Complete Defense Framework to Protect Deep Neural Networks against Adversarial Examples

Table 10

Classification accuracy of adv-Inception-v3 as targeted network (%).

The proportion of legitimate examples (%)	0	10	20	30	40	50	60	70	80	90	100	Average
Adv-inception-v3	89.9	90.6	91.2	92.0	92.9	93.6	94.4	95.1	96.4	96.9	97.3	93.7
ResGN + Adv-inception-v3	98.4	98.5	98.7	98.8	99.0	99.1	99.3	99.3	99.4	99.5	99.8	99.1
Detection + ResGN + Adv-inception-v3	98.2	98.4	98.7	98.9	99.1	99.2	99.4	99.5	99.7	99.8	99.9	99.2
Randomization + Adv-inception-v3	89.3	89.7	90.3	91.7	92.3	93.1	93.8	94.3	95.1	95.8	96.2	92.9
HGD + Adv-inception-v3	84.3	84.9	85.8	86.4	87.5	88.3	89.2	90.1	90.5	91.1	92.1	88.2
ComDefend + Adv-inception-v3	89.1	89.6	90.3	90.5	91.1	91.3	91.9	92.3	92.5	93.4	94.6	91.5