0.7101999999999999, 0.7099, 0.7092, 0.7087, 0.7071000000000001, 0.7052, 0.7002999999999999, 0.6880999999999999, 0.6767000000000001, 0.5857, 0.33609999999999995, 0.17059999999999997, 0.02310000000000001], "robust_accuracy": [0.7108, 0.7101999999999999, 0.7099, 0.7092, 0.7087, 0.7071000000000001, 0.7052, 0.7002999999999999, 0.6880999999999999, 0.6767000000000001, 0.5851, 0.3245, 0.1481, 0.013599999999999945]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7479, 0.7469, 0.7464, 0.7458, 0.7452, 0.7434000000000001, 0.7415, 0.7351, 0.7233, 0.7107, 0.6276999999999999, 0.4102, 0.24509999999999998, 0.06589999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7479, 0.7473000000000001, 0.7464999999999999, 0.7461, 0.7453000000000001, 0.7439, 0.7419, 0.7372000000000001, 0.7263999999999999, 0.7162999999999999, 0.6436999999999999, 0.42679999999999996, 0.23740000000000006, 0.03190000000000004], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7479, 0.7469, 0.7464, 0.7458, 0.7452, 0.7434000000000001, 0.7414000000000001, 0.735, 0.7233, 0.7105, 0.6225, 0.365, 0.16590000000000005, 0.009800000000000031], "L2AdditiveUniformNoiseAttack()": [0.7479, 0.7479, 0.7479, 0.7479, 0.7479, 0.7479, 0.7479, 0.7479, 0.7477, 0.7478, 0.7481, 0.7475, 0.7458, 0.7449], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7479, 0.7469, 0.7463, 0.7454000000000001, 0.745, 0.7432000000000001, 0.7411, 0.7343, 0.722, 0.7081999999999999, 0.6185, 0.3739, 0.1865, 0.019000000000000017], "robust_accuracy": [0.7479, 0.7469, 0.7463, 0.7454000000000001, 0.745, 0.7432000000000001, 0.7411, 0.7343, 0.722, 0.7081999999999999, 0.617, 0.3601, 0.16300000000000003, 0.009399999999999964]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7273000000000001, 0.7267, 0.7262, 0.7255, 0.7253000000000001, 0.7242, 0.7219, 0.7166, 0.7046, 0.6939, 0.6163000000000001, 0.4031, 0.246, 0.07320000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7273000000000001, 0.7267, 0.7263999999999999, 0.7257, 0.7254, 0.7248, 0.7229, 0.7179, 0.7075, 0.6986, 0.6328, 0.42210000000000003, 0.24419999999999997, 0.03839999999999999], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7273000000000001, 0.7267, 0.7262, 0.7255, 0.7253000000000001, 0.7241, 0.7219, 0.7163999999999999, 0.7045, 0.6935, 0.6126, 0.363, 0.1745, 0.014499999999999957], "L2AdditiveUniformNoiseAttack()": [0.7273000000000001, 0.7273000000000001, 0.7273000000000001, 0.7273000000000001, 0.7273000000000001, 0.7272000000000001, 0.7272000000000001, 0.7272000000000001, 0.7269, 0.7271000000000001, 0.7266, 0.7269, 0.7268, 0.7254], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7273000000000001, 0.7267, 0.7262, 0.7254, 0.7253000000000001, 0.7239, 0.7216, 0.7155, 0.7038, 0.6909000000000001, 0.6084, 0.37129999999999996, 0.19669999999999999, 0.0262], "robust_accuracy": [0.7273000000000001, 0.7267, 0.7262, 0.7254, 0.7253000000000001, 0.7239, 0.7216, 0.7155, 0.7038, 0.6909000000000001, 0.6075999999999999, 0.35740000000000005, 0.17149999999999999, 0.013000000000000012]}}}, "2": {"1": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7203999999999999, 0.7197, 0.719, 0.7183999999999999, 0.7177, 0.7171000000000001, 0.7149, 0.7101, 0.6980999999999999, 0.6864, 0.6037, 0.37629999999999997, 0.21919999999999995, 0.06159999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7203999999999999, 0.7198, 0.7193, 0.7187, 0.7182999999999999, 0.7173, 0.7159, 0.7115, 0.7015, 0.692, 0.618, 0.3871, 0.1996, 0.01859999999999995], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7203999999999999, 0.7197, 0.719, 0.7183999999999999, 0.7177, 0.7171000000000001, 0.7149, 0.7101, 0.6978, 0.6861999999999999, 0.5989, 0.32410000000000005, 0.12890000000000001, 0.005499999999999949], "L2AdditiveUniformNoiseAttack()": [0.7203999999999999, 0.7203999999999999, 0.7203999999999999, 0.7203999999999999, 0.7203999999999999, 0.7203999999999999, 0.7203999999999999, 0.7202, 0.7201, 0.7202999999999999, 0.7198, 0.7202, 0.7206, 0.719], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7203999999999999, 0.7197, 0.7189, 0.7183999999999999, 0.7177, 0.7168, 0.7145, 0.7095, 0.6964, 0.6836, 0.5956, 0.33730000000000004, 0.16159999999999997, 0.012599999999999945], "robust_accuracy": [0.7203999999999999, 0.7197, 0.7189, 0.7183999999999999, 0.7177, 0.7168, 0.7145, 0.7095, 0.6964, 0.6836, 0.5942000000000001, 0.31810000000000005, 0.1261, 0.00539999999999996]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7172000000000001, 0.7167, 0.7159, 0.7156, 0.7149, 0.7136, 0.7115, 0.7052, 0.6931, 0.6808000000000001, 0.5884, 0.3499, 0.1995, 0.05159999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7172000000000001, 0.7167, 0.7159, 0.7157, 0.7153, 0.7145, 0.712, 0.7075, 0.6967, 0.6863, 0.6065, 0.3649, 0.1855, 0.023700000000000054], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7172000000000001, 0.7167, 0.7159, 0.7156, 0.7149, 0.7137, 0.7115, 0.7051000000000001, 0.6931, 0.6804, 0.5827, 0.30100000000000005, 0.12519999999999998, 0.008099999999999996], "L2AdditiveUniformNoiseAttack()": [0.7172000000000001, 0.7172000000000001, 0.7172000000000001, 0.7172000000000001, 0.7172000000000001, 0.7171000000000001, 0.7171000000000001, 0.7170000000000001, 0.7172000000000001, 0.7172000000000001, 0.7174, 0.7172000000000001, 0.7162999999999999, 0.7149], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7172000000000001, 0.7166, 0.7159, 0.7155, 0.7148, 0.7134, 0.7115, 0.7041, 0.6912, 0.6774, 0.5754, 0.31210000000000004, 0.14690000000000003, 0.015499999999999958], "robust_accuracy": [0.7172000000000001, 0.7166, 0.7159, 0.7155, 0.7148, 0.7134, 0.7115, 0.7041, 0.6912, 0.6774, 0.5747, 0.29510000000000003, 0.123, 0.00770000000000004]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7050000000000001, 0.7045, 0.7035, 0.7024, 0.702, 0.7008, 0.6990000000000001, 0.6938, 0.6782, 0.6663, 0.5728, 0.33830000000000005, 0.1855, 0.05230000000000001], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7050000000000001, 0.7046, 0.7039, 0.7029000000000001, 0.7021, 0.7014, 0.6997, 0.6957, 0.6834, 0.6708000000000001, 0.5902000000000001, 0.35440000000000005, 0.17269999999999996, 0.016599999999999948], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7050000000000001, 0.7045, 0.7033, 0.7024, 0.702, 0.7008, 0.6990000000000001, 0.6938, 0.6780999999999999, 0.6657, 0.5678000000000001, 0.29059999999999997, 0.10980000000000001, 0.0049000000000000155], "L2AdditiveUniformNoiseAttack()": [0.7050000000000001, 0.7050000000000001, 0.7050000000000001, 0.7049000000000001, 0.7051000000000001, 0.7050000000000001, 0.7051000000000001, 0.7050000000000001, 0.7048, 0.7051000000000001, 0.7049000000000001, 0.7051000000000001, 0.7056, 0.7011000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7050000000000001, 0.7044, 0.7033, 0.7024, 0.7018, 0.7001999999999999, 0.6985, 0.6926, 0.6759999999999999, 0.6633, 0.5628, 0.29979999999999996, 0.136, 0.01090000000000002], "robust_accuracy": [0.7050000000000001, 0.7044, 0.7033, 0.7024, 0.7018, 0.7001999999999999, 0.6985, 0.6926, 0.6759999999999999, 0.6632, 0.5616, 0.2841, 0.10709999999999997, 0.0044999999999999485]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7011000000000001, 0.7006, 0.6997, 0.6995, 0.6989000000000001, 0.6980999999999999, 0.6948, 0.6880999999999999, 0.6738999999999999, 0.6601, 0.5664, 0.33599999999999997, 0.18110000000000004, 0.051899999999999946], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7011000000000001, 0.7007, 0.6999, 0.6997, 0.6993, 0.6984, 0.6964, 0.69, 0.6767000000000001, 0.6667000000000001, 0.5838, 0.34440000000000004, 0.16149999999999998, 0.015800000000000036], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7011000000000001, 0.7006, 0.6997, 0.6995, 0.6989000000000001, 0.6980999999999999, 0.6948, 0.6880999999999999, 0.6738, 0.6597999999999999, 0.5610999999999999, 0.2811, 0.09989999999999999, 0.0049000000000000155], "L2AdditiveUniformNoiseAttack()": [0.7011000000000001, 0.7011000000000001, 0.7011000000000001, 0.7011000000000001, 0.7011000000000001, 0.7011000000000001, 0.7011000000000001, 0.7010000000000001, 0.7011000000000001, 0.7009000000000001, 0.7007, 0.7011000000000001, 0.7012, 0.6981999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7011000000000001, 0.7006, 0.6996, 0.6995, 0.6988, 0.6978, 0.6941999999999999, 0.6867, 0.6717, 0.6576, 0.5554, 0.2932, 0.125, 0.011099999999999999], "robust_accuracy": [0.7011000000000001, 0.7006, 0.6996, 0.6995, 0.6988, 0.6978, 0.6941999999999999, 0.6867, 0.6717, 0.6575, 0.5541, 0.274, 0.09740000000000004, 0.0047000000000000375]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7269, 0.7267, 0.7262, 0.7257, 0.7249, 0.7239, 0.7209, 0.7146, 0.7018, 0.6877, 0.5913999999999999, 0.3436, 0.18930000000000002, 0.04239999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7269, 0.7267, 0.7266, 0.726, 0.7256, 0.7242999999999999, 0.7222, 0.7167, 0.7053, 0.6945, 0.608, 0.3619, 0.18689999999999996, 0.01970000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7269, 0.7267, 0.7262, 0.7257, 0.7249, 0.7239, 0.7209, 0.7146, 0.7017, 0.6873, 0.5857, 0.29790000000000005, 0.12209999999999999, 0.005900000000000016], "L2AdditiveUniformNoiseAttack()": [0.7269, 0.7269, 0.7269, 0.7269, 0.7269, 0.7269, 0.7269, 0.727, 0.727, 0.7272000000000001, 0.7264999999999999, 0.7273000000000001, 0.7272000000000001, 0.7272000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7269, 0.7266, 0.7262, 0.7257, 0.7246, 0.7237, 0.7202999999999999, 0.7139, 0.7001999999999999, 0.6848000000000001, 0.5805, 0.3094, 0.14639999999999997, 0.013700000000000045], "robust_accuracy": [0.7269, 0.7266, 0.7262, 0.7257, 0.7246, 0.7237, 0.7202999999999999, 0.7139, 0.7001999999999999, 0.6848000000000001, 0.5796, 0.2931, 0.12, 0.005600000000000049]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7313000000000001, 0.7307, 0.7303, 0.7295, 0.7287, 0.7277, 0.7254, 0.7199, 0.7073, 0.6907, 0.6001000000000001, 0.37239999999999995, 0.21689999999999998, 0.05349999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7313000000000001, 0.7307, 0.7303, 0.7298, 0.7291000000000001, 0.7281, 0.7259, 0.7214, 0.7114, 0.6974, 0.6174999999999999, 0.38770000000000004, 0.20779999999999998, 0.022399999999999975], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7313000000000001, 0.7307, 0.7303, 0.7295, 0.7287, 0.7277, 0.7253000000000001, 0.7197, 0.7068, 0.6901999999999999, 0.5948, 0.3265, 0.1382, 0.007099999999999995], "L2AdditiveUniformNoiseAttack()": [0.7313000000000001, 0.7313000000000001, 0.7313000000000001, 0.7314, 0.7313000000000001, 0.7313000000000001, 0.7314, 0.7312000000000001, 0.7315, 0.7309, 0.7323999999999999, 0.7314, 0.7316, 0.7282], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7313000000000001, 0.7307, 0.7303, 0.7294, 0.7283, 0.7274, 0.725, 0.719, 0.7045, 0.6875, 0.5891, 0.33640000000000003, 0.1654, 0.014700000000000046], "robust_accuracy": [0.7313000000000001, 0.7307, 0.7303, 0.7294, 0.7283, 0.7274, 0.725, 0.7189, 0.7045, 0.6875, 0.5878, 0.31999999999999995, 0.136, 0.00649999999999995]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7001, 0.6996, 0.6984, 0.6981999999999999, 0.6976, 0.6969000000000001, 0.6949000000000001, 0.6889000000000001, 0.6749, 0.6642, 0.5759000000000001, 0.3549, 0.20530000000000004, 0.05810000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7001, 0.6996, 0.6986, 0.6982999999999999, 0.698, 0.6972, 0.6953, 0.6910000000000001, 0.6793, 0.6692, 0.593, 0.3729, 0.19930000000000003, 0.027000000000000024], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7001, 0.6996, 0.6984, 0.6981999999999999, 0.6976, 0.6969000000000001, 0.6949000000000001, 0.6887, 0.6749, 0.6637, 0.5705, 0.31789999999999996, 0.13790000000000002, 0.009199999999999986], "L2AdditiveUniformNoiseAttack()": [0.7001, 0.7001, 0.7, 0.7001999999999999, 0.7, 0.7001999999999999, 0.7001, 0.7001999999999999, 0.7001999999999999, 0.7, 0.7002999999999999, 0.7013, 0.6994, 0.6976], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7001, 0.6996, 0.6984, 0.698, 0.6975, 0.6967, 0.6948, 0.6879, 0.6738, 0.6621, 0.5654, 0.32320000000000004, 0.1583, 0.018199999999999994], "robust_accuracy": [0.7001, 0.6996, 0.6984, 0.698, 0.6975, 0.6967, 0.6948, 0.6879, 0.6738, 0.6619999999999999, 0.5643, 0.31120000000000003, 0.13480000000000003, 0.00880000000000003]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7246, 0.7238, 0.7235, 0.7223999999999999, 0.7217, 0.7207, 0.718, 0.7106, 0.6965, 0.6812, 0.5735, 0.3103, 0.16369999999999996, 0.04479999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7246, 0.724, 0.7235, 0.7231000000000001, 0.722, 0.721, 0.7188, 0.7129, 0.7009000000000001, 0.687, 0.5933999999999999, 0.31110000000000004, 0.13270000000000004, 0.008600000000000052], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7246, 0.7238, 0.7235, 0.7223999999999999, 0.7217, 0.7207, 0.7179, 0.7106, 0.6961999999999999, 0.6808000000000001, 0.5654, 0.24470000000000003, 0.07799999999999996, 0.0023999999999999577], "L2AdditiveUniformNoiseAttack()": [0.7246, 0.7246, 0.7244999999999999, 0.7244999999999999, 0.7244999999999999, 0.7244999999999999, 0.7246, 0.7244999999999999, 0.7248, 0.7248, 0.7248, 0.7242999999999999, 0.725, 0.7211000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7246, 0.7238, 0.7235, 0.7222, 0.7217, 0.7204999999999999, 0.7173, 0.7094, 0.6940999999999999, 0.6789000000000001, 0.5636, 0.26449999999999996, 0.10499999999999998, 0.006099999999999994], "robust_accuracy": [0.7246, 0.7238, 0.7235, 0.7222, 0.7217, 0.7204999999999999, 0.7173, 0.7094, 0.6940999999999999, 0.6788000000000001, 0.5609999999999999, 0.241, 0.07650000000000001, 0.0022999999999999687]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7477, 0.7474000000000001, 0.7464999999999999, 0.7457, 0.7448, 0.7432000000000001, 0.74, 0.7336, 0.7196, 0.7052, 0.6023000000000001, 0.345, 0.18799999999999994, 0.04620000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7477, 0.7475, 0.7465999999999999, 0.746, 0.7452, 0.7439, 0.7413000000000001, 0.735, 0.7238, 0.7119, 0.6206, 0.34840000000000004, 0.1602, 0.010000000000000009], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7477, 0.7474000000000001, 0.7464999999999999, 0.7457, 0.7448, 0.7432000000000001, 0.7399, 0.7335, 0.7195, 0.7042999999999999, 0.5932999999999999, 0.2803, 0.10109999999999997, 0.0024999999999999467], "L2AdditiveUniformNoiseAttack()": [0.7477, 0.7477, 0.7477, 0.7477, 0.7477, 0.7477, 0.7479, 0.7477, 0.7476, 0.748, 0.7482, 0.7479, 0.7476, 0.7446999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7477, 0.7474000000000001, 0.7463, 0.7454000000000001, 0.7445999999999999, 0.7429, 0.7399, 0.7325999999999999, 0.7176, 0.7021, 0.5896, 0.2993, 0.13029999999999997, 0.006700000000000039], "robust_accuracy": [0.7477, 0.7474000000000001, 0.7463, 0.7454000000000001, 0.7445999999999999, 0.7429, 0.7399, 0.7325999999999999, 0.7175, 0.7019, 0.587, 0.27659999999999996, 0.09850000000000003, 0.0024999999999999467]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7181, 0.7178, 0.7173, 0.7162999999999999, 0.7156, 0.7145, 0.7126, 0.7045, 0.6905, 0.6762, 0.5751, 0.3185, 0.15880000000000005, 0.0353], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7181, 0.7178, 0.7175, 0.7168, 0.7162, 0.7150000000000001, 0.7132000000000001, 0.7073, 0.6946, 0.6833, 0.5932999999999999, 0.3318, 0.13680000000000003, 0.007299999999999973], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7181, 0.7178, 0.7173, 0.7162999999999999, 0.7156, 0.7145, 0.7125, 0.7044, 0.6901999999999999, 0.6755, 0.5692999999999999, 0.25639999999999996, 0.07950000000000002, 0.0018000000000000238], "L2AdditiveUniformNoiseAttack()": [0.7181, 0.7181, 0.7181, 0.7181, 0.7181, 0.7181, 0.718, 0.7182, 0.7181, 0.7179, 0.718, 0.7166, 0.7174, 0.7161], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7181, 0.7178, 0.7172000000000001, 0.7162999999999999, 0.7156, 0.7142999999999999, 0.7121, 0.7037, 0.6886, 0.6738, 0.5663, 0.27790000000000004, 0.10760000000000003, 0.0048000000000000265], "robust_accuracy": [0.7181, 0.7178, 0.7172000000000001, 0.7162999999999999, 0.7156, 0.7142999999999999, 0.7121, 0.7037, 0.6885, 0.6738, 0.5646, 0.25239999999999996, 0.0776, 0.0018000000000000238]}}, "2": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7339, 0.7334, 0.7327, 0.7316, 0.731, 0.7301, 0.7281, 0.7215, 0.7078, 0.6934, 0.5937, 0.35619999999999996, 0.1896, 0.04569999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7339, 0.7334, 0.7329, 0.732, 0.7313000000000001, 0.7306, 0.7284999999999999, 0.7232000000000001, 0.712, 0.6999, 0.6138, 0.3718, 0.1773, 0.017199999999999993], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7339, 0.7334, 0.7327, 0.7316, 0.731, 0.7301, 0.728, 0.7215, 0.7076, 0.6928000000000001, 0.5895, 0.3025, 0.11409999999999998, 0.005099999999999993], "L2AdditiveUniformNoiseAttack()": [0.7339, 0.7338, 0.7337, 0.7339, 0.7338, 0.7339, 0.7338, 0.734, 0.7338, 0.7338, 0.7331, 0.7336, 0.7329, 0.7321], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7339, 0.7333000000000001, 0.7324999999999999, 0.7314, 0.7309, 0.7297, 0.7276, 0.7209, 0.7065, 0.6907, 0.5861000000000001, 0.32099999999999995, 0.13690000000000002, 0.010299999999999976], "robust_accuracy": [0.7339, 0.7333000000000001, 0.7324999999999999, 0.7314, 0.7309, 0.7297, 0.7276, 0.7209, 0.7065, 0.6905, 0.585, 0.2984, 0.11109999999999998, 0.0047000000000000375]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7277, 0.7269, 0.7264999999999999, 0.7255, 0.7247, 0.7233, 0.7211000000000001, 0.7135, 0.7, 0.6857, 0.5880000000000001, 0.348, 0.1935, 0.04700000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7277, 0.7271000000000001, 0.7266, 0.726, 0.725, 0.7238, 0.7217, 0.7153, 0.7042999999999999, 0.6925, 0.6059, 0.36, 0.18079999999999996, 0.017199999999999993], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7277, 0.7269, 0.7264999999999999, 0.7255, 0.7247, 0.7233, 0.7211000000000001, 0.7135, 0.6998, 0.6848000000000001, 0.5794, 0.29510000000000003, 0.11660000000000004, 0.005600000000000049], "L2AdditiveUniformNoiseAttack()": [0.7277, 0.7277, 0.7277, 0.7277, 0.7277, 0.7277, 0.7276, 0.7276, 0.7276, 0.7273000000000001, 0.7276, 0.7263999999999999, 0.7264999999999999, 0.7243999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7277, 0.7269, 0.7264999999999999, 0.7254, 0.7244999999999999, 0.7232000000000001, 0.7206, 0.7127, 0.6981999999999999, 0.6841999999999999, 0.5778, 0.3154, 0.1471, 0.013000000000000012], "robust_accuracy": [0.7277, 0.7269, 0.7264999999999999, 0.7254, 0.7244999999999999, 0.7232000000000001, 0.7206, 0.7127, 0.6981999999999999, 0.6839, 0.5761000000000001, 0.2924, 0.11550000000000005, 0.00539999999999996]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7137, 0.7131000000000001, 0.7126, 0.7119, 0.7113, 0.71, 0.7076, 0.7022999999999999, 0.6897, 0.6779, 0.5906, 0.36970000000000003, 0.2086, 0.049900000000000055], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7137, 0.7133, 0.7126, 0.7121999999999999, 0.7118, 0.7102999999999999, 0.7087, 0.7042999999999999, 0.6939, 0.6837, 0.607, 0.38780000000000003, 0.2047, 0.024700000000000055], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7137, 0.7131000000000001, 0.7126, 0.7119, 0.7113, 0.71, 0.7076, 0.7021999999999999, 0.6895, 0.6769000000000001, 0.5856, 0.32699999999999996, 0.14180000000000004, 0.007299999999999973], "L2AdditiveUniformNoiseAttack()": [0.7137, 0.7137, 0.7137, 0.7137, 0.7137, 0.7137, 0.7137, 0.7136, 0.7135, 0.7137, 0.7142, 0.7145, 0.7129, 0.7108], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7137, 0.7130000000000001, 0.7126, 0.7119, 0.7111000000000001, 0.7098, 0.7075, 0.7015, 0.6886, 0.6752, 0.5821000000000001, 0.3385, 0.16410000000000002, 0.016599999999999948], "robust_accuracy": [0.7137, 0.7130000000000001, 0.7126, 0.7119, 0.7111000000000001, 0.7098, 0.7075, 0.7015, 0.6884, 0.675, 0.5813999999999999, 0.32299999999999995, 0.1391, 0.006900000000000017]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7292000000000001, 0.7289, 0.7279, 0.7271000000000001, 0.7266, 0.7258, 0.7239, 0.7189, 0.7056, 0.6927, 0.5988, 0.34750000000000003, 0.18930000000000002, 0.04359999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7292000000000001, 0.7289, 0.7281, 0.7274, 0.7271000000000001, 0.7262, 0.7247, 0.7207, 0.7097, 0.6981999999999999, 0.6155999999999999, 0.3659, 0.18359999999999999, 0.01859999999999995], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7292000000000001, 0.7289, 0.7279, 0.7271000000000001, 0.7266, 0.7258, 0.7239, 0.7187, 0.7055, 0.6926, 0.5928, 0.30110000000000003, 0.11680000000000001, 0.005299999999999971], "L2AdditiveUniformNoiseAttack()": [0.7292000000000001, 0.7292000000000001, 0.7292000000000001, 0.7292000000000001, 0.7292000000000001, 0.7292000000000001, 0.7292000000000001, 0.7291000000000001, 0.7292000000000001, 0.7292000000000001, 0.7299, 0.7298, 0.7301, 0.7283999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7292000000000001, 0.7289, 0.7278, 0.7271000000000001, 0.7266, 0.7256, 0.7237, 0.718, 0.704, 0.6898, 0.5886, 0.3154, 0.14359999999999995, 0.011099999999999999], "robust_accuracy": [0.7292000000000001, 0.7289, 0.7278, 0.7271000000000001, 0.7266, 0.7256, 0.7237, 0.718, 0.704, 0.6898, 0.5871999999999999, 0.29710000000000003, 0.11509999999999998, 0.0046000000000000485]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7079, 0.7072, 0.7066, 0.7058, 0.7054, 0.7041, 0.7016, 0.6962999999999999, 0.6824, 0.671, 0.5822, 0.35719999999999996, 0.20520000000000005, 0.050000000000000044], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7079, 0.7073, 0.7067, 0.7061999999999999, 0.7057, 0.7051000000000001, 0.7022999999999999, 0.6982999999999999, 0.6854, 0.6759, 0.5992, 0.3768, 0.20430000000000004, 0.028100000000000014], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7079, 0.7072, 0.7066, 0.7058, 0.7054, 0.7041, 0.7016, 0.6962999999999999, 0.6821999999999999, 0.6705, 0.5771, 0.31779999999999997, 0.13790000000000002, 0.009600000000000053], "L2AdditiveUniformNoiseAttack()": [0.7079, 0.7079, 0.7079, 0.7079, 0.7079, 0.7079, 0.7079, 0.7078, 0.708, 0.7077, 0.7081, 0.7079, 0.7075, 0.706], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7079, 0.7072, 0.7062999999999999, 0.7057, 0.7053, 0.7038, 0.7014, 0.6949000000000001, 0.6809000000000001, 0.6679999999999999, 0.5701, 0.3208, 0.1543, 0.017299999999999982], "robust_accuracy": [0.7079, 0.7072, 0.7062999999999999, 0.7057, 0.7053, 0.7038, 0.7014, 0.6949000000000001, 0.6809000000000001, 0.6679999999999999, 0.5692999999999999, 0.3097, 0.13419999999999999, 0.009199999999999986]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7155, 0.7149, 0.7145, 0.7138, 0.7132000000000001, 0.7125, 0.7102999999999999, 0.7035, 0.6906, 0.677, 0.591, 0.3436, 0.1854, 0.03590000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7155, 0.7151000000000001, 0.7147, 0.7142, 0.7136, 0.7129, 0.7111000000000001, 0.7053, 0.6947, 0.683, 0.607, 0.365, 0.18130000000000002, 0.018199999999999994], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7155, 0.7149, 0.7145, 0.7138, 0.7132000000000001, 0.7123999999999999, 0.7102999999999999, 0.7035, 0.6904, 0.6769000000000001, 0.5851, 0.29769999999999996, 0.11629999999999996, 0.005299999999999971], "L2AdditiveUniformNoiseAttack()": [0.7155, 0.7155, 0.7155, 0.7156, 0.7156, 0.7156, 0.7155, 0.7156, 0.7155, 0.7155, 0.7158, 0.716, 0.7171000000000001, 0.7151000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7155, 0.7149, 0.7143999999999999, 0.7136, 0.7130000000000001, 0.7121999999999999, 0.7096, 0.7021999999999999, 0.6878, 0.6736, 0.5783, 0.30679999999999996, 0.138, 0.010099999999999998], "robust_accuracy": [0.7155, 0.7149, 0.7143999999999999, 0.7136, 0.7130000000000001, 0.7121999999999999, 0.7096, 0.7021999999999999, 0.6878, 0.6736, 0.5775, 0.2914, 0.11360000000000003, 0.005099999999999993]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7281, 0.7279, 0.7276, 0.7266, 0.7261, 0.725, 0.723, 0.7176, 0.7061999999999999, 0.6954, 0.6127, 0.3798, 0.21350000000000002, 0.05259999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7281, 0.7279, 0.7278, 0.727, 0.7263, 0.7256, 0.724, 0.7188, 0.7094, 0.7007, 0.6269, 0.39870000000000005, 0.2096, 0.02639999999999998], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7281, 0.7279, 0.7276, 0.7266, 0.7261, 0.725, 0.723, 0.7175, 0.7061999999999999, 0.6953, 0.6077, 0.3338, 0.14149999999999996, 0.009000000000000008], "L2AdditiveUniformNoiseAttack()": [0.7281, 0.7281, 0.7281, 0.7281, 0.7281, 0.7282, 0.7281, 0.7282, 0.7283, 0.7283, 0.7287, 0.7271000000000001, 0.7267, 0.7277], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7281, 0.7279, 0.7275, 0.7263999999999999, 0.7259, 0.7249, 0.7223999999999999, 0.7166, 0.7052, 0.6927, 0.6023000000000001, 0.3388, 0.1684, 0.017100000000000004], "robust_accuracy": [0.7281, 0.7279, 0.7275, 0.7263999999999999, 0.7259, 0.7249, 0.7223999999999999, 0.7166, 0.7052, 0.6927, 0.6016, 0.32589999999999997, 0.1382, 0.008299999999999974]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7235, 0.7229, 0.7223999999999999, 0.7217, 0.7211000000000001, 0.7202999999999999, 0.718, 0.7127, 0.6986, 0.6874, 0.6039, 0.3751, 0.21389999999999998, 0.05259999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7235, 0.7229, 0.7226, 0.7219, 0.7213, 0.7207, 0.7189, 0.7145, 0.7030000000000001, 0.692, 0.6196999999999999, 0.39239999999999997, 0.2087, 0.026599999999999957], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7235, 0.7229, 0.7223999999999999, 0.7217, 0.7211000000000001, 0.7202999999999999, 0.718, 0.7127, 0.6986, 0.6871, 0.5979, 0.3336, 0.1402, 0.009299999999999975], "L2AdditiveUniformNoiseAttack()": [0.7235, 0.7235, 0.7235, 0.7234, 0.7235, 0.7234, 0.7235, 0.7235, 0.7234, 0.7234, 0.7234, 0.7222, 0.722, 0.7191000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7235, 0.7229, 0.7222999999999999, 0.7213, 0.7209, 0.7199, 0.7175, 0.7114, 0.6969000000000001, 0.6849000000000001, 0.5921000000000001, 0.3389, 0.1593, 0.018000000000000016], "robust_accuracy": [0.7235, 0.7229, 0.7222999999999999, 0.7213, 0.7209, 0.7199, 0.7175, 0.7114, 0.6969000000000001, 0.6848000000000001, 0.5912, 0.32620000000000005, 0.13570000000000004, 0.009000000000000008]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7110000000000001, 0.7108, 0.7101, 0.7093, 0.7082999999999999, 0.7072, 0.7047, 0.6984, 0.6847, 0.673, 0.5916, 0.3771, 0.22360000000000002, 0.06269999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7110000000000001, 0.7108, 0.7101999999999999, 0.7096, 0.7088, 0.7075, 0.7055, 0.7002999999999999, 0.6895, 0.6779, 0.6061000000000001, 0.39570000000000005, 0.22099999999999997, 0.033299999999999996], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7110000000000001, 0.7108, 0.7101, 0.7093, 0.7082999999999999, 0.7072, 0.7047, 0.6985, 0.6845, 0.6728000000000001, 0.5861000000000001, 0.33640000000000003, 0.15700000000000003, 0.01100000000000001], "L2AdditiveUniformNoiseAttack()": [0.7110000000000001, 0.7110000000000001, 0.7110000000000001, 0.7110000000000001, 0.7110000000000001, 0.7110000000000001, 0.7111000000000001, 0.7111000000000001, 0.7112, 0.7112, 0.7110000000000001, 0.7106, 0.7122999999999999, 0.7092], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7110000000000001, 0.7108, 0.71, 0.7091000000000001, 0.7081999999999999, 0.7070000000000001, 0.7041, 0.6974, 0.683, 0.6702, 0.5805, 0.34230000000000005, 0.17659999999999998, 0.021299999999999986], "robust_accuracy": [0.7110000000000001, 0.7108, 0.71, 0.7091000000000001, 0.7081999999999999, 0.7070000000000001, 0.7041, 0.6974, 0.683, 0.6702, 0.5795, 0.33009999999999995, 0.15339999999999998, 0.010700000000000043]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7137, 0.7133, 0.7128, 0.7116, 0.7108, 0.7099, 0.7075, 0.7022999999999999, 0.6909000000000001, 0.6799999999999999, 0.5882000000000001, 0.36429999999999996, 0.20799999999999996, 0.04859999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7137, 0.7133, 0.7132000000000001, 0.7121, 0.7111000000000001, 0.7101, 0.7082999999999999, 0.7036, 0.6944, 0.685, 0.6053, 0.38770000000000004, 0.20550000000000002, 0.024900000000000033], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7137, 0.7133, 0.7128, 0.7116, 0.7108, 0.7099, 0.7075, 0.7022999999999999, 0.6907, 0.6797, 0.5842, 0.32230000000000003, 0.14100000000000001, 0.009000000000000008], "L2AdditiveUniformNoiseAttack()": [0.7137, 0.7137, 0.7137, 0.7137, 0.7137, 0.7137, 0.7137, 0.7139, 0.7136, 0.7142, 0.714, 0.7128, 0.7132000000000001, 0.7133], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7137, 0.7133, 0.7127, 0.7116, 0.7106, 0.7096, 0.7071000000000001, 0.7013, 0.6892, 0.6772, 0.5784, 0.3285, 0.16379999999999995, 0.015800000000000036], "robust_accuracy": [0.7137, 0.7133, 0.7127, 0.7116, 0.7106, 0.7096, 0.7071000000000001, 0.7013, 0.6892, 0.6772, 0.5778, 0.31610000000000005, 0.13839999999999997, 0.008199999999999985]}}, "4": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7527, 0.7519, 0.7514000000000001, 0.7503, 0.7494000000000001, 0.7479, 0.7455, 0.7397, 0.7249, 0.7125, 0.6274, 0.38959999999999995, 0.23250000000000004, 0.06840000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7527, 0.7519, 0.7515000000000001, 0.7505, 0.7498, 0.7486999999999999, 0.7464, 0.7419, 0.7297, 0.7183999999999999, 0.643, 0.3944, 0.20650000000000002, 0.023700000000000054], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7527, 0.7519, 0.7514000000000001, 0.7503, 0.7494000000000001, 0.7479, 0.7455, 0.7396, 0.7243999999999999, 0.7119, 0.6202, 0.33230000000000004, 0.13729999999999998, 0.007000000000000006], "L2AdditiveUniformNoiseAttack()": [0.7527, 0.7527, 0.7527, 0.7528, 0.7527, 0.7527, 0.7527, 0.7529, 0.7528, 0.7528, 0.753, 0.7523, 0.7525, 0.7477], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7527, 0.7519, 0.7512, 0.7499, 0.7492, 0.7477, 0.7452, 0.7389, 0.7234, 0.7098, 0.6175999999999999, 0.3517, 0.1664, 0.01639999999999997], "robust_accuracy": [0.7527, 0.7519, 0.7512, 0.7499, 0.7492, 0.7477, 0.7452, 0.7389, 0.7233, 0.7098, 0.6149, 0.32889999999999997, 0.13439999999999996, 0.006700000000000039]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7402, 0.7397, 0.7394000000000001, 0.7391, 0.7384, 0.7371, 0.7349, 0.7289, 0.7188, 0.7053, 0.6162000000000001, 0.3832, 0.22050000000000003, 0.06430000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7402, 0.7398, 0.7396, 0.7392000000000001, 0.739, 0.7372000000000001, 0.7358, 0.73, 0.7229, 0.7113, 0.6303000000000001, 0.3941, 0.2016, 0.02290000000000003], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7402, 0.7397, 0.7394000000000001, 0.7391, 0.7384, 0.7371, 0.7349, 0.7288, 0.7188, 0.7048, 0.6099, 0.32389999999999997, 0.13429999999999997, 0.006000000000000005], "L2AdditiveUniformNoiseAttack()": [0.7402, 0.7402, 0.7402, 0.7402, 0.7402, 0.7402, 0.7403, 0.7401, 0.7403, 0.7407, 0.74, 0.7399, 0.739, 0.7371], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7402, 0.7397, 0.7393000000000001, 0.7391, 0.738, 0.7368, 0.7343, 0.728, 0.7169, 0.7028, 0.6036, 0.33819999999999995, 0.1583, 0.014399999999999968], "robust_accuracy": [0.7402, 0.7397, 0.7393000000000001, 0.7391, 0.738, 0.7368, 0.7343, 0.728, 0.7169, 0.7028, 0.6019, 0.31810000000000005, 0.13019999999999998, 0.005600000000000049]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7451, 0.7448, 0.7444999999999999, 0.7439, 0.7428, 0.7417, 0.7396, 0.7342, 0.7227, 0.7089, 0.616, 0.399, 0.24209999999999998, 0.07699999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7451, 0.7448, 0.7445999999999999, 0.7442, 0.7435, 0.7423, 0.7405999999999999, 0.7362, 0.7257, 0.7139, 0.6303000000000001, 0.4043, 0.21540000000000004, 0.027000000000000024], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7451, 0.7448, 0.7444999999999999, 0.7439, 0.7428, 0.7417, 0.7396, 0.7341, 0.7224999999999999, 0.7081999999999999, 0.6082000000000001, 0.34119999999999995, 0.14300000000000002, 0.010099999999999998], "L2AdditiveUniformNoiseAttack()": [0.7451, 0.7451, 0.7451, 0.7452, 0.7452, 0.7452, 0.7451, 0.7451, 0.7455, 0.7452, 0.7454000000000001, 0.7449, 0.7445999999999999, 0.7422], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7451, 0.7448, 0.7444, 0.7437, 0.7425999999999999, 0.7416, 0.7392000000000001, 0.7332000000000001, 0.7207, 0.7056, 0.6049, 0.3556, 0.17510000000000003, 0.020299999999999985], "robust_accuracy": [0.7451, 0.7448, 0.7444, 0.7437, 0.7425999999999999, 0.7416, 0.7392000000000001, 0.7332000000000001, 0.7207, 0.7055, 0.6033999999999999, 0.3365, 0.13939999999999997, 0.009800000000000031]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7222, 0.7214, 0.7211000000000001, 0.7206, 0.7203999999999999, 0.7186, 0.7152000000000001, 0.7098, 0.6972, 0.6849000000000001, 0.6008, 0.3751, 0.22499999999999998, 0.06279999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7222, 0.7214, 0.7212000000000001, 0.7206, 0.7204999999999999, 0.7197, 0.7163999999999999, 0.7111000000000001, 0.7014, 0.6904, 0.6168, 0.39170000000000005, 0.21409999999999996, 0.02839999999999998], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7222, 0.7214, 0.7211000000000001, 0.7206, 0.7203999999999999, 0.7186, 0.7152000000000001, 0.7098, 0.6969000000000001, 0.6843, 0.5938, 0.3275, 0.14690000000000003, 0.008199999999999985], "L2AdditiveUniformNoiseAttack()": [0.7222, 0.7222, 0.7221, 0.7221, 0.7222999999999999, 0.7222, 0.7221, 0.7222999999999999, 0.7221, 0.7221, 0.7218, 0.7227, 0.7203999999999999, 0.719], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7222, 0.7214, 0.7211000000000001, 0.7206, 0.7201, 0.7182999999999999, 0.7147, 0.7093, 0.6958, 0.683, 0.5900000000000001, 0.34019999999999995, 0.17159999999999997, 0.018100000000000005], "robust_accuracy": [0.7222, 0.7214, 0.7211000000000001, 0.7206, 0.7201, 0.7182999999999999, 0.7147, 0.7093, 0.6958, 0.6829000000000001, 0.5881000000000001, 0.3226, 0.14349999999999996, 0.007900000000000018]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7298, 0.7295, 0.7293000000000001, 0.7281, 0.7275, 0.726, 0.7235, 0.7177, 0.7048, 0.6948, 0.6112, 0.3961, 0.24380000000000002, 0.07230000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7298, 0.7295, 0.7293000000000001, 0.7284999999999999, 0.7281, 0.7264999999999999, 0.7239, 0.719, 0.708, 0.6990000000000001, 0.6275, 0.41069999999999995, 0.23509999999999998, 0.03520000000000001], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7298, 0.7295, 0.7293000000000001, 0.7281, 0.7275, 0.726, 0.7235, 0.7177, 0.7047, 0.6942999999999999, 0.6058, 0.3516, 0.16659999999999997, 0.011600000000000055], "L2AdditiveUniformNoiseAttack()": [0.7298, 0.7298, 0.7298, 0.7298, 0.7298, 0.7299, 0.7298, 0.7298, 0.73, 0.7299, 0.7303999999999999, 0.7284999999999999, 0.7292000000000001, 0.7317], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7298, 0.7295, 0.7292000000000001, 0.7281, 0.7274, 0.7258, 0.7234, 0.7167, 0.7034, 0.6933, 0.6039, 0.36450000000000005, 0.19479999999999997, 0.027000000000000024], "robust_accuracy": [0.7298, 0.7295, 0.7292000000000001, 0.7281, 0.7274, 0.7258, 0.7234, 0.7167, 0.7034, 0.6931, 0.6022000000000001, 0.34730000000000005, 0.1632, 0.01100000000000001]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7375, 0.7368, 0.7361, 0.7357, 0.7344999999999999, 0.7327, 0.7302, 0.7242, 0.7130000000000001, 0.6989000000000001, 0.6051, 0.3617, 0.20540000000000003, 0.0484], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7375, 0.7368, 0.7363999999999999, 0.7358, 0.7353000000000001, 0.7332000000000001, 0.731, 0.7259, 0.7162, 0.7051000000000001, 0.6205, 0.37849999999999995, 0.1965, 0.021299999999999986], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7375, 0.7368, 0.7361, 0.7357, 0.7344999999999999, 0.7327, 0.7302, 0.7242, 0.7127, 0.6986, 0.5998, 0.3154, 0.12870000000000004, 0.005700000000000038], "L2AdditiveUniformNoiseAttack()": [0.7375, 0.7375, 0.7375, 0.7374, 0.7376, 0.7375, 0.7375, 0.7373000000000001, 0.7373000000000001, 0.7375, 0.7375, 0.7373000000000001, 0.737, 0.7358], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7375, 0.7368, 0.736, 0.7357, 0.7343999999999999, 0.7323999999999999, 0.7298, 0.7239, 0.7115, 0.6969000000000001, 0.5964, 0.32920000000000005, 0.1542, 0.013900000000000023], "robust_accuracy": [0.7375, 0.7368, 0.736, 0.7357, 0.7343999999999999, 0.7323999999999999, 0.7298, 0.7239, 0.7115, 0.6969000000000001, 0.5954999999999999, 0.31110000000000004, 0.1269, 0.005600000000000049]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7241, 0.7241, 0.7237, 0.7231000000000001, 0.7222, 0.7212000000000001, 0.7196, 0.7151000000000001, 0.7025, 0.6911, 0.6052, 0.388, 0.23140000000000005, 0.06569999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7241, 0.7241, 0.7239, 0.7233, 0.7226, 0.7215, 0.7207, 0.7167, 0.7062999999999999, 0.6973, 0.6229, 0.4042, 0.22299999999999998, 0.027900000000000036], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7241, 0.7241, 0.7237, 0.7231000000000001, 0.7222, 0.7212000000000001, 0.7196, 0.7151000000000001, 0.7024, 0.6908000000000001, 0.6003000000000001, 0.34299999999999997, 0.15690000000000004, 0.009199999999999986], "L2AdditiveUniformNoiseAttack()": [0.7241, 0.7241, 0.7241, 0.7241, 0.7241, 0.7241, 0.7241, 0.7241, 0.7241, 0.7242999999999999, 0.7243999999999999, 0.724, 0.7241, 0.7227], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7241, 0.7241, 0.7236, 0.7228, 0.7219, 0.7212000000000001, 0.7194, 0.7142999999999999, 0.7015, 0.6890000000000001, 0.5981000000000001, 0.3569, 0.18330000000000002, 0.020100000000000007], "robust_accuracy": [0.7241, 0.7241, 0.7236, 0.7228, 0.7219, 0.7212000000000001, 0.7194, 0.7142999999999999, 0.7015, 0.6890000000000001, 0.5971, 0.33909999999999996, 0.1543, 0.008000000000000007]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7283, 0.7275, 0.7268, 0.7264999999999999, 0.7263999999999999, 0.7249, 0.7222, 0.7161, 0.7038, 0.6908000000000001, 0.6011, 0.37739999999999996, 0.22089999999999999, 0.06740000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7283, 0.7276, 0.7271000000000001, 0.7266, 0.7264999999999999, 0.7254, 0.7233, 0.7177, 0.7077, 0.6970000000000001, 0.6178, 0.38970000000000005, 0.20540000000000003, 0.030200000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7283, 0.7275, 0.7268, 0.7264999999999999, 0.7263999999999999, 0.7249, 0.7222, 0.7159, 0.7038, 0.6904, 0.5941000000000001, 0.3248, 0.14359999999999995, 0.010399999999999965], "L2AdditiveUniformNoiseAttack()": [0.7283, 0.7283, 0.7283, 0.7283, 0.7283, 0.7283, 0.7283999999999999, 0.7281, 0.7283999999999999, 0.7281, 0.7277, 0.7273000000000001, 0.7272000000000001, 0.727], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7283, 0.7274, 0.7268, 0.7263999999999999, 0.7262, 0.7247, 0.7214, 0.7153, 0.7022999999999999, 0.6886, 0.5899, 0.33330000000000004, 0.16349999999999998, 0.020199999999999996], "robust_accuracy": [0.7283, 0.7274, 0.7268, 0.7263999999999999, 0.7262, 0.7247, 0.7214, 0.7153, 0.7022999999999999, 0.6886, 0.5881000000000001, 0.3185, 0.13990000000000002, 0.009700000000000042]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7421, 0.7416, 0.7411, 0.7404999999999999, 0.7401, 0.7388, 0.7367, 0.731, 0.7188, 0.7059, 0.6161, 0.3923, 0.2318, 0.06930000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7421, 0.7417, 0.7412000000000001, 0.7407, 0.7404, 0.7393000000000001, 0.7374, 0.7324999999999999, 0.7231000000000001, 0.7116, 0.6304000000000001, 0.40190000000000003, 0.21640000000000004, 0.02939999999999998], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7421, 0.7416, 0.7411, 0.7404999999999999, 0.7401, 0.7388, 0.7367, 0.7308, 0.7187, 0.7057, 0.61, 0.33940000000000003, 0.14480000000000004, 0.010000000000000009], "L2AdditiveUniformNoiseAttack()": [0.7421, 0.7421, 0.7421, 0.7421, 0.7421, 0.7421, 0.742, 0.7421, 0.742, 0.7421, 0.7423, 0.7422, 0.7428, 0.7413000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7421, 0.7416, 0.7408, 0.7404999999999999, 0.7399, 0.7384, 0.7365999999999999, 0.7303999999999999, 0.7178, 0.7041, 0.6078, 0.357, 0.17720000000000002, 0.019499999999999962], "robust_accuracy": [0.7421, 0.7416, 0.7408, 0.7404999999999999, 0.7399, 0.7384, 0.7365999999999999, 0.7303999999999999, 0.7178, 0.7041, 0.6065, 0.33530000000000004, 0.14280000000000004, 0.008900000000000019]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7236, 0.7229, 0.7224999999999999, 0.7219, 0.7212000000000001, 0.7203999999999999, 0.7183999999999999, 0.7128, 0.7005, 0.6856, 0.6045, 0.3721, 0.21889999999999998, 0.06579999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7236, 0.723, 0.7226, 0.7221, 0.7215, 0.7208, 0.719, 0.7139, 0.7046, 0.6917, 0.6168, 0.38560000000000005, 0.20489999999999997, 0.027100000000000013], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7236, 0.7229, 0.7224999999999999, 0.7219, 0.7212000000000001, 0.7203999999999999, 0.7182999999999999, 0.7128, 0.7004, 0.6851, 0.5984, 0.32289999999999996, 0.14139999999999997, 0.009600000000000053], "L2AdditiveUniformNoiseAttack()": [0.7236, 0.7236, 0.7235, 0.7236, 0.7235, 0.7236, 0.7236, 0.7235, 0.7237, 0.7234, 0.7237, 0.7236, 0.723, 0.7206], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7236, 0.7229, 0.7223999999999999, 0.7217, 0.7212000000000001, 0.7201, 0.7178, 0.7122999999999999, 0.6985, 0.6833, 0.5941000000000001, 0.33699999999999997, 0.16759999999999997, 0.01990000000000003], "robust_accuracy": [0.7236, 0.7229, 0.7223999999999999, 0.7217, 0.7212000000000001, 0.7201, 0.7178, 0.7122999999999999, 0.6985, 0.6832, 0.5929, 0.31920000000000004, 0.13970000000000005, 0.009000000000000008]}}, "8": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7369, 0.7364999999999999, 0.7352000000000001, 0.7348, 0.7343999999999999, 0.7335, 0.7316, 0.7246, 0.712, 0.698, 0.6057, 0.3711, 0.2107, 0.05520000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7369, 0.7365999999999999, 0.7357, 0.735, 0.7345999999999999, 0.7341, 0.7321, 0.7263, 0.7169, 0.7042999999999999, 0.6215999999999999, 0.3839, 0.19589999999999996, 0.0232], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7369, 0.7364999999999999, 0.7352000000000001, 0.7347, 0.7343999999999999, 0.7335, 0.7316, 0.7246, 0.7113, 0.6976, 0.6012, 0.3144, 0.12770000000000004, 0.00649999999999995], "L2AdditiveUniformNoiseAttack()": [0.7369, 0.7369, 0.7369, 0.7369, 0.737, 0.7369, 0.7368, 0.7369, 0.7369, 0.7369, 0.7367, 0.7364999999999999, 0.7365999999999999, 0.7372000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7369, 0.7363999999999999, 0.735, 0.7347, 0.7343, 0.7334, 0.7313000000000001, 0.7241, 0.7098, 0.6965, 0.5996, 0.3337, 0.15880000000000005, 0.015599999999999947], "robust_accuracy": [0.7369, 0.7363999999999999, 0.735, 0.7347, 0.7343, 0.7334, 0.7313000000000001, 0.7241, 0.7097, 0.6965, 0.598, 0.3115, 0.1259, 0.006199999999999983]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7233, 0.723, 0.7223999999999999, 0.722, 0.7212000000000001, 0.72, 0.7179, 0.7122999999999999, 0.7009000000000001, 0.6905, 0.6028, 0.3982, 0.2508, 0.0827], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7233, 0.723, 0.7224999999999999, 0.7222999999999999, 0.7216, 0.7204999999999999, 0.7188, 0.714, 0.7044, 0.6950000000000001, 0.6174999999999999, 0.40780000000000005, 0.22960000000000003, 0.03600000000000003], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7233, 0.723, 0.7223999999999999, 0.722, 0.7212000000000001, 0.72, 0.7178, 0.7122999999999999, 0.7005, 0.6903, 0.5972999999999999, 0.3457, 0.16200000000000003, 0.013499999999999956], "L2AdditiveUniformNoiseAttack()": [0.7233, 0.7233, 0.7233, 0.7233, 0.7233, 0.7234, 0.7234, 0.7235, 0.7235, 0.7235, 0.7234, 0.7233, 0.7232000000000001, 0.7217], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7233, 0.723, 0.7222999999999999, 0.7216, 0.721, 0.7199, 0.7175, 0.7113, 0.6989000000000001, 0.6885, 0.5916, 0.35829999999999995, 0.18810000000000004, 0.025599999999999956], "robust_accuracy": [0.7233, 0.723, 0.7222999999999999, 0.7216, 0.721, 0.7199, 0.7175, 0.7113, 0.6989000000000001, 0.6885, 0.5909, 0.3407, 0.15959999999999996, 0.012700000000000045]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7396, 0.7389, 0.7382, 0.7378, 0.7375, 0.736, 0.7339, 0.7274, 0.7142, 0.7022999999999999, 0.6129, 0.38870000000000005, 0.2409, 0.09209999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7396, 0.7391, 0.7387, 0.738, 0.7377, 0.7368, 0.7345999999999999, 0.729, 0.7176, 0.7070000000000001, 0.6276999999999999, 0.38439999999999996, 0.19810000000000005, 0.0242], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7396, 0.7389, 0.7382, 0.7378, 0.7374, 0.736, 0.7339, 0.7274, 0.714, 0.7017, 0.6039, 0.31710000000000005, 0.13129999999999997, 0.007600000000000051], "L2AdditiveUniformNoiseAttack()": [0.7396, 0.7396, 0.7396, 0.7396, 0.7396, 0.7396, 0.7395, 0.7395, 0.7395, 0.7395, 0.7396, 0.7399, 0.7394000000000001, 0.738], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7396, 0.7389, 0.7382, 0.7378, 0.7374, 0.7359, 0.7334, 0.7263999999999999, 0.7128, 0.7002999999999999, 0.6027, 0.33819999999999995, 0.16569999999999996, 0.01759999999999995], "robust_accuracy": [0.7396, 0.7389, 0.7382, 0.7378, 0.7374, 0.7359, 0.7334, 0.7263999999999999, 0.7128, 0.7001999999999999, 0.6, 0.31200000000000006, 0.12829999999999997, 0.007000000000000006]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7171000000000001, 0.7166, 0.716, 0.7159, 0.7156, 0.7146, 0.7114, 0.7072, 0.6978, 0.6851, 0.6013, 0.38980000000000004, 0.2429, 0.07599999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7171000000000001, 0.7168, 0.7162, 0.716, 0.7158, 0.7152000000000001, 0.7127, 0.7085, 0.7005, 0.69, 0.6158, 0.40249999999999997, 0.23160000000000003, 0.034599999999999964], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7171000000000001, 0.7166, 0.716, 0.7159, 0.7156, 0.7145, 0.7113, 0.7071000000000001, 0.6975, 0.6847, 0.5961000000000001, 0.34719999999999995, 0.15769999999999995, 0.011900000000000022], "L2AdditiveUniformNoiseAttack()": [0.7171000000000001, 0.7171000000000001, 0.7170000000000001, 0.7170000000000001, 0.7171000000000001, 0.7170000000000001, 0.7169, 0.7171000000000001, 0.7172000000000001, 0.7171000000000001, 0.7169, 0.7173, 0.7166, 0.7165], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7171000000000001, 0.7166, 0.716, 0.7159, 0.7155, 0.7142999999999999, 0.7113, 0.7066, 0.6962999999999999, 0.6820999999999999, 0.5913999999999999, 0.35450000000000004, 0.18500000000000005, 0.0232], "robust_accuracy": [0.7171000000000001, 0.7166, 0.716, 0.7159, 0.7155, 0.7142999999999999, 0.7113, 0.7066, 0.6961999999999999, 0.6819999999999999, 0.5902000000000001, 0.34119999999999995, 0.15510000000000002, 0.01100000000000001]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7207, 0.7203999999999999, 0.7201, 0.7197, 0.7191000000000001, 0.7175, 0.7139, 0.7094, 0.6965, 0.6859999999999999, 0.595, 0.3719, 0.2247, 0.07199999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7207, 0.7203999999999999, 0.7202, 0.7198, 0.7195, 0.7182999999999999, 0.7152000000000001, 0.7102999999999999, 0.7013, 0.6918, 0.61, 0.3813, 0.20820000000000005, 0.02949999999999997], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7207, 0.7203999999999999, 0.7201, 0.7197, 0.7191000000000001, 0.7175, 0.7139, 0.7093, 0.6962999999999999, 0.6858, 0.5898, 0.32410000000000005, 0.13749999999999996, 0.010600000000000054], "L2AdditiveUniformNoiseAttack()": [0.7207, 0.7207, 0.7207, 0.7207, 0.7207, 0.7207, 0.7207, 0.7207, 0.721, 0.7204999999999999, 0.7206, 0.7196, 0.7214, 0.7181], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7207, 0.7203999999999999, 0.7201, 0.7196, 0.719, 0.7171000000000001, 0.7136, 0.7082999999999999, 0.6953, 0.6836, 0.5841000000000001, 0.3315, 0.16249999999999998, 0.017199999999999993], "robust_accuracy": [0.7207, 0.7203999999999999, 0.7201, 0.7196, 0.719, 0.7171000000000001, 0.7136, 0.7081999999999999, 0.6953, 0.6836, 0.5837, 0.3175, 0.13419999999999999, 0.009600000000000053]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.731, 0.7303999999999999, 0.73, 0.7292000000000001, 0.7286, 0.7278, 0.7254, 0.7195, 0.7076, 0.6945, 0.6057, 0.37749999999999995, 0.22230000000000005, 0.06999999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.731, 0.7303999999999999, 0.7301, 0.7295, 0.729, 0.7282, 0.7263, 0.7213, 0.7110000000000001, 0.7009000000000001, 0.6216999999999999, 0.3851, 0.20199999999999996, 0.01970000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.731, 0.7303999999999999, 0.73, 0.7292000000000001, 0.7286, 0.7278, 0.7254, 0.7193, 0.7073, 0.6940999999999999, 0.5987, 0.3218, 0.134, 0.0048000000000000265], "L2AdditiveUniformNoiseAttack()": [0.731, 0.731, 0.7311000000000001, 0.731, 0.731, 0.7311000000000001, 0.731, 0.7309, 0.7309, 0.7316, 0.7309, 0.7314, 0.7311000000000001, 0.7297], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.731, 0.7303, 0.7299, 0.729, 0.7284999999999999, 0.7272000000000001, 0.7248, 0.7182999999999999, 0.7053, 0.692, 0.5947, 0.3359, 0.16379999999999995, 0.01319999999999999], "robust_accuracy": [0.731, 0.7303, 0.7299, 0.729, 0.7284999999999999, 0.7272000000000001, 0.7248, 0.7182999999999999, 0.7053, 0.692, 0.5932, 0.31710000000000005, 0.13129999999999997, 0.0043999999999999595]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7412000000000001, 0.7404, 0.7401, 0.7397, 0.739, 0.738, 0.7359, 0.73, 0.7187, 0.7071000000000001, 0.6145, 0.384, 0.23550000000000004, 0.07869999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7412000000000001, 0.7404999999999999, 0.7402, 0.7399, 0.7394000000000001, 0.7385999999999999, 0.7363999999999999, 0.7317, 0.7222999999999999, 0.7129, 0.6305000000000001, 0.39159999999999995, 0.2108, 0.02739999999999998], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7412000000000001, 0.7404, 0.7401, 0.7397, 0.739, 0.738, 0.7358, 0.73, 0.7185, 0.7061999999999999, 0.6059, 0.32689999999999997, 0.1442, 0.009399999999999964], "L2AdditiveUniformNoiseAttack()": [0.7412000000000001, 0.7412000000000001, 0.7412000000000001, 0.7412000000000001, 0.7412000000000001, 0.7411, 0.7412000000000001, 0.741, 0.7408, 0.7411, 0.7411, 0.7408, 0.7409, 0.7424], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7412000000000001, 0.7403, 0.74, 0.7395, 0.7387, 0.7376, 0.7356, 0.7295, 0.7162, 0.7038, 0.6017, 0.33609999999999995, 0.16720000000000002, 0.017199999999999993], "robust_accuracy": [0.7412000000000001, 0.7403, 0.74, 0.7395, 0.7387, 0.7376, 0.7356, 0.7295, 0.7162, 0.7037, 0.5996, 0.3175, 0.14090000000000003, 0.008600000000000052]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7121, 0.7115, 0.7108, 0.7103999999999999, 0.7099, 0.7090000000000001, 0.7063999999999999, 0.7007, 0.6879, 0.6756, 0.5881000000000001, 0.36419999999999997, 0.21609999999999996, 0.0665], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7121, 0.7117, 0.7109, 0.7108, 0.7101, 0.7092, 0.7072, 0.7021, 0.6921999999999999, 0.6809000000000001, 0.6046, 0.37270000000000003, 0.19199999999999995, 0.019399999999999973], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7121, 0.7115, 0.7108, 0.7103999999999999, 0.7099, 0.7090000000000001, 0.7063999999999999, 0.7005, 0.6877, 0.6751, 0.5800000000000001, 0.3103, 0.12880000000000003, 0.005900000000000016], "L2AdditiveUniformNoiseAttack()": [0.7121, 0.7121999999999999, 0.7121, 0.7121999999999999, 0.7121999999999999, 0.7121999999999999, 0.7121, 0.7119, 0.7121999999999999, 0.7121999999999999, 0.7121, 0.7118, 0.7112, 0.7112], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7121, 0.7114, 0.7108, 0.7102999999999999, 0.7098, 0.7088, 0.7062999999999999, 0.7, 0.6866, 0.6731, 0.5784, 0.3315, 0.15659999999999996, 0.012800000000000034], "robust_accuracy": [0.7121, 0.7114, 0.7108, 0.7102999999999999, 0.7098, 0.7088, 0.7062999999999999, 0.7, 0.6866, 0.673, 0.5763, 0.30800000000000005, 0.12629999999999997, 0.005499999999999949]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7322, 0.7319, 0.7311000000000001, 0.7309, 0.7301, 0.7287, 0.7261, 0.72, 0.7090000000000001, 0.6987, 0.6203000000000001, 0.405, 0.24870000000000003, 0.07620000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7322, 0.732, 0.7313000000000001, 0.7309, 0.7307, 0.7292000000000001, 0.727, 0.7214, 0.7121999999999999, 0.7041, 0.6334, 0.4244, 0.24250000000000005, 0.04049999999999998], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7322, 0.7319, 0.7311000000000001, 0.7309, 0.7301, 0.7287, 0.7261, 0.7199, 0.7086, 0.6984, 0.6155999999999999, 0.3607, 0.1733, 0.015700000000000047], "L2AdditiveUniformNoiseAttack()": [0.7322, 0.7322, 0.7322, 0.7322, 0.7322, 0.7323, 0.7323, 0.7323, 0.7323999999999999, 0.7321, 0.732, 0.7309, 0.7316, 0.7291000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7322, 0.7318, 0.7311000000000001, 0.7308, 0.7301, 0.7283999999999999, 0.7255, 0.7197, 0.7078, 0.6968, 0.6122000000000001, 0.3722, 0.20099999999999996, 0.029000000000000026], "robust_accuracy": [0.7322, 0.7318, 0.7311000000000001, 0.7308, 0.7301, 0.7283999999999999, 0.7255, 0.7197, 0.7077, 0.6968, 0.6111, 0.3569, 0.17079999999999995, 0.015199999999999991]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7448, 0.7443, 0.7438, 0.7431, 0.7424999999999999, 0.7409, 0.739, 0.7343999999999999, 0.7214, 0.7072, 0.6184000000000001, 0.37739999999999996, 0.21399999999999997, 0.060899999999999954], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7448, 0.7444, 0.744, 0.7434000000000001, 0.743, 0.7416, 0.7398, 0.7362, 0.725, 0.7128, 0.634, 0.39170000000000005, 0.1977, 0.0252], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7448, 0.7443, 0.7438, 0.7431, 0.7424999999999999, 0.7409, 0.739, 0.7342, 0.7213, 0.7070000000000001, 0.6112, 0.3205, 0.13039999999999996, 0.008199999999999985], "L2AdditiveUniformNoiseAttack()": [0.7448, 0.7448, 0.7449, 0.7448, 0.7448, 0.7446999999999999, 0.7449, 0.7444999999999999, 0.7448, 0.7452, 0.7452, 0.7451, 0.7455, 0.7442], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7448, 0.7443, 0.7437, 0.7431, 0.7424999999999999, 0.7409, 0.7389, 0.7339, 0.7204999999999999, 0.7055, 0.6109, 0.34230000000000005, 0.16290000000000004, 0.015100000000000002], "robust_accuracy": [0.7448, 0.7443, 0.7437, 0.7431, 0.7424999999999999, 0.7409, 0.7389, 0.7339, 0.7204999999999999, 0.7055, 0.6087, 0.3184, 0.12819999999999998, 0.007399999999999962]}}, "16": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7299, 0.729, 0.7283, 0.7276, 0.7274, 0.7261, 0.724, 0.7171000000000001, 0.7049000000000001, 0.6938, 0.6013999999999999, 0.3812, 0.23740000000000006, 0.0766], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7299, 0.7291000000000001, 0.7287, 0.7279, 0.7276, 0.727, 0.7244999999999999, 0.7193, 0.7089, 0.6974, 0.6187, 0.3903, 0.21509999999999996, 0.03059999999999996], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7299, 0.729, 0.7283, 0.7276, 0.7274, 0.7261, 0.724, 0.7170000000000001, 0.7047, 0.6934, 0.5953999999999999, 0.33230000000000004, 0.15190000000000003, 0.011499999999999955], "L2AdditiveUniformNoiseAttack()": [0.7299, 0.7299, 0.7299, 0.7299, 0.7299, 0.7299, 0.7299, 0.73, 0.7296, 0.7299, 0.7295, 0.7303999999999999, 0.7292000000000001, 0.7294], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7299, 0.729, 0.7282, 0.7275, 0.7274, 0.7259, 0.7236, 0.7166, 0.7034, 0.6907, 0.5924, 0.34450000000000003, 0.17900000000000005, 0.02210000000000001], "robust_accuracy": [0.7299, 0.729, 0.7282, 0.7275, 0.7274, 0.7259, 0.7236, 0.7166, 0.7034, 0.6907, 0.5907, 0.3276, 0.1492, 0.01090000000000002]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.753, 0.752, 0.7512, 0.7505999999999999, 0.7503, 0.7488, 0.7461, 0.739, 0.7247, 0.7137, 0.6161, 0.37860000000000005, 0.2259, 0.08099999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.753, 0.7522, 0.7516, 0.7507, 0.7504, 0.7494000000000001, 0.7472, 0.7408, 0.7278, 0.7187, 0.6329, 0.378, 0.18930000000000002, 0.022199999999999998], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.753, 0.752, 0.7512, 0.7505999999999999, 0.7503, 0.7488, 0.7461, 0.7389, 0.7242, 0.7129, 0.6086, 0.3073, 0.1251, 0.00649999999999995], "L2AdditiveUniformNoiseAttack()": [0.753, 0.753, 0.7529, 0.7528, 0.7528, 0.7529, 0.7528, 0.7531, 0.7531, 0.7528, 0.7528, 0.7536, 0.7518, 0.7512], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.753, 0.752, 0.7511, 0.7505999999999999, 0.7502, 0.7485999999999999, 0.7459, 0.7383, 0.7231000000000001, 0.7114, 0.6051, 0.3306, 0.1563, 0.01429999999999998], "robust_accuracy": [0.753, 0.752, 0.7511, 0.7505999999999999, 0.7502, 0.7485999999999999, 0.7459, 0.7383, 0.7231000000000001, 0.7113, 0.603, 0.3045, 0.12209999999999999, 0.005800000000000027]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.724, 0.7235, 0.7222999999999999, 0.7219, 0.7215, 0.7201, 0.7178, 0.712, 0.7002999999999999, 0.6877, 0.5956, 0.3772, 0.23409999999999997, 0.09460000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.724, 0.7236, 0.7226, 0.7222999999999999, 0.7217, 0.7206, 0.7188, 0.7139, 0.7035, 0.6926, 0.6106, 0.37749999999999995, 0.1996, 0.028200000000000003], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.724, 0.7235, 0.7222999999999999, 0.7219, 0.7215, 0.7201, 0.7178, 0.712, 0.6998, 0.6872, 0.5877, 0.31389999999999996, 0.13280000000000003, 0.008900000000000019], "L2AdditiveUniformNoiseAttack()": [0.724, 0.724, 0.724, 0.724, 0.724, 0.724, 0.724, 0.7241, 0.7242999999999999, 0.7243999999999999, 0.7238, 0.7246, 0.7243999999999999, 0.7218], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.724, 0.7234, 0.7222999999999999, 0.7219, 0.7214, 0.7199, 0.7173, 0.7112, 0.6973, 0.6841999999999999, 0.5816, 0.3267, 0.1614, 0.019100000000000006], "robust_accuracy": [0.724, 0.7234, 0.7222999999999999, 0.7219, 0.7214, 0.7199, 0.7173, 0.7112, 0.6973, 0.6841999999999999, 0.5797, 0.3074, 0.12929999999999997, 0.008199999999999985]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7522, 0.7515000000000001, 0.751, 0.7502, 0.7498, 0.7489, 0.7462, 0.7421, 0.7313000000000001, 0.7182, 0.6246, 0.40149999999999997, 0.24919999999999998, 0.07930000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7522, 0.7515000000000001, 0.7511, 0.7507, 0.7501, 0.7491, 0.7474000000000001, 0.7433000000000001, 0.7341, 0.7242999999999999, 0.6421, 0.40959999999999996, 0.2229, 0.02739999999999998], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7522, 0.7515000000000001, 0.751, 0.7502, 0.7498, 0.7489, 0.7462, 0.742, 0.7311000000000001, 0.7178, 0.6179, 0.34340000000000004, 0.14780000000000004, 0.009099999999999997], "L2AdditiveUniformNoiseAttack()": [0.7522, 0.7522, 0.7522, 0.7522, 0.7522, 0.7523, 0.7522, 0.7521, 0.752, 0.7522, 0.7525, 0.7518, 0.7531, 0.7507], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7522, 0.7515000000000001, 0.7509, 0.7501, 0.7494000000000001, 0.7488, 0.746, 0.7415, 0.7291000000000001, 0.7159, 0.6145, 0.3619, 0.1804, 0.01849999999999996], "robust_accuracy": [0.7522, 0.7515000000000001, 0.7509, 0.7501, 0.7494000000000001, 0.7488, 0.746, 0.7415, 0.7291000000000001, 0.7159, 0.6135999999999999, 0.3397, 0.14470000000000005, 0.008700000000000041]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7428, 0.7422, 0.7409, 0.7403, 0.7395, 0.7376, 0.7347, 0.7279, 0.7127, 0.7014, 0.6078, 0.37270000000000003, 0.2247, 0.08209999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7428, 0.7423, 0.7413000000000001, 0.7407, 0.74, 0.7382, 0.7362, 0.7297, 0.7169, 0.706, 0.6256999999999999, 0.37129999999999996, 0.1835, 0.016700000000000048], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7428, 0.7422, 0.7409, 0.7403, 0.7395, 0.7376, 0.7345999999999999, 0.7277, 0.7125, 0.7006, 0.5988, 0.29879999999999995, 0.11499999999999999, 0.0044999999999999485], "L2AdditiveUniformNoiseAttack()": [0.7428, 0.7428, 0.7428, 0.7428, 0.7429, 0.7429, 0.7427, 0.7429, 0.7424999999999999, 0.7424999999999999, 0.7429, 0.7416, 0.7417, 0.736], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7428, 0.742, 0.7408, 0.7401, 0.7392000000000001, 0.7372000000000001, 0.7343, 0.7266, 0.7111000000000001, 0.6984, 0.5952, 0.3197, 0.14549999999999996, 0.00990000000000002], "robust_accuracy": [0.7428, 0.742, 0.7408, 0.7401, 0.7392000000000001, 0.7372000000000001, 0.7343, 0.7266, 0.7111000000000001, 0.6981999999999999, 0.5928, 0.2946, 0.11199999999999999, 0.0041999999999999815]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7109, 0.7105, 0.7095, 0.7091000000000001, 0.7088, 0.7081, 0.7051000000000001, 0.6993, 0.687, 0.6746, 0.5824, 0.36539999999999995, 0.22929999999999995, 0.08840000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7109, 0.7105, 0.7098, 0.7091000000000001, 0.7089, 0.7085, 0.7061, 0.7006, 0.6904, 0.6798, 0.5959, 0.36560000000000004, 0.1915, 0.027800000000000047], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7109, 0.7105, 0.7095, 0.7091000000000001, 0.7088, 0.7081, 0.7051000000000001, 0.6993, 0.687, 0.6742, 0.5738, 0.30210000000000004, 0.12770000000000004, 0.008399999999999963], "L2AdditiveUniformNoiseAttack()": [0.7109, 0.7109, 0.7109, 0.7109, 0.7109, 0.7109, 0.7108, 0.7108, 0.7109, 0.7107, 0.7113, 0.712, 0.7119, 0.7101999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7109, 0.7103999999999999, 0.7094, 0.7090000000000001, 0.7082999999999999, 0.7077, 0.7049000000000001, 0.6981999999999999, 0.6849000000000001, 0.6709, 0.5670999999999999, 0.3093, 0.14559999999999995, 0.015700000000000047], "robust_accuracy": [0.7109, 0.7103999999999999, 0.7094, 0.7090000000000001, 0.7082999999999999, 0.7077, 0.7049000000000001, 0.6981999999999999, 0.6849000000000001, 0.6708000000000001, 0.5655, 0.29279999999999995, 0.122, 0.007800000000000029]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7209, 0.7198, 0.7185, 0.7179, 0.7174, 0.7155, 0.7123999999999999, 0.7048, 0.6909000000000001, 0.6782, 0.5783, 0.34230000000000005, 0.19810000000000005, 0.06010000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7209, 0.7202999999999999, 0.719, 0.7181, 0.7178, 0.7162999999999999, 0.7136, 0.7075, 0.6950000000000001, 0.6843, 0.5953999999999999, 0.34540000000000004, 0.16579999999999995, 0.016599999999999948], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7209, 0.7198, 0.7185, 0.7179, 0.7174, 0.7155, 0.7123999999999999, 0.7048, 0.6907, 0.6774, 0.5708, 0.2811, 0.10660000000000003, 0.0047000000000000375], "L2AdditiveUniformNoiseAttack()": [0.7209, 0.7208, 0.7209, 0.721, 0.7209, 0.721, 0.7209, 0.721, 0.7207, 0.7207, 0.7198, 0.7196, 0.7198, 0.7187], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7209, 0.7196, 0.7183999999999999, 0.7179, 0.7172000000000001, 0.7148, 0.7121999999999999, 0.7041999999999999, 0.6889000000000001, 0.6745, 0.565, 0.2925, 0.12519999999999998, 0.009700000000000042], "robust_accuracy": [0.7209, 0.7196, 0.7183999999999999, 0.7179, 0.7172000000000001, 0.7148, 0.7121999999999999, 0.7041999999999999, 0.6889000000000001, 0.6745, 0.5628, 0.27480000000000004, 0.10319999999999996, 0.0040000000000000036]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7232000000000001, 0.7222, 0.7217, 0.7211000000000001, 0.7202, 0.7193, 0.7174, 0.7114, 0.6998, 0.6873, 0.5958, 0.37529999999999997, 0.23219999999999996, 0.07350000000000001], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7232000000000001, 0.7222999999999999, 0.7217, 0.7214, 0.7209, 0.7197, 0.7179, 0.7136, 0.7035, 0.6934, 0.6113, 0.38480000000000003, 0.2136, 0.026599999999999957], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7232000000000001, 0.7222, 0.7217, 0.7211000000000001, 0.7201, 0.7193, 0.7174, 0.7113, 0.6997, 0.6866, 0.5909, 0.32620000000000005, 0.14300000000000002, 0.009499999999999953], "L2AdditiveUniformNoiseAttack()": [0.7232000000000001, 0.7232000000000001, 0.7232000000000001, 0.7232000000000001, 0.7232000000000001, 0.7232000000000001, 0.7232000000000001, 0.7232000000000001, 0.7231000000000001, 0.723, 0.7231000000000001, 0.7216, 0.7217, 0.7207], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7232000000000001, 0.7222, 0.7217, 0.7211000000000001, 0.72, 0.7192000000000001, 0.7172000000000001, 0.7106, 0.6991, 0.6857, 0.5884, 0.34240000000000004, 0.17459999999999998, 0.018199999999999994], "robust_accuracy": [0.7232000000000001, 0.7222, 0.7217, 0.7211000000000001, 0.72, 0.7192000000000001, 0.7172000000000001, 0.7106, 0.6991, 0.6855, 0.5871, 0.3235, 0.14029999999999998, 0.009099999999999997]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7309, 0.7303999999999999, 0.73, 0.7297, 0.7293000000000001, 0.7274, 0.7257, 0.7192000000000001, 0.7071000000000001, 0.6949000000000001, 0.5991, 0.3871, 0.24919999999999998, 0.09409999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7309, 0.7304999999999999, 0.7301, 0.7299, 0.7294, 0.7281, 0.7262, 0.7212000000000001, 0.7109, 0.7007, 0.6148, 0.393, 0.22040000000000004, 0.03210000000000002], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7309, 0.7303999999999999, 0.73, 0.7297, 0.7293000000000001, 0.7274, 0.7257, 0.7191000000000001, 0.7069, 0.694, 0.5920000000000001, 0.33220000000000005, 0.15439999999999998, 0.010600000000000054], "L2AdditiveUniformNoiseAttack()": [0.7309, 0.7309, 0.7309, 0.7309, 0.7309, 0.7309, 0.7309, 0.7309, 0.7313000000000001, 0.7312000000000001, 0.7313000000000001, 0.7325999999999999, 0.7318, 0.7298], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7309, 0.7303999999999999, 0.73, 0.7295, 0.7291000000000001, 0.7273000000000001, 0.7252000000000001, 0.7181, 0.7055, 0.6908000000000001, 0.5872999999999999, 0.34530000000000005, 0.1805, 0.021299999999999986], "robust_accuracy": [0.7309, 0.7303999999999999, 0.73, 0.7295, 0.7291000000000001, 0.7273000000000001, 0.7252000000000001, 0.7181, 0.7055, 0.6908000000000001, 0.5860000000000001, 0.32789999999999997, 0.1522, 0.00990000000000002]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7273000000000001, 0.7268, 0.7261, 0.7254, 0.7246, 0.7233, 0.7208, 0.7159, 0.7026, 0.6910000000000001, 0.6062000000000001, 0.3951, 0.24760000000000004, 0.08699999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7273000000000001, 0.7269, 0.7262, 0.7255, 0.7251000000000001, 0.7237, 0.7219, 0.7171000000000001, 0.7065, 0.6966, 0.6189, 0.3963, 0.2158, 0.030200000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7273000000000001, 0.7268, 0.7261, 0.7254, 0.7246, 0.7233, 0.7208, 0.716, 0.7024, 0.6907, 0.5972, 0.33230000000000004, 0.1461, 0.010700000000000043], "L2AdditiveUniformNoiseAttack()": [0.7273000000000001, 0.7273000000000001, 0.7273000000000001, 0.7273000000000001, 0.7273000000000001, 0.7273000000000001, 0.7273000000000001, 0.7274, 0.7272000000000001, 0.727, 0.7268, 0.7262, 0.7254, 0.7255], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7273000000000001, 0.7268, 0.7257, 0.7251000000000001, 0.7242999999999999, 0.7229, 0.72, 0.7141, 0.7002999999999999, 0.688, 0.5919, 0.3387, 0.16669999999999996, 0.019499999999999962], "robust_accuracy": [0.7273000000000001, 0.7268, 0.7257, 0.7251000000000001, 0.7242999999999999, 0.7229, 0.72, 0.7141, 0.7002999999999999, 0.688, 0.5906, 0.32310000000000005, 0.14, 0.009499999999999953]}}, "32": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7646999999999999, 0.7638, 0.7632, 0.7625, 0.7621, 0.7608, 0.7583, 0.7522, 0.7378, 0.7253000000000001, 0.636, 0.40290000000000004, 0.2531, 0.09599999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7646999999999999, 0.7639, 0.7633, 0.7629, 0.7624, 0.7613, 0.7593, 0.7549, 0.742, 0.7307, 0.6524, 0.403, 0.21489999999999998, 0.029100000000000015], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7646999999999999, 0.7638, 0.7632, 0.7625, 0.7621, 0.7608, 0.7583, 0.7523, 0.7376, 0.7249, 0.6285000000000001, 0.33940000000000003, 0.14300000000000002, 0.009700000000000042], "L2AdditiveUniformNoiseAttack()": [0.7646999999999999, 0.7646999999999999, 0.7646999999999999, 0.7646999999999999, 0.7646999999999999, 0.7646, 0.7645, 0.7644, 0.7643, 0.7641, 0.7643, 0.7631, 0.763, 0.7614], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7646999999999999, 0.7638, 0.7632, 0.7625, 0.7618, 0.7602, 0.758, 0.7516, 0.7365999999999999, 0.7229, 0.6258, 0.3581, 0.17310000000000003, 0.01739999999999997], "robust_accuracy": [0.7646999999999999, 0.7638, 0.7632, 0.7625, 0.7618, 0.7602, 0.758, 0.7516, 0.7363999999999999, 0.7227, 0.624, 0.33540000000000003, 0.1402, 0.007900000000000018]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7671, 0.7661, 0.7655000000000001, 0.7651, 0.7644, 0.7631, 0.7605, 0.7552, 0.7438, 0.7317, 0.6383, 0.40359999999999996, 0.25, 0.08679999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7671, 0.7663, 0.7655000000000001, 0.7655000000000001, 0.7645, 0.7637, 0.7619, 0.7575000000000001, 0.7463, 0.7372000000000001, 0.6541, 0.4032, 0.20850000000000002, 0.022700000000000053], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7671, 0.7661, 0.7655000000000001, 0.7651, 0.7644, 0.7631, 0.7605, 0.7552, 0.7436, 0.7317, 0.6299, 0.32999999999999996, 0.13149999999999995, 0.006700000000000039], "L2AdditiveUniformNoiseAttack()": [0.7671, 0.7671, 0.7671, 0.7671, 0.7673, 0.7671, 0.7673, 0.767, 0.7671, 0.7673, 0.7666, 0.7666, 0.7679, 0.7628], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7671, 0.7661, 0.7655000000000001, 0.7648, 0.7644, 0.7629, 0.7604, 0.7545, 0.7424999999999999, 0.7294, 0.6267, 0.3518, 0.16569999999999996, 0.015000000000000013], "robust_accuracy": [0.7671, 0.7661, 0.7655000000000001, 0.7648, 0.7644, 0.7629, 0.7604, 0.7545, 0.7424, 0.7294, 0.6245, 0.3247, 0.12780000000000002, 0.00649999999999995]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7299, 0.7292000000000001, 0.7286, 0.7273000000000001, 0.7264999999999999, 0.7254, 0.7229, 0.7163999999999999, 0.7059, 0.6947, 0.603, 0.3881, 0.25049999999999994, 0.09870000000000001], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7299, 0.7292000000000001, 0.7288, 0.7275, 0.7271000000000001, 0.7259, 0.7239, 0.7185, 0.71, 0.6999, 0.6184000000000001, 0.38680000000000003, 0.2086, 0.031399999999999983], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7299, 0.7292000000000001, 0.7286, 0.7273000000000001, 0.7264999999999999, 0.7254, 0.7228, 0.7163999999999999, 0.7058, 0.6941999999999999, 0.5935, 0.3268, 0.14049999999999996, 0.01090000000000002], "L2AdditiveUniformNoiseAttack()": [0.7299, 0.7299, 0.7299, 0.7299, 0.7298, 0.7299, 0.7299, 0.7297, 0.73, 0.7298, 0.7296, 0.7289, 0.7297, 0.7267], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7299, 0.7291000000000001, 0.7283, 0.7273000000000001, 0.7263999999999999, 0.7253000000000001, 0.7221, 0.716, 0.7041999999999999, 0.6919, 0.5897, 0.3386, 0.1704, 0.021399999999999975], "robust_accuracy": [0.7299, 0.7291000000000001, 0.7283, 0.7273000000000001, 0.7263999999999999, 0.7253000000000001, 0.7221, 0.716, 0.7041999999999999, 0.6919, 0.5872999999999999, 0.3218, 0.13759999999999994, 0.009800000000000031]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7301, 0.7294, 0.729, 0.7287, 0.7281, 0.727, 0.7248, 0.7192000000000001, 0.7087, 0.6954, 0.6033999999999999, 0.39070000000000005, 0.24509999999999998, 0.09789999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7301, 0.7295, 0.7291000000000001, 0.7289, 0.7283999999999999, 0.7273000000000001, 0.7258, 0.7204999999999999, 0.7119, 0.7013, 0.6188, 0.38949999999999996, 0.20579999999999998, 0.024800000000000044], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7301, 0.7294, 0.729, 0.7287, 0.7281, 0.727, 0.7248, 0.7192000000000001, 0.7085, 0.6947, 0.5951, 0.32620000000000005, 0.13580000000000003, 0.006700000000000039], "L2AdditiveUniformNoiseAttack()": [0.7301, 0.7301, 0.7301, 0.7301, 0.73, 0.7302, 0.73, 0.7299, 0.7303, 0.73, 0.7299, 0.7304999999999999, 0.7293000000000001, 0.7302], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7301, 0.7294, 0.729, 0.7286, 0.7278, 0.7269, 0.7242999999999999, 0.7182, 0.7067, 0.6927, 0.5912, 0.34099999999999997, 0.16649999999999998, 0.016800000000000037], "robust_accuracy": [0.7301, 0.7294, 0.729, 0.7286, 0.7278, 0.7269, 0.7242999999999999, 0.7182, 0.7067, 0.6927, 0.5893999999999999, 0.32010000000000005, 0.13319999999999999, 0.006099999999999994]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7663, 0.7659, 0.7655000000000001, 0.765, 0.7643, 0.763, 0.7613, 0.7543, 0.7416, 0.7283, 0.6319, 0.38260000000000005, 0.22599999999999998, 0.08299999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7663, 0.766, 0.7657, 0.7653, 0.7646, 0.7637, 0.7621, 0.7567, 0.7448, 0.7349, 0.65, 0.38660000000000005, 0.1977, 0.024399999999999977], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7663, 0.7659, 0.7655000000000001, 0.765, 0.7643, 0.763, 0.7613, 0.7541, 0.7413000000000001, 0.7276, 0.6244000000000001, 0.31920000000000004, 0.13, 0.008499999999999952], "L2AdditiveUniformNoiseAttack()": [0.7663, 0.7663, 0.7663, 0.7663, 0.7664, 0.7666999999999999, 0.7664, 0.7665, 0.7665, 0.7669, 0.7665, 0.7663, 0.7658, 0.7614], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7663, 0.7659, 0.7655000000000001, 0.765, 0.7642, 0.7628, 0.7606999999999999, 0.7539, 0.7401, 0.7263, 0.6238, 0.34030000000000005, 0.16190000000000004, 0.015800000000000036], "robust_accuracy": [0.7663, 0.7659, 0.7655000000000001, 0.765, 0.7642, 0.7628, 0.7606999999999999, 0.7539, 0.74, 0.7262, 0.6214999999999999, 0.3163, 0.12819999999999998, 0.007299999999999973]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7296, 0.7286, 0.7279, 0.7268, 0.7264999999999999, 0.725, 0.7232000000000001, 0.7163999999999999, 0.7032, 0.6897, 0.5961000000000001, 0.3578, 0.21750000000000003, 0.07720000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7296, 0.7287, 0.7281, 0.7273000000000001, 0.7267, 0.7256, 0.7241, 0.7187, 0.7076, 0.6950000000000001, 0.6124, 0.36129999999999995, 0.1835, 0.018399999999999972], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7296, 0.7286, 0.7279, 0.7268, 0.7263999999999999, 0.725, 0.7231000000000001, 0.7162, 0.7031000000000001, 0.6890000000000001, 0.5878, 0.2944, 0.11870000000000003, 0.0044999999999999485], "L2AdditiveUniformNoiseAttack()": [0.7296, 0.7296, 0.7296, 0.7295, 0.7294, 0.7295, 0.7295, 0.7295, 0.7296, 0.7292000000000001, 0.7295, 0.7296, 0.7297, 0.725], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7296, 0.7284999999999999, 0.7276, 0.7266, 0.7262, 0.7248, 0.7226, 0.7153, 0.7019, 0.6880999999999999, 0.5858, 0.3144, 0.14690000000000003, 0.010700000000000043], "robust_accuracy": [0.7296, 0.7284999999999999, 0.7276, 0.7266, 0.7262, 0.7248, 0.7226, 0.7153, 0.7018, 0.688, 0.5837, 0.2913, 0.11660000000000004, 0.0039000000000000146]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7463, 0.746, 0.7452, 0.7442, 0.7435, 0.7424, 0.7391, 0.7318, 0.7201, 0.7083999999999999, 0.6165, 0.39159999999999995, 0.24129999999999996, 0.08220000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7463, 0.746, 0.7453000000000001, 0.7444999999999999, 0.7438, 0.7427, 0.7402, 0.7345999999999999, 0.7232000000000001, 0.7123999999999999, 0.6337999999999999, 0.3881, 0.20130000000000003, 0.02200000000000002], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7463, 0.746, 0.7452, 0.7442, 0.7435, 0.7424, 0.7391, 0.7318, 0.7199, 0.7081, 0.6091, 0.3218, 0.12780000000000002, 0.00539999999999996], "L2AdditiveUniformNoiseAttack()": [0.7463, 0.7463, 0.7463, 0.7463, 0.7463, 0.7463, 0.7463, 0.7464, 0.7463, 0.7463, 0.7457, 0.7458, 0.7454000000000001, 0.746], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7463, 0.7459, 0.745, 0.7439, 0.7433000000000001, 0.7422, 0.7387, 0.7314, 0.7181, 0.7067, 0.6053, 0.3396, 0.1583, 0.015599999999999947], "robust_accuracy": [0.7463, 0.7459, 0.745, 0.7439, 0.7433000000000001, 0.7422, 0.7387, 0.7314, 0.7181, 0.7065, 0.6039, 0.31820000000000004, 0.12419999999999998, 0.005099999999999993]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7368, 0.7361, 0.7356, 0.7347, 0.7343999999999999, 0.7334, 0.7308, 0.7243999999999999, 0.7115, 0.6998, 0.617, 0.3899, 0.24270000000000003, 0.09409999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7368, 0.7362, 0.7356, 0.735, 0.7344999999999999, 0.7337, 0.732, 0.7262, 0.7146, 0.7045, 0.631, 0.3933, 0.20940000000000003, 0.02859999999999996], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7368, 0.7361, 0.7356, 0.7347, 0.7343999999999999, 0.7334, 0.7308, 0.7242999999999999, 0.7114, 0.6997, 0.6101, 0.3265, 0.13890000000000002, 0.01090000000000002], "L2AdditiveUniformNoiseAttack()": [0.7368, 0.7368, 0.7368, 0.7367, 0.7368, 0.7368, 0.7368, 0.7368, 0.7363999999999999, 0.7365999999999999, 0.7375, 0.736, 0.7364999999999999, 0.7353000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7368, 0.7361, 0.7355, 0.7347, 0.7343999999999999, 0.7333000000000001, 0.7303, 0.724, 0.7098, 0.6982999999999999, 0.607, 0.34740000000000004, 0.17759999999999998, 0.01980000000000004], "robust_accuracy": [0.7368, 0.7361, 0.7355, 0.7347, 0.7343999999999999, 0.7333000000000001, 0.7303, 0.7239, 0.7098, 0.6982999999999999, 0.6053999999999999, 0.3225, 0.13670000000000004, 0.009600000000000053]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7488, 0.7479, 0.7468, 0.746, 0.7449, 0.7439, 0.7412000000000001, 0.7357, 0.7223999999999999, 0.7090000000000001, 0.6167, 0.394, 0.25570000000000004, 0.1049], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7488, 0.7482, 0.7473000000000001, 0.7462, 0.7457, 0.7443, 0.7423, 0.7373000000000001, 0.7268, 0.7152000000000001, 0.6305000000000001, 0.3971, 0.22089999999999999, 0.03290000000000004], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7488, 0.7479, 0.7468, 0.746, 0.7449, 0.7439, 0.7412000000000001, 0.7357, 0.7222999999999999, 0.7086, 0.6068, 0.33909999999999996, 0.15469999999999995, 0.01090000000000002], "L2AdditiveUniformNoiseAttack()": [0.7488, 0.7486999999999999, 0.7485999999999999, 0.7488, 0.7486999999999999, 0.7485999999999999, 0.7484999999999999, 0.7488, 0.7483, 0.7488, 0.7484, 0.7469, 0.7471, 0.743], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7488, 0.7479, 0.7466999999999999, 0.746, 0.7448, 0.7437, 0.7408, 0.7348, 0.7211000000000001, 0.7068, 0.607, 0.35850000000000004, 0.18899999999999995, 0.021599999999999953], "robust_accuracy": [0.7488, 0.7479, 0.7466999999999999, 0.746, 0.7448, 0.7437, 0.7408, 0.7348, 0.7211000000000001, 0.7068, 0.6039, 0.33609999999999995, 0.15180000000000005, 0.010000000000000009]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7484, 0.7482, 0.7479, 0.7474000000000001, 0.7468, 0.7458, 0.7433000000000001, 0.7378, 0.7227, 0.7094, 0.6189, 0.39080000000000004, 0.2449, 0.08979999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7484, 0.7482, 0.748, 0.7475, 0.7474000000000001, 0.7464, 0.7442, 0.7398, 0.7282, 0.7150000000000001, 0.6329, 0.39039999999999997, 0.20689999999999997, 0.024800000000000044], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7484, 0.7482, 0.7479, 0.7474000000000001, 0.7468, 0.7458, 0.7433000000000001, 0.7378, 0.7222999999999999, 0.7085, 0.6101, 0.32120000000000004, 0.13749999999999996, 0.007199999999999984], "L2AdditiveUniformNoiseAttack()": [0.7484, 0.7484, 0.7484, 0.7484, 0.7483, 0.7483, 0.7483, 0.7486999999999999, 0.7486999999999999, 0.7484999999999999, 0.7488, 0.7493000000000001, 0.7469, 0.7443], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7484, 0.7482, 0.7479, 0.7474000000000001, 0.7465999999999999, 0.7454000000000001, 0.7429, 0.7374, 0.7204999999999999, 0.7061999999999999, 0.6074999999999999, 0.3427, 0.17190000000000005, 0.016700000000000048], "robust_accuracy": [0.7484, 0.7482, 0.7479, 0.7474000000000001, 0.7465999999999999, 0.7454000000000001, 0.7429, 0.7374, 0.7204999999999999, 0.7061999999999999, 0.6048, 0.31779999999999997, 0.13460000000000005, 0.006900000000000017]}}}, "3": {"1": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7421, 0.7416, 0.7412000000000001, 0.7402, 0.7391, 0.7381, 0.7348, 0.7278, 0.7131000000000001, 0.6953, 0.5812999999999999, 0.31120000000000003, 0.16810000000000003, 0.044300000000000006], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7421, 0.7416, 0.7413000000000001, 0.7404999999999999, 0.7398, 0.7385999999999999, 0.7362, 0.7298, 0.7181, 0.7030000000000001, 0.6024, 0.3154, 0.13260000000000005, 0.007399999999999962], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7421, 0.7416, 0.7412000000000001, 0.7402, 0.7391, 0.7381, 0.7348, 0.7278, 0.7129, 0.6950000000000001, 0.5699000000000001, 0.24339999999999995, 0.07450000000000001, 0.0021999999999999797], "L2AdditiveUniformNoiseAttack()": [0.7421, 0.7421, 0.7421, 0.7421, 0.7421, 0.7421, 0.7421, 0.7422, 0.7422, 0.7423, 0.7417, 0.7428, 0.7424999999999999, 0.7412000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7421, 0.7415, 0.7409, 0.7402, 0.739, 0.7376, 0.7344999999999999, 0.7266, 0.7101999999999999, 0.6921999999999999, 0.5680000000000001, 0.26770000000000005, 0.10719999999999996, 0.0050000000000000044], "robust_accuracy": [0.7421, 0.7415, 0.7409, 0.7402, 0.739, 0.7376, 0.7344999999999999, 0.7266, 0.7101999999999999, 0.6921999999999999, 0.5644, 0.23950000000000005, 0.07279999999999998, 0.0021999999999999797]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7192000000000001, 0.7186, 0.7181, 0.7174, 0.7162999999999999, 0.7148, 0.7119, 0.7038, 0.6874, 0.6726, 0.5553, 0.2872, 0.14749999999999996, 0.04349999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7192000000000001, 0.7186, 0.7182, 0.7178, 0.7170000000000001, 0.7151000000000001, 0.7130000000000001, 0.7061999999999999, 0.6919, 0.6788000000000001, 0.5756, 0.2865, 0.1129, 0.0040999999999999925], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7192000000000001, 0.7186, 0.7181, 0.7174, 0.7162999999999999, 0.7148, 0.7119, 0.7036, 0.6871, 0.6716, 0.5455, 0.21819999999999995, 0.058699999999999974, 0.0006000000000000449], "L2AdditiveUniformNoiseAttack()": [0.7192000000000001, 0.7192000000000001, 0.7192000000000001, 0.7192000000000001, 0.7192000000000001, 0.7192000000000001, 0.7193, 0.7193, 0.7194, 0.7192000000000001, 0.7206, 0.7187, 0.7202, 0.7181], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7192000000000001, 0.7186, 0.7181, 0.7172000000000001, 0.7162999999999999, 0.7146, 0.7116, 0.7030000000000001, 0.6861999999999999, 0.6702, 0.5454, 0.24719999999999998, 0.0917, 0.0034999999999999476], "robust_accuracy": [0.7192000000000001, 0.7186, 0.7181, 0.7172000000000001, 0.7162999999999999, 0.7146, 0.7116, 0.7030000000000001, 0.6861999999999999, 0.6699999999999999, 0.542, 0.21589999999999998, 0.05710000000000004, 0.0006000000000000449]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7527, 0.7517, 0.7512, 0.7507, 0.75, 0.7484, 0.746, 0.7388, 0.7256, 0.7106, 0.608, 0.35619999999999996, 0.2005, 0.05740000000000001], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7527, 0.7518, 0.7514000000000001, 0.751, 0.7504, 0.7496, 0.7473000000000001, 0.7404, 0.729, 0.7176, 0.6239, 0.35740000000000005, 0.16100000000000003, 0.008700000000000041], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7527, 0.7517, 0.7512, 0.7507, 0.75, 0.7484, 0.746, 0.7387, 0.7254, 0.7098, 0.5987, 0.2882, 0.09340000000000004, 0.0018000000000000238], "L2AdditiveUniformNoiseAttack()": [0.7527, 0.7527, 0.7528, 0.7527, 0.7525, 0.7528, 0.7527, 0.7525999999999999, 0.7525, 0.7525999999999999, 0.7523, 0.7524, 0.7518, 0.751], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7527, 0.7517, 0.7512, 0.7505999999999999, 0.7499, 0.7482, 0.7455, 0.7378, 0.7239, 0.7071000000000001, 0.5937, 0.31120000000000003, 0.13139999999999996, 0.005900000000000016], "robust_accuracy": [0.7527, 0.7517, 0.7512, 0.7505999999999999, 0.7499, 0.7482, 0.7455, 0.7378, 0.7239, 0.7070000000000001, 0.5915, 0.2842, 0.09160000000000001, 0.0016000000000000458]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7491, 0.7483, 0.7476, 0.7465999999999999, 0.7462, 0.745, 0.7418, 0.7328, 0.7163999999999999, 0.7019, 0.5819, 0.29369999999999996, 0.14400000000000002, 0.054400000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7491, 0.7483, 0.748, 0.7472, 0.7464999999999999, 0.7452, 0.7425999999999999, 0.7357, 0.7208, 0.7079, 0.5998, 0.28090000000000004, 0.0978, 0.0029000000000000137], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7491, 0.7483, 0.7476, 0.7465999999999999, 0.7462, 0.745, 0.7418, 0.7325999999999999, 0.7162999999999999, 0.7012, 0.5692999999999999, 0.20630000000000004, 0.05010000000000003, 0.0004999999999999449], "L2AdditiveUniformNoiseAttack()": [0.7491, 0.7491, 0.749, 0.749, 0.749, 0.749, 0.749, 0.7492, 0.749, 0.7489, 0.7499, 0.7498, 0.7484999999999999, 0.7477], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7491, 0.7483, 0.7476, 0.7465999999999999, 0.7461, 0.7446999999999999, 0.7413000000000001, 0.732, 0.7148, 0.6994, 0.5722, 0.246, 0.08099999999999996, 0.0019000000000000128], "robust_accuracy": [0.7491, 0.7483, 0.7476, 0.7465999999999999, 0.7461, 0.7446999999999999, 0.7413000000000001, 0.732, 0.7148, 0.6992, 0.5657, 0.20430000000000004, 0.04859999999999998, 0.00039999999999995595]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7376, 0.7373000000000001, 0.7363999999999999, 0.7361, 0.7359, 0.7343, 0.731, 0.7241, 0.7125, 0.6994, 0.5931, 0.33220000000000005, 0.1734, 0.03990000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7376, 0.7373000000000001, 0.7365999999999999, 0.7363, 0.7361, 0.7351, 0.732, 0.7262, 0.716, 0.7061999999999999, 0.6114999999999999, 0.33999999999999997, 0.14649999999999996, 0.007199999999999984], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7376, 0.7373000000000001, 0.7363999999999999, 0.7361, 0.7359, 0.7343, 0.731, 0.7241, 0.7122999999999999, 0.6991, 0.5856, 0.26749999999999996, 0.08530000000000004, 0.0010999999999999899], "L2AdditiveUniformNoiseAttack()": [0.7376, 0.7376, 0.7376, 0.7376, 0.7377, 0.7377, 0.7377, 0.7377, 0.7377, 0.7381, 0.7378, 0.7384, 0.7372000000000001, 0.7351], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7376, 0.7373000000000001, 0.7363999999999999, 0.7361, 0.7359, 0.7342, 0.7304999999999999, 0.7234, 0.7110000000000001, 0.6961999999999999, 0.5835, 0.2954, 0.11770000000000003, 0.0036000000000000476], "robust_accuracy": [0.7376, 0.7373000000000001, 0.7363999999999999, 0.7361, 0.7359, 0.7342, 0.7304999999999999, 0.7234, 0.7110000000000001, 0.6960999999999999, 0.5818, 0.26449999999999996, 0.08360000000000001, 0.0008000000000000229]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7226, 0.7213, 0.7202999999999999, 0.7194, 0.719, 0.7175, 0.7148, 0.7072, 0.6918, 0.6758, 0.5643, 0.30789999999999995, 0.1633, 0.05059999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7226, 0.7214, 0.7206, 0.7198, 0.7193, 0.7186, 0.7162, 0.7092, 0.696, 0.6828000000000001, 0.5839, 0.30920000000000003, 0.12860000000000005, 0.007099999999999995], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7226, 0.7213, 0.7202999999999999, 0.7194, 0.719, 0.7175, 0.7148, 0.7071000000000001, 0.6916, 0.675, 0.5559000000000001, 0.23760000000000003, 0.07199999999999995, 0.0019000000000000128], "L2AdditiveUniformNoiseAttack()": [0.7226, 0.7227, 0.7227, 0.7224999999999999, 0.7223999999999999, 0.7224999999999999, 0.7224999999999999, 0.7223999999999999, 0.7222999999999999, 0.7219, 0.722, 0.7217, 0.7229, 0.724], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7226, 0.7213, 0.7202, 0.7194, 0.7189, 0.7173, 0.7143999999999999, 0.7063999999999999, 0.6907, 0.6732, 0.554, 0.26570000000000005, 0.10389999999999999, 0.005099999999999993], "robust_accuracy": [0.7226, 0.7213, 0.7202, 0.7194, 0.7189, 0.7173, 0.7143999999999999, 0.7063999999999999, 0.6906, 0.6731, 0.5515, 0.23540000000000005, 0.07040000000000002, 0.0016000000000000458]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7463, 0.7455, 0.7451, 0.7449, 0.7442, 0.7428, 0.7404999999999999, 0.7355, 0.7222999999999999, 0.7103999999999999, 0.6188, 0.38060000000000005, 0.23870000000000002, 0.0826], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7463, 0.7455, 0.7452, 0.745, 0.7446999999999999, 0.7435, 0.7414000000000001, 0.7369, 0.7274, 0.7151000000000001, 0.6343, 0.3923, 0.21399999999999997, 0.02980000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7463, 0.7455, 0.7451, 0.7449, 0.7442, 0.7428, 0.7404999999999999, 0.7355, 0.7221, 0.7097, 0.6127, 0.32630000000000003, 0.1461, 0.009499999999999953], "L2AdditiveUniformNoiseAttack()": [0.7463, 0.7463, 0.7463, 0.7463, 0.7463, 0.7463, 0.7464, 0.7462, 0.7463, 0.7463, 0.7468, 0.746, 0.7474000000000001, 0.7464999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7463, 0.7455, 0.745, 0.7446999999999999, 0.7441, 0.7427, 0.7401, 0.7345999999999999, 0.7207, 0.7081999999999999, 0.6093, 0.34230000000000005, 0.17859999999999998, 0.02310000000000001], "robust_accuracy": [0.7463, 0.7455, 0.745, 0.7446999999999999, 0.7441, 0.7427, 0.7401, 0.7345999999999999, 0.7207, 0.7081999999999999, 0.6081, 0.3217, 0.14339999999999997, 0.009000000000000008]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7258, 0.7255, 0.7249, 0.7243999999999999, 0.7238, 0.723, 0.7204999999999999, 0.7121, 0.6976, 0.6819, 0.5687, 0.3067, 0.17000000000000004, 0.0706], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7258, 0.7256, 0.725, 0.7243999999999999, 0.7241, 0.7235, 0.7214, 0.7141, 0.7018, 0.6889000000000001, 0.585, 0.29369999999999996, 0.11419999999999997, 0.006700000000000039], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7258, 0.7255, 0.7249, 0.7243999999999999, 0.7238, 0.723, 0.7204999999999999, 0.712, 0.6974, 0.6814, 0.5584, 0.22299999999999998, 0.06530000000000002, 0.0017000000000000348], "L2AdditiveUniformNoiseAttack()": [0.7258, 0.7258, 0.726, 0.7258, 0.726, 0.7259, 0.7259, 0.7259, 0.726, 0.7261, 0.7259, 0.7257, 0.7284999999999999, 0.728], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7258, 0.7255, 0.7249, 0.7243999999999999, 0.7237, 0.7229, 0.7202, 0.7114, 0.696, 0.6788000000000001, 0.5565, 0.25249999999999995, 0.0917, 0.0040999999999999925], "robust_accuracy": [0.7258, 0.7255, 0.7249, 0.7243999999999999, 0.7237, 0.7229, 0.7202, 0.7114, 0.6959, 0.6786, 0.5528, 0.21919999999999995, 0.06369999999999998, 0.0016000000000000458]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7176, 0.7167, 0.7159, 0.7149, 0.7133, 0.712, 0.7101, 0.7038, 0.6913, 0.6763, 0.5755, 0.3367, 0.19940000000000002, 0.06389999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7176, 0.7167, 0.7161, 0.7154, 0.7141, 0.7126, 0.7108, 0.7053, 0.6941999999999999, 0.6832, 0.5948, 0.344, 0.16949999999999998, 0.01859999999999995], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7176, 0.7167, 0.7159, 0.7149, 0.7133, 0.712, 0.7101, 0.7039, 0.6911, 0.6759, 0.5664, 0.2812, 0.11180000000000001, 0.005800000000000027], "L2AdditiveUniformNoiseAttack()": [0.7176, 0.7176, 0.7176, 0.7176, 0.7175, 0.7174, 0.7176, 0.7174, 0.7174, 0.7176, 0.7167, 0.7158, 0.7169, 0.7152000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7176, 0.7167, 0.7159, 0.7146, 0.7132000000000001, 0.7119, 0.7094, 0.7033, 0.6896, 0.6738999999999999, 0.5639000000000001, 0.2995, 0.14380000000000004, 0.015199999999999991], "robust_accuracy": [0.7176, 0.7167, 0.7159, 0.7146, 0.7132000000000001, 0.7119, 0.7094, 0.7033, 0.6895, 0.6738, 0.5618000000000001, 0.278, 0.10999999999999999, 0.005499999999999949]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7237, 0.7232000000000001, 0.7223999999999999, 0.7219, 0.7212000000000001, 0.7198, 0.7173, 0.7126, 0.6986, 0.6835, 0.5809, 0.3265, 0.16779999999999995, 0.046599999999999975], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7237, 0.7232000000000001, 0.7227, 0.7222, 0.7217, 0.7203999999999999, 0.7187, 0.7137, 0.7021999999999999, 0.69, 0.598, 0.3347, 0.14549999999999996, 0.010700000000000043], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7237, 0.7232000000000001, 0.7223999999999999, 0.7219, 0.7212000000000001, 0.7198, 0.7173, 0.7125, 0.6985, 0.6833, 0.5738, 0.2632, 0.08950000000000002, 0.0027000000000000357], "L2AdditiveUniformNoiseAttack()": [0.7237, 0.7237, 0.7237, 0.7237, 0.7238, 0.7238, 0.7238, 0.7237, 0.7236, 0.7238, 0.7232000000000001, 0.7234, 0.7235, 0.7219], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7237, 0.7231000000000001, 0.7223999999999999, 0.7219, 0.7211000000000001, 0.7198, 0.7170000000000001, 0.7119, 0.6974, 0.6815, 0.5714, 0.2863, 0.1139, 0.008399999999999963], "robust_accuracy": [0.7237, 0.7231000000000001, 0.7223999999999999, 0.7219, 0.7211000000000001, 0.7198, 0.7170000000000001, 0.7119, 0.6974, 0.6814, 0.5686, 0.2599, 0.08750000000000002, 0.0027000000000000357]}}, "2": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7142999999999999, 0.7129, 0.7125, 0.7117, 0.7113, 0.71, 0.7078, 0.7014, 0.6887, 0.6765, 0.5840000000000001, 0.35250000000000004, 0.20620000000000005, 0.05930000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7142999999999999, 0.7130000000000001, 0.7125, 0.712, 0.7117, 0.7107, 0.7088, 0.7037, 0.6925, 0.6821999999999999, 0.6013999999999999, 0.36260000000000003, 0.1856, 0.01749999999999996], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7142999999999999, 0.7129, 0.7125, 0.7117, 0.7113, 0.71, 0.7078, 0.7013, 0.6887, 0.6760999999999999, 0.5778, 0.2984, 0.121, 0.005700000000000038], "L2AdditiveUniformNoiseAttack()": [0.7142999999999999, 0.7142999999999999, 0.7142999999999999, 0.7142999999999999, 0.7142999999999999, 0.7142999999999999, 0.7143999999999999, 0.7141, 0.7138, 0.7139, 0.7142999999999999, 0.7151000000000001, 0.7148, 0.7130000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7142999999999999, 0.7129, 0.7125, 0.7116, 0.7111000000000001, 0.7097, 0.7076, 0.7010000000000001, 0.688, 0.6743, 0.5769, 0.31999999999999995, 0.15339999999999998, 0.012800000000000034], "robust_accuracy": [0.7142999999999999, 0.7129, 0.7125, 0.7116, 0.7111000000000001, 0.7097, 0.7076, 0.7010000000000001, 0.688, 0.6743, 0.575, 0.2956, 0.11839999999999995, 0.0048000000000000265]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7258, 0.7253000000000001, 0.7243999999999999, 0.7238, 0.7233, 0.7204999999999999, 0.7177, 0.7094, 0.6918, 0.6758, 0.5657, 0.31089999999999995, 0.16800000000000004, 0.05579999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7258, 0.7253000000000001, 0.7244999999999999, 0.7239, 0.7237, 0.7213, 0.7186, 0.7113, 0.6978, 0.683, 0.5862, 0.3006, 0.13019999999999998, 0.009199999999999986], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7258, 0.7253000000000001, 0.7243999999999999, 0.7238, 0.7233, 0.7204999999999999, 0.7177, 0.7093, 0.6916, 0.6754, 0.5553, 0.23219999999999996, 0.08079999999999998, 0.0023999999999999577], "L2AdditiveUniformNoiseAttack()": [0.7258, 0.7258, 0.7258, 0.7258, 0.7257, 0.7257, 0.7259, 0.7261, 0.7256, 0.7262, 0.7252000000000001, 0.7238, 0.7222, 0.7213], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7258, 0.7252000000000001, 0.724, 0.7237, 0.7227, 0.7202, 0.7171000000000001, 0.7072, 0.6900999999999999, 0.6718, 0.5509, 0.25339999999999996, 0.10389999999999999, 0.007199999999999984], "robust_accuracy": [0.7258, 0.7252000000000001, 0.724, 0.7237, 0.7227, 0.7202, 0.7171000000000001, 0.7072, 0.6900999999999999, 0.6718, 0.5483, 0.2268, 0.07899999999999996, 0.0022999999999999687]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7515000000000001, 0.7512, 0.7505999999999999, 0.7498, 0.7488, 0.7474000000000001, 0.7448, 0.7384999999999999, 0.7243999999999999, 0.7102999999999999, 0.6115999999999999, 0.36739999999999995, 0.20430000000000004, 0.06720000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7515000000000001, 0.7513, 0.7507, 0.7502, 0.7495, 0.748, 0.746, 0.7411, 0.7283, 0.7162999999999999, 0.628, 0.37, 0.17589999999999995, 0.01870000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7515000000000001, 0.7512, 0.7505999999999999, 0.7498, 0.7488, 0.7474000000000001, 0.7448, 0.7384999999999999, 0.724, 0.7096, 0.6052, 0.2993, 0.10929999999999995, 0.00660000000000005], "L2AdditiveUniformNoiseAttack()": [0.7515000000000001, 0.7515000000000001, 0.7515000000000001, 0.7516, 0.7516, 0.7515000000000001, 0.7516, 0.7515000000000001, 0.7516, 0.7515000000000001, 0.7518, 0.7513, 0.7514000000000001, 0.7518], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7515000000000001, 0.7511, 0.7505, 0.7495, 0.7488, 0.7473000000000001, 0.7444, 0.7377, 0.7226, 0.7085, 0.6056, 0.3267, 0.14600000000000002, 0.014900000000000024], "robust_accuracy": [0.7515000000000001, 0.7511, 0.7505, 0.7495, 0.7488, 0.7473000000000001, 0.7444, 0.7377, 0.7226, 0.7085, 0.6029, 0.2955, 0.1069, 0.006299999999999972]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7367, 0.736, 0.7352000000000001, 0.7349, 0.7342, 0.7321, 0.7289, 0.722, 0.7063999999999999, 0.6917, 0.5821000000000001, 0.3234, 0.17659999999999998, 0.04959999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7367, 0.736, 0.7353000000000001, 0.735, 0.7347, 0.7325999999999999, 0.7301, 0.7236, 0.7113, 0.6979, 0.5996, 0.3247, 0.13970000000000005, 0.008900000000000019], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7367, 0.736, 0.7352000000000001, 0.7349, 0.7342, 0.7321, 0.7289, 0.7219, 0.7061, 0.6908000000000001, 0.5728, 0.25429999999999997, 0.08109999999999995, 0.0018000000000000238], "L2AdditiveUniformNoiseAttack()": [0.7367, 0.7367, 0.7367, 0.7367, 0.7367, 0.7368, 0.7369, 0.7367, 0.7364999999999999, 0.7369, 0.7373000000000001, 0.7359, 0.7343, 0.7296], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7367, 0.736, 0.7352000000000001, 0.7348, 0.7339, 0.7319, 0.7282, 0.7209, 0.7045, 0.6894, 0.5726, 0.28369999999999995, 0.1129, 0.0050000000000000044], "robust_accuracy": [0.7367, 0.736, 0.7352000000000001, 0.7348, 0.7339, 0.7319, 0.7282, 0.7209, 0.7044, 0.6893, 0.5694, 0.2519, 0.07899999999999996, 0.0016000000000000458]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7119, 0.7116, 0.7110000000000001, 0.7106, 0.7096, 0.7078, 0.7053, 0.6995, 0.6873, 0.6740999999999999, 0.5819, 0.371, 0.22550000000000003, 0.07389999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7119, 0.7116, 0.7112, 0.7107, 0.71, 0.7091000000000001, 0.7063999999999999, 0.7015, 0.6912, 0.6799999999999999, 0.5971, 0.37770000000000004, 0.20109999999999995, 0.025499999999999967], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7119, 0.7116, 0.7110000000000001, 0.7106, 0.7096, 0.7078, 0.7053, 0.6993, 0.6869000000000001, 0.6735, 0.5764, 0.3174, 0.13249999999999995, 0.007199999999999984], "L2AdditiveUniformNoiseAttack()": [0.7119, 0.7119, 0.7119, 0.7119, 0.7119, 0.7119, 0.7119, 0.7117, 0.712, 0.7116, 0.7123999999999999, 0.7121999999999999, 0.7119, 0.7118], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7119, 0.7113, 0.7108, 0.7102999999999999, 0.7094, 0.7076, 0.7049000000000001, 0.6984, 0.6848000000000001, 0.6700999999999999, 0.5688, 0.32799999999999996, 0.15839999999999999, 0.015199999999999991], "robust_accuracy": [0.7119, 0.7113, 0.7108, 0.7102999999999999, 0.7094, 0.7076, 0.7049000000000001, 0.6984, 0.6848000000000001, 0.6699999999999999, 0.5679000000000001, 0.3117, 0.12980000000000003, 0.006700000000000039]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7196, 0.7189, 0.718, 0.7174, 0.7166, 0.7152000000000001, 0.7136, 0.7065, 0.6942999999999999, 0.6818, 0.5871999999999999, 0.36250000000000004, 0.2177, 0.07499999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7196, 0.7189, 0.7181, 0.7176, 0.7170000000000001, 0.7159, 0.7145, 0.7082999999999999, 0.6976, 0.6871, 0.6037, 0.3679, 0.19579999999999997, 0.02529999999999999], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7196, 0.7189, 0.718, 0.7174, 0.7166, 0.7152000000000001, 0.7135, 0.7065, 0.694, 0.6809000000000001, 0.5794, 0.3064, 0.12839999999999996, 0.006700000000000039], "L2AdditiveUniformNoiseAttack()": [0.7196, 0.7196, 0.7196, 0.7196, 0.7196, 0.7195, 0.7196, 0.7195, 0.7196, 0.7194, 0.7197, 0.7202, 0.7166, 0.7150000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7196, 0.7189, 0.718, 0.7172000000000001, 0.7162999999999999, 0.7151000000000001, 0.7128, 0.706, 0.6917, 0.6773, 0.5743, 0.32110000000000005, 0.15700000000000003, 0.017800000000000038], "robust_accuracy": [0.7196, 0.7189, 0.718, 0.7172000000000001, 0.7162999999999999, 0.7151000000000001, 0.7128, 0.706, 0.6917, 0.6773, 0.5723, 0.30069999999999997, 0.125, 0.006199999999999983]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7454000000000001, 0.7449, 0.744, 0.7437, 0.7427, 0.7409, 0.7371, 0.7287, 0.7152000000000001, 0.6998, 0.5958, 0.33199999999999996, 0.17920000000000003, 0.05049999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7454000000000001, 0.7449, 0.7442, 0.7438, 0.7433000000000001, 0.7418, 0.7384999999999999, 0.7317, 0.7193, 0.7069, 0.6144000000000001, 0.32630000000000003, 0.13839999999999997, 0.007099999999999995], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7454000000000001, 0.7449, 0.744, 0.7437, 0.7427, 0.7409, 0.737, 0.7288, 0.7148, 0.6994, 0.5855, 0.253, 0.07920000000000005, 0.0010000000000000009], "L2AdditiveUniformNoiseAttack()": [0.7454000000000001, 0.7454000000000001, 0.7453000000000001, 0.7454000000000001, 0.7453000000000001, 0.7454000000000001, 0.7454000000000001, 0.7453000000000001, 0.7455, 0.7453000000000001, 0.7454000000000001, 0.7438, 0.7431, 0.7401], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7454000000000001, 0.7448, 0.744, 0.7434000000000001, 0.7424999999999999, 0.7405999999999999, 0.7362, 0.7275, 0.7130000000000001, 0.6964, 0.5784, 0.27149999999999996, 0.10299999999999998, 0.0039000000000000146], "robust_accuracy": [0.7454000000000001, 0.7448, 0.744, 0.7434000000000001, 0.7424999999999999, 0.7405999999999999, 0.7362, 0.7275, 0.7130000000000001, 0.6962999999999999, 0.5762, 0.2471, 0.07579999999999998, 0.0010000000000000009]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7484, 0.7475, 0.7469, 0.7466999999999999, 0.7465999999999999, 0.7448, 0.7424999999999999, 0.7358, 0.7217, 0.7087, 0.6102000000000001, 0.3677, 0.2138, 0.06040000000000001], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7484, 0.7476, 0.7471, 0.7468, 0.7465999999999999, 0.7459, 0.7435, 0.7379, 0.7261, 0.7152000000000001, 0.6283000000000001, 0.37629999999999997, 0.18930000000000002, 0.019299999999999984], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7484, 0.7475, 0.7469, 0.7466999999999999, 0.7465999999999999, 0.7446999999999999, 0.7424999999999999, 0.7357, 0.7217, 0.7085, 0.6034999999999999, 0.30679999999999996, 0.119, 0.00539999999999996], "L2AdditiveUniformNoiseAttack()": [0.7484, 0.7484, 0.7483, 0.7484, 0.7483, 0.7483, 0.7484, 0.7483, 0.7483, 0.7484999999999999, 0.7488, 0.7502, 0.7482, 0.7492], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7484, 0.7475, 0.7469, 0.7465999999999999, 0.7463, 0.7444999999999999, 0.742, 0.7345999999999999, 0.7195, 0.7056, 0.5972, 0.3236, 0.1532, 0.013000000000000012], "robust_accuracy": [0.7484, 0.7475, 0.7469, 0.7465999999999999, 0.7463, 0.7444999999999999, 0.742, 0.7345999999999999, 0.7195, 0.7055, 0.5966, 0.30279999999999996, 0.11709999999999998, 0.0048000000000000265]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7508, 0.7504, 0.75, 0.7493000000000001, 0.7489, 0.7473000000000001, 0.7446999999999999, 0.7393000000000001, 0.7261, 0.7127, 0.6108, 0.34840000000000004, 0.1895, 0.046699999999999964], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7508, 0.7505, 0.7501, 0.7499, 0.7492, 0.748, 0.7455, 0.741, 0.7292000000000001, 0.7193, 0.631, 0.36040000000000005, 0.16820000000000002, 0.012900000000000023], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7508, 0.7504, 0.75, 0.7493000000000001, 0.7489, 0.7473000000000001, 0.7446999999999999, 0.7392000000000001, 0.7257, 0.7121, 0.603, 0.29159999999999997, 0.1058, 0.0039000000000000146], "L2AdditiveUniformNoiseAttack()": [0.7508, 0.7508, 0.7508, 0.7508, 0.7508, 0.7507, 0.7508, 0.7507, 0.751, 0.7513, 0.7511, 0.7522, 0.7505, 0.7507], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7508, 0.7504, 0.75, 0.7493000000000001, 0.7488, 0.7472, 0.7446999999999999, 0.7384, 0.7247, 0.7102999999999999, 0.6012, 0.3113, 0.1362, 0.009000000000000008], "robust_accuracy": [0.7508, 0.7504, 0.75, 0.7493000000000001, 0.7488, 0.7472, 0.7446999999999999, 0.7384, 0.7247, 0.7102999999999999, 0.5992999999999999, 0.2881, 0.10350000000000004, 0.0036000000000000476]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7343, 0.7337, 0.7331, 0.7325999999999999, 0.7321, 0.7303, 0.7283, 0.723, 0.7095, 0.6955, 0.6093999999999999, 0.3812, 0.23409999999999997, 0.07620000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7343, 0.7338, 0.7335, 0.7329, 0.7323, 0.7314, 0.729, 0.7244999999999999, 0.7137, 0.7013, 0.6246, 0.3922, 0.21250000000000002, 0.027000000000000024], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7343, 0.7337, 0.7331, 0.7325999999999999, 0.7321, 0.7303, 0.7283, 0.723, 0.7091000000000001, 0.6951, 0.6039, 0.32920000000000005, 0.14190000000000003, 0.00770000000000004], "L2AdditiveUniformNoiseAttack()": [0.7343, 0.7343, 0.7343, 0.7343, 0.7343, 0.7342, 0.7342, 0.7341, 0.7341, 0.7343, 0.7347, 0.7349, 0.7349, 0.7318], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7343, 0.7336, 0.733, 0.7323999999999999, 0.7319, 0.7302, 0.7279, 0.7214, 0.7065, 0.6916, 0.5949, 0.3377, 0.16659999999999997, 0.018199999999999994], "robust_accuracy": [0.7343, 0.7336, 0.733, 0.7323999999999999, 0.7319, 0.7302, 0.7279, 0.7214, 0.7063999999999999, 0.6915, 0.5946, 0.3217, 0.139, 0.007099999999999995]}}, "4": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7407, 0.74, 0.7393000000000001, 0.7387, 0.7377, 0.7363999999999999, 0.7337, 0.7268, 0.7129, 0.6991, 0.6016, 0.3628, 0.21340000000000003, 0.06679999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7407, 0.74, 0.7394000000000001, 0.7392000000000001, 0.7381, 0.7372000000000001, 0.7348, 0.7284999999999999, 0.7169, 0.7041, 0.6168, 0.36550000000000005, 0.18389999999999995, 0.01970000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7407, 0.74, 0.7393000000000001, 0.7387, 0.7377, 0.7363999999999999, 0.7337, 0.7268, 0.7127, 0.6987, 0.5946, 0.29600000000000004, 0.11819999999999997, 0.005800000000000027], "L2AdditiveUniformNoiseAttack()": [0.7407, 0.7407, 0.7407, 0.7407, 0.7407, 0.7407, 0.7407, 0.7408, 0.7404999999999999, 0.7407, 0.7405999999999999, 0.7398, 0.7412000000000001, 0.7416], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7407, 0.74, 0.7393000000000001, 0.7384999999999999, 0.7377, 0.7361, 0.7331, 0.7259, 0.7112, 0.6962999999999999, 0.5913999999999999, 0.3174, 0.1531, 0.014000000000000012], "robust_accuracy": [0.7407, 0.74, 0.7393000000000001, 0.7384999999999999, 0.7377, 0.7361, 0.7331, 0.7259, 0.7112, 0.6961999999999999, 0.5897, 0.29200000000000004, 0.1159, 0.005199999999999982]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7482, 0.7477, 0.7475, 0.7474000000000001, 0.7472, 0.7464, 0.7434000000000001, 0.7372000000000001, 0.7252000000000001, 0.7138, 0.6251, 0.384, 0.23019999999999996, 0.07230000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7482, 0.7477, 0.7475, 0.7474000000000001, 0.7474000000000001, 0.747, 0.7448, 0.7396, 0.7293000000000001, 0.7194, 0.6402, 0.3922, 0.20499999999999996, 0.022800000000000042], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7482, 0.7477, 0.7475, 0.7474000000000001, 0.7472, 0.7464, 0.7434000000000001, 0.7372000000000001, 0.725, 0.7133, 0.6194, 0.3244, 0.13270000000000004, 0.005700000000000038], "L2AdditiveUniformNoiseAttack()": [0.7482, 0.7482, 0.7482, 0.7482, 0.7483, 0.7482, 0.7483, 0.7482, 0.7483, 0.7482, 0.7486999999999999, 0.7491, 0.7484999999999999, 0.7504], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7482, 0.7477, 0.7475, 0.7474000000000001, 0.7471, 0.746, 0.743, 0.7363, 0.7243999999999999, 0.7118, 0.616, 0.3435, 0.17200000000000004, 0.015900000000000025], "robust_accuracy": [0.7482, 0.7477, 0.7475, 0.7474000000000001, 0.7471, 0.746, 0.743, 0.7363, 0.7243999999999999, 0.7118, 0.614, 0.32089999999999996, 0.1311, 0.005700000000000038]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7473000000000001, 0.7471, 0.7462, 0.7452, 0.7448, 0.7433000000000001, 0.7405999999999999, 0.7339, 0.7207, 0.7079, 0.6098, 0.36439999999999995, 0.21350000000000002, 0.07079999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7473000000000001, 0.7472, 0.7462, 0.7458, 0.745, 0.7441, 0.7416, 0.736, 0.7252000000000001, 0.7129, 0.6282, 0.36660000000000004, 0.18000000000000005, 0.021199999999999997], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7473000000000001, 0.7471, 0.7462, 0.7452, 0.7448, 0.7433000000000001, 0.7405999999999999, 0.7339, 0.7204999999999999, 0.7074, 0.6008, 0.29890000000000005, 0.11739999999999995, 0.005800000000000027], "L2AdditiveUniformNoiseAttack()": [0.7473000000000001, 0.7473000000000001, 0.7473000000000001, 0.7474000000000001, 0.7473000000000001, 0.7473000000000001, 0.7474000000000001, 0.7473000000000001, 0.7474000000000001, 0.7473000000000001, 0.7472, 0.7462, 0.747, 0.7453000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7473000000000001, 0.7471, 0.7461, 0.7451, 0.7448, 0.7432000000000001, 0.7402, 0.7335, 0.7192000000000001, 0.7061, 0.5989, 0.32199999999999995, 0.14739999999999998, 0.01429999999999998], "robust_accuracy": [0.7473000000000001, 0.7471, 0.7461, 0.7451, 0.7448, 0.7432000000000001, 0.7402, 0.7335, 0.7191000000000001, 0.7061, 0.5972, 0.29600000000000004, 0.11499999999999999, 0.005099999999999993]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7384999999999999, 0.7377, 0.737, 0.7363, 0.7358, 0.7343999999999999, 0.7319, 0.7252000000000001, 0.7129, 0.6995, 0.5974999999999999, 0.3456, 0.19810000000000005, 0.05989999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7384999999999999, 0.7377, 0.7373000000000001, 0.7368, 0.736, 0.7348, 0.7325999999999999, 0.7269, 0.7163999999999999, 0.7053, 0.6139, 0.3477, 0.16549999999999998, 0.014599999999999946], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7384999999999999, 0.7377, 0.737, 0.7363, 0.7358, 0.7343, 0.732, 0.725, 0.7125, 0.6988, 0.5884, 0.27959999999999996, 0.10199999999999998, 0.0036000000000000476], "L2AdditiveUniformNoiseAttack()": [0.7384999999999999, 0.7384999999999999, 0.7384, 0.7384, 0.7384, 0.7383, 0.7384999999999999, 0.7387, 0.7381, 0.7384, 0.7384, 0.7384999999999999, 0.7376, 0.7384], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7384999999999999, 0.7377, 0.737, 0.7362, 0.7357, 0.734, 0.7316, 0.7242, 0.7107, 0.6962999999999999, 0.5851999999999999, 0.29979999999999996, 0.1331, 0.009000000000000008], "robust_accuracy": [0.7384999999999999, 0.7377, 0.737, 0.7362, 0.7357, 0.734, 0.7316, 0.7242, 0.7107, 0.6960999999999999, 0.5829, 0.2752, 0.10019999999999996, 0.0032999999999999696]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.734, 0.7335, 0.7333000000000001, 0.7327, 0.7323, 0.7314, 0.729, 0.7198, 0.7057, 0.6924, 0.603, 0.3708, 0.22850000000000004, 0.0807], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.734, 0.7335, 0.7333000000000001, 0.733, 0.7324999999999999, 0.7319, 0.73, 0.7222999999999999, 0.7099, 0.6993, 0.6199, 0.37329999999999997, 0.1987, 0.027100000000000013], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.734, 0.7335, 0.7333000000000001, 0.7327, 0.7323, 0.7314, 0.7288, 0.7198, 0.7055, 0.6918, 0.5944, 0.3094, 0.13249999999999995, 0.00990000000000002], "L2AdditiveUniformNoiseAttack()": [0.734, 0.734, 0.734, 0.7339, 0.7341, 0.734, 0.7341, 0.734, 0.7343, 0.7337, 0.735, 0.7342, 0.7335, 0.7316], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.734, 0.7334, 0.7332000000000001, 0.7324999999999999, 0.7322, 0.7311000000000001, 0.7281, 0.7193, 0.7044, 0.6896, 0.5911, 0.3274, 0.1623, 0.01739999999999997], "robust_accuracy": [0.734, 0.7334, 0.7332000000000001, 0.7324999999999999, 0.7322, 0.7311000000000001, 0.7281, 0.7193, 0.7044, 0.6896, 0.5889, 0.30500000000000005, 0.13, 0.00880000000000003]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7401, 0.74, 0.7392000000000001, 0.7383, 0.7377, 0.7363, 0.7328, 0.7263999999999999, 0.7126, 0.698, 0.6022000000000001, 0.36650000000000005, 0.21899999999999997, 0.06999999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7401, 0.74, 0.7394000000000001, 0.7389, 0.7379, 0.737, 0.7341, 0.7287, 0.7166, 0.7042999999999999, 0.6196999999999999, 0.36950000000000005, 0.18169999999999997, 0.01759999999999995], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7401, 0.74, 0.7392000000000001, 0.7383, 0.7377, 0.7363, 0.7327, 0.7263, 0.7121999999999999, 0.6973, 0.5929, 0.30269999999999997, 0.11670000000000003, 0.0050000000000000044], "L2AdditiveUniformNoiseAttack()": [0.7401, 0.7401, 0.7401, 0.7401, 0.7401, 0.74, 0.7401, 0.7402, 0.7399, 0.7404999999999999, 0.7404, 0.7404999999999999, 0.7397, 0.7361], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7401, 0.74, 0.7391, 0.7381, 0.7375, 0.7362, 0.7323, 0.7258, 0.7105, 0.6949000000000001, 0.589, 0.3234, 0.14939999999999998, 0.012900000000000023], "robust_accuracy": [0.7401, 0.74, 0.7391, 0.7381, 0.7375, 0.7362, 0.7323, 0.7257, 0.7105, 0.6948, 0.5869, 0.2992, 0.11360000000000003, 0.0046000000000000485]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7353000000000001, 0.7348, 0.7339, 0.7335, 0.7331, 0.7323, 0.73, 0.7241, 0.7089, 0.6932, 0.5859, 0.3267, 0.1763, 0.04569999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7353000000000001, 0.7349, 0.734, 0.7337, 0.7334, 0.7327, 0.7309, 0.7252000000000001, 0.7127, 0.6994, 0.6046, 0.32989999999999997, 0.14649999999999996, 0.011499999999999955], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7353000000000001, 0.7348, 0.7339, 0.7335, 0.7331, 0.7322, 0.73, 0.7241, 0.7086, 0.6927, 0.5768, 0.26580000000000004, 0.08899999999999997, 0.0032999999999999696], "L2AdditiveUniformNoiseAttack()": [0.7353000000000001, 0.7353000000000001, 0.7353000000000001, 0.7352000000000001, 0.7353000000000001, 0.7354, 0.7353000000000001, 0.7352000000000001, 0.7353000000000001, 0.7355, 0.7359, 0.7358, 0.7356, 0.7342], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7353000000000001, 0.7347, 0.7339, 0.7335, 0.7329, 0.7322, 0.7297, 0.7237, 0.7071000000000001, 0.6914, 0.5745, 0.28879999999999995, 0.11670000000000003, 0.007800000000000029], "robust_accuracy": [0.7353000000000001, 0.7347, 0.7339, 0.7335, 0.7329, 0.7322, 0.7297, 0.7237, 0.7071000000000001, 0.6912, 0.5722, 0.26270000000000004, 0.0877, 0.0028000000000000247]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7150000000000001, 0.7143999999999999, 0.7141, 0.7135, 0.7128, 0.7114, 0.7086, 0.7008, 0.6865, 0.6738999999999999, 0.5835, 0.3657, 0.22719999999999996, 0.08430000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7150000000000001, 0.7145, 0.7141, 0.7136, 0.7132000000000001, 0.712, 0.7094, 0.7028, 0.6913, 0.6804, 0.5985, 0.366, 0.18889999999999996, 0.02200000000000002], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7150000000000001, 0.7143999999999999, 0.7141, 0.7135, 0.7128, 0.7114, 0.7086, 0.7008, 0.6864, 0.673, 0.575, 0.30200000000000005, 0.12390000000000001, 0.005499999999999949], "L2AdditiveUniformNoiseAttack()": [0.7150000000000001, 0.7150000000000001, 0.7150000000000001, 0.7149, 0.7149, 0.7148, 0.7148, 0.7149, 0.7151000000000001, 0.7152000000000001, 0.7147, 0.7141, 0.7138, 0.7112], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7150000000000001, 0.7143999999999999, 0.7139, 0.7132000000000001, 0.7128, 0.7108, 0.7079, 0.7002999999999999, 0.6852, 0.6712, 0.5726, 0.32320000000000004, 0.1593, 0.015499999999999958], "robust_accuracy": [0.7150000000000001, 0.7143999999999999, 0.7139, 0.7132000000000001, 0.7128, 0.7108, 0.7079, 0.7002999999999999, 0.6852, 0.671, 0.5700000000000001, 0.2974, 0.12190000000000001, 0.0049000000000000155]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7486999999999999, 0.7482, 0.7472, 0.7465999999999999, 0.7458, 0.7444999999999999, 0.7404, 0.7343, 0.721, 0.7081999999999999, 0.6127, 0.3677, 0.21309999999999996, 0.06230000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7486999999999999, 0.7482, 0.7476, 0.7468, 0.7463, 0.7451, 0.7423, 0.7367, 0.7258, 0.7134, 0.6291, 0.3771, 0.18710000000000004, 0.02059999999999995], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7486999999999999, 0.7482, 0.7472, 0.7465999999999999, 0.7458, 0.7444, 0.7404999999999999, 0.7343, 0.7208, 0.7077, 0.6051, 0.30879999999999996, 0.12160000000000004, 0.00770000000000004], "L2AdditiveUniformNoiseAttack()": [0.7486999999999999, 0.7488, 0.7486999999999999, 0.7486999999999999, 0.7486999999999999, 0.7488, 0.7489, 0.7485999999999999, 0.7486999999999999, 0.7484999999999999, 0.7482, 0.7494000000000001, 0.7491, 0.7457], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7486999999999999, 0.7482, 0.7469, 0.7464, 0.7453000000000001, 0.7444, 0.7403, 0.7339, 0.72, 0.7062999999999999, 0.605, 0.33309999999999995, 0.15049999999999997, 0.015100000000000002], "robust_accuracy": [0.7486999999999999, 0.7482, 0.7469, 0.7464, 0.7453000000000001, 0.7444, 0.7403, 0.7339, 0.72, 0.7061, 0.603, 0.3065, 0.11819999999999997, 0.007099999999999995]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.746, 0.7451, 0.7446999999999999, 0.7438, 0.7435, 0.7414000000000001, 0.7384, 0.732, 0.7206, 0.7037, 0.5938, 0.34209999999999996, 0.1985, 0.06369999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.746, 0.7453000000000001, 0.7448, 0.7444, 0.7438, 0.7425999999999999, 0.7394000000000001, 0.7336, 0.7236, 0.7118, 0.6123000000000001, 0.33919999999999995, 0.15649999999999997, 0.015800000000000036], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.746, 0.7451, 0.7446999999999999, 0.7438, 0.7435, 0.7414000000000001, 0.7384, 0.732, 0.7203999999999999, 0.7025, 0.5836, 0.2682, 0.09550000000000003, 0.0043999999999999595], "L2AdditiveUniformNoiseAttack()": [0.746, 0.746, 0.746, 0.746, 0.746, 0.746, 0.7459, 0.746, 0.7457, 0.746, 0.7463, 0.7477, 0.7473000000000001, 0.7446999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.746, 0.745, 0.7445999999999999, 0.7438, 0.7432000000000001, 0.7411, 0.738, 0.7315, 0.7187, 0.6997, 0.5768, 0.2843, 0.12090000000000001, 0.00990000000000002], "robust_accuracy": [0.746, 0.745, 0.7445999999999999, 0.7438, 0.7432000000000001, 0.7411, 0.738, 0.7315, 0.7187, 0.6993, 0.575, 0.2623, 0.09330000000000005, 0.0038000000000000256]}}, "8": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7297, 0.7292000000000001, 0.7279, 0.7276, 0.7269, 0.7256, 0.7217, 0.7148, 0.7015, 0.6864, 0.5844, 0.35609999999999997, 0.21719999999999995, 0.09109999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7297, 0.7293000000000001, 0.7283999999999999, 0.7277, 0.7273000000000001, 0.7263, 0.723, 0.7167, 0.7051000000000001, 0.6932, 0.598, 0.3466, 0.17169999999999996, 0.020499999999999963], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7297, 0.7292000000000001, 0.7279, 0.7276, 0.7269, 0.7255, 0.7216, 0.7147, 0.7012, 0.6860999999999999, 0.5727, 0.28190000000000004, 0.11439999999999995, 0.005299999999999971], "L2AdditiveUniformNoiseAttack()": [0.7297, 0.7297, 0.7297, 0.7297, 0.7299, 0.7297, 0.7297, 0.7297, 0.7295, 0.7298, 0.73, 0.7308, 0.7299, 0.7318], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7297, 0.7291000000000001, 0.7278, 0.7275, 0.7267, 0.7254, 0.7211000000000001, 0.7139, 0.6996, 0.6844, 0.5727, 0.30710000000000004, 0.1442, 0.0121], "robust_accuracy": [0.7297, 0.7291000000000001, 0.7278, 0.7275, 0.7267, 0.7254, 0.7211000000000001, 0.7138, 0.6995, 0.6844, 0.5694, 0.27780000000000005, 0.11109999999999998, 0.0041999999999999815]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7302, 0.7297, 0.7293000000000001, 0.7287, 0.7282, 0.7268, 0.7242999999999999, 0.7182999999999999, 0.7053, 0.6901999999999999, 0.6007, 0.36750000000000005, 0.22399999999999998, 0.08179999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7302, 0.7298, 0.7294, 0.729, 0.7283, 0.7274, 0.7252000000000001, 0.7202, 0.71, 0.6969000000000001, 0.6151, 0.362, 0.17720000000000002, 0.016199999999999992], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7302, 0.7297, 0.7293000000000001, 0.7287, 0.7282, 0.7268, 0.7242999999999999, 0.7182999999999999, 0.7050000000000001, 0.6898, 0.5915, 0.2966, 0.10940000000000005, 0.0046000000000000485], "L2AdditiveUniformNoiseAttack()": [0.7302, 0.7302, 0.7302, 0.7302, 0.7302, 0.7302, 0.7303, 0.7303999999999999, 0.7303, 0.73, 0.7301, 0.7291000000000001, 0.7297, 0.7284999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7302, 0.7297, 0.7292000000000001, 0.7287, 0.7282, 0.7264999999999999, 0.724, 0.7177, 0.7033, 0.6888000000000001, 0.5909, 0.3173, 0.14339999999999997, 0.01100000000000001], "robust_accuracy": [0.7302, 0.7297, 0.7292000000000001, 0.7287, 0.7282, 0.7264999999999999, 0.724, 0.7177, 0.7033, 0.6888000000000001, 0.5881000000000001, 0.29269999999999996, 0.10760000000000003, 0.0038000000000000256]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7053, 0.7042999999999999, 0.7034, 0.7030000000000001, 0.7026, 0.7017, 0.6980999999999999, 0.6906, 0.6755, 0.6611, 0.5623, 0.347, 0.20589999999999997, 0.06910000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7053, 0.7044, 0.7039, 0.7031000000000001, 0.7027, 0.7021, 0.6994, 0.6926, 0.6796, 0.6674, 0.5787, 0.34750000000000003, 0.17700000000000005, 0.018199999999999994], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7053, 0.7042999999999999, 0.7034, 0.7030000000000001, 0.7026, 0.7017, 0.698, 0.6906, 0.6754, 0.6603, 0.5541, 0.2842, 0.11580000000000001, 0.005800000000000027], "L2AdditiveUniformNoiseAttack()": [0.7053, 0.7053, 0.7052, 0.7053, 0.7052, 0.7052, 0.7052, 0.7049000000000001, 0.7053, 0.7051000000000001, 0.7058, 0.7041999999999999, 0.7053, 0.7046], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7053, 0.7041999999999999, 0.7033, 0.7030000000000001, 0.7026, 0.7012, 0.6974, 0.6898, 0.6735, 0.6586000000000001, 0.5527, 0.30000000000000004, 0.14159999999999995, 0.01090000000000002], "robust_accuracy": [0.7053, 0.7041999999999999, 0.7033, 0.7030000000000001, 0.7026, 0.7012, 0.6974, 0.6898, 0.6734, 0.6583, 0.5501, 0.27849999999999997, 0.1129, 0.0049000000000000155]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7519, 0.7514000000000001, 0.7505999999999999, 0.7499, 0.7491, 0.7475, 0.7444, 0.7379, 0.7254, 0.7125, 0.6113, 0.37239999999999995, 0.2116, 0.060699999999999976], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7519, 0.7515000000000001, 0.7507, 0.7501, 0.7496, 0.7484, 0.7455, 0.7399, 0.7292000000000001, 0.7186, 0.6286, 0.3779, 0.17969999999999997, 0.016700000000000048], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7519, 0.7514000000000001, 0.7505999999999999, 0.7499, 0.7491, 0.7475, 0.7443, 0.7376, 0.7252000000000001, 0.7118, 0.6032, 0.3056, 0.1129, 0.0043999999999999595], "L2AdditiveUniformNoiseAttack()": [0.7519, 0.7519, 0.7519, 0.7519, 0.7519, 0.7519, 0.7519, 0.7521, 0.752, 0.7519, 0.7516, 0.7514000000000001, 0.7505999999999999, 0.7477], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7519, 0.7514000000000001, 0.7505, 0.7497, 0.7488, 0.7473000000000001, 0.7442, 0.7372000000000001, 0.7243999999999999, 0.7109, 0.6029, 0.3317, 0.1451, 0.010000000000000009], "robust_accuracy": [0.7519, 0.7514000000000001, 0.7505, 0.7497, 0.7488, 0.7473000000000001, 0.7442, 0.7371, 0.7243999999999999, 0.7107, 0.6, 0.30279999999999996, 0.11050000000000004, 0.0037000000000000366]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7378, 0.7372000000000001, 0.7363, 0.7357, 0.735, 0.7341, 0.7312000000000001, 0.7238, 0.7118, 0.6998, 0.6, 0.3641, 0.22340000000000004, 0.0797], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7378, 0.7372000000000001, 0.7365999999999999, 0.7361, 0.7353000000000001, 0.7347, 0.7322, 0.726, 0.7149, 0.7048, 0.6167, 0.3641, 0.18259999999999998, 0.022599999999999953], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7378, 0.7372000000000001, 0.7363, 0.7357, 0.7349, 0.7341, 0.7312000000000001, 0.7238, 0.7116, 0.6990000000000001, 0.5892999999999999, 0.29769999999999996, 0.11970000000000003, 0.006399999999999961], "L2AdditiveUniformNoiseAttack()": [0.7378, 0.7378, 0.7379, 0.7379, 0.7379, 0.7379, 0.738, 0.7378, 0.738, 0.7381, 0.7378, 0.7389, 0.7376, 0.7375], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7378, 0.7372000000000001, 0.7363, 0.7355, 0.7349, 0.7338, 0.7309, 0.7228, 0.7099, 0.6974, 0.5851999999999999, 0.3185, 0.14700000000000002, 0.01629999999999998], "robust_accuracy": [0.7378, 0.7372000000000001, 0.7363, 0.7355, 0.7349, 0.7338, 0.7309, 0.7228, 0.7099, 0.6973, 0.5825, 0.2934, 0.11709999999999998, 0.006099999999999994]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7534, 0.7525, 0.7519, 0.7513, 0.7504, 0.7494000000000001, 0.7466999999999999, 0.741, 0.7294, 0.7151000000000001, 0.619, 0.3851, 0.22650000000000003, 0.07579999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7534, 0.7527, 0.7521, 0.7515000000000001, 0.7507, 0.75, 0.748, 0.7425999999999999, 0.7329, 0.7215, 0.6321, 0.38759999999999994, 0.19669999999999999, 0.0242], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7534, 0.7525, 0.7519, 0.7513, 0.7504, 0.7493000000000001, 0.7465999999999999, 0.7409, 0.7293000000000001, 0.7142, 0.6114999999999999, 0.3183, 0.12570000000000003, 0.007199999999999984], "L2AdditiveUniformNoiseAttack()": [0.7534, 0.7534, 0.7534, 0.7534, 0.7534, 0.7534, 0.7534, 0.7534, 0.7534, 0.7531, 0.7537, 0.7529, 0.7536, 0.751], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7534, 0.7524, 0.7518, 0.7511, 0.7504, 0.749, 0.7463, 0.7408, 0.7274, 0.7111000000000001, 0.6093, 0.33999999999999997, 0.1592, 0.015800000000000036], "robust_accuracy": [0.7534, 0.7524, 0.7518, 0.7511, 0.7504, 0.749, 0.7463, 0.7408, 0.7274, 0.7110000000000001, 0.6079, 0.3143, 0.12370000000000003, 0.006900000000000017]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7491, 0.7483, 0.7475, 0.7471, 0.7464999999999999, 0.7444999999999999, 0.7421, 0.7355, 0.7216, 0.708, 0.6133, 0.3802, 0.2349, 0.08799999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7491, 0.7484, 0.7477, 0.7472, 0.747, 0.7455, 0.7431, 0.7376, 0.7258, 0.7136, 0.6281, 0.383, 0.20040000000000002, 0.023800000000000043], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7491, 0.7483, 0.7475, 0.7471, 0.7464999999999999, 0.7444999999999999, 0.742, 0.7355, 0.7215, 0.7071000000000001, 0.6061000000000001, 0.31589999999999996, 0.13139999999999996, 0.006700000000000039], "L2AdditiveUniformNoiseAttack()": [0.7491, 0.7491, 0.7491, 0.7491, 0.7491, 0.7491, 0.749, 0.7488, 0.749, 0.749, 0.7489, 0.7484999999999999, 0.7472, 0.7459], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7491, 0.7483, 0.7475, 0.7469, 0.7464999999999999, 0.7444, 0.7419, 0.7352000000000001, 0.7202999999999999, 0.7056, 0.6043000000000001, 0.3399, 0.17020000000000002, 0.01429999999999998], "robust_accuracy": [0.7491, 0.7483, 0.7475, 0.7469, 0.7464999999999999, 0.7444, 0.7419, 0.7352000000000001, 0.7202999999999999, 0.7053, 0.6021000000000001, 0.3124, 0.13, 0.00539999999999996]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7433000000000001, 0.7433000000000001, 0.7425999999999999, 0.7421, 0.7418, 0.7403, 0.7378, 0.7314, 0.7168, 0.7052, 0.6159, 0.37150000000000005, 0.2227, 0.06710000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7433000000000001, 0.7433000000000001, 0.7431, 0.7422, 0.742, 0.7412000000000001, 0.7389, 0.7337, 0.7203999999999999, 0.7103999999999999, 0.633, 0.377, 0.19379999999999997, 0.020000000000000018], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7433000000000001, 0.7433000000000001, 0.7425999999999999, 0.7421, 0.7418, 0.7402, 0.7378, 0.7313000000000001, 0.7165, 0.7047, 0.6091, 0.30979999999999996, 0.12229999999999996, 0.005600000000000049], "L2AdditiveUniformNoiseAttack()": [0.7433000000000001, 0.7433000000000001, 0.7433000000000001, 0.7433000000000001, 0.7433000000000001, 0.7433000000000001, 0.7433000000000001, 0.7435, 0.7433000000000001, 0.7435, 0.7435, 0.7437, 0.7437, 0.7411], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7433000000000001, 0.7432000000000001, 0.7424999999999999, 0.7421, 0.7415, 0.74, 0.7376, 0.7307, 0.7151000000000001, 0.7034, 0.6036, 0.32709999999999995, 0.15469999999999995, 0.013599999999999945], "robust_accuracy": [0.7433000000000001, 0.7432000000000001, 0.7424999999999999, 0.7421, 0.7415, 0.74, 0.7376, 0.7307, 0.7151000000000001, 0.7032, 0.6022000000000001, 0.30479999999999996, 0.1199, 0.005099999999999993]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7486999999999999, 0.7479, 0.7464, 0.746, 0.7457, 0.7443, 0.7408, 0.7351, 0.7208, 0.7078, 0.6048, 0.3759, 0.24239999999999995, 0.10399999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7486999999999999, 0.7481, 0.7469, 0.7461, 0.7459, 0.7449, 0.7422, 0.7367, 0.725, 0.7133, 0.6161, 0.35919999999999996, 0.18020000000000003, 0.020199999999999996], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7486999999999999, 0.7479, 0.7464, 0.746, 0.7457, 0.7443, 0.7408, 0.7349, 0.7203999999999999, 0.7068, 0.5909, 0.2912, 0.11570000000000003, 0.006099999999999994], "L2AdditiveUniformNoiseAttack()": [0.7486999999999999, 0.7486999999999999, 0.7486999999999999, 0.7486999999999999, 0.7486999999999999, 0.7486999999999999, 0.7489, 0.7488, 0.7485999999999999, 0.7484999999999999, 0.7484999999999999, 0.7483, 0.7489, 0.746], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7486999999999999, 0.7479, 0.7463, 0.746, 0.7457, 0.7439, 0.7402, 0.7343999999999999, 0.7195, 0.7048, 0.5900000000000001, 0.3176, 0.14990000000000003, 0.014900000000000024], "robust_accuracy": [0.7486999999999999, 0.7479, 0.7463, 0.746, 0.7457, 0.7439, 0.7402, 0.7343999999999999, 0.7194, 0.7047, 0.5856, 0.28700000000000003, 0.11250000000000004, 0.005700000000000038]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7416, 0.7407, 0.7402, 0.7398, 0.7393000000000001, 0.7381, 0.7357, 0.728, 0.7159, 0.7030000000000001, 0.6025, 0.3648, 0.22519999999999996, 0.08320000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7416, 0.7408, 0.7403, 0.74, 0.7395, 0.7384999999999999, 0.7368, 0.7306, 0.7195, 0.7090000000000001, 0.6195999999999999, 0.3661, 0.18320000000000003, 0.01870000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7416, 0.7405999999999999, 0.7402, 0.7398, 0.7393000000000001, 0.7381, 0.7357, 0.7279, 0.7154, 0.7022999999999999, 0.5949, 0.2994, 0.12019999999999997, 0.005700000000000038], "L2AdditiveUniformNoiseAttack()": [0.7416, 0.7416, 0.7416, 0.7415, 0.7416, 0.7416, 0.7416, 0.7415, 0.7413000000000001, 0.7413000000000001, 0.7411, 0.7404, 0.7405999999999999, 0.74], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7416, 0.7405999999999999, 0.7401, 0.7397, 0.7392000000000001, 0.738, 0.7355, 0.7275, 0.7146, 0.7005, 0.5941000000000001, 0.3257, 0.15390000000000004, 0.012900000000000023], "robust_accuracy": [0.7416, 0.7405999999999999, 0.7401, 0.7397, 0.7392000000000001, 0.738, 0.7355, 0.7275, 0.7145, 0.7004, 0.5915, 0.29679999999999995, 0.11860000000000004, 0.005299999999999971]}}, "16": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7496, 0.749, 0.7485999999999999, 0.7481, 0.7478, 0.7466999999999999, 0.7433000000000001, 0.7365999999999999, 0.723, 0.7088, 0.612, 0.3748, 0.22499999999999998, 0.08420000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7496, 0.7492, 0.7488, 0.7484, 0.7479, 0.747, 0.7445999999999999, 0.7384999999999999, 0.7263999999999999, 0.7159, 0.6274, 0.36619999999999997, 0.17520000000000002, 0.01849999999999996], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7496, 0.749, 0.7485999999999999, 0.7481, 0.7478, 0.7465999999999999, 0.7433000000000001, 0.7365999999999999, 0.7226, 0.708, 0.6004, 0.2904, 0.11029999999999995, 0.0043999999999999595], "L2AdditiveUniformNoiseAttack()": [0.7496, 0.7496, 0.7496, 0.7495, 0.7495, 0.7495, 0.7496, 0.7496, 0.7495, 0.7493000000000001, 0.7494000000000001, 0.75, 0.7512, 0.7457], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7496, 0.749, 0.7484999999999999, 0.7481, 0.7478, 0.7464, 0.7428, 0.7361, 0.7214, 0.7071000000000001, 0.6014999999999999, 0.32130000000000003, 0.14300000000000002, 0.01090000000000002], "robust_accuracy": [0.7496, 0.749, 0.7484999999999999, 0.7481, 0.7478, 0.7464, 0.7428, 0.7361, 0.7214, 0.7069, 0.5971, 0.2882, 0.10750000000000004, 0.0038000000000000256]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7379, 0.7377, 0.7369, 0.7359, 0.7351, 0.7338, 0.7309, 0.7244999999999999, 0.7098, 0.6967, 0.5996, 0.37150000000000005, 0.2368, 0.09919999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7379, 0.7377, 0.7371, 0.7363999999999999, 0.7355, 0.7342, 0.7318, 0.7258, 0.7130000000000001, 0.7030000000000001, 0.6143000000000001, 0.36160000000000003, 0.18269999999999997, 0.021199999999999997], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7379, 0.7377, 0.7369, 0.7359, 0.7351, 0.7338, 0.7309, 0.7243999999999999, 0.7095, 0.6959, 0.5891, 0.2953, 0.11609999999999998, 0.005199999999999982], "L2AdditiveUniformNoiseAttack()": [0.7379, 0.7379, 0.7379, 0.7379, 0.7379, 0.7379, 0.7381, 0.7379, 0.7381, 0.7384, 0.7379, 0.7375, 0.7383, 0.7364999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7379, 0.7376, 0.7369, 0.7358, 0.735, 0.7337, 0.7303999999999999, 0.7237, 0.7079, 0.6944, 0.587, 0.3198, 0.15059999999999996, 0.013700000000000045], "robust_accuracy": [0.7379, 0.7376, 0.7369, 0.7358, 0.735, 0.7337, 0.7303999999999999, 0.7237, 0.7079, 0.6942999999999999, 0.5843, 0.2922, 0.11309999999999998, 0.0047000000000000375]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.737, 0.7365999999999999, 0.7358, 0.7354, 0.7345999999999999, 0.733, 0.7313000000000001, 0.7244999999999999, 0.7083999999999999, 0.6953, 0.5932999999999999, 0.355, 0.21819999999999995, 0.09109999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.737, 0.7368, 0.736, 0.7355, 0.7351, 0.7337, 0.7317, 0.7262, 0.7123999999999999, 0.7001, 0.6086, 0.34130000000000005, 0.16390000000000005, 0.014000000000000012], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.737, 0.7365999999999999, 0.7358, 0.7354, 0.7345999999999999, 0.733, 0.7313000000000001, 0.7242999999999999, 0.7081999999999999, 0.6946, 0.5820000000000001, 0.27380000000000004, 0.09830000000000005, 0.0039000000000000146], "L2AdditiveUniformNoiseAttack()": [0.737, 0.737, 0.737, 0.737, 0.737, 0.7369, 0.737, 0.7369, 0.737, 0.737, 0.7371, 0.7375, 0.7364999999999999, 0.7328], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.737, 0.7365999999999999, 0.7357, 0.7353000000000001, 0.7343999999999999, 0.733, 0.7306, 0.7237, 0.7072, 0.6926, 0.5826, 0.30110000000000003, 0.13190000000000002, 0.008700000000000041], "robust_accuracy": [0.737, 0.7365999999999999, 0.7357, 0.7353000000000001, 0.7343999999999999, 0.733, 0.7306, 0.7237, 0.7072, 0.6924, 0.5786, 0.27080000000000004, 0.09540000000000004, 0.0038000000000000256]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.746, 0.7455, 0.7451, 0.7442, 0.7437, 0.7421, 0.7397, 0.7333000000000001, 0.7209, 0.7077, 0.6133, 0.38439999999999996, 0.24150000000000005, 0.0917], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.746, 0.7457, 0.7454000000000001, 0.7444, 0.7441, 0.7429, 0.7404999999999999, 0.7359, 0.724, 0.714, 0.6295999999999999, 0.38249999999999995, 0.19789999999999996, 0.02100000000000002], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.746, 0.7455, 0.7451, 0.7442, 0.7437, 0.7421, 0.7397, 0.7333000000000001, 0.7206, 0.7069, 0.604, 0.3147, 0.12439999999999996, 0.005199999999999982], "L2AdditiveUniformNoiseAttack()": [0.746, 0.746, 0.746, 0.7459, 0.746, 0.7459, 0.746, 0.746, 0.7463, 0.7458, 0.7451, 0.7466999999999999, 0.7442, 0.7412000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.746, 0.7455, 0.745, 0.7442, 0.7437, 0.7419, 0.7393000000000001, 0.7331, 0.72, 0.7059, 0.6045, 0.344, 0.16500000000000004, 0.015199999999999991], "robust_accuracy": [0.746, 0.7455, 0.745, 0.7442, 0.7437, 0.7419, 0.7393000000000001, 0.7331, 0.7199, 0.7059, 0.6011, 0.3123, 0.12209999999999999, 0.0044999999999999485]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7606999999999999, 0.7604, 0.7599, 0.7594, 0.7585999999999999, 0.7571, 0.7541, 0.7461, 0.7327, 0.7178, 0.6181, 0.38170000000000004, 0.23809999999999998, 0.0947], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7606999999999999, 0.7605, 0.7601, 0.7597, 0.7589, 0.7579, 0.7552, 0.7485999999999999, 0.736, 0.7244999999999999, 0.6332, 0.3691, 0.18489999999999995, 0.017800000000000038], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7606999999999999, 0.7604, 0.7599, 0.7594, 0.7585, 0.7571, 0.7541, 0.7461, 0.7323999999999999, 0.7171000000000001, 0.6072, 0.2993, 0.11319999999999997, 0.006199999999999983], "L2AdditiveUniformNoiseAttack()": [0.7606999999999999, 0.7606999999999999, 0.7606999999999999, 0.7606999999999999, 0.7606999999999999, 0.7606999999999999, 0.7606999999999999, 0.7606999999999999, 0.7608, 0.7608, 0.7606999999999999, 0.7597, 0.7593, 0.7568], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7606999999999999, 0.7604, 0.7599, 0.7592, 0.7585, 0.7569, 0.7537, 0.7457, 0.7301, 0.7150000000000001, 0.6052, 0.3218, 0.15059999999999996, 0.011499999999999955], "robust_accuracy": [0.7606999999999999, 0.7604, 0.7599, 0.7592, 0.7585, 0.7569, 0.7537, 0.7457, 0.7301, 0.7148, 0.6023000000000001, 0.2932, 0.11029999999999995, 0.005600000000000049]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7351, 0.7344999999999999, 0.7343, 0.7334, 0.7325999999999999, 0.7313000000000001, 0.7271000000000001, 0.7187, 0.7026, 0.6892, 0.5907, 0.36319999999999997, 0.22760000000000002, 0.09670000000000001], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7351, 0.7344999999999999, 0.7343, 0.7339, 0.7332000000000001, 0.7319, 0.7293000000000001, 0.7213, 0.7085, 0.6955, 0.6056, 0.3466, 0.16600000000000004, 0.019000000000000017], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7351, 0.7344999999999999, 0.7343, 0.7334, 0.7325999999999999, 0.7313000000000001, 0.7271000000000001, 0.7186, 0.7022999999999999, 0.6878, 0.5779000000000001, 0.2801, 0.10360000000000003, 0.005600000000000049], "L2AdditiveUniformNoiseAttack()": [0.7351, 0.7351, 0.7351, 0.7351, 0.7349, 0.7351, 0.7351, 0.7351, 0.735, 0.7352000000000001, 0.7356, 0.7343999999999999, 0.7332000000000001, 0.7311000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7351, 0.7344999999999999, 0.7342, 0.7331, 0.7325999999999999, 0.7311000000000001, 0.7264999999999999, 0.7173, 0.7007, 0.6855, 0.5754, 0.3022, 0.134, 0.012199999999999989], "robust_accuracy": [0.7351, 0.7344999999999999, 0.7342, 0.7331, 0.7325999999999999, 0.7311000000000001, 0.7264999999999999, 0.7173, 0.7007, 0.6854, 0.5726, 0.2761, 0.10089999999999999, 0.005299999999999971]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7297, 0.7296, 0.7287, 0.728, 0.7273000000000001, 0.7261, 0.7222999999999999, 0.7159, 0.7027, 0.6881999999999999, 0.5915, 0.361, 0.22609999999999997, 0.10399999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7297, 0.7296, 0.7288, 0.7282, 0.7277, 0.7266, 0.7239, 0.7177, 0.7070000000000001, 0.6951, 0.607, 0.348, 0.1664, 0.016900000000000026], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7297, 0.7296, 0.7287, 0.728, 0.7273000000000001, 0.7261, 0.7222999999999999, 0.7158, 0.7024, 0.6875, 0.5817, 0.2841, 0.10709999999999997, 0.0050000000000000044], "L2AdditiveUniformNoiseAttack()": [0.7297, 0.7297, 0.7297, 0.7297, 0.7297, 0.7297, 0.7299, 0.7298, 0.7297, 0.7297, 0.7299, 0.7284999999999999, 0.727, 0.7219], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7297, 0.7296, 0.7284999999999999, 0.7279, 0.7269, 0.7259, 0.7221, 0.7151000000000001, 0.7013, 0.6860999999999999, 0.5831, 0.31479999999999997, 0.14439999999999997, 0.011099999999999999], "robust_accuracy": [0.7297, 0.7296, 0.7284999999999999, 0.7279, 0.7269, 0.7259, 0.7221, 0.7151000000000001, 0.7012, 0.6859999999999999, 0.5783, 0.28269999999999995, 0.10499999999999998, 0.0042999999999999705]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7379, 0.7375, 0.7365999999999999, 0.7359, 0.7353000000000001, 0.734, 0.7309, 0.7226, 0.7063999999999999, 0.6939, 0.5982000000000001, 0.35550000000000004, 0.21140000000000003, 0.07669999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7379, 0.7375, 0.737, 0.7361, 0.7358, 0.7347, 0.7322, 0.7253000000000001, 0.7102999999999999, 0.6989000000000001, 0.615, 0.351, 0.16949999999999998, 0.02210000000000001], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7379, 0.7375, 0.7365999999999999, 0.7359, 0.7353000000000001, 0.734, 0.731, 0.7224999999999999, 0.7061, 0.6934, 0.5881000000000001, 0.28059999999999996, 0.10909999999999997, 0.006399999999999961], "L2AdditiveUniformNoiseAttack()": [0.7379, 0.7379, 0.7379, 0.7379, 0.7379, 0.7381, 0.7379, 0.738, 0.738, 0.7382, 0.7377, 0.737, 0.7357, 0.7352000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7379, 0.7373000000000001, 0.7365999999999999, 0.7358, 0.7353000000000001, 0.7338, 0.7306, 0.7217, 0.7051000000000001, 0.6912, 0.5836, 0.30100000000000005, 0.13419999999999999, 0.014000000000000012], "robust_accuracy": [0.7379, 0.7373000000000001, 0.7365999999999999, 0.7358, 0.7353000000000001, 0.7338, 0.7306, 0.7217, 0.7050000000000001, 0.6912, 0.581, 0.276, 0.10650000000000004, 0.006099999999999994]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7517, 0.7508, 0.7503, 0.7494000000000001, 0.7489, 0.7472, 0.7451, 0.738, 0.7237, 0.7081999999999999, 0.6124, 0.37929999999999997, 0.23229999999999995, 0.08240000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7517, 0.7511, 0.7505, 0.7499, 0.7493000000000001, 0.7476, 0.7456, 0.7402, 0.7283999999999999, 0.7156, 0.6273, 0.36839999999999995, 0.18089999999999995, 0.01849999999999996], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7517, 0.7508, 0.7503, 0.7494000000000001, 0.7489, 0.7472, 0.7449, 0.738, 0.7235, 0.7075, 0.6018, 0.29700000000000004, 0.11229999999999996, 0.005700000000000038], "L2AdditiveUniformNoiseAttack()": [0.7517, 0.7517, 0.7516, 0.7516, 0.7517, 0.7518, 0.752, 0.7517, 0.7519, 0.7518, 0.7523, 0.7529, 0.7518, 0.7517], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7517, 0.7508, 0.7502, 0.7493000000000001, 0.7485999999999999, 0.747, 0.7445999999999999, 0.7376, 0.7214, 0.706, 0.5994999999999999, 0.3226, 0.1481, 0.012499999999999956], "robust_accuracy": [0.7517, 0.7508, 0.7502, 0.7493000000000001, 0.7485999999999999, 0.747, 0.7445999999999999, 0.7376, 0.7214, 0.706, 0.597, 0.29259999999999997, 0.10960000000000003, 0.005299999999999971]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7207, 0.7202, 0.7193, 0.7183999999999999, 0.718, 0.7165, 0.7135, 0.7059, 0.6909000000000001, 0.6800999999999999, 0.5857, 0.37039999999999995, 0.23560000000000003, 0.09509999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7207, 0.7202, 0.7197, 0.7188, 0.7182999999999999, 0.7168, 0.7151000000000001, 0.7081999999999999, 0.6952, 0.6843, 0.5997, 0.35319999999999996, 0.17469999999999997, 0.01739999999999997], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7207, 0.7202, 0.7193, 0.7183999999999999, 0.718, 0.7165, 0.7135, 0.7059, 0.6907, 0.679, 0.5743, 0.28400000000000003, 0.1069, 0.0048000000000000265], "L2AdditiveUniformNoiseAttack()": [0.7207, 0.7206, 0.7207, 0.7207, 0.7207, 0.7207, 0.7206, 0.7206, 0.7207, 0.7208, 0.7208, 0.7204999999999999, 0.7181, 0.7157], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7207, 0.7202, 0.7191000000000001, 0.7182999999999999, 0.7177, 0.7162999999999999, 0.7129, 0.7050000000000001, 0.6888000000000001, 0.6759, 0.569, 0.29979999999999996, 0.1331, 0.00880000000000003], "robust_accuracy": [0.7207, 0.7202, 0.7191000000000001, 0.7182999999999999, 0.7177, 0.7162999999999999, 0.7129, 0.7050000000000001, 0.6888000000000001, 0.6759, 0.5666, 0.277, 0.10150000000000003, 0.0041999999999999815]}}, "32": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7545, 0.7539, 0.7532, 0.7525999999999999, 0.7519, 0.7508, 0.7479, 0.741, 0.7273000000000001, 0.7147, 0.6183000000000001, 0.38980000000000004, 0.24419999999999997, 0.0937], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7545, 0.754, 0.7532, 0.7529, 0.7524, 0.7513, 0.7492, 0.743, 0.7307, 0.7194, 0.6322, 0.37949999999999995, 0.1915, 0.02070000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7545, 0.7539, 0.7532, 0.7525999999999999, 0.7518, 0.7507, 0.7479, 0.741, 0.727, 0.714, 0.6082000000000001, 0.30500000000000005, 0.12009999999999998, 0.006000000000000005], "L2AdditiveUniformNoiseAttack()": [0.7545, 0.7544, 0.7544, 0.7545, 0.7545, 0.7545, 0.7543, 0.7545, 0.7545, 0.7544, 0.7542, 0.7541, 0.7547, 0.7522], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7545, 0.7539, 0.7531, 0.7523, 0.7518, 0.7505, 0.7475, 0.7402, 0.7256, 0.712, 0.6033, 0.32699999999999996, 0.15139999999999998, 0.012299999999999978], "robust_accuracy": [0.7545, 0.7539, 0.7531, 0.7523, 0.7518, 0.7505, 0.7475, 0.7402, 0.7255, 0.712, 0.6009, 0.2995, 0.1159, 0.005600000000000049]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7591, 0.7584, 0.7575000000000001, 0.7568, 0.7559, 0.7551, 0.7512, 0.7445999999999999, 0.7316, 0.718, 0.6234999999999999, 0.3984, 0.26180000000000003, 0.11919999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7591, 0.7585999999999999, 0.7578, 0.7574, 0.7563, 0.7555000000000001, 0.7533, 0.7464999999999999, 0.7352000000000001, 0.7235, 0.6383, 0.38170000000000004, 0.19879999999999998, 0.0252], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7591, 0.7584, 0.7575000000000001, 0.7567, 0.7559, 0.7551, 0.7512, 0.7446999999999999, 0.7315, 0.7173, 0.6123000000000001, 0.31200000000000006, 0.13, 0.007399999999999962], "L2AdditiveUniformNoiseAttack()": [0.7591, 0.7591, 0.7591, 0.7591, 0.7591, 0.7591, 0.7592, 0.7591, 0.7591, 0.7592, 0.7582, 0.7589, 0.7584, 0.7579], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7591, 0.7584, 0.7574, 0.7565, 0.7559, 0.7548, 0.7509, 0.7437, 0.7302, 0.7157, 0.6111, 0.33699999999999997, 0.1674, 0.01770000000000005], "robust_accuracy": [0.7591, 0.7584, 0.7574, 0.7565, 0.7559, 0.7548, 0.7509, 0.7437, 0.7302, 0.7155, 0.6083000000000001, 0.30789999999999995, 0.12739999999999996, 0.00660000000000005]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7481, 0.7475, 0.7468, 0.746, 0.7453000000000001, 0.7437, 0.7418, 0.7348, 0.7203999999999999, 0.7047, 0.6014999999999999, 0.36970000000000003, 0.24380000000000002, 0.11519999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7481, 0.7477, 0.7469, 0.7463, 0.7456, 0.7442, 0.7422, 0.7374, 0.7253000000000001, 0.7112, 0.6185, 0.3509, 0.1663, 0.018299999999999983], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7481, 0.7475, 0.7468, 0.746, 0.7453000000000001, 0.7437, 0.7417, 0.7348, 0.7202999999999999, 0.7038, 0.5885, 0.27649999999999997, 0.10509999999999997, 0.006199999999999983], "L2AdditiveUniformNoiseAttack()": [0.7481, 0.7481, 0.7481, 0.7482, 0.7481, 0.7482, 0.7483, 0.7483, 0.7479, 0.7481, 0.7484, 0.7475, 0.7481, 0.7469], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7481, 0.7475, 0.7466999999999999, 0.7458, 0.745, 0.7434000000000001, 0.7412000000000001, 0.7343, 0.7188, 0.7022999999999999, 0.5895, 0.31220000000000003, 0.14270000000000005, 0.01100000000000001], "robust_accuracy": [0.7481, 0.7475, 0.7466999999999999, 0.7458, 0.745, 0.7434000000000001, 0.7412000000000001, 0.7343, 0.7188, 0.7019, 0.5847, 0.2732, 0.1038, 0.0043999999999999595]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7473000000000001, 0.7464, 0.7454000000000001, 0.7444999999999999, 0.7438, 0.7427, 0.7395, 0.7319, 0.7159, 0.7019, 0.5912999999999999, 0.364, 0.23440000000000005, 0.11119999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7473000000000001, 0.7464, 0.7456, 0.7448, 0.7442, 0.7435, 0.7409, 0.735, 0.7215, 0.7082999999999999, 0.6073999999999999, 0.3487, 0.17100000000000004, 0.024499999999999966], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7473000000000001, 0.7464, 0.7454000000000001, 0.7444999999999999, 0.7437, 0.7427, 0.7395, 0.7318, 0.716, 0.7012, 0.5778, 0.2782, 0.10899999999999999, 0.010099999999999998], "L2AdditiveUniformNoiseAttack()": [0.7473000000000001, 0.7473000000000001, 0.7473000000000001, 0.7472, 0.7473000000000001, 0.7472, 0.7471, 0.7473000000000001, 0.7472, 0.7465999999999999, 0.7463, 0.7465999999999999, 0.7459, 0.743], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7473000000000001, 0.7464, 0.7453000000000001, 0.7444999999999999, 0.7436, 0.7425999999999999, 0.7394000000000001, 0.7312000000000001, 0.7153, 0.6993, 0.5794, 0.31010000000000004, 0.14329999999999998, 0.014599999999999946], "robust_accuracy": [0.7473000000000001, 0.7464, 0.7453000000000001, 0.7444999999999999, 0.7436, 0.7425999999999999, 0.7394000000000001, 0.7312000000000001, 0.7153, 0.6992, 0.5748, 0.27580000000000005, 0.1059, 0.007399999999999962]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7512, 0.7508, 0.7503, 0.7497, 0.7489, 0.7474000000000001, 0.7443, 0.7367, 0.721, 0.7056, 0.5928, 0.36329999999999996, 0.23150000000000004, 0.11180000000000001], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7512, 0.7508, 0.7503, 0.7499, 0.7494000000000001, 0.748, 0.745, 0.7392000000000001, 0.7263, 0.7123999999999999, 0.6084, 0.34130000000000005, 0.1673, 0.02210000000000001], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7512, 0.7508, 0.7503, 0.7497, 0.7489, 0.7474000000000001, 0.7442, 0.7367, 0.7206, 0.7045, 0.5776, 0.27490000000000003, 0.10709999999999997, 0.00649999999999995], "L2AdditiveUniformNoiseAttack()": [0.7512, 0.7512, 0.7513, 0.7513, 0.7512, 0.7512, 0.7513, 0.7512, 0.7512, 0.7517, 0.751, 0.7515000000000001, 0.7518, 0.7519], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7512, 0.7507, 0.7503, 0.7496, 0.7485999999999999, 0.7471, 0.7433000000000001, 0.7361, 0.7182999999999999, 0.7021, 0.5803, 0.3036, 0.14559999999999995, 0.012599999999999945], "robust_accuracy": [0.7512, 0.7507, 0.7503, 0.7496, 0.7485999999999999, 0.7471, 0.7433000000000001, 0.736, 0.7182999999999999, 0.7017, 0.5746, 0.27149999999999996, 0.10460000000000003, 0.005499999999999949]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.734, 0.7331, 0.7324999999999999, 0.7314, 0.731, 0.7296, 0.728, 0.7212000000000001, 0.7092, 0.6966, 0.6033, 0.37739999999999996, 0.24209999999999998, 0.10729999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.734, 0.7331, 0.7328, 0.7321, 0.7313000000000001, 0.7303999999999999, 0.7286, 0.7229, 0.7121999999999999, 0.7014, 0.6178, 0.36629999999999996, 0.1844, 0.023499999999999965], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.734, 0.7331, 0.7324999999999999, 0.7314, 0.731, 0.7296, 0.728, 0.7212000000000001, 0.7088, 0.696, 0.5936, 0.30100000000000005, 0.12360000000000004, 0.006399999999999961], "L2AdditiveUniformNoiseAttack()": [0.734, 0.734, 0.734, 0.734, 0.734, 0.734, 0.7342, 0.7341, 0.734, 0.734, 0.7343, 0.7338, 0.7329, 0.7307], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.734, 0.733, 0.7323999999999999, 0.7313000000000001, 0.7308, 0.7295, 0.7277, 0.7207, 0.7074, 0.6939, 0.5898, 0.31789999999999996, 0.15039999999999998, 0.01429999999999998], "robust_accuracy": [0.734, 0.733, 0.7323999999999999, 0.7313000000000001, 0.7308, 0.7295, 0.7277, 0.7207, 0.7074, 0.6938, 0.5873999999999999, 0.29610000000000003, 0.12029999999999996, 0.005700000000000038]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7182, 0.7174, 0.7163999999999999, 0.7153, 0.7147, 0.7127, 0.7092, 0.702, 0.6887, 0.6747000000000001, 0.5681, 0.34630000000000005, 0.21909999999999996, 0.10540000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7182, 0.7177, 0.7166, 0.7158, 0.7149, 0.7138, 0.7101999999999999, 0.7041, 0.6921999999999999, 0.6813, 0.5811, 0.3256, 0.15669999999999995, 0.019100000000000006], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7182, 0.7174, 0.7163999999999999, 0.7153, 0.7147, 0.7127, 0.7092, 0.702, 0.6883, 0.6732, 0.5565, 0.26, 0.09899999999999998, 0.006199999999999983], "L2AdditiveUniformNoiseAttack()": [0.7182, 0.7182, 0.7182, 0.7182, 0.7182, 0.7181, 0.718, 0.7182999999999999, 0.7181, 0.7179, 0.7174, 0.7177, 0.7174, 0.7207], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7182, 0.7173, 0.7162999999999999, 0.7151000000000001, 0.7147, 0.7121999999999999, 0.7088, 0.7011000000000001, 0.6872, 0.6722, 0.5564, 0.2891, 0.13029999999999997, 0.01090000000000002], "robust_accuracy": [0.7182, 0.7173, 0.7162999999999999, 0.7151000000000001, 0.7147, 0.7121999999999999, 0.7088, 0.7011000000000001, 0.6872, 0.6718, 0.5529999999999999, 0.2571, 0.09560000000000002, 0.0047000000000000375]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7508, 0.7501, 0.7495, 0.7491, 0.7484, 0.7473000000000001, 0.7448, 0.7392000000000001, 0.724, 0.708, 0.6051, 0.37460000000000004, 0.23939999999999995, 0.1049], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7508, 0.7504, 0.7495, 0.7492, 0.7488, 0.7477, 0.7455, 0.7413000000000001, 0.7283, 0.7142999999999999, 0.622, 0.35860000000000003, 0.1835, 0.02510000000000001], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7508, 0.7501, 0.7495, 0.7491, 0.7484, 0.7473000000000001, 0.7448, 0.7391, 0.7237, 0.7072, 0.5943, 0.2933, 0.12290000000000001, 0.00770000000000004], "L2AdditiveUniformNoiseAttack()": [0.7508, 0.7508, 0.7508, 0.7508, 0.7508, 0.7508, 0.7509, 0.7509, 0.7508, 0.7507, 0.7508, 0.7516, 0.7509, 0.7536], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7508, 0.7501, 0.7495, 0.749, 0.7481, 0.7469, 0.7444999999999999, 0.7377, 0.7218, 0.7047, 0.5921000000000001, 0.3147, 0.15049999999999997, 0.016700000000000048], "robust_accuracy": [0.7508, 0.7501, 0.7495, 0.749, 0.7481, 0.7469, 0.7444999999999999, 0.7377, 0.7218, 0.7046, 0.5889, 0.2891, 0.12070000000000003, 0.006900000000000017]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.771, 0.7706, 0.77, 0.7695, 0.769, 0.7676000000000001, 0.7655000000000001, 0.758, 0.7448, 0.7283999999999999, 0.6268, 0.38439999999999996, 0.2388, 0.09860000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.771, 0.7708, 0.7701, 0.7696000000000001, 0.7693, 0.768, 0.7661, 0.7605, 0.7479, 0.7354, 0.6412, 0.371, 0.1814, 0.020299999999999985], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.771, 0.7706, 0.77, 0.7695, 0.769, 0.7676000000000001, 0.7654, 0.7579, 0.7442, 0.7275, 0.6152, 0.2996, 0.11329999999999996, 0.005900000000000016], "L2AdditiveUniformNoiseAttack()": [0.771, 0.771, 0.7709, 0.771, 0.771, 0.771, 0.7709, 0.7715, 0.7714, 0.7714, 0.7714, 0.7709, 0.7706999999999999, 0.7683], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.771, 0.7706, 0.77, 0.7694, 0.7688, 0.7673, 0.7651, 0.7572, 0.743, 0.7261, 0.6146, 0.32799999999999996, 0.1511, 0.011900000000000022], "robust_accuracy": [0.771, 0.7706, 0.77, 0.7694, 0.7688, 0.7673, 0.7651, 0.7572, 0.7429, 0.726, 0.6105, 0.29569999999999996, 0.11150000000000004, 0.0047000000000000375]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7658, 0.7657, 0.7646, 0.7637, 0.7633, 0.7615000000000001, 0.7594, 0.7507, 0.7376, 0.7236, 0.6243000000000001, 0.3883, 0.24150000000000005, 0.10289999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7658, 0.7657, 0.7649, 0.7641, 0.7635000000000001, 0.7626, 0.7605999999999999, 0.7535000000000001, 0.7416, 0.7298, 0.639, 0.37039999999999995, 0.17759999999999998, 0.015900000000000025], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7658, 0.7657, 0.7645, 0.7637, 0.7633, 0.7615000000000001, 0.7594, 0.7507, 0.737, 0.723, 0.6128, 0.2952, 0.10950000000000004, 0.0044999999999999485], "L2AdditiveUniformNoiseAttack()": [0.7658, 0.7658, 0.7658, 0.7658, 0.7658, 0.7659, 0.7658, 0.7659, 0.7661, 0.7662, 0.7661, 0.7646, 0.7641, 0.7632], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7658, 0.7657, 0.7644, 0.7636000000000001, 0.7631, 0.7615000000000001, 0.7592, 0.7502, 0.7359, 0.7211000000000001, 0.6128, 0.32789999999999997, 0.14790000000000003, 0.010299999999999976], "robust_accuracy": [0.7658, 0.7657, 0.7644, 0.7636000000000001, 0.7631, 0.7615000000000001, 0.7592, 0.7502, 0.7358, 0.7211000000000001, 0.6088, 0.29200000000000004, 0.10699999999999998, 0.0036000000000000476]}}}, "4": {"1": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7302, 0.7296, 0.729, 0.7284999999999999, 0.7279, 0.7264999999999999, 0.7234, 0.7163999999999999, 0.7002999999999999, 0.6841999999999999, 0.5724, 0.33530000000000004, 0.2046, 0.09030000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7302, 0.7298, 0.7293000000000001, 0.7284999999999999, 0.7283, 0.7272000000000001, 0.7247, 0.7179, 0.704, 0.6915, 0.5898, 0.3224, 0.15349999999999997, 0.011299999999999977], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7302, 0.7296, 0.729, 0.7284999999999999, 0.7279, 0.7264999999999999, 0.7233, 0.7162999999999999, 0.7001999999999999, 0.6833, 0.5599000000000001, 0.2573, 0.09330000000000005, 0.0029000000000000137], "L2AdditiveUniformNoiseAttack()": [0.7302, 0.7303, 0.7303, 0.7302, 0.7302, 0.7303, 0.7303, 0.7303, 0.7306, 0.7303, 0.7301, 0.7304999999999999, 0.7279, 0.7277], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7302, 0.7296, 0.7289, 0.7282, 0.7277, 0.7263999999999999, 0.7232000000000001, 0.7152000000000001, 0.6996, 0.6819999999999999, 0.5621, 0.28890000000000005, 0.13129999999999997, 0.008600000000000052], "robust_accuracy": [0.7302, 0.7296, 0.7289, 0.7282, 0.7277, 0.7263999999999999, 0.7232000000000001, 0.7152000000000001, 0.6995, 0.6818, 0.5573, 0.2559, 0.09189999999999998, 0.0024999999999999467]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7394000000000001, 0.7388, 0.7376, 0.7369, 0.7356, 0.7337, 0.7302, 0.7212000000000001, 0.7062999999999999, 0.6936, 0.5851, 0.32189999999999996, 0.17500000000000004, 0.0665], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7394000000000001, 0.7389, 0.7381, 0.7374, 0.7364999999999999, 0.735, 0.7315, 0.724, 0.7106, 0.6990000000000001, 0.605, 0.29979999999999996, 0.10980000000000001, 0.0024999999999999467], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7394000000000001, 0.7388, 0.7376, 0.7369, 0.7356, 0.7337, 0.7302, 0.7211000000000001, 0.7061999999999999, 0.6929000000000001, 0.5705, 0.2178, 0.05249999999999999, 9.999999999998899e-05], "L2AdditiveUniformNoiseAttack()": [0.7394000000000001, 0.7394000000000001, 0.7394000000000001, 0.7394000000000001, 0.7394000000000001, 0.7394000000000001, 0.7393000000000001, 0.7394000000000001, 0.7392000000000001, 0.7395, 0.7388, 0.737, 0.7367, 0.737], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7394000000000001, 0.7387, 0.7376, 0.7368, 0.7353000000000001, 0.7334, 0.7299, 0.7201, 0.7052, 0.6909000000000001, 0.5717, 0.25849999999999995, 0.08799999999999997, 0.0018000000000000238], "robust_accuracy": [0.7394000000000001, 0.7387, 0.7376, 0.7368, 0.7353000000000001, 0.7334, 0.7299, 0.7201, 0.7052, 0.6908000000000001, 0.567, 0.21489999999999998, 0.051100000000000034, 9.999999999998899e-05]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7368, 0.736, 0.7351, 0.7342, 0.7338, 0.7322, 0.7297, 0.7215, 0.7062999999999999, 0.6930000000000001, 0.5898, 0.35240000000000005, 0.20540000000000003, 0.07589999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7368, 0.7361, 0.7353000000000001, 0.7345999999999999, 0.7341, 0.7329, 0.7308, 0.7241, 0.7098, 0.6990000000000001, 0.6077, 0.3399, 0.14849999999999997, 0.008399999999999963], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7368, 0.736, 0.7351, 0.7342, 0.7338, 0.7322, 0.7296, 0.7212000000000001, 0.7061, 0.6924, 0.5802, 0.2683, 0.08520000000000005, 0.0017000000000000348], "L2AdditiveUniformNoiseAttack()": [0.7368, 0.7368, 0.7369, 0.7367, 0.7368, 0.7369, 0.7368, 0.7367, 0.7363999999999999, 0.7365999999999999, 0.7364999999999999, 0.736, 0.7355, 0.7371], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7368, 0.7359, 0.7348, 0.7342, 0.7335, 0.7319, 0.729, 0.7194, 0.7050000000000001, 0.6900999999999999, 0.5771, 0.2966, 0.121, 0.005600000000000049], "robust_accuracy": [0.7368, 0.7359, 0.7348, 0.7342, 0.7335, 0.7319, 0.729, 0.7194, 0.7049000000000001, 0.6900999999999999, 0.5744, 0.26449999999999996, 0.0837, 0.0014999999999999458]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7361, 0.7357, 0.7351, 0.7339, 0.7329, 0.7307, 0.7278, 0.7209, 0.7073, 0.6918, 0.5853999999999999, 0.3469, 0.2037, 0.08189999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7361, 0.7357, 0.7355, 0.7347, 0.7336, 0.7319, 0.7287, 0.7231000000000001, 0.7114, 0.6991, 0.6021000000000001, 0.3356, 0.15349999999999997, 0.012700000000000045], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7361, 0.7357, 0.7351, 0.7339, 0.7329, 0.7307, 0.7278, 0.7208, 0.7068, 0.6913, 0.5730999999999999, 0.26160000000000005, 0.0947, 0.0020000000000000018], "L2AdditiveUniformNoiseAttack()": [0.7361, 0.7361, 0.7361, 0.7362, 0.7361, 0.7361, 0.7362, 0.7362, 0.7364999999999999, 0.736, 0.7353000000000001, 0.7352000000000001, 0.7355, 0.7345999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7361, 0.7357, 0.7351, 0.7337, 0.7329, 0.7302, 0.7275, 0.7202, 0.7056, 0.6899, 0.5734, 0.29490000000000005, 0.12839999999999996, 0.008000000000000007], "robust_accuracy": [0.7361, 0.7357, 0.7351, 0.7337, 0.7329, 0.7302, 0.7275, 0.7202, 0.7055, 0.6898, 0.5700000000000001, 0.25880000000000003, 0.09230000000000005, 0.0018000000000000238]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.766, 0.7649, 0.7636000000000001, 0.7629, 0.7619, 0.7604, 0.7575000000000001, 0.7479, 0.7298, 0.7121999999999999, 0.5901000000000001, 0.3205, 0.18489999999999995, 0.07589999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.766, 0.7651, 0.764, 0.7631, 0.7626999999999999, 0.761, 0.7582, 0.7514000000000001, 0.7359, 0.7197, 0.6085, 0.2943, 0.11309999999999998, 0.0040000000000000036], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.766, 0.7649, 0.7636000000000001, 0.7629, 0.7619, 0.7604, 0.7575000000000001, 0.7476, 0.7295, 0.7111000000000001, 0.5729, 0.2188, 0.05489999999999995, 0.0008000000000000229], "L2AdditiveUniformNoiseAttack()": [0.766, 0.766, 0.766, 0.766, 0.7659, 0.766, 0.766, 0.766, 0.7661, 0.7655000000000001, 0.7652, 0.7656000000000001, 0.7639, 0.7619], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.766, 0.7649, 0.7634, 0.7629, 0.7618, 0.7602, 0.7569, 0.7468, 0.7281, 0.7071000000000001, 0.5749, 0.25749999999999995, 0.09060000000000001, 0.0026000000000000467], "robust_accuracy": [0.766, 0.7649, 0.7634, 0.7629, 0.7618, 0.7602, 0.7569, 0.7468, 0.728, 0.7071000000000001, 0.5687, 0.21660000000000001, 0.05269999999999997, 0.0008000000000000229]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7251000000000001, 0.7247, 0.7236, 0.723, 0.7222, 0.7209, 0.7163999999999999, 0.7048, 0.6858, 0.6683, 0.5455, 0.2932, 0.1694, 0.07369999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7251000000000001, 0.7248, 0.7242, 0.7234, 0.723, 0.7215, 0.7176, 0.7093, 0.6910000000000001, 0.6753, 0.5624, 0.2683, 0.10529999999999995, 0.0042999999999999705], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7251000000000001, 0.7247, 0.7236, 0.723, 0.7222, 0.7209, 0.7163999999999999, 0.7048, 0.6853, 0.6675, 0.5317000000000001, 0.2036, 0.056599999999999984, 0.0007000000000000339], "L2AdditiveUniformNoiseAttack()": [0.7251000000000001, 0.7252000000000001, 0.7251000000000001, 0.7251000000000001, 0.7251000000000001, 0.7252000000000001, 0.7254, 0.7255, 0.7253000000000001, 0.7254, 0.7258, 0.7257, 0.7222999999999999, 0.7216], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7251000000000001, 0.7246, 0.7236, 0.7229, 0.7221, 0.7207, 0.716, 0.7034, 0.6835, 0.6658, 0.5321, 0.23409999999999997, 0.08560000000000001, 0.0021999999999999797], "robust_accuracy": [0.7251000000000001, 0.7246, 0.7236, 0.7229, 0.7221, 0.7207, 0.716, 0.7034, 0.6834, 0.6657, 0.5275000000000001, 0.20120000000000005, 0.05469999999999997, 0.0007000000000000339]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7543, 0.7535000000000001, 0.752, 0.7516, 0.7507, 0.7485999999999999, 0.7463, 0.7369, 0.7203999999999999, 0.7022999999999999, 0.5781000000000001, 0.30700000000000005, 0.1734, 0.07069999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7543, 0.7537, 0.7524, 0.7518, 0.7511, 0.7493000000000001, 0.7468, 0.74, 0.7257, 0.7105, 0.5956, 0.2895, 0.1129, 0.006299999999999972], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7543, 0.7535000000000001, 0.752, 0.7516, 0.7507, 0.7485999999999999, 0.7462, 0.7367, 0.7203999999999999, 0.7012, 0.5609999999999999, 0.2157, 0.06140000000000001, 0.0012999999999999678], "L2AdditiveUniformNoiseAttack()": [0.7543, 0.7543, 0.7543, 0.7544, 0.7543, 0.7545999999999999, 0.7544, 0.7544, 0.7542, 0.7543, 0.7545999999999999, 0.7535000000000001, 0.7525, 0.7512], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7543, 0.7534, 0.7519, 0.7515000000000001, 0.7501, 0.7483, 0.7456, 0.7359, 0.7188, 0.6990000000000001, 0.5617, 0.25329999999999997, 0.09350000000000003, 0.0048000000000000265], "robust_accuracy": [0.7543, 0.7534, 0.7519, 0.7515000000000001, 0.7501, 0.7483, 0.7456, 0.7359, 0.7188, 0.6989000000000001, 0.5556, 0.2137, 0.06010000000000004, 0.0012999999999999678]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7605999999999999, 0.7599, 0.7595000000000001, 0.7585, 0.7576, 0.7564, 0.7537, 0.7476, 0.7324999999999999, 0.7162, 0.6031, 0.3369, 0.18720000000000003, 0.06520000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7605999999999999, 0.7599, 0.7596, 0.7587, 0.7583, 0.7568, 0.7548, 0.7494000000000001, 0.7358, 0.7229, 0.6213, 0.32430000000000003, 0.13419999999999999, 0.006099999999999994], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7605999999999999, 0.7599, 0.7595000000000001, 0.7585, 0.7576, 0.7564, 0.7537, 0.7476, 0.732, 0.7147, 0.5904, 0.24719999999999998, 0.07650000000000001, 0.0010999999999999899], "L2AdditiveUniformNoiseAttack()": [0.7605999999999999, 0.7606999999999999, 0.7605, 0.7605999999999999, 0.7605, 0.7605999999999999, 0.7604, 0.7606999999999999, 0.7602, 0.7605999999999999, 0.7603, 0.7597, 0.7602, 0.7606999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7605999999999999, 0.7598, 0.7593, 0.7585, 0.7576, 0.7563, 0.7534, 0.7463, 0.7312000000000001, 0.7129, 0.5903, 0.2832, 0.1159, 0.0049000000000000155], "robust_accuracy": [0.7605999999999999, 0.7598, 0.7593, 0.7585, 0.7576, 0.7563, 0.7534, 0.7463, 0.7312000000000001, 0.7126, 0.5865, 0.24529999999999996, 0.07530000000000003, 0.0008000000000000229]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7162, 0.7156, 0.7151000000000001, 0.7141, 0.7132000000000001, 0.7109, 0.7078, 0.6985, 0.6815, 0.6641, 0.5456, 0.3103, 0.18700000000000006, 0.0817], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7162, 0.7157, 0.7153, 0.7142999999999999, 0.7136, 0.7117, 0.7090000000000001, 0.7017, 0.6867, 0.6705, 0.5614, 0.2861, 0.11280000000000001, 0.005800000000000027], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7162, 0.7156, 0.7151000000000001, 0.7141, 0.7132000000000001, 0.7108, 0.7077, 0.6982999999999999, 0.6815, 0.6623, 0.5294, 0.2146, 0.060899999999999954, 0.0017000000000000348], "L2AdditiveUniformNoiseAttack()": [0.7162, 0.7162, 0.7162, 0.7162999999999999, 0.7162999999999999, 0.7162, 0.7162999999999999, 0.7162, 0.7168, 0.7166, 0.7167, 0.7170000000000001, 0.7162, 0.7194], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7162, 0.7156, 0.7150000000000001, 0.714, 0.7132000000000001, 0.7105, 0.7076, 0.6974, 0.6799999999999999, 0.6596, 0.5314, 0.2491, 0.09109999999999996, 0.0037000000000000366], "robust_accuracy": [0.7162, 0.7156, 0.7150000000000001, 0.714, 0.7132000000000001, 0.7105, 0.7076, 0.6974, 0.6799999999999999, 0.6594, 0.5255000000000001, 0.2126, 0.05930000000000002, 0.0016000000000000458]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7183999999999999, 0.7177, 0.7162999999999999, 0.7155, 0.7149, 0.7122999999999999, 0.7099, 0.7013, 0.6839999999999999, 0.6698999999999999, 0.5435, 0.29100000000000004, 0.16869999999999996, 0.06830000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7183999999999999, 0.7177, 0.7168, 0.7156, 0.7154, 0.7137, 0.7110000000000001, 0.7046, 0.6878, 0.6756, 0.5594, 0.26959999999999995, 0.10729999999999995, 0.0050000000000000044], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7183999999999999, 0.7177, 0.7162999999999999, 0.7155, 0.7149, 0.7122999999999999, 0.7099, 0.7012, 0.6834, 0.669, 0.5287, 0.20440000000000003, 0.06379999999999997, 0.0013999999999999568], "L2AdditiveUniformNoiseAttack()": [0.7183999999999999, 0.7182999999999999, 0.7183999999999999, 0.7183999999999999, 0.7183999999999999, 0.7185, 0.7182999999999999, 0.7182999999999999, 0.7182999999999999, 0.7179, 0.7187, 0.7178, 0.7199, 0.7183999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7183999999999999, 0.7176, 0.7162, 0.7154, 0.7143999999999999, 0.7121, 0.7091000000000001, 0.6999, 0.6823, 0.6662, 0.5283, 0.23550000000000004, 0.08709999999999996, 0.0031999999999999806], "robust_accuracy": [0.7183999999999999, 0.7176, 0.7162, 0.7154, 0.7143999999999999, 0.7121, 0.7091000000000001, 0.6999, 0.6823, 0.6661, 0.5242, 0.2026, 0.06220000000000003, 0.0010999999999999899]}}, "2": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7666999999999999, 0.7658, 0.7651, 0.7646999999999999, 0.7638, 0.7625, 0.7591, 0.7505999999999999, 0.732, 0.7153, 0.6044, 0.34099999999999997, 0.19830000000000003, 0.07940000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7666999999999999, 0.766, 0.7653, 0.7649, 0.7642, 0.7631, 0.7604, 0.7528, 0.7363999999999999, 0.7226, 0.6195999999999999, 0.32599999999999996, 0.13870000000000005, 0.010199999999999987], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7666999999999999, 0.7658, 0.7651, 0.7646999999999999, 0.7638, 0.7625, 0.759, 0.7503, 0.7314, 0.7148, 0.5893999999999999, 0.2542, 0.07999999999999996, 0.0023999999999999577], "L2AdditiveUniformNoiseAttack()": [0.7666999999999999, 0.7666999999999999, 0.7666999999999999, 0.7666999999999999, 0.7666999999999999, 0.7666999999999999, 0.7665, 0.7668, 0.7668, 0.7671, 0.7665, 0.7675, 0.7666999999999999, 0.7648], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7666999999999999, 0.7658, 0.7651, 0.7645, 0.7635000000000001, 0.7621, 0.7588, 0.7496, 0.7299, 0.7131000000000001, 0.5913999999999999, 0.28490000000000004, 0.11250000000000004, 0.00660000000000005], "robust_accuracy": [0.7666999999999999, 0.7658, 0.7651, 0.7645, 0.7635000000000001, 0.7621, 0.7588, 0.7496, 0.7299, 0.7129, 0.5860000000000001, 0.25049999999999994, 0.0786, 0.0020999999999999908]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7438, 0.7432000000000001, 0.7424999999999999, 0.7419, 0.7411, 0.7397, 0.7375, 0.7302, 0.7151000000000001, 0.7014, 0.6009, 0.3611, 0.21230000000000004, 0.07640000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7438, 0.7434000000000001, 0.7425999999999999, 0.7424, 0.7417, 0.7401, 0.7379, 0.7318, 0.721, 0.7072, 0.6151, 0.352, 0.16149999999999998, 0.015900000000000025], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7438, 0.7432000000000001, 0.7424999999999999, 0.7419, 0.741, 0.7397, 0.7375, 0.7301, 0.7147, 0.7009000000000001, 0.5902000000000001, 0.28049999999999997, 0.09909999999999997, 0.0044999999999999485], "L2AdditiveUniformNoiseAttack()": [0.7438, 0.7437, 0.7437, 0.7437, 0.7437, 0.7437, 0.7437, 0.7438, 0.7436, 0.7434000000000001, 0.7442, 0.7424999999999999, 0.7439, 0.7448], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7438, 0.7432000000000001, 0.7424999999999999, 0.7417, 0.7408, 0.7394000000000001, 0.7367, 0.7284999999999999, 0.7122999999999999, 0.6972, 0.5831999999999999, 0.2922, 0.12450000000000006, 0.009399999999999964], "robust_accuracy": [0.7438, 0.7432000000000001, 0.7424999999999999, 0.7417, 0.7408, 0.7394000000000001, 0.7367, 0.7284999999999999, 0.7121999999999999, 0.6971, 0.581, 0.27149999999999996, 0.0948, 0.0034999999999999476]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7609, 0.7602, 0.7597, 0.7583, 0.7574, 0.7556, 0.7517, 0.7457, 0.7299, 0.7155, 0.6112, 0.36519999999999997, 0.22130000000000005, 0.08220000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7609, 0.7603, 0.7598, 0.7591, 0.758, 0.7563, 0.7537, 0.7477, 0.7345999999999999, 0.7224999999999999, 0.6281, 0.35209999999999997, 0.16459999999999997, 0.013000000000000012], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7609, 0.7602, 0.7597, 0.7583, 0.7575000000000001, 0.7556, 0.7517, 0.7457, 0.7295, 0.7143999999999999, 0.5982000000000001, 0.2813, 0.1008, 0.0034999999999999476], "L2AdditiveUniformNoiseAttack()": [0.7609, 0.7609, 0.761, 0.7609, 0.7609, 0.761, 0.7611, 0.7608, 0.7606999999999999, 0.7605999999999999, 0.7606999999999999, 0.7608, 0.7589, 0.7576], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7609, 0.7602, 0.7596, 0.7582, 0.7572, 0.7553, 0.7516, 0.745, 0.7283999999999999, 0.7128, 0.5979, 0.3124, 0.13729999999999998, 0.009600000000000053], "robust_accuracy": [0.7609, 0.7602, 0.7596, 0.7582, 0.7572, 0.7553, 0.7516, 0.745, 0.7283999999999999, 0.7123999999999999, 0.5947, 0.27890000000000004, 0.09899999999999998, 0.0032999999999999696]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7412000000000001, 0.7407, 0.7396, 0.7388, 0.7376, 0.7363, 0.7338, 0.7263, 0.7125, 0.6971, 0.5895, 0.3275, 0.17920000000000003, 0.05579999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7412000000000001, 0.7407, 0.7399, 0.7392000000000001, 0.7384, 0.737, 0.7344999999999999, 0.7288, 0.7172000000000001, 0.7039, 0.6062000000000001, 0.31679999999999997, 0.13319999999999999, 0.007199999999999984], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7412000000000001, 0.7407, 0.7396, 0.7388, 0.7376, 0.7363, 0.7338, 0.7261, 0.712, 0.6960999999999999, 0.579, 0.24529999999999996, 0.07779999999999998, 0.0010000000000000009], "L2AdditiveUniformNoiseAttack()": [0.7412000000000001, 0.7412000000000001, 0.7412000000000001, 0.7412000000000001, 0.7411, 0.7412000000000001, 0.7412000000000001, 0.741, 0.741, 0.7414000000000001, 0.7409, 0.7404999999999999, 0.7399, 0.7351], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7412000000000001, 0.7407, 0.7395, 0.7385999999999999, 0.7375, 0.7361, 0.7333000000000001, 0.7258, 0.7102999999999999, 0.694, 0.5801000000000001, 0.27380000000000004, 0.10660000000000003, 0.0039000000000000146], "robust_accuracy": [0.7412000000000001, 0.7407, 0.7395, 0.7385999999999999, 0.7375, 0.7361, 0.7333000000000001, 0.7257, 0.7101999999999999, 0.6939, 0.5757, 0.24239999999999995, 0.07589999999999997, 0.0010000000000000009]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7384, 0.7375, 0.7373000000000001, 0.7368, 0.7358, 0.7347, 0.7318, 0.7231000000000001, 0.7075, 0.6909000000000001, 0.5875, 0.34130000000000005, 0.20089999999999997, 0.07579999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7384, 0.7378, 0.7373000000000001, 0.7372000000000001, 0.7363999999999999, 0.7352000000000001, 0.7334, 0.7258, 0.7134, 0.6990000000000001, 0.6041000000000001, 0.3377, 0.15680000000000005, 0.01539999999999997], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7384, 0.7375, 0.7373000000000001, 0.7368, 0.7358, 0.7347, 0.7317, 0.7229, 0.7073, 0.6895, 0.5749, 0.26859999999999995, 0.09660000000000002, 0.0042999999999999705], "L2AdditiveUniformNoiseAttack()": [0.7384, 0.7384, 0.7384, 0.7384, 0.7384, 0.7384, 0.7383, 0.7384999999999999, 0.7385999999999999, 0.7387, 0.7384, 0.7394000000000001, 0.7371, 0.7394000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7384, 0.7375, 0.7373000000000001, 0.7368, 0.7357, 0.7343999999999999, 0.731, 0.722, 0.7049000000000001, 0.6859999999999999, 0.571, 0.28669999999999995, 0.12570000000000003, 0.008399999999999963], "robust_accuracy": [0.7384, 0.7375, 0.7373000000000001, 0.7368, 0.7357, 0.7343999999999999, 0.731, 0.7219, 0.7049000000000001, 0.6859, 0.5681, 0.2631, 0.09430000000000005, 0.0031999999999999806]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7332000000000001, 0.7328, 0.7319, 0.7315, 0.731, 0.7298, 0.7266, 0.7208, 0.7052, 0.6899, 0.5832999999999999, 0.34199999999999997, 0.20320000000000005, 0.07950000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7332000000000001, 0.7329, 0.7321, 0.7319, 0.7311000000000001, 0.7302, 0.7279, 0.7227, 0.7101999999999999, 0.6954, 0.5977, 0.33130000000000004, 0.15580000000000005, 0.01629999999999998], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7332000000000001, 0.7328, 0.7319, 0.7315, 0.731, 0.7297, 0.7263999999999999, 0.7206, 0.7046, 0.6895, 0.5718, 0.26160000000000005, 0.09889999999999999, 0.0034999999999999476], "L2AdditiveUniformNoiseAttack()": [0.7332000000000001, 0.7332000000000001, 0.7332000000000001, 0.7334, 0.7333000000000001, 0.7333000000000001, 0.7335, 0.7332000000000001, 0.7334, 0.7336, 0.7337, 0.733, 0.7331, 0.7335], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7332000000000001, 0.7328, 0.7319, 0.7315, 0.731, 0.7296, 0.7263, 0.7202999999999999, 0.7035, 0.6879, 0.5734, 0.29179999999999995, 0.13470000000000004, 0.011600000000000055], "robust_accuracy": [0.7332000000000001, 0.7328, 0.7319, 0.7315, 0.731, 0.7296, 0.7263, 0.7202, 0.7035, 0.6877, 0.5692999999999999, 0.25870000000000004, 0.0968, 0.0031999999999999806]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7604, 0.7601, 0.7589, 0.7584, 0.7574, 0.756, 0.7533, 0.7461, 0.7324999999999999, 0.7157, 0.6059, 0.3466, 0.19440000000000002, 0.07340000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7604, 0.7601, 0.7593, 0.7584, 0.7581, 0.7565999999999999, 0.7542, 0.7491, 0.7364999999999999, 0.724, 0.6216999999999999, 0.3318, 0.14, 0.008399999999999963], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7604, 0.7601, 0.7589, 0.7584, 0.7574, 0.756, 0.7533, 0.7461, 0.7323999999999999, 0.7146, 0.5918, 0.25529999999999997, 0.08350000000000002, 0.0014999999999999458], "L2AdditiveUniformNoiseAttack()": [0.7604, 0.7604, 0.7605, 0.7605, 0.7604, 0.7605, 0.7603, 0.7605999999999999, 0.7606999999999999, 0.7605, 0.7605, 0.7596, 0.7592, 0.7557], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7604, 0.76, 0.7587, 0.7583, 0.757, 0.7554, 0.7532, 0.745, 0.7311000000000001, 0.7127, 0.5877, 0.27959999999999996, 0.11280000000000001, 0.005199999999999982], "robust_accuracy": [0.7604, 0.76, 0.7587, 0.7583, 0.757, 0.7554, 0.7532, 0.745, 0.7311000000000001, 0.7123999999999999, 0.5842, 0.2509, 0.08199999999999996, 0.0013999999999999568]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7573, 0.7567, 0.7563, 0.7558, 0.755, 0.7535000000000001, 0.7502, 0.7427, 0.7283, 0.7146, 0.6048, 0.3601, 0.2147, 0.08220000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7573, 0.7568, 0.7564, 0.7561, 0.7556, 0.7543, 0.7516, 0.745, 0.7319, 0.7202999999999999, 0.6214, 0.3439, 0.1563, 0.01319999999999999], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7573, 0.7567, 0.7563, 0.7558, 0.755, 0.7535000000000001, 0.7502, 0.7425999999999999, 0.7277, 0.7135, 0.5925, 0.27059999999999995, 0.09530000000000005, 0.0031999999999999806], "L2AdditiveUniformNoiseAttack()": [0.7573, 0.7573, 0.7572, 0.7572, 0.7573, 0.7573, 0.7573, 0.7572, 0.7575000000000001, 0.7571, 0.7576, 0.7573, 0.7568, 0.7549], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7573, 0.7567, 0.7562, 0.7557, 0.7547, 0.7532, 0.7499, 0.7416, 0.727, 0.7107, 0.5905, 0.2986, 0.1271, 0.008900000000000019], "robust_accuracy": [0.7573, 0.7567, 0.7562, 0.7557, 0.7547, 0.7532, 0.7499, 0.7416, 0.7269, 0.7103999999999999, 0.5872999999999999, 0.26639999999999997, 0.09350000000000003, 0.0030999999999999917]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.748, 0.7478, 0.7472, 0.7465999999999999, 0.7458, 0.7442, 0.7416, 0.7355, 0.7197, 0.7037, 0.5921000000000001, 0.34140000000000004, 0.2026, 0.08130000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.748, 0.7478, 0.7473000000000001, 0.7468, 0.7464, 0.745, 0.7423, 0.7375, 0.7242999999999999, 0.7089, 0.6093999999999999, 0.3235, 0.13929999999999998, 0.010800000000000032], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.748, 0.7478, 0.7472, 0.7465999999999999, 0.7458, 0.7442, 0.7415, 0.7353000000000001, 0.7192000000000001, 0.7029000000000001, 0.5789, 0.25339999999999996, 0.07740000000000002, 0.0030999999999999917], "L2AdditiveUniformNoiseAttack()": [0.748, 0.748, 0.748, 0.7482, 0.748, 0.7481, 0.7482, 0.7484999999999999, 0.7481, 0.7484, 0.7484, 0.7482, 0.7479, 0.7455], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.748, 0.7477, 0.7471, 0.7465999999999999, 0.7458, 0.7441, 0.7412000000000001, 0.7349, 0.7182999999999999, 0.7016, 0.5784, 0.28490000000000004, 0.11429999999999996, 0.007900000000000018], "robust_accuracy": [0.748, 0.7477, 0.7471, 0.7465999999999999, 0.7458, 0.7441, 0.7412000000000001, 0.7349, 0.7182, 0.7014, 0.5741, 0.2499, 0.07620000000000005, 0.0029000000000000137]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7449, 0.7442, 0.7431, 0.7418, 0.7407, 0.7394000000000001, 0.737, 0.7299, 0.7159, 0.7025, 0.6033, 0.36850000000000005, 0.22999999999999998, 0.09399999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7449, 0.7443, 0.7433000000000001, 0.7427, 0.7413000000000001, 0.7401, 0.7377, 0.7318, 0.7195, 0.7083999999999999, 0.6181, 0.35829999999999995, 0.17569999999999997, 0.01770000000000005], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7449, 0.7442, 0.7431, 0.7418, 0.7407, 0.7394000000000001, 0.737, 0.7297, 0.7157, 0.7018, 0.5932999999999999, 0.2903, 0.11080000000000001, 0.0041999999999999815], "L2AdditiveUniformNoiseAttack()": [0.7449, 0.7449, 0.7449, 0.7449, 0.7448, 0.7448, 0.745, 0.7449, 0.7451, 0.7449, 0.7446999999999999, 0.7439, 0.7437, 0.7422], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7449, 0.744, 0.743, 0.7417, 0.7407, 0.739, 0.7367, 0.7289, 0.7146, 0.6998, 0.5928, 0.3194, 0.15059999999999996, 0.011900000000000022], "robust_accuracy": [0.7449, 0.744, 0.743, 0.7417, 0.7407, 0.739, 0.7367, 0.7289, 0.7146, 0.6998, 0.5898, 0.2873, 0.10899999999999999, 0.0036000000000000476]}}, "4": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7428, 0.7424, 0.7418, 0.7411, 0.7402, 0.7384, 0.7358, 0.7286, 0.7150000000000001, 0.7010000000000001, 0.6039, 0.36739999999999995, 0.22909999999999997, 0.09109999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7428, 0.7424, 0.742, 0.7416, 0.7405999999999999, 0.7393000000000001, 0.7363, 0.7304999999999999, 0.7192000000000001, 0.7068, 0.6187, 0.3519, 0.16749999999999998, 0.016900000000000026], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7428, 0.7424, 0.7418, 0.7411, 0.7402, 0.7384, 0.7358, 0.7286, 0.7145, 0.7001, 0.5904, 0.28400000000000003, 0.10409999999999997, 0.0039000000000000146], "L2AdditiveUniformNoiseAttack()": [0.7428, 0.7428, 0.7429, 0.7429, 0.7428, 0.7428, 0.7428, 0.7429, 0.7429, 0.7427, 0.743, 0.7424, 0.7442, 0.7415], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7428, 0.7424, 0.7417, 0.7409, 0.7399, 0.7381, 0.7351, 0.7274, 0.7123999999999999, 0.6974, 0.5867, 0.30820000000000003, 0.136, 0.010399999999999965], "robust_accuracy": [0.7428, 0.7424, 0.7417, 0.7409, 0.7399, 0.7381, 0.7351, 0.7274, 0.7123999999999999, 0.6972, 0.5833999999999999, 0.2772, 0.10140000000000005, 0.0033999999999999586]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7417, 0.7415, 0.7404, 0.7398, 0.7393000000000001, 0.7373000000000001, 0.7347, 0.727, 0.7109, 0.694, 0.5904, 0.3651, 0.22629999999999995, 0.08699999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7417, 0.7415, 0.7407, 0.7402, 0.7396, 0.738, 0.7358, 0.7292000000000001, 0.7159, 0.702, 0.6073, 0.3486, 0.1703, 0.015000000000000013], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7417, 0.7415, 0.7404, 0.7398, 0.7393000000000001, 0.7373000000000001, 0.7347, 0.7269, 0.7101999999999999, 0.6931, 0.5783, 0.2763, 0.10650000000000004, 0.0041999999999999815], "L2AdditiveUniformNoiseAttack()": [0.7417, 0.7417, 0.7417, 0.7417, 0.7417, 0.7417, 0.7417, 0.7417, 0.7422, 0.7424, 0.7416, 0.7416, 0.7403, 0.7398], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7417, 0.7414000000000001, 0.7404, 0.7397, 0.739, 0.7373000000000001, 0.7343999999999999, 0.7263, 0.7082999999999999, 0.6911, 0.5755, 0.30169999999999997, 0.13759999999999994, 0.010399999999999965], "robust_accuracy": [0.7417, 0.7414000000000001, 0.7404, 0.7397, 0.739, 0.7373000000000001, 0.7343999999999999, 0.7263, 0.708, 0.6910000000000001, 0.5726, 0.2713, 0.1028, 0.0039000000000000146]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7401, 0.7396, 0.739, 0.7384999999999999, 0.7377, 0.7362, 0.7334, 0.7261, 0.7128, 0.7008, 0.5938, 0.348, 0.2096, 0.08909999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7401, 0.7397, 0.7392000000000001, 0.7387, 0.7383, 0.7374, 0.7341, 0.7279, 0.7166, 0.7062999999999999, 0.6088, 0.32489999999999997, 0.14629999999999999, 0.016199999999999992], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7401, 0.7396, 0.739, 0.7384999999999999, 0.7377, 0.7362, 0.7334, 0.7261, 0.7123999999999999, 0.7005, 0.5801000000000001, 0.25249999999999995, 0.08960000000000001, 0.0040000000000000036], "L2AdditiveUniformNoiseAttack()": [0.7401, 0.7401, 0.7401, 0.7401, 0.74, 0.7401, 0.7402, 0.7401, 0.7404, 0.7402, 0.7404, 0.7393000000000001, 0.7396, 0.7363999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7401, 0.7394000000000001, 0.739, 0.7384999999999999, 0.7376, 0.7361, 0.7331, 0.7258, 0.7119, 0.6979, 0.5809, 0.2875, 0.12870000000000004, 0.01090000000000002], "robust_accuracy": [0.7401, 0.7394000000000001, 0.739, 0.7384999999999999, 0.7376, 0.7361, 0.7331, 0.7258, 0.7119, 0.6979, 0.5768, 0.25, 0.08850000000000002, 0.0032999999999999696]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7471, 0.7463, 0.746, 0.7448, 0.7444, 0.7435, 0.7413000000000001, 0.7334, 0.7189, 0.7031000000000001, 0.5992999999999999, 0.3571, 0.22199999999999998, 0.09079999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7471, 0.7464, 0.7462, 0.7454000000000001, 0.7444999999999999, 0.7439, 0.7422, 0.7359, 0.7237, 0.7102999999999999, 0.6143000000000001, 0.34119999999999995, 0.16369999999999996, 0.017199999999999993], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7471, 0.7463, 0.746, 0.7448, 0.7444, 0.7435, 0.7412000000000001, 0.7334, 0.7183999999999999, 0.7021999999999999, 0.5879, 0.276, 0.10099999999999998, 0.005099999999999993], "L2AdditiveUniformNoiseAttack()": [0.7471, 0.7471, 0.7471, 0.7471, 0.7471, 0.747, 0.747, 0.7472, 0.7471, 0.7473000000000001, 0.7472, 0.7469, 0.7462, 0.7454000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7471, 0.7463, 0.7457, 0.7446999999999999, 0.7443, 0.7434000000000001, 0.741, 0.7329, 0.7161, 0.6988, 0.5844, 0.29969999999999997, 0.13360000000000005, 0.010399999999999965], "robust_accuracy": [0.7471, 0.7463, 0.7457, 0.7446999999999999, 0.7443, 0.7434000000000001, 0.741, 0.7329, 0.7161, 0.6988, 0.5811, 0.2712, 0.09919999999999995, 0.0043999999999999595]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7418, 0.7411, 0.7404, 0.7394000000000001, 0.7387, 0.7373000000000001, 0.7345999999999999, 0.7287, 0.7153, 0.7014, 0.5991, 0.3601, 0.22209999999999996, 0.08389999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7418, 0.7412000000000001, 0.7404999999999999, 0.7398, 0.7392000000000001, 0.7379, 0.7356, 0.731, 0.719, 0.7066, 0.6147, 0.35450000000000004, 0.16949999999999998, 0.015100000000000002], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7418, 0.7411, 0.7404, 0.7394000000000001, 0.7387, 0.7373000000000001, 0.7345999999999999, 0.7284999999999999, 0.7147, 0.7006, 0.5873999999999999, 0.27980000000000005, 0.10119999999999996, 0.0037000000000000366], "L2AdditiveUniformNoiseAttack()": [0.7418, 0.7418, 0.7419, 0.7418, 0.7418, 0.7419, 0.7418, 0.7422, 0.7419, 0.7416, 0.7416, 0.7408, 0.7408, 0.7403], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7418, 0.741, 0.7401, 0.7391, 0.7385999999999999, 0.7369, 0.734, 0.728, 0.712, 0.6988, 0.5843, 0.29710000000000003, 0.129, 0.008499999999999952], "robust_accuracy": [0.7418, 0.741, 0.7401, 0.7391, 0.7385999999999999, 0.7369, 0.734, 0.728, 0.712, 0.6987, 0.5820000000000001, 0.2732, 0.09809999999999997, 0.0032999999999999696]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7481, 0.7473000000000001, 0.7468, 0.7463, 0.7456, 0.7448, 0.7418, 0.7343999999999999, 0.7215, 0.7076, 0.6061000000000001, 0.36860000000000004, 0.22050000000000003, 0.0797], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7481, 0.7473000000000001, 0.747, 0.7464, 0.746, 0.7451, 0.743, 0.7371, 0.7248, 0.7134, 0.6229, 0.36119999999999997, 0.1744, 0.020399999999999974], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7481, 0.7473000000000001, 0.7468, 0.7463, 0.7456, 0.7448, 0.7418, 0.7343, 0.7212000000000001, 0.7070000000000001, 0.5968, 0.2905, 0.11009999999999998, 0.005099999999999993], "L2AdditiveUniformNoiseAttack()": [0.7481, 0.7481, 0.7481, 0.7481, 0.7479, 0.7481, 0.748, 0.748, 0.7483, 0.7479, 0.7486999999999999, 0.7481, 0.7484, 0.748], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7481, 0.7473000000000001, 0.7468, 0.7463, 0.7456, 0.7442, 0.7415, 0.7337, 0.7202999999999999, 0.7050000000000001, 0.596, 0.3155, 0.14270000000000005, 0.012700000000000045], "robust_accuracy": [0.7481, 0.7473000000000001, 0.7468, 0.7463, 0.7456, 0.7442, 0.7415, 0.7337, 0.7202, 0.7050000000000001, 0.5925, 0.2882, 0.1078, 0.0043999999999999595]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7056, 0.7048, 0.7041999999999999, 0.7036, 0.7032, 0.7014, 0.6984, 0.6908000000000001, 0.6769000000000001, 0.6612, 0.5523, 0.3184, 0.19099999999999995, 0.07599999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7056, 0.7049000000000001, 0.7042999999999999, 0.7039, 0.7034, 0.7021999999999999, 0.6994, 0.6931, 0.6824, 0.6678, 0.5692999999999999, 0.30369999999999997, 0.13580000000000003, 0.009600000000000053], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7056, 0.7048, 0.7041999999999999, 0.7036, 0.7032, 0.7014, 0.6982999999999999, 0.6908000000000001, 0.6764, 0.6602, 0.5395, 0.23939999999999995, 0.07989999999999997, 0.0022999999999999687], "L2AdditiveUniformNoiseAttack()": [0.7056, 0.7056, 0.7056, 0.7056, 0.7056, 0.7055, 0.7056, 0.7055, 0.7055, 0.7054, 0.7061999999999999, 0.7047, 0.7052, 0.7055], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7056, 0.7048, 0.7041999999999999, 0.7036, 0.7029000000000001, 0.7013, 0.6978, 0.6903, 0.6753, 0.6581, 0.5395, 0.26870000000000005, 0.11119999999999997, 0.006299999999999972], "robust_accuracy": [0.7056, 0.7048, 0.7041999999999999, 0.7036, 0.7029000000000001, 0.7013, 0.6978, 0.6903, 0.6751, 0.6579999999999999, 0.5353, 0.23760000000000003, 0.07779999999999998, 0.0021999999999999797]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.73, 0.7295, 0.729, 0.7286, 0.728, 0.7262, 0.723, 0.7143999999999999, 0.7006, 0.6864, 0.5849, 0.3469, 0.21240000000000003, 0.08750000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.73, 0.7295, 0.7291000000000001, 0.7287, 0.7284999999999999, 0.7273000000000001, 0.7244999999999999, 0.7167, 0.7046, 0.6919, 0.5987, 0.33899999999999997, 0.16679999999999995, 0.022700000000000053], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.73, 0.7295, 0.729, 0.7286, 0.728, 0.7261, 0.723, 0.7142999999999999, 0.7005, 0.6852, 0.5747, 0.27249999999999996, 0.10850000000000004, 0.006000000000000005], "L2AdditiveUniformNoiseAttack()": [0.73, 0.73, 0.73, 0.73, 0.73, 0.73, 0.7301, 0.7299, 0.7296, 0.7299, 0.7299, 0.7289, 0.729, 0.7283], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.73, 0.7295, 0.7289, 0.7286, 0.7279, 0.7258, 0.7223999999999999, 0.7136, 0.6984, 0.6831, 0.5719000000000001, 0.29379999999999995, 0.13939999999999997, 0.014599999999999946], "robust_accuracy": [0.73, 0.7295, 0.7289, 0.7286, 0.7279, 0.7258, 0.7223999999999999, 0.7136, 0.6984, 0.683, 0.5698, 0.2682, 0.10609999999999997, 0.00539999999999996]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7254, 0.7242, 0.7233, 0.7229, 0.7224999999999999, 0.7212000000000001, 0.7179, 0.7112, 0.6980999999999999, 0.6824, 0.5728, 0.33309999999999995, 0.20030000000000003, 0.07020000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7254, 0.7242, 0.7237, 0.7229, 0.7227, 0.7219, 0.7194, 0.7131000000000001, 0.702, 0.6894, 0.5889, 0.3183, 0.14959999999999996, 0.010600000000000054], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7254, 0.7242, 0.7233, 0.7229, 0.7224999999999999, 0.7212000000000001, 0.7179, 0.7112, 0.6978, 0.6811, 0.5597, 0.25449999999999995, 0.09030000000000005, 0.0017000000000000348], "L2AdditiveUniformNoiseAttack()": [0.7254, 0.7254, 0.7255, 0.7255, 0.7256, 0.7255, 0.7255, 0.7255, 0.7254, 0.7253000000000001, 0.7251000000000001, 0.7241, 0.725, 0.7252000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7254, 0.7242, 0.7233, 0.7228, 0.7224999999999999, 0.7209, 0.7176, 0.7108, 0.6968, 0.6796, 0.5591999999999999, 0.2764, 0.12070000000000003, 0.007800000000000029], "robust_accuracy": [0.7254, 0.7242, 0.7233, 0.7228, 0.7224999999999999, 0.7209, 0.7176, 0.7108, 0.6966, 0.6793, 0.5556, 0.25070000000000003, 0.08730000000000004, 0.0014999999999999458]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.744, 0.7431, 0.7427, 0.742, 0.741, 0.7396, 0.7365999999999999, 0.7293000000000001, 0.7155, 0.6994, 0.6011, 0.375, 0.2359, 0.10440000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.744, 0.7433000000000001, 0.7429, 0.7424, 0.7416, 0.7404, 0.7373000000000001, 0.7318, 0.7193, 0.7057, 0.6175999999999999, 0.3648, 0.19179999999999997, 0.025699999999999945], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.744, 0.7431, 0.7427, 0.742, 0.741, 0.7396, 0.7365999999999999, 0.7292000000000001, 0.7151000000000001, 0.6982999999999999, 0.5917, 0.3014, 0.12619999999999998, 0.009700000000000042], "L2AdditiveUniformNoiseAttack()": [0.744, 0.744, 0.744, 0.744, 0.7439, 0.744, 0.744, 0.744, 0.7441, 0.7436, 0.7438, 0.744, 0.7424, 0.7404999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.744, 0.7431, 0.7424999999999999, 0.7417, 0.741, 0.7393000000000001, 0.7361, 0.7284999999999999, 0.7134, 0.6970000000000001, 0.5919, 0.3286, 0.16310000000000002, 0.019499999999999962], "robust_accuracy": [0.744, 0.7431, 0.7424999999999999, 0.7417, 0.741, 0.7393000000000001, 0.7361, 0.7283999999999999, 0.7134, 0.6965, 0.5885, 0.2983, 0.12329999999999997, 0.008399999999999963]}}, "8": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7551, 0.7545, 0.7538, 0.753, 0.7522, 0.7507, 0.7481, 0.7411, 0.725, 0.7088, 0.6099, 0.36550000000000005, 0.22150000000000003, 0.0847], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7551, 0.7545999999999999, 0.7542, 0.7533, 0.7525999999999999, 0.7513, 0.749, 0.7431, 0.7296, 0.7154, 0.6208, 0.352, 0.1643, 0.01419999999999999], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7551, 0.7545, 0.7538, 0.753, 0.7522, 0.7507, 0.7481, 0.7409, 0.7244999999999999, 0.7072, 0.5996, 0.27980000000000005, 0.0998, 0.0042999999999999705], "L2AdditiveUniformNoiseAttack()": [0.7551, 0.7551, 0.7552, 0.7551, 0.7552, 0.7554, 0.7553, 0.7553, 0.7555000000000001, 0.7552, 0.755, 0.7554, 0.7549, 0.7547], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7551, 0.7545, 0.7538, 0.7527, 0.7522, 0.7503, 0.7477, 0.74, 0.7231000000000001, 0.7058, 0.5984, 0.31210000000000004, 0.1371, 0.010000000000000009], "robust_accuracy": [0.7551, 0.7545, 0.7538, 0.7527, 0.7522, 0.7503, 0.7477, 0.74, 0.723, 0.7055, 0.5952, 0.27749999999999997, 0.09809999999999997, 0.0034999999999999476]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7469, 0.7463, 0.7454000000000001, 0.7445999999999999, 0.7444, 0.7424, 0.7381, 0.7315, 0.7158, 0.7005, 0.5823, 0.34299999999999997, 0.21489999999999998, 0.09809999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7469, 0.7464, 0.7455, 0.745, 0.7444, 0.7435, 0.7397, 0.7334, 0.7206, 0.7070000000000001, 0.5986, 0.31189999999999996, 0.13029999999999997, 0.01100000000000001], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7469, 0.7463, 0.7454000000000001, 0.7445999999999999, 0.7444, 0.7424, 0.738, 0.7313000000000001, 0.7154, 0.6994, 0.5659000000000001, 0.23909999999999998, 0.07189999999999996, 0.0030000000000000027], "L2AdditiveUniformNoiseAttack()": [0.7469, 0.7469, 0.7469, 0.7469, 0.7469, 0.7469, 0.7469, 0.7469, 0.747, 0.7465999999999999, 0.7468, 0.7465999999999999, 0.7461, 0.7465999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7469, 0.7461, 0.7453000000000001, 0.7444, 0.7443, 0.7417, 0.7378, 0.7301, 0.7135, 0.6978, 0.565, 0.27270000000000005, 0.10770000000000002, 0.006700000000000039], "robust_accuracy": [0.7469, 0.7461, 0.7453000000000001, 0.7444, 0.7443, 0.7417, 0.7378, 0.7301, 0.7134, 0.6976, 0.5604, 0.23540000000000005, 0.07050000000000001, 0.0020000000000000018]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7312000000000001, 0.7309, 0.7296, 0.7293000000000001, 0.7284999999999999, 0.727, 0.7242, 0.7176, 0.7041, 0.6921999999999999, 0.6028, 0.3821, 0.24750000000000005, 0.10140000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7312000000000001, 0.7309, 0.73, 0.7293000000000001, 0.729, 0.7274, 0.7251000000000001, 0.7195, 0.7088, 0.6976, 0.6174999999999999, 0.377, 0.20299999999999996, 0.022700000000000053], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7312000000000001, 0.7309, 0.7296, 0.7293000000000001, 0.7284999999999999, 0.727, 0.7242, 0.7175, 0.704, 0.6916, 0.5925, 0.3107, 0.13170000000000004, 0.006700000000000039], "L2AdditiveUniformNoiseAttack()": [0.7312000000000001, 0.7312000000000001, 0.7312000000000001, 0.7312000000000001, 0.7313000000000001, 0.7312000000000001, 0.7312000000000001, 0.7313000000000001, 0.7313000000000001, 0.7316, 0.7312000000000001, 0.7319, 0.7317, 0.7301], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7312000000000001, 0.7309, 0.7295, 0.7292000000000001, 0.7284999999999999, 0.7269, 0.7237, 0.7170000000000001, 0.7028, 0.6899, 0.5932, 0.3388, 0.1713, 0.014100000000000001], "robust_accuracy": [0.7312000000000001, 0.7309, 0.7295, 0.7292000000000001, 0.7284999999999999, 0.7269, 0.7237, 0.7170000000000001, 0.7028, 0.6899, 0.5897, 0.30889999999999995, 0.12949999999999995, 0.005900000000000016]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7255, 0.725, 0.7237, 0.7233, 0.7223999999999999, 0.721, 0.7174, 0.7109, 0.6984, 0.6846, 0.5841000000000001, 0.35660000000000003, 0.23140000000000005, 0.11150000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7255, 0.725, 0.7242, 0.7234, 0.7228, 0.7213, 0.7186, 0.7129, 0.7016, 0.6895, 0.5992, 0.3357, 0.1713, 0.021700000000000053], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7255, 0.725, 0.7237, 0.7233, 0.7223999999999999, 0.7209, 0.7175, 0.7109, 0.6982999999999999, 0.6832, 0.5712999999999999, 0.2704, 0.10970000000000002, 0.006199999999999983], "L2AdditiveUniformNoiseAttack()": [0.7255, 0.7255, 0.7255, 0.7255, 0.7255, 0.7255, 0.7255, 0.7254, 0.7256, 0.7259, 0.7256, 0.7238, 0.723, 0.7213], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7255, 0.725, 0.7235, 0.7231000000000001, 0.722, 0.7207, 0.7171000000000001, 0.7099, 0.6965, 0.6814, 0.5703, 0.29769999999999996, 0.14059999999999995, 0.013499999999999956], "robust_accuracy": [0.7255, 0.725, 0.7235, 0.7231000000000001, 0.722, 0.7207, 0.7171000000000001, 0.7099, 0.6965, 0.6812, 0.567, 0.2662, 0.10660000000000003, 0.005299999999999971]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7319, 0.7316, 0.7308, 0.7299, 0.7295, 0.7286, 0.726, 0.7182999999999999, 0.7032, 0.6886, 0.585, 0.352, 0.2198, 0.09589999999999999], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7319, 0.7316, 0.7309, 0.7306, 0.7298, 0.7289, 0.7269, 0.7206, 0.7076, 0.6946, 0.5997, 0.33799999999999997, 0.16569999999999996, 0.016900000000000026], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7319, 0.7316, 0.7307, 0.7299, 0.7295, 0.7287, 0.7259, 0.7182, 0.7031000000000001, 0.6881999999999999, 0.5728, 0.26470000000000005, 0.10519999999999996, 0.0038000000000000256], "L2AdditiveUniformNoiseAttack()": [0.7319, 0.7319, 0.7319, 0.7319, 0.7319, 0.732, 0.7321, 0.7318, 0.7319, 0.7317, 0.7314, 0.7315, 0.7314, 0.7309], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7319, 0.7315, 0.7307, 0.7299, 0.7294, 0.7283, 0.7257, 0.7178, 0.7021, 0.6860999999999999, 0.5722, 0.29500000000000004, 0.1362, 0.01100000000000001], "robust_accuracy": [0.7319, 0.7315, 0.7307, 0.7299, 0.7294, 0.7283, 0.7257, 0.7178, 0.7021, 0.6859999999999999, 0.5686, 0.2622, 0.10299999999999998, 0.0030000000000000027]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7428, 0.7422, 0.7415, 0.741, 0.7405999999999999, 0.7394000000000001, 0.7363, 0.7297, 0.7146, 0.6995, 0.5966, 0.35719999999999996, 0.21909999999999996, 0.08630000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7428, 0.7422, 0.7419, 0.7411, 0.7407, 0.7401, 0.7374, 0.7314, 0.719, 0.7063999999999999, 0.6134, 0.34340000000000004, 0.16200000000000003, 0.018000000000000016], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7428, 0.7422, 0.7415, 0.741, 0.7405999999999999, 0.7394000000000001, 0.7363, 0.7296, 0.7143999999999999, 0.6982999999999999, 0.5861000000000001, 0.2704, 0.1028, 0.0050000000000000044], "L2AdditiveUniformNoiseAttack()": [0.7428, 0.7428, 0.7428, 0.7428, 0.7428, 0.7427, 0.7428, 0.7425999999999999, 0.7433000000000001, 0.7427, 0.7431, 0.7437, 0.744, 0.7421], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7428, 0.7421, 0.7415, 0.7409, 0.7404999999999999, 0.7392000000000001, 0.7362, 0.7288, 0.7127, 0.6969000000000001, 0.5851, 0.3014, 0.13759999999999994, 0.013800000000000034], "robust_accuracy": [0.7428, 0.7421, 0.7415, 0.7409, 0.7404999999999999, 0.7392000000000001, 0.7362, 0.7288, 0.7127, 0.6965, 0.5818, 0.26880000000000004, 0.10060000000000002, 0.0049000000000000155]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7401, 0.7393000000000001, 0.7383, 0.7375, 0.7367, 0.735, 0.7315, 0.7232000000000001, 0.7098, 0.6961999999999999, 0.5984, 0.3657, 0.22350000000000003, 0.09299999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7401, 0.7394000000000001, 0.7384999999999999, 0.738, 0.7372000000000001, 0.7355, 0.7334, 0.7257, 0.7142, 0.7027, 0.6124, 0.35429999999999995, 0.17049999999999998, 0.01959999999999995], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7401, 0.7392000000000001, 0.7383, 0.7375, 0.7365999999999999, 0.735, 0.7315, 0.7232000000000001, 0.7095, 0.6953, 0.5869, 0.28480000000000005, 0.10860000000000003, 0.005800000000000027], "L2AdditiveUniformNoiseAttack()": [0.7401, 0.7401, 0.7401, 0.7401, 0.7401, 0.7401, 0.7401, 0.7402, 0.7402, 0.7398, 0.7398, 0.7389, 0.7379, 0.7369], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7401, 0.7389, 0.7383, 0.7374, 0.7364999999999999, 0.735, 0.731, 0.723, 0.7089, 0.6941999999999999, 0.5878, 0.3174, 0.1451, 0.0121], "robust_accuracy": [0.7401, 0.7389, 0.7383, 0.7374, 0.7364999999999999, 0.735, 0.731, 0.723, 0.7087, 0.6939, 0.5838, 0.2824, 0.10699999999999998, 0.0050000000000000044]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7489, 0.7484, 0.7475, 0.7463, 0.7451, 0.7441, 0.7408, 0.7332000000000001, 0.7153, 0.7002999999999999, 0.5903, 0.35029999999999994, 0.2157, 0.08489999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7489, 0.7484, 0.7478, 0.7469, 0.7459, 0.7445999999999999, 0.7419, 0.7355, 0.7209, 0.7059, 0.6052, 0.3297, 0.1501, 0.010499999999999954], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7489, 0.7484, 0.7475, 0.7463, 0.7451, 0.7441, 0.7407, 0.733, 0.7147, 0.6991, 0.5777, 0.2591, 0.09019999999999995, 0.0020999999999999908], "L2AdditiveUniformNoiseAttack()": [0.7489, 0.7489, 0.7489, 0.7488, 0.749, 0.7486999999999999, 0.7489, 0.7486999999999999, 0.7489, 0.7491, 0.7485999999999999, 0.7481, 0.7486999999999999, 0.7451], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7489, 0.7483, 0.7471, 0.7458, 0.7448, 0.744, 0.7398, 0.732, 0.7122999999999999, 0.6958, 0.5716, 0.2793, 0.11750000000000005, 0.00660000000000005], "robust_accuracy": [0.7489, 0.7483, 0.7471, 0.7458, 0.7448, 0.744, 0.7398, 0.732, 0.7122999999999999, 0.6958, 0.5697, 0.25160000000000005, 0.08640000000000003, 0.0018000000000000238]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7499, 0.7492, 0.7484999999999999, 0.748, 0.7472, 0.7452, 0.741, 0.7337, 0.7178, 0.7033, 0.5968, 0.35519999999999996, 0.21830000000000005, 0.09630000000000005], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7499, 0.7494000000000001, 0.7489, 0.7482, 0.7476, 0.7458, 0.742, 0.7355, 0.722, 0.7096, 0.6101, 0.3244, 0.14080000000000004, 0.011099999999999999], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7499, 0.7492, 0.7484999999999999, 0.748, 0.7472, 0.7452, 0.7409, 0.7337, 0.7172000000000001, 0.7019, 0.5803, 0.2469, 0.07989999999999997, 0.0026000000000000467], "L2AdditiveUniformNoiseAttack()": [0.7499, 0.7499, 0.7499, 0.7499, 0.7499, 0.7499, 0.7499, 0.75, 0.7499, 0.7501, 0.75, 0.7503, 0.7514000000000001, 0.7475], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7499, 0.7491, 0.7484, 0.7478, 0.747, 0.7448, 0.7407, 0.733, 0.7157, 0.6997, 0.5804, 0.2794, 0.11319999999999997, 0.006800000000000028], "robust_accuracy": [0.7499, 0.7491, 0.7484, 0.7478, 0.747, 0.7448, 0.7407, 0.733, 0.7155, 0.6994, 0.5757, 0.244, 0.07779999999999998, 0.0024999999999999467]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7662, 0.765, 0.7644, 0.7641, 0.7633, 0.762, 0.7587, 0.7522, 0.7367, 0.721, 0.6187, 0.3801, 0.23750000000000004, 0.0817], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7662, 0.7652, 0.7645, 0.7643, 0.7635000000000001, 0.7624, 0.7601, 0.7543, 0.7415, 0.7277, 0.6335, 0.3712, 0.18130000000000002, 0.016700000000000048], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7662, 0.765, 0.7644, 0.7641, 0.7633, 0.762, 0.7587, 0.7521, 0.7363999999999999, 0.7202, 0.6078, 0.30210000000000004, 0.10850000000000004, 0.0043999999999999595], "L2AdditiveUniformNoiseAttack()": [0.7662, 0.7662, 0.7662, 0.7662, 0.7662, 0.7662, 0.7661, 0.7661, 0.7661, 0.7658, 0.7652, 0.7641, 0.765, 0.7613], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7662, 0.7649, 0.7644, 0.7641, 0.7633, 0.7618, 0.7581, 0.7514000000000001, 0.7342, 0.7175, 0.6023000000000001, 0.3217, 0.14300000000000002, 0.010499999999999954], "robust_accuracy": [0.7662, 0.7649, 0.7644, 0.7641, 0.7633, 0.7618, 0.7581, 0.7514000000000001, 0.7341, 0.7174, 0.6004, 0.29679999999999995, 0.10599999999999998, 0.0039000000000000146]}}, "16": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7484, 0.7476, 0.7466999999999999, 0.7462, 0.7456, 0.7443, 0.7403, 0.7347, 0.7219, 0.7102999999999999, 0.6039, 0.3718, 0.23860000000000003, 0.1079], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7484, 0.7476, 0.747, 0.7465999999999999, 0.7461, 0.7445999999999999, 0.742, 0.7364999999999999, 0.7262, 0.7142, 0.6162000000000001, 0.33919999999999995, 0.15500000000000003, 0.014100000000000001], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7484, 0.7476, 0.7466999999999999, 0.7462, 0.7456, 0.7442, 0.7403, 0.7345999999999999, 0.7215, 0.7095, 0.5900000000000001, 0.2681, 0.09150000000000003, 0.0031999999999999806], "L2AdditiveUniformNoiseAttack()": [0.7484, 0.7484, 0.7483, 0.7484, 0.7484, 0.7484, 0.7484999999999999, 0.7484999999999999, 0.7485999999999999, 0.7481, 0.7483, 0.7486999999999999, 0.7488, 0.748], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7484, 0.7476, 0.7465999999999999, 0.746, 0.7455, 0.744, 0.7403, 0.7338, 0.7201, 0.7073, 0.5901000000000001, 0.3023, 0.13060000000000005, 0.009199999999999986], "robust_accuracy": [0.7484, 0.7476, 0.7465999999999999, 0.746, 0.7455, 0.744, 0.7403, 0.7338, 0.7201, 0.7070000000000001, 0.5852999999999999, 0.265, 0.08950000000000002, 0.0027000000000000357]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7545, 0.754, 0.753, 0.752, 0.7509, 0.7495, 0.7466999999999999, 0.7404999999999999, 0.7256, 0.7103999999999999, 0.6024, 0.3618, 0.2298, 0.09340000000000004], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7545, 0.754, 0.7534, 0.7525, 0.7518, 0.75, 0.7479, 0.7419, 0.7295, 0.7171000000000001, 0.618, 0.3429, 0.16190000000000004, 0.015000000000000013], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7545, 0.754, 0.753, 0.752, 0.7509, 0.7495, 0.7466999999999999, 0.7404, 0.7253000000000001, 0.7095, 0.5881000000000001, 0.273, 0.09660000000000002, 0.0037000000000000366], "L2AdditiveUniformNoiseAttack()": [0.7545, 0.7545, 0.7545, 0.7545, 0.7545, 0.7545, 0.7544, 0.7544, 0.7542, 0.7543, 0.7545, 0.7533, 0.7527, 0.7516], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7545, 0.7539, 0.7529, 0.7518, 0.7504, 0.7492, 0.7464, 0.739, 0.7232000000000001, 0.7061999999999999, 0.5853999999999999, 0.29810000000000003, 0.1279, 0.009499999999999953], "robust_accuracy": [0.7545, 0.7539, 0.7529, 0.7518, 0.7504, 0.7492, 0.7464, 0.739, 0.7232000000000001, 0.7061999999999999, 0.5818, 0.26880000000000004, 0.09399999999999997, 0.0031999999999999806]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7449, 0.7444999999999999, 0.7433000000000001, 0.7421, 0.7418, 0.7404999999999999, 0.7377, 0.7315, 0.7163999999999999, 0.7005, 0.5972, 0.3658, 0.22850000000000004, 0.0988], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7449, 0.7445999999999999, 0.7435, 0.7427, 0.7421, 0.7411, 0.7389, 0.7334, 0.7211000000000001, 0.7076, 0.6099, 0.3425, 0.16449999999999998, 0.01529999999999998], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7449, 0.7444, 0.7433000000000001, 0.7421, 0.7418, 0.7404999999999999, 0.7377, 0.7314, 0.7162, 0.6992, 0.5824, 0.2692, 0.09919999999999995, 0.0038000000000000256], "L2AdditiveUniformNoiseAttack()": [0.7449, 0.7449, 0.7449, 0.7449, 0.745, 0.7449, 0.7449, 0.7452, 0.7449, 0.7445999999999999, 0.7446999999999999, 0.7444, 0.7431, 0.7428], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7449, 0.7444, 0.7433000000000001, 0.7421, 0.7416, 0.7404, 0.7373000000000001, 0.7306, 0.7148, 0.6977, 0.5831, 0.30089999999999995, 0.13580000000000003, 0.010600000000000054], "robust_accuracy": [0.7449, 0.7444, 0.7433000000000001, 0.7421, 0.7416, 0.7404, 0.7373000000000001, 0.7306, 0.7148, 0.6974, 0.5779000000000001, 0.26639999999999997, 0.09650000000000003, 0.0034999999999999476]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7375, 0.7367, 0.7363, 0.7358, 0.7353000000000001, 0.7335, 0.7309, 0.7221, 0.7044, 0.6918, 0.5902000000000001, 0.35419999999999996, 0.2147, 0.07909999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7375, 0.7368, 0.7365999999999999, 0.7359, 0.7356, 0.7343, 0.7315, 0.7255, 0.7096, 0.6971, 0.6061000000000001, 0.3448, 0.16700000000000004, 0.01429999999999998], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7375, 0.7367, 0.7363, 0.7358, 0.7352000000000001, 0.7335, 0.7309, 0.7219, 0.7044, 0.6914, 0.5799000000000001, 0.27349999999999997, 0.10140000000000005, 0.0029000000000000137], "L2AdditiveUniformNoiseAttack()": [0.7375, 0.7375, 0.7376, 0.7375, 0.7375, 0.7376, 0.7378, 0.7375, 0.7372000000000001, 0.7372000000000001, 0.7383, 0.7377, 0.7371, 0.7349], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7375, 0.7365999999999999, 0.7362, 0.7357, 0.7348, 0.7333000000000001, 0.7303999999999999, 0.721, 0.7027, 0.6894, 0.5795, 0.30100000000000005, 0.13739999999999997, 0.009299999999999975], "robust_accuracy": [0.7375, 0.7365999999999999, 0.7362, 0.7357, 0.7348, 0.7333000000000001, 0.7303999999999999, 0.721, 0.7027, 0.6894, 0.5759000000000001, 0.2693, 0.09909999999999997, 0.0023999999999999577]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7405999999999999, 0.7402, 0.7395, 0.7392000000000001, 0.7381, 0.7368, 0.734, 0.7267, 0.7119, 0.6962999999999999, 0.5973999999999999, 0.37670000000000003, 0.25039999999999996, 0.11439999999999995], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7405999999999999, 0.7402, 0.7395, 0.7394000000000001, 0.7383, 0.7377, 0.7347, 0.7283999999999999, 0.7159, 0.7030000000000001, 0.6114999999999999, 0.36040000000000005, 0.1895, 0.025800000000000045], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7405999999999999, 0.7402, 0.7395, 0.7391, 0.7381, 0.7368, 0.734, 0.7263999999999999, 0.7114, 0.6953, 0.5833999999999999, 0.2914, 0.123, 0.007800000000000029], "L2AdditiveUniformNoiseAttack()": [0.7405999999999999, 0.7405999999999999, 0.7405999999999999, 0.7405999999999999, 0.7405999999999999, 0.7405999999999999, 0.7405999999999999, 0.7407, 0.7405999999999999, 0.7404999999999999, 0.7415, 0.7415, 0.7403, 0.7396], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7405999999999999, 0.7401, 0.7395, 0.739, 0.738, 0.7367, 0.7336, 0.7255, 0.7095, 0.6929000000000001, 0.5799000000000001, 0.3184, 0.1582, 0.01629999999999998], "robust_accuracy": [0.7405999999999999, 0.7401, 0.7395, 0.739, 0.738, 0.7367, 0.7336, 0.7255, 0.7094, 0.6929000000000001, 0.5769, 0.2871, 0.12009999999999998, 0.006900000000000017]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7505, 0.7498, 0.7484999999999999, 0.7473000000000001, 0.7463, 0.745, 0.7422, 0.7352000000000001, 0.719, 0.7045, 0.5942000000000001, 0.35929999999999995, 0.23640000000000005, 0.1129], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7505, 0.7499, 0.7488, 0.7477, 0.747, 0.7455, 0.7435, 0.7372000000000001, 0.7235, 0.7121, 0.6087, 0.33199999999999996, 0.1583, 0.018299999999999983], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7505, 0.7498, 0.7484999999999999, 0.7473000000000001, 0.7463, 0.745, 0.7422, 0.7351, 0.7186, 0.7027, 0.5778, 0.2611, 0.09609999999999996, 0.00539999999999996], "L2AdditiveUniformNoiseAttack()": [0.7505, 0.7505, 0.7505, 0.7505999999999999, 0.7507, 0.7508, 0.7505999999999999, 0.7507, 0.7504, 0.7504, 0.751, 0.7495, 0.7494000000000001, 0.7477], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7505, 0.7496, 0.7482, 0.7472, 0.7461, 0.7448, 0.7414000000000001, 0.7342, 0.7172000000000001, 0.7004, 0.5792999999999999, 0.2953, 0.13549999999999995, 0.011499999999999955], "robust_accuracy": [0.7505, 0.7496, 0.7482, 0.7472, 0.7461, 0.7448, 0.7414000000000001, 0.7341, 0.7172000000000001, 0.7, 0.5738, 0.2591, 0.09409999999999996, 0.0049000000000000155]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7536, 0.7525, 0.7514000000000001, 0.7507, 0.7505999999999999, 0.749, 0.7465999999999999, 0.7392000000000001, 0.7228, 0.7065, 0.6031, 0.36729999999999996, 0.23219999999999996, 0.11209999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7536, 0.7525999999999999, 0.7516, 0.7511, 0.7507, 0.75, 0.7476, 0.7416, 0.7282, 0.7132000000000001, 0.6154, 0.3275, 0.1452, 0.013499999999999956], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7536, 0.7525, 0.7514000000000001, 0.7507, 0.7505999999999999, 0.7489, 0.7465999999999999, 0.7392000000000001, 0.7221, 0.7052, 0.5876, 0.25539999999999996, 0.08540000000000003, 0.0024999999999999467], "L2AdditiveUniformNoiseAttack()": [0.7536, 0.7536, 0.7537, 0.7536, 0.7536, 0.7536, 0.7535000000000001, 0.7535000000000001, 0.7538, 0.753, 0.7537, 0.754, 0.7527, 0.7507], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7536, 0.7524, 0.7511, 0.7507, 0.7504, 0.7488, 0.7462, 0.7384999999999999, 0.7202, 0.7022999999999999, 0.5858, 0.2862, 0.12, 0.007800000000000029], "robust_accuracy": [0.7536, 0.7524, 0.7511, 0.7507, 0.7504, 0.7488, 0.7462, 0.7384999999999999, 0.7202, 0.7021, 0.5818, 0.25229999999999997, 0.08299999999999996, 0.0021999999999999797]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7501, 0.7494000000000001, 0.7489, 0.7483, 0.7477, 0.7459, 0.7423, 0.7367, 0.7223999999999999, 0.7086, 0.6062000000000001, 0.3722, 0.24129999999999996, 0.10360000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7501, 0.7496, 0.749, 0.7485999999999999, 0.748, 0.7468, 0.7439, 0.7384999999999999, 0.7257, 0.7152000000000001, 0.6224000000000001, 0.35440000000000005, 0.1805, 0.021700000000000053], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7501, 0.7494000000000001, 0.7489, 0.7483, 0.7477, 0.7459, 0.7423, 0.7365999999999999, 0.7221, 0.7070000000000001, 0.5923, 0.28669999999999995, 0.11409999999999998, 0.00660000000000005], "L2AdditiveUniformNoiseAttack()": [0.7501, 0.75, 0.75, 0.75, 0.75, 0.75, 0.7502, 0.75, 0.7503, 0.7502, 0.75, 0.7494000000000001, 0.7503, 0.7472], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7501, 0.7494000000000001, 0.7489, 0.7482, 0.7476, 0.7455, 0.7418, 0.7351, 0.7202, 0.7054, 0.5871999999999999, 0.3075, 0.14629999999999999, 0.013599999999999945], "robust_accuracy": [0.7501, 0.7494000000000001, 0.7489, 0.7482, 0.7476, 0.7455, 0.7418, 0.7351, 0.7202, 0.7051000000000001, 0.5845, 0.28080000000000005, 0.11019999999999996, 0.006099999999999994]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7482, 0.7477, 0.7469, 0.7462, 0.7448, 0.7438, 0.7408, 0.7334, 0.7177, 0.7021, 0.5979, 0.3739, 0.25939999999999996, 0.13880000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7482, 0.7477, 0.7474000000000001, 0.7465999999999999, 0.7457, 0.744, 0.742, 0.7363, 0.7219, 0.7078, 0.6074999999999999, 0.33089999999999997, 0.1523, 0.016900000000000026], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7482, 0.7477, 0.7469, 0.7462, 0.7448, 0.7438, 0.7407, 0.7332000000000001, 0.7174, 0.7011000000000001, 0.5791, 0.26139999999999997, 0.0938, 0.00539999999999996], "L2AdditiveUniformNoiseAttack()": [0.7482, 0.7482, 0.7482, 0.7483, 0.7483, 0.7482, 0.7482, 0.7484, 0.7482, 0.7481, 0.7476, 0.7489, 0.7462, 0.7472], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7482, 0.7477, 0.7469, 0.746, 0.7445999999999999, 0.7436, 0.7403, 0.7323, 0.7151000000000001, 0.6987, 0.5822, 0.2945, 0.13280000000000003, 0.011800000000000033], "robust_accuracy": [0.7482, 0.7477, 0.7469, 0.746, 0.7445999999999999, 0.7436, 0.7403, 0.7323, 0.7151000000000001, 0.6986, 0.5758, 0.2583, 0.09179999999999999, 0.005099999999999993]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7439, 0.7431, 0.7422, 0.7417, 0.741, 0.7397, 0.7374, 0.7299, 0.7148, 0.7019, 0.5932999999999999, 0.357, 0.22540000000000004, 0.09260000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7439, 0.7432000000000001, 0.7423, 0.742, 0.7414000000000001, 0.7404, 0.7384999999999999, 0.7322, 0.7192000000000001, 0.7075, 0.6093999999999999, 0.33819999999999995, 0.15959999999999996, 0.01639999999999997], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7439, 0.7431, 0.7422, 0.7417, 0.741, 0.7397, 0.7373000000000001, 0.7299, 0.7142999999999999, 0.7011000000000001, 0.5819, 0.27259999999999995, 0.09809999999999997, 0.005600000000000049], "L2AdditiveUniformNoiseAttack()": [0.7439, 0.7439, 0.7439, 0.7441, 0.744, 0.7439, 0.744, 0.7438, 0.7439, 0.744, 0.7441, 0.7444999999999999, 0.7442, 0.7424999999999999], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7439, 0.7431, 0.7421, 0.7416, 0.741, 0.7395, 0.7363999999999999, 0.7294, 0.7131000000000001, 0.6996, 0.5805, 0.30100000000000005, 0.13280000000000003, 0.011600000000000055], "robust_accuracy": [0.7439, 0.7431, 0.7421, 0.7416, 0.741, 0.7395, 0.7363999999999999, 0.7294, 0.7131000000000001, 0.6993, 0.5766, 0.26949999999999996, 0.09670000000000001, 0.0050000000000000044]}}, "32": {"0": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7342, 0.7335, 0.7328, 0.7318, 0.7308, 0.7295, 0.7263, 0.718, 0.7021, 0.6845, 0.5721, 0.33819999999999995, 0.21450000000000002, 0.09160000000000001], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7342, 0.7337, 0.7329, 0.7321, 0.7314, 0.7306, 0.7268, 0.7201, 0.7063999999999999, 0.6925, 0.5882000000000001, 0.31610000000000005, 0.14670000000000005, 0.012199999999999989], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7342, 0.7335, 0.7328, 0.7318, 0.7308, 0.7295, 0.7263, 0.7178, 0.7015, 0.6839, 0.5596, 0.24870000000000003, 0.0877, 0.0041999999999999815], "L2AdditiveUniformNoiseAttack()": [0.7342, 0.7342, 0.7342, 0.7342, 0.7341, 0.7341, 0.7342, 0.7341, 0.7344999999999999, 0.7342, 0.7348, 0.7348, 0.7343999999999999, 0.7314], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7342, 0.7334, 0.7325999999999999, 0.7317, 0.7307, 0.7294, 0.7261, 0.7168, 0.7006, 0.6820999999999999, 0.562, 0.28169999999999995, 0.12390000000000001, 0.009000000000000008], "robust_accuracy": [0.7342, 0.7334, 0.7325999999999999, 0.7317, 0.7307, 0.7294, 0.7261, 0.7168, 0.7005, 0.6818, 0.5573, 0.24680000000000002, 0.08609999999999995, 0.0030999999999999917]}, "1": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7451, 0.7444, 0.7438, 0.7432000000000001, 0.7424999999999999, 0.7402, 0.7361, 0.7289, 0.7147, 0.7010000000000001, 0.6007, 0.37139999999999995, 0.2538, 0.13529999999999998], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7451, 0.7444, 0.7439, 0.7434000000000001, 0.7429, 0.7413000000000001, 0.7375, 0.7311000000000001, 0.719, 0.7070000000000001, 0.6135999999999999, 0.3527, 0.18400000000000005, 0.031000000000000028], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7451, 0.7444, 0.7438, 0.7432000000000001, 0.7424999999999999, 0.7402, 0.7361, 0.7288, 0.7142, 0.7004, 0.5872999999999999, 0.28759999999999997, 0.12239999999999995, 0.01639999999999997], "L2AdditiveUniformNoiseAttack()": [0.7451, 0.7451, 0.7451, 0.7451, 0.7451, 0.7451, 0.7452, 0.7454000000000001, 0.7451, 0.7453000000000001, 0.7444999999999999, 0.7438, 0.7442, 0.7434000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7451, 0.7443, 0.7438, 0.743, 0.7424, 0.7398, 0.7356, 0.7279, 0.7132000000000001, 0.6991, 0.5912, 0.32310000000000005, 0.1673, 0.019399999999999973], "robust_accuracy": [0.7451, 0.7443, 0.7438, 0.743, 0.7424, 0.7398, 0.7356, 0.7279, 0.7131000000000001, 0.6991, 0.5849, 0.28559999999999997, 0.12060000000000004, 0.010000000000000009]}, "2": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7465999999999999, 0.7462, 0.7454000000000001, 0.745, 0.7444999999999999, 0.7431, 0.7409, 0.7323, 0.7162999999999999, 0.7011000000000001, 0.6056, 0.3738, 0.24719999999999998, 0.12670000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7465999999999999, 0.7463, 0.7456, 0.7452, 0.7448, 0.7435, 0.742, 0.7356, 0.7216, 0.7071000000000001, 0.618, 0.34440000000000004, 0.16379999999999995, 0.015900000000000025], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7465999999999999, 0.7462, 0.7454000000000001, 0.7449, 0.7444999999999999, 0.7431, 0.7409, 0.732, 0.7157, 0.7004, 0.5927, 0.27170000000000005, 0.09689999999999999, 0.0049000000000000155], "L2AdditiveUniformNoiseAttack()": [0.7465999999999999, 0.7465999999999999, 0.7465999999999999, 0.7464999999999999, 0.7464999999999999, 0.7465999999999999, 0.7466999999999999, 0.7464999999999999, 0.7466999999999999, 0.747, 0.7471, 0.747, 0.7473000000000001, 0.7455], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7465999999999999, 0.7462, 0.7452, 0.7449, 0.7444999999999999, 0.7428, 0.7403, 0.7312000000000001, 0.7150000000000001, 0.6988, 0.5938, 0.3067, 0.13749999999999996, 0.011600000000000055], "robust_accuracy": [0.7465999999999999, 0.7462, 0.7452, 0.7449, 0.7444999999999999, 0.7428, 0.7403, 0.7312000000000001, 0.7150000000000001, 0.6986, 0.5887, 0.2681, 0.0948, 0.0041999999999999815]}, "3": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7649, 0.7644, 0.7637, 0.7632, 0.7628, 0.7614, 0.7585, 0.7505999999999999, 0.7375, 0.7246, 0.6228, 0.392, 0.26470000000000005, 0.12680000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7649, 0.7645, 0.7639, 0.7634, 0.7629, 0.7621, 0.7596, 0.7527, 0.7409, 0.7297, 0.6385000000000001, 0.3647, 0.18500000000000005, 0.022499999999999964], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7649, 0.7644, 0.7637, 0.7632, 0.7628, 0.7613, 0.7585, 0.7505999999999999, 0.7371, 0.7233, 0.608, 0.29700000000000004, 0.11580000000000001, 0.00880000000000003], "L2AdditiveUniformNoiseAttack()": [0.7649, 0.7648, 0.7649, 0.7649, 0.7649, 0.765, 0.7649, 0.7649, 0.7648, 0.7646, 0.7652, 0.7642, 0.7632, 0.7626], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7649, 0.7644, 0.7636000000000001, 0.7632, 0.7628, 0.7611, 0.7582, 0.7498, 0.7354, 0.7219, 0.6107, 0.3295, 0.1593, 0.014900000000000024], "robust_accuracy": [0.7649, 0.7644, 0.7636000000000001, 0.7632, 0.7628, 0.7611, 0.7582, 0.7498, 0.7352000000000001, 0.7217, 0.6054999999999999, 0.29300000000000004, 0.11319999999999997, 0.006399999999999961]}, "4": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7423, 0.7415, 0.741, 0.7404999999999999, 0.7397, 0.7377, 0.7345999999999999, 0.727, 0.7114, 0.6966, 0.5886, 0.36729999999999996, 0.23860000000000003, 0.11429999999999996], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7423, 0.7416, 0.7411, 0.7407, 0.7399, 0.7384999999999999, 0.7361, 0.7287, 0.7159, 0.7030000000000001, 0.6023000000000001, 0.3426, 0.17200000000000004, 0.02429999999999999], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7423, 0.7415, 0.741, 0.7404999999999999, 0.7397, 0.7377, 0.7345999999999999, 0.727, 0.7110000000000001, 0.6953, 0.5752999999999999, 0.27270000000000005, 0.11060000000000003, 0.00770000000000004], "L2AdditiveUniformNoiseAttack()": [0.7423, 0.7423, 0.7423, 0.7424, 0.7422, 0.7422, 0.7424, 0.7423, 0.7422, 0.7424, 0.7416, 0.7421, 0.7404999999999999, 0.739], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7423, 0.7415, 0.741, 0.7403, 0.7391, 0.7372000000000001, 0.7341, 0.7259, 0.7090000000000001, 0.6933, 0.575, 0.30000000000000004, 0.14380000000000004, 0.015800000000000036], "robust_accuracy": [0.7423, 0.7415, 0.741, 0.7403, 0.7391, 0.7372000000000001, 0.7341, 0.7259, 0.7090000000000001, 0.6932, 0.5709, 0.268, 0.10860000000000003, 0.00660000000000005]}, "5": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7437, 0.7429, 0.7422, 0.7415, 0.7404, 0.739, 0.7362, 0.7281, 0.7105, 0.6939, 0.5886, 0.3526, 0.22430000000000005, 0.10470000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7437, 0.7431, 0.7424, 0.7417, 0.741, 0.7397, 0.7372000000000001, 0.7303, 0.7166, 0.7001999999999999, 0.6014999999999999, 0.3208, 0.13990000000000002, 0.010000000000000009], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7437, 0.7429, 0.7422, 0.7415, 0.7404, 0.739, 0.7359, 0.7281, 0.7103999999999999, 0.6929000000000001, 0.5726, 0.24609999999999999, 0.0806, 0.0027000000000000357], "L2AdditiveUniformNoiseAttack()": [0.7437, 0.7437, 0.7436, 0.7437, 0.7436, 0.7436, 0.7437, 0.7439, 0.7437, 0.7439, 0.7438, 0.7433000000000001, 0.7414000000000001, 0.7393000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7437, 0.7428, 0.742, 0.7414000000000001, 0.7402, 0.7389, 0.7354, 0.7272000000000001, 0.7082999999999999, 0.6905, 0.5717, 0.2825, 0.11309999999999998, 0.007600000000000051], "robust_accuracy": [0.7437, 0.7428, 0.742, 0.7414000000000001, 0.7402, 0.7389, 0.7354, 0.7272000000000001, 0.7082999999999999, 0.6905, 0.5676, 0.24260000000000004, 0.07850000000000001, 0.0021999999999999797]}, "6": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7253000000000001, 0.7248, 0.7242, 0.7236, 0.7227, 0.7206, 0.7182, 0.7119, 0.6980999999999999, 0.6832, 0.5805, 0.35450000000000004, 0.22850000000000004, 0.10409999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7253000000000001, 0.7248, 0.7242999999999999, 0.7238, 0.7229, 0.7212000000000001, 0.719, 0.7137, 0.7026, 0.6900999999999999, 0.5972, 0.3409, 0.17759999999999998, 0.02749999999999997], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7253000000000001, 0.7248, 0.7242, 0.7236, 0.7227, 0.7206, 0.7181, 0.7117, 0.6979, 0.6827, 0.5698, 0.2772, 0.12019999999999997, 0.008199999999999985], "L2AdditiveUniformNoiseAttack()": [0.7253000000000001, 0.7253000000000001, 0.7253000000000001, 0.7253000000000001, 0.7253000000000001, 0.7253000000000001, 0.7253000000000001, 0.7253000000000001, 0.7255, 0.7253000000000001, 0.7255, 0.7238, 0.7243999999999999, 0.7235], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7253000000000001, 0.7247, 0.724, 0.7233, 0.7224999999999999, 0.7203999999999999, 0.7179, 0.7110000000000001, 0.6957, 0.6805, 0.5689, 0.30279999999999996, 0.1512, 0.018199999999999994], "robust_accuracy": [0.7253000000000001, 0.7247, 0.724, 0.7233, 0.7224999999999999, 0.7203999999999999, 0.7179, 0.7109, 0.6957, 0.6805, 0.5653, 0.2733, 0.118, 0.007399999999999962]}, "7": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7559, 0.7552, 0.754, 0.7531, 0.7525, 0.7504, 0.7461, 0.7389, 0.723, 0.7094, 0.6073999999999999, 0.38670000000000004, 0.2669, 0.13590000000000002], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7559, 0.7553, 0.7541, 0.7535000000000001, 0.7527, 0.7512, 0.7475, 0.7413000000000001, 0.7275, 0.7158, 0.6199, 0.34819999999999995, 0.1703, 0.018000000000000016], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7559, 0.7552, 0.754, 0.7531, 0.7525, 0.7504, 0.7461, 0.7388, 0.7223999999999999, 0.7083999999999999, 0.5904, 0.2751, 0.10629999999999995, 0.0049000000000000155], "L2AdditiveUniformNoiseAttack()": [0.7559, 0.7559, 0.7559, 0.7559, 0.756, 0.7559, 0.7559, 0.7558, 0.756, 0.7559, 0.7558, 0.7549, 0.7554, 0.7538], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7559, 0.7552, 0.754, 0.753, 0.7524, 0.7497, 0.7458, 0.738, 0.7209, 0.7061, 0.5904, 0.3097, 0.1441, 0.013700000000000045], "robust_accuracy": [0.7559, 0.7552, 0.754, 0.753, 0.7524, 0.7497, 0.7458, 0.738, 0.7207, 0.7059, 0.5857, 0.272, 0.10340000000000005, 0.0040999999999999925]}, "8": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.7568, 0.7564, 0.7556, 0.7547, 0.7539, 0.7527, 0.7492, 0.7433000000000001, 0.7294, 0.7139, 0.6043000000000001, 0.3719, 0.24039999999999995, 0.11119999999999997], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.7568, 0.7565, 0.756, 0.7553, 0.7544, 0.7531, 0.7502, 0.7449, 0.7327, 0.7201, 0.6195999999999999, 0.3458, 0.1664, 0.014800000000000035], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.7568, 0.7564, 0.7556, 0.7547, 0.7539, 0.7525999999999999, 0.7492, 0.7432000000000001, 0.7288, 0.7133, 0.5912, 0.27259999999999995, 0.10019999999999996, 0.0031999999999999806], "L2AdditiveUniformNoiseAttack()": [0.7568, 0.7569, 0.7568, 0.7568, 0.7569, 0.7569, 0.7569, 0.7568, 0.7568, 0.7568, 0.757, 0.758, 0.7582, 0.7556], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.7568, 0.7564, 0.7554, 0.7545999999999999, 0.7539, 0.7525, 0.7492, 0.7428, 0.7275, 0.7118, 0.5925, 0.3084, 0.14080000000000004, 0.008900000000000019], "robust_accuracy": [0.7568, 0.7564, 0.7554, 0.7545999999999999, 0.7539, 0.7525, 0.7492, 0.7428, 0.7275, 0.7117, 0.5878, 0.2704, 0.09899999999999998, 0.0020999999999999908]}, "9": {"L2FastGradientAttack(rel_stepsize=1.0, abs_stepsize=None, steps=1, random_start=False)": [0.748, 0.7473000000000001, 0.7466999999999999, 0.7464, 0.7451, 0.744, 0.7405999999999999, 0.7337, 0.7178, 0.7029000000000001, 0.5962000000000001, 0.36729999999999996, 0.23719999999999997, 0.10150000000000003], "L2ProjectedGradientDescentAttack(rel_stepsize=0.025, abs_stepsize=None, steps=50, random_start=True)": [0.748, 0.7473000000000001, 0.7468, 0.7464999999999999, 0.7457, 0.7445999999999999, 0.742, 0.7361, 0.7231000000000001, 0.7087, 0.6093, 0.3477, 0.17079999999999995, 0.01759999999999995], "L2BasicIterativeAttack(rel_stepsize=0.2, abs_stepsize=None, steps=10, random_start=False)": [0.748, 0.7473000000000001, 0.7466999999999999, 0.7463, 0.7451, 0.744, 0.7405999999999999, 0.7334, 0.7172000000000001, 0.702, 0.5797, 0.2803, 0.10460000000000003, 0.0049000000000000155], "L2AdditiveUniformNoiseAttack()": [0.748, 0.748, 0.748, 0.7481, 0.748, 0.748, 0.7481, 0.7479, 0.748, 0.7483, 0.7486999999999999, 0.7476, 0.7472, 0.7454000000000001], "L2DeepFoolAttack(steps=50, candidates=10, overshoot=0.02, loss=logits)": [0.748, 0.7473000000000001, 0.7466999999999999, 0.7463, 0.745, 0.7438, 0.7402, 0.7331, 0.7159, 0.7005, 0.5811, 0.3106, 0.14100000000000001, 0.011299999999999977], "robust_accuracy": [0.748, 0.7473000000000001, 0.7466999999999999, 0.7463, 0.745, 0.7438, 0.7402, 0.733, 0.7159, 0.7001999999999999, 0.5755, 0.2784, 0.10260000000000002, 0.0041999999999999815]}}}}