Adversarial Robust Image Classification on CIFAR-10 (test)
95.9Accuracy (Clean)AT-l_2
Evaluation results
| Method | Links | ||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| AT-l_2Backbone=EDM2024.10 | 95.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 53.32 | 84.77 | — | — | — | — | — | — | — | — | — | — | 5.08 | 47.72 | |
| Rebuffi et al.Classifier=WideResNet-70-16, Extra data=true2023.12 | 95.74 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 81.44 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AS (adaptive smoothing)Robust base model=EDM + TRADES [89]2023.01 | 95.23 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 68.06 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PC-DARTSTraining-free NAS=false, Params (M)=3.6, Search Time (GPU sec)=83552023.06 | 95.14 | 17.74 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 73.57 | 29.76 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SBGCBackbone=SCORE SDE2024.10 | 95.04 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 0 | 0 | — | — | — | — | — | — | — | — | — | — | 0 | 0 | |
| Song et al.Purification=Gibbs Update, Backbone=WideResNet-28-102023.12 | 95 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RobNetTraining-free NAS=false, Params (M)=5.44, Search Time (GPU sec)=2740622023.06 | 94.94 | 14.69 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 72.49 | 25.42 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Gowal et al.Classifier=WideResNet-70-16, Extra data=true2023.12 | 94.74 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 79.88 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| CRoZeTraining-free NAS=true, Params (M)=5.52, Search Time (GPU sec)=170662023.06 | 94.34 | 20.51 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 74.11 | 33.07 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DrNASTraining-free NAS=false, Params (M)=4.1, Search Time (GPU sec)=468572023.06 | 94.18 | 15.63 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 71.79 | 26.71 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Traditional Poisoning AttackNetwork=ResNet, Trigger Pattern=Watermark, Pre-trained Model Accuracy=92%2021.06 | 94 | — | — | — | — | — | — | — | — | — | — | — | — | — | 100 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Yang et al.Purification=Mask+Recon., Backbone=WideResNet-28-102023.12 | 94 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 15 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SODEF+TRADES2023.01 | 93.73 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 71.28 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GDPMClassifier=WideResNet-28-102023.12 | 93.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 90.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GDMPThreat Model=BPDA + EOT, EOT=20, epsilon=8/255, norm=l_infinity2024.10 | 93.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 76.22 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AdvRushTraining-free NAS=false, Params (M)=4.2, Search Time (GPU sec)=2512452023.06 | 93.44 | 14.94 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 71.43 | 25.67 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AT-l_infBackbone=EDM2024.10 | 93.36 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 70.9 | 69.73 | — | — | — | — | — | — | — | — | — | — | 2.93 | 47.85 | |
| NaturalBackbone=MobileNet-v22023.12 | 93.35 | 12.21 | — | 0 | — | — | — | — | — | — | — | — | — | — | — | 0 | — | — | — | — | 85.2 | 0 | — | 0 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 0.036 | 0.9 | 0.75 | 0 | 0 | 0 | 0 | 0 | — | — | |
| Diffusion (EDM)+TRADES2023.01 | 93.25 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 70.69 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Nie et al.Classifier=WideResNet-70-16, Extra data=false2023.12 | 93.24 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 81.17 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AT-l_2Backbone=DDPM2024.10 | 93.16 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 49.41 | 81.05 | — | — | — | — | — | — | — | — | — | — | 5.27 | 45.24 | |
| GradNormTraining-free NAS=true, Params (M)=4.69, Search Time (GPU sec)=97402023.06 | 92.95 | 15.64 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 63.03 | 26.78 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Rebuffi et al.Classifier=WideResNet-70-16, Extra data=false2023.12 | 92.41 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 80.86 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Augustin et al.Classifier=WideResNet-28-10, Extra data=true2023.12 | 92.23 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 77.93 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Diffusion (DDPM)+TRADES2023.01 | 92.23 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 66.58 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SynFlowTraining-free NAS=true, Params (M)=5.08, Search Time (GPU sec)=101382023.06 | 92.15 | 12.65 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 70.74 | 22.22 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Handcrafted Backdoor AttackNetwork=ResNet, Trigger Pattern=Watermark, Pre-trained Model Accuracy=92%2021.06 | 92 | — | — | — | — | — | — | — | — | — | — | — | — | — | 100 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GDPMClassifier=WideResNet-28-10, Extra data=false2023.12 | 92 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 75.28 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Prototype Conformity Loss (PCL)epsilon=4/2552019.04 | 91.9 | 85.3 | 70.1 | 69.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Rebuffi et al.Classifier=WideResNet-28-10, Extra data=false2023.12 | 91.79 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 78.32 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TRADES XCIT-L122023.01 | 91.73 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 57.58 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Nie et al.Purification=Diffusion, t*=0.0075, Backbone=WideResNet-28-102023.12 | 91.38 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 77.62 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Nie et al.Classifier=WideResNet-28-10, Extra data=false2023.12 | 91.38 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 78.98 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| CAUSALDIFF w/o APBackbone=DDPM2024.10 | 91.21 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 69.14 | 84.96 | — | — | — | — | — | — | — | — | — | — | 91.21 | 81.77 | |
| Unlabeled data+TRADES2023.01 | 91.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 65.88 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| 3-ensembleAdv. train=false, Model=ResNet152, # samples=1282024.08 | 91.06 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 61.72 | — | — | — | — | 67.97 | — | — | — | — | — | 59.38 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Nie et al.Classifier=WideResNet-70-162023.12 | 91.03 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 57.69 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Traditional Poisoning AttackNetwork=CNN, Trigger Pattern=Square, Pre-trained Model Accuracy=92%2021.06 | 91 | — | — | — | — | — | — | — | — | — | — | — | — | — | 99 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Handcrafted Backdoor AttackNetwork=CNN, Trigger Pattern=Square, Pre-trained Model Accuracy=92%2021.06 | 91 | — | — | — | — | — | — | — | — | — | — | — | — | — | 99 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Traditional Poisoning AttackNetwork=CNN, Trigger Pattern=Checkerboard, Pre-trained Model Accuracy=92%2021.06 | 91 | — | — | — | — | — | — | — | — | — | — | — | — | — | 98 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Handcrafted Backdoor AttackNetwork=CNN, Trigger Pattern=Checkerboard, Pre-trained Model Accuracy=92%2021.06 | 91 | — | — | — | — | — | — | — | — | — | — | — | — | — | 99 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Nie et al.Classifier=WideResNet-28-102023.12 | 91 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 54.92 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Gowal et al.Classifier=WideResNet-70-16, Extra data=false2023.12 | 90.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 74.03 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Wang et al.Classifier=WideResNet-28-102023.12 | 90.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 62.15 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Wang et al.Classifier=WideResNet-70-162023.12 | 90.67 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 63.52 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ABanditNAS-10Category=Robust NAS, Params=5.2M, FLOPS=794.11M2024.05 | 90.64 | 81.31 | — | — | — | 50.51 | — | — | — | — | — | — | — | — | — | 16.03 | — | — | — | — | — | — | 45.73 | — | 29.31 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RAMPBackbone=WRN-70-16, Uses extra data for pre-training=true, Source Model=Gowal et al., 20202024.02 | 90.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 54.7 | 74.6 | 57.9 | 53.3 | — | — | — | — | — | — | — | — | — | — | |
| GDPMPurification=Diffusion, Backbone=WideResNet-28-102023.12 | 90.36 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 77.31 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Sehwag et al.Classifier=WideResNet-28-10, Extra data=true2023.12 | 90.31 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 75.39 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| CAUSALDIFFBackbone=DDPM2024.10 | 90.23 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 83.01 | 86.33 | — | — | — | — | — | — | — | — | — | — | 89.84 | 86.39 | |
| CausalDiffThreat Model=BPDA + EOT, EOT=20, epsilon=8/255, norm=l_infinity2024.10 | 90.23 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 88.48 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| 3-ensemble of self-ensemblesAdv. train=false, Model=ResNet152, # samples=1282024.08 | 90.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 68.75 | — | — | — | — | 71.88 | — | — | — | — | — | 68.75 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RDCBackbone=EDM2024.10 | 89.85 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 75.67 | 82.03 | — | — | — | — | — | — | — | — | — | — | 89.45 | 82.38 | |
| RDCThreat Model=BPDA + EOT, EOT=20, epsilon=8/255, norm=l_infinity2024.10 | 89.85 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 75.67 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| E-ATBackbone=WRN-28-10, Uses extra data for pre-training=true, Source Model=Gowal et al., 20202024.02 | 89.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 54.4 | 76.1 | 56 | 50.5 | — | — | — | — | — | — | — | — | — | — | |
| E-ATBackbone=WRN-70-16, Uses extra data for pre-training=true, Source Model=Gowal et al., 20202024.02 | 89.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 54.4 | 76.7 | 58 | 51.6 | — | — | — | — | — | — | — | — | — | — | |
| RAMPBackbone=WRN-28-10, Uses extra data for pre-training=true, Source Model=Gowal et al., 20202024.02 | 89.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 55.9 | 74.7 | 56 | 52.9 | — | — | — | — | — | — | — | — | — | — | |
| E-ATBackbone=WRN-28-10, Uses extra data for pre-training=true, Source Model=Carmon et al., 20192024.02 | 89.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 51.8 | 74.6 | 53.3 | 47.9 | — | — | — | — | — | — | — | — | — | — | |
| Nie et al.Purification=Diffusion, t*=0.1, Backbone=WideResNet-28-102023.12 | 89.23 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 81.56 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RAMPBackbone=WRN-28-10, Uses extra data for pre-training=true, Source Model=Carmon et al., 20192024.02 | 89.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 55.9 | 74.7 | 55.7 | 52.7 | — | — | — | — | — | — | — | — | — | — | |
| Multi-res backboneAdv. train=false, Model=ResNet152, # samples=1282024.08 | 89.17 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 32.81 | — | — | — | — | 41.44 | — | — | — | — | — | 21.88 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Rony et al.Classifier=WideResNet-28-10, Extra data=false2023.12 | 89.05 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 66.41 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DiffPureThreat Model=BPDA + EOT, EOT=20, epsilon=8/255, norm=l_infinity2024.10 | 89.02 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 81.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AT-l_infBackbone=DDPM2024.10 | 88.87 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 63.28 | 64.65 | — | — | — | — | — | — | — | — | — | — | 4.88 | 44.27 | |
| AT(S2O)Backbone=Hybrid-L16, Perturbation Norm=l_infinity, Perturbation Radius (delta)=8/2552022.11 | 88.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 61.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Wu et al.Classifier=WideResNet-28-10, Extra data=true2023.12 | 88.51 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 72.85 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AT(AWP)Backbone=ViT-L16, Perturbation Norm=l_infinity, Perturbation Radius (delta)=8/2552022.11 | 88.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 62.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AT(AWP)Backbone=Hybrid-L16, Perturbation Norm=l_infinity, Perturbation Radius (delta)=8/2552022.11 | 88.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 61.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AT(TrH)Backbone=ViT-B16, Perturbation budget (epsilon)=8/255, Adversarial threat model=l_inf2022.11 | 88.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 61.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Ding et al.Classifier=WideResNet-28-10, Extra data=false2023.12 | 88.02 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 67.77 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AT(SWA)Backbone=ViT-L16, Perturbation Norm=l_infinity, Perturbation Radius (delta)=8/2552022.11 | 88 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 61.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AT(base)Backbone=Hybrid-L16, Perturbation Norm=l_infinity, Perturbation Radius (delta)=8/2552022.11 | 88 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 61.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AT(TrH)Backbone=Hybrid-L16, Perturbation Norm=l_infinity, Perturbation Radius (delta)=8/2552022.11 | 88 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 61 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| LM-EDMBackbone=EDM2024.10 | 87.89 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 71.68 | 75 | — | — | — | — | — | — | — | — | — | — | 87.5 | 78.06 | |
| E-ATBackbone=WRN-34-20, Uses extra data for pre-training=false, Source Model=Gowal et al., 20202024.02 | 87.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 49 | 71.6 | 49.8 | 45.1 | — | — | — | — | — | — | — | — | — | — | |
| AT(base)Backbone=ViT-B16, Perturbation budget (epsilon)=8/255, Adversarial threat model=l_inf2022.11 | 87.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 60.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DIFFPUREBackbone=SCORE SDE2024.10 | 87.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 53.12 | 75.59 | — | — | — | — | — | — | — | — | — | — | 12.89 | 47.2 | |
| AT(base)Backbone=ViT-L16, Perturbation Norm=l_infinity, Perturbation Radius (delta)=8/2552022.11 | 87.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 60.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TRADES(S2O)Backbone=ViT-L16, Perturbation Norm=l_infinity, Perturbation Radius (delta)=8/2552022.11 | 87.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 61.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TRADES(TrH)Backbone=Hybrid-L16, Perturbation Norm=l_infinity, Perturbation Radius (delta)=8/2552022.11 | 87.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 61.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AT(AWP)Backbone=ViT-B16, Perturbation budget (epsilon)=8/255, Adversarial threat model=l_inf2022.11 | 87.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 61.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TRADES(S2O)Backbone=Hybrid-L16, Perturbation Norm=l_infinity, Perturbation Radius (delta)=8/2552022.11 | 87.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 61.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Self-ensembleAdv. train=false, Model=ResNet152, # samples=1282024.08 | 87.14 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 50 | — | — | — | — | 53.12 | — | — | — | — | — | 43.75 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AT(S2O)Backbone=ViT-L16, Perturbation Norm=l_infinity, Perturbation Radius (delta)=8/2552022.11 | 87.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 60.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RobustResNet-A4#P (M)=147, #F (G)=39.42022.12 | 87.1 | — | — | — | — | 60.26 | — | — | — | — | — | — | — | — | — | 56.29 | 57.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RAMPBackbone=WRN-34-20, Uses extra data for pre-training=false, Source Model=Gowal et al., 20202024.02 | 87.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 49.7 | 70.8 | 50.4 | 46.9 | — | — | — | — | — | — | — | — | — | — | |
| AT(TrH)Backbone=ViT-L16, Perturbation Norm=l_infinity, Perturbation Radius (delta)=8/2552022.11 | 87 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 61.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AT(SWA)Backbone=ViT-B16, Perturbation budget (epsilon)=8/255, Adversarial threat model=l_inf2022.11 | 86.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 60.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AT(S2O)Backbone=ViT-B16, Perturbation budget (epsilon)=8/255, Adversarial threat model=l_inf2022.11 | 86.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 60.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RobustResNet-A3#P (M)=75.9, #F (G)=19.92022.12 | 86.79 | — | — | — | — | 60.1 | — | — | — | — | — | — | — | — | — | 55.84 | 57.29 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AT(SWA)Backbone=Hybrid-L16, Perturbation Norm=l_infinity, Perturbation Radius (delta)=8/2552022.11 | 86.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 57.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TRADES(TrH)Backbone=ViT-L16, Perturbation Norm=l_infinity, Perturbation Radius (delta)=8/2552022.11 | 86.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 61.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NADARCategory=Robust NAS, Params=4.4M, FLOPS=700.00M2024.05 | 86.23 | 60.46 | — | — | — | 53.43 | — | — | — | — | — | — | — | — | — | 50.44 | — | — | — | — | — | — | 53.06 | — | 52.64 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Yong et al.Purification=DSM+LD, Backbone=WideResNet-28-102023.12 | 86.14 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 70.01 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ADPThreat Model=BPDA + EOT, EOT=20, epsilon=8/255, norm=l_infinity2024.10 | 86.14 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 70.01 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| WRN-34-10Arch.=WRN-34-10, #Params=48M2023.06 | 86.07 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 52.19 | — | 56.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Handcrafted Backdoor AttackNetwork=CNN, Trigger Pattern=Random, Pre-trained Model Accuracy=92%2021.06 | 86 | — | — | — | — | — | — | — | — | — | — | — | — | — | 99 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DenseNet-121Category=Hand-Crafted, Params=7.0M, FLOPS=59.83M2024.05 | 85.95 | 58.46 | — | — | — | 50.49 | — | — | — | — | — | — | — | — | — | 47.46 | — | — | — | — | — | — | 49.92 | — | 49.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ARNASCategory=Robust NAS, Params=4.5M, FLOPS=1.27G2024.05 | 85.92 | 62.45 | — | — | — | 55.87 | — | — | — | — | — | — | — | — | — | 52.66 | — | — | — | — | — | — | 55.43 | — | 54.84 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TRADES(SWA)Backbone=ViT-L16, Perturbation Norm=l_infinity, Perturbation Radius (delta)=8/2552022.11 | 85.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 60.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — |