The percentage of attack attempts that successfully cause a model to behave as the attacker intended.