Adversarial Image Classification on EMNIST Letters
81.4Clean AccuracyAdvTrain (off)
Evaluation results
| Method | Links | ||||
|---|---|---|---|---|---|
| AdvTrain (off)Attack=Black-Box Transfer PGD-20, ρ=0.9, Surrogate Model=SimpleCNN2026.05 | 81.4 | 70.1 | 80.5 | — | |
| AdvTrainAdversarial Training=off2026.05 | 81.4 | 0 | 13 | 212 | |
| Vanilla2026.05 | 80.8 | 12.2 | 37.1 | 114 | |
| VanillaAttack=Black-Box Transfer PGD-20, ρ=0.9, Surrogate Model=SimpleCNN2026.05 | 80.7 | 89.1 | 92.8 | — | |
| Selective (off)Attack=Black-Box Transfer PGD-20, ρ=0.9, Surrogate Model=SimpleCNN2026.05 | 80.7 | 82.3 | 89.9 | — | |
| Two-Stage Sel.Attack=Black-Box Transfer PGD-20, ρ=0.9, Surrogate Model=SimpleCNN2026.05 | 80.7 | 85.5 | 90.7 | — | |
| SelectiveSelective Mechanism=off2026.05 | 80.7 | 7.8 | 27.2 | 209 | |
| SelectiveSelective Mechanism=on2026.05 | 80.7 | 6.4 | 25.8 | 210 | |
| Two-Stage Sel.2026.05 | 80.7 | 22.5 | 39.8 | 228 | |
| AdvTrain (on)Attack=Black-Box Transfer PGD-20, ρ=0.9, Surrogate Model=SimpleCNN2026.05 | 80.4 | 70 | 79.5 | — | |
| AdvTrainAdversarial Training=on2026.05 | 80.4 | 5.8 | 26.9 | 226 | |
| Selective (on)Attack=Black-Box Transfer PGD-20, ρ=0.9, Surrogate Model=SimpleCNN2026.05 | 80.3 | 83.7 | 90.4 | — | |
| Sep-AwareAttack=Black-Box Transfer PGD-20, ρ=0.9, Surrogate Model=SimpleCNN2026.05 | 80.3 | 72.8 | 80.8 | — | |
| Sep-Aware2026.05 | 80.3 | 5.1 | 26.8 | 226 |