Adversarial Purification on CIFAR-10
96Standard AccuracyFlowPurePGD
Evaluation results
| Method | Links | ||||
|---|---|---|---|---|---|
| FlowPurePGDType=Standard Accuracy2025.05 | 96 | 96 | — | — | |
| FlowPureCWType=Standard Accuracy2025.05 | 95.96 | 95.96 | — | — | |
| VictimType=Standard Accuracy2025.05 | 95.81 | 95.81 | — | — | |
| Nie et al. (2022) + SSNI-LBackbone=WRN-70-162025.06 | 94.99 | 84.44 | — | — | |
| FlowPureCWType=Robust Accuracy, Setting=Preprocessor-blind, Attack=CW2025.05 | 94.36 | 94.36 | — | — | |
| Wang et al. (2022) + SSNI-NClassifier=WideResNet-28-10, Attack Type=BPDA+EOT l_inf (eps=8/255), Sample-Specific Noise Injection (SSNI-N)=true2025.06 | 94.08 | 80.99 | — | — | |
| Wang et al. (2022) + SSNI-LBackbone=WRN-70-162025.06 | 93.88 | 43.03 | — | — | |
| Wang et al. (2022) + SSNI-LBackbone=WRN-70-162025.06 | 93.88 | 82.88 | — | — | |
| Nie et al. (2022) + SSNI-LBackbone=WRN-70-162025.06 | 93.82 | 49.94 | — | — | |
| Nie et al. (2022) + SSNI-LBackbone=WRN-28-102025.06 | 93.82 | 81.12 | — | — | |
| Wang et al. (2022) + SSNI-LBackbone=WRN-28-102025.06 | 93.62 | 36.59 | — | — | |
| Wang et al. (2022) + SSNI-LBackbone=WRN-28-102025.06 | 93.62 | 80.66 | — | — | |
| Lee & Kim (2023) + SSNI-NClassifier=WideResNet-28-10, Attack Type=BPDA+EOT l_inf (eps=8/255), Sample-Specific Noise Injection (SSNI-N)=true2025.06 | 93.55 | 87.3 | — | — | |
| Lee & Kim (2023) + SSNI-LBackbone=WRN-28-102025.06 | 93.49 | 53.71 | — | — | |
| Lee & Kim (2023) + SSNI-LBackbone=WRN-28-102025.06 | 93.49 | 85.29 | — | — | |
| Nie et al. (2022) + SSNI-NClassifier=WideResNet-28-10, Attack Type=BPDA+EOT l_inf (eps=8/255), Sample-Specific Noise Injection (SSNI-N)=true2025.06 | 93.29 | 82.1 | — | — | |
| Wang et al. (2022)Backbone=WRN-70-162025.06 | 93.1 | 43.55 | — | — | |
| Wang et al. (2022)Backbone=WRN-70-162025.06 | 93.1 | 85.03 | — | — | |
| Nie et al. (2022) + SSNI-LBackbone=WRN-28-102025.06 | 92.97 | 46.35 | — | — | |
| Nie et al. (2022)Backbone=WRN-70-162025.06 | 92.9 | 82.94 | — | — | |
| Lee & Kim (2023) + SSNI-LBackbone=WRN-70-162025.06 | 92.64 | 52.86 | — | — | |
| Lee & Kim (2023) + SSNI-LBackbone=WRN-70-162025.06 | 92.64 | 84.9 | — | — | |
| Wang et al. (2022)Classifier=WideResNet-28-10, Attack Type=BPDA+EOT l_inf (eps=8/255), Sample-Specific Noise Injection (SSNI-N)=false2025.06 | 92.45 | 79.88 | — | — | |
| Wang et al. (2022)Backbone=WRN-28-102025.06 | 92.45 | 36.72 | — | — | |
| Wang et al. (2022)Backbone=WRN-28-102025.06 | 92.45 | 82.29 | — | — | |
| GDMPType=Standard Accuracy2025.05 | 92.41 | 80.81 | — | — | |
| GDMPType=Robust Accuracy, Setting=Preprocessor-blind, Attack=CW2025.05 | 92.37 | 80.59 | — | — | |
| FlowPurePGDType=Robust Accuracy, Setting=Preprocessor-blind, Attack=PGD2025.05 | 92.23 | 92.23 | — | — | |
| ADBMType=Standard Accuracy2025.05 | 91.93 | 78.77 | — | — | |
| Nie et al. (2022)Backbone=WRN-28-102025.06 | 91.8 | 82.81 | — | — | |
| GDMPType=Robust Accuracy, Setting=Preprocessor-blind, Attack=PGD2025.05 | 91.48 | 78.67 | — | — | |
| FlowPurePGDType=Robust Accuracy, Setting=Preprocessor-blind, Attack=CW2025.05 | 91.45 | 91.45 | — | — | |
| Nie et al. (2022)Backbone=WRN-70-162025.06 | 90.89 | 52.15 | — | — | |
| ADBMType=Robust Accuracy, Setting=Preprocessor-blind, Attack=CW2025.05 | 90.25 | 74.86 | — | — | |
| Lee & Kim (2023)Classifier=WideResNet-28-10, Attack Type=BPDA+EOT l_inf (eps=8/255), Sample-Specific Noise Injection (SSNI-N)=false2025.06 | 90.1 | 88.4 | — | — | |
| Lee & Kim (2023)Backbone=WRN-28-102025.06 | 90.1 | 56.05 | — | — | |
| Lee & Kim (2023)Backbone=WRN-28-102025.06 | 90.1 | 83.66 | — | — | |
| DiffPureType=Standard Accuracy2025.05 | 89.99 | 73.69 | — | — | |
| DiffPureType=Robust Accuracy, Setting=Preprocessor-blind, Attack=CW2025.05 | 89.82 | 73.76 | — | — | |
| Nie et al. (2022)Classifier=WideResNet-28-10, Attack Type=BPDA+EOT l_inf (eps=8/255), Sample-Specific Noise Injection (SSNI-N)=false2025.06 | 89.71 | 81.9 | — | — | |
| Nie et al. (2022)Backbone=WRN-28-102025.06 | 89.71 | 47.98 | — | — | |
| FlowPureGaussType=Standard Accuracy2025.05 | 89.6 | 74.59 | — | — | |
| FlowPureGaussType=Robust Accuracy, Setting=Preprocessor-blind, Attack=CW2025.05 | 89.44 | 74.31 | — | — | |
| Lee & Kim (2023)Backbone=WRN-70-162025.06 | 89.39 | 56.97 | — | — | |
| Lee & Kim (2023)Backbone=WRN-70-162025.06 | 89.39 | 84.51 | — | — | |
| DiffPureType=Robust Accuracy, Setting=Preprocessor-blind, Attack=PGD2025.05 | 89.1 | 72.25 | — | — | |
| ADBMType=Robust Accuracy, Setting=Preprocessor-blind, Attack=PGD2025.05 | 89.08 | 72.59 | — | — | |
| FlowPureGaussType=Robust Accuracy, Setting=Preprocessor-blind, Attack=PGD2025.05 | 88.81 | 72.79 | — | — | |
| FlowPureCWType=Robust Accuracy, Setting=Preprocessor-blind, Attack=PGD2025.05 | 87.33 | 87.33 | — | — | |
| LMType=Standard Accuracy2025.05 | 82.94 | 65.03 | — | — | |
| LMType=Robust Accuracy, Setting=Preprocessor-blind, Attack=CW2025.05 | 78.7 | 56.2 | — | — | |
| FlowPureGaussType=Robust Accuracy, Setting=White-box, Attack=BPDA2025.05 | 73.95 | 46.09 | — | — | |
| GDMPType=Robust Accuracy, Setting=White-box, Attack=BPDA2025.05 | 73.23 | 47.46 | — | — | |
| DiffPureType=Robust Accuracy, Setting=White-box, Attack=BPDA2025.05 | 71.74 | 41.4 | — | — | |
| LMType=Robust Accuracy, Setting=Preprocessor-blind, Attack=PGD2025.05 | 67.61 | 44.86 | — | — | |
| ADBMType=Robust Accuracy, Setting=White-box, Attack=BPDA2025.05 | 65.25 | 36.26 | — | — | |
| LMType=Robust Accuracy, Setting=White-box, Attack=BPDA2025.05 | 50.96 | 24.86 | — | — | |
| FlowPureGaussType=Robust Accuracy, Setting=White-box, Attack=DH2025.05 | 43.12 | 21.87 | — | — | |
| DiffPureType=Robust Accuracy, Setting=White-box, Attack=DH2025.05 | 40.64 | 17.7 | — | — | |
| GDMPType=Robust Accuracy, Setting=White-box, Attack=DH2025.05 | 33.78 | 14.9 | — | — | |
| ADBMType=Robust Accuracy, Setting=White-box, Attack=DH2025.05 | 32.35 | 13.15 | — | — | |
| FlowPureCWType=Robust Accuracy, Setting=White-box, Attack=BPDA2025.05 | 23.43 | 23.43 | — | — | |
| FlowPurePGDType=Robust Accuracy, Setting=White-box, Attack=BPDA2025.05 | 13.34 | 13.34 | — | — | |
| LMType=Robust Accuracy, Setting=White-box, Attack=DH2025.05 | 12.55 | 4.82 | — | — | |
| FlowPurePGDType=Robust Accuracy, Setting=White-box, Attack=DH2025.05 | 1.17 | 1.17 | — | — | |
| FlowPureCWType=Robust Accuracy, Setting=White-box, Attack=DH2025.05 | 1.11 | 1.11 | — | — | |
| VictimType=Robust Accuracy, Setting=Preprocessor-blind, Attack=PGD2025.05 | 0.04 | 0.04 | — | — | |
| VictimType=Robust Accuracy, Setting=Preprocessor-blind, Attack=CW2025.05 | 0 | 0 | — | — | |
| DiffpureClassifier=WideResNet-70-162026.07 | — | — | 42.2 | 60.8 | |
| DiffpureClassifier=ResNet-502026.07 | — | — | 38.02 | 54.74 | |
| RAMRM-PureMAEClassifier=WideResNet-70-162026.07 | — | — | 44.27 | 62.42 | |
| RAMRM-PureMAEClassifier=ResNet-502026.07 | — | — | 43.72 | 60.08 | |
| RAMRM-PureMaskDiTClassifier=WideResNet-70-162026.07 | — | — | 58.37 | 68.55 | |
| RAMRM-PureMaskDiTClassifier=ResNet-502026.07 | — | — | 54.22 | 67.15 |