Cycle-Consistent Adversarial GAN: The Integration of Adversarial Attack and Defense

Table 3

Classification accuracy rates of adversarial examples crafted by FGSM, BIM, PGD, and CycleAdvGAN. FGSM (attack with ) and FGSM (defense with ) means that we train the CycleAdvGAN with the adversarial examples crafted by FGSM.

Method	MNIST		CIFAR10
	A	B	Resnet-18	VGG-16
FGSM [8]	6.12	10.53	10.27	13.2
FGSM (attack with )	2.54	1.27	5.2	3.6
FGSM (defense with )	98.12	92.45	54.8	43.8
BIM [9]	0.76	1.13	8.96	8.97
BIM (attack with )	0.6	0.43	1.98	2.6
BIM (defense with )	94.6	93.15	44.8	38.6
PGD [24]	0.67	0.88	9.8	8.51
PGD (attack with )	0.54	0.46	2.2	2.4
PGD (defense with )	95.4	94.3	48.2	40.4