Table 5. Ablation experiment of the ensemble model FRs.

Model info	Training costs		Visual quality			Attack performance
	TruePert	Epoch	SSIM	PSNR	MSE	ASR1	ASR2	FSS&FTS
M 1	4.49	1,490	95.02	32.37	34.81	69.47	68.53	60.71&34.06
M 2	4.55	1,490	94.49	32.23	36.12	91.42	87.50	52.83&47.77
M 3	4.56	1,490	94.40	32.26	36.10	91.83	87.90	53.62&48.39
M 4	4.05	1,490	95.36	33.37	28.76	89.12	86.63	58.00&46.83
M 4	4.32	2,490	95.14	32.70	32.57	92.28	89.65	55.63&49.25