Table 2. The different targets’ AP of YOLOv4-NWPU under different adversarial attacks.
| Kind name | I-FGSM | ADM-I-FGSM | Difference | PGD | ADM-PGD | Difference |
|---|---|---|---|---|---|---|
| Airplane | 6.64% | 1.62% | 5.02% | 9.50% | 3.27% | 6.23% |
| Ship | 1.81% | 0.43% | 1.38% | 2.73% | 1.30% | 1.43% |
| Storage tank | 0.25% | 1.62% | −1.36% | 0.40% | 3.25% | −2.85% |
| Baseball diamond | 7.72% | 0.93% | 6.79% | 15.76% | 1.39% | 14.37% |
| Tennis court | 9.10% | 0.12% | 8.99% | 9.23% | 0.39% | 8.84% |
| Basketball court | 0.01% | 0.01% | 0.00% | 0.01% | 0.01% | 0.00% |
| Ground track field | 4.99% | 1.05% | 3.94% | 6.82% | 3.08% | 3.74% |
| Harbor | 0.02% | 0.01% | 0.02% | 0.54% | 0.93% | −0.39% |
| Bridge | 0.01% | 0.00% | 0.01% | 0.01% | 0.00% | 0.01% |
| Vehicle | 0.28% | 2.19% | −1.91% | 0.33% | 8.79% | −8.46% |
| mAP | 3.08% | 0.8% | 2.28% | 4.53% | 2.24% | 2.29% |
Note:
The difference is equal to the AP without ADM method minus the AP with ADM method.