| Pixel changes | 4 0.0080% | 8 0.0159% | 16 0.0319% | 32 0.0638% | 64 0.1276% | |
| ResNet101-4 | Misclassification Recognition rate | 22 97.80% | 21 97.90% | 24 97.60% | 21 97.90% | 27 97.30% |
| ResNet101-8 | Misclassification Recognition rate | 22 97.80% | 22 97.80% | 25 97.50% | 28 97.20% | 31 96.90% |
| ResNet101-16 | Misclassification Recognition rate | 29 97.90% | 30 97.00% | 28 97.20% | 29 97.10% | 37 96.30% |
| ResNet101-32 | Misclassification Recognition rate | 27 97.30% | 26 97.40% | 29 97.10% | 32 96.80% | 35 96.50% |
| ResNet101-64 | Misclassification Recognition rate | 47 95.30% | 48 95.20% | 50 95.00% | 52 94.80% | 55 94.50% |