Adversarial Robustness Accuracy on CIFAR-100 (test)
85.21Clean AccuracyAS (adaptive smoothing)
Evaluation results
| Method | Links | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| AS (adaptive smoothing)Robust base model=EDM + TRADES [89]2023.01 | 85.21 | — | — | — | — | — | — | 38.72 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RDC2023.05 | 80.47 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 53.12 | — | — | |
| RDC2024.10 | 80.47 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 53.12 | — | — | |
| AS (adaptive smoothing)Robust base model=Unlabeled data + TRADES [39]2023.01 | 80.18 | — | — | — | — | — | — | 35.15 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DC2023.05 | 79.69 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 39.06 | — | — | |
| DC2024.10 | 79.69 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 39.06 | — | — | |
| WRN40-2Backbone=WideResNet-40-22023.05 | 78.13 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 0 | — | — | |
| WRN40-22024.10 | 78.13 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 0 | — | — | |
| StandardBackbone=ResNet-182022.06 | 76.721 | — | — | — | — | — | — | — | 22.122 | 52.874 | — | — | — | — | — | — | — | — | — | — | — | |
| LCNN+GradRegBackbone=ResNet-182022.06 | 76.622 | — | — | — | — | — | — | — | 52.477 | 64.678 | — | — | — | — | — | — | — | — | — | — | — | |
| Softplus+wt decayBackbone=ResNet-182022.06 | 76.622 | — | — | — | — | — | — | — | 23.907 | 53.766 | — | — | — | — | — | — | — | — | — | — | — | |
| LCNNBackbone=ResNet-182022.06 | 76.602 | — | — | — | — | — | — | — | 23.709 | 52.179 | — | — | — | — | — | — | — | — | — | — | — | |
| GradRegBackbone=ResNet-182022.06 | 76.394 | — | — | — | — | — | — | — | 50.294 | 64.678 | — | — | — | — | — | — | — | — | — | — | — | |
| CUREBackbone=ResNet-182022.06 | 75.928 | — | — | — | — | — | — | — | 50.096 | 63.488 | — | — | — | — | — | — | — | — | — | — | — | |
| Adv TrainingBackbone=ResNet-182022.06 | 75.521 | — | — | — | — | — | — | — | 55.155 | 66.861 | — | — | — | — | — | — | — | — | — | — | — | |
| LCNN + GradReg + Adv TrainingBackbone=ResNet-182022.06 | 75.382 | — | — | — | — | — | — | — | 59.222 | 66.861 | — | — | — | — | — | — | — | — | — | — | — | |
| Wang et al.2023.05 | 75.22 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 42.67 | — | — | |
| Diffusion (EDM)+TRADES2023.01 | 75.22 | — | — | — | — | — | — | 42.67 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AT-EDM2024.10 | 75.22 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 42.67 | — | — | |
| CURE + GradRegBackbone=ResNet-182022.06 | 74.192 | — | — | — | — | — | — | — | 60.81 | 67.357 | — | — | — | — | — | — | — | — | — | — | — | |
| Prototype Conformity Loss (PCL)epsilon=4/2552019.04 | 71.9 | 49.1 | 40.7 | 38.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TRADES XCIT-L122023.01 | 70.76 | — | — | — | — | — | — | 35.08 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Unlabeled data+TRADES2023.01 | 69.17 | — | — | — | — | — | — | 36.98 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| 3-ensemble of self-ensemblesAdv. train=false, Model=ResNet152, # samples=5122024.08 | 67.71 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 48.16 | — | — | 37.32 | |
| 3-ensembleAdv. train=false, Model=ResNet152, # samples=1282024.08 | 66.63 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 47.66 | — | — | 37.5 | |
| Diffusion (DDPM)+AT2023.01 | 65.93 | — | — | — | — | — | — | 31.15 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Self-ensembleAdv. train=false, Model=ResNet152, # samples=5122024.08 | 65.71 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 46.29 | — | — | 30.08 | |
| Multi-res backboneAdv. train=false, Model=ResNet152, # samples=1282024.08 | 65.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 25 | — | — | 13.28 | |
| CausalDiff2024.10 | 65.62 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 56.25 | — | — | |
| SCORE Loss AT2023.01 | 65.56 | — | — | — | — | — | — | 33.05 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Rebuffi et al.2023.05 | 63.56 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 34.64 | — | — | |
| Diffusion (DDPM)+TRADES2023.01 | 63.56 | — | — | — | — | — | — | 34.64 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AT-DDPM2024.10 | 63.56 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 34.64 | — | — | |
| RobustResNet-A4#P (M)=147, #F (G)=39.42022.12 | 61.66 | — | — | — | — | 34.25 | 30.04 | 29 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Song et al.epsilon=4/2552019.04 | 61.6 | 29.3 | 27.3 | 26.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TRADES2023.01 | 60.86 | — | — | — | — | — | — | 30.03 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RobustResNet-A3#P (M)=75.9, #F (G)=19.92022.12 | 60.16 | — | — | — | — | 33.59 | 29.58 | 28.48 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AVGTraining Objective=AVG, AdaptiveBudget=None2023.06 | 59.94 | — | — | — | — | — | — | 16.1 | — | — | 30.35 | 40.26 | 18.92 | 18.61 | 25.2 | 37 | 16.3 | — | — | — | — | |
| RobustResNet-A2#P (M)=39.0, #F (G)=10.82022.12 | 59.38 | — | — | — | — | 33 | 28.71 | 27.68 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RobustResNet-A1#P (M)=19.2, #F (G)=5.112022.12 | 59.34 | — | — | — | — | 32.7 | 27.76 | 26.75 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| WRN-34-R#P (M)=68.1, #F (G)=19.12022.12 | 58.78 | — | — | — | — | 31.17 | 27.33 | 26.31 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PDARTSArchitecture=PDARTS2024.05 | 58.41 | 30.35 | — | — | — | 25.83 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ARNASArchitecture=ARNAS2024.05 | 58.18 | 32.6 | — | — | — | 29.54 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AdaptiveBudgetTraining Objective=AVG, Budget Norm=l22023.06 | 58.16 | — | — | — | — | — | — | 19.5 | — | — | 32.62 | 40.27 | 21.57 | 21.16 | 28 | 37.1 | 19.7 | — | — | — | — | |
| AdaptiveBudgetTraining Objective=AVG, Budget Norm=l12023.06 | 57.78 | — | — | — | — | — | — | 18.9 | — | — | 33.16 | 41.03 | 21.81 | 21.55 | 28.6 | 37.9 | 19 | — | — | — | — | |
| WRN-70-16#P (M)=267, #F (G)=38.82022.12 | 56.93 | — | — | — | — | 29.76 | 27.2 | 26.12 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| WRN-46-14#P (M)=128, #F (G)=18.62022.12 | 56.78 | — | — | — | — | 30.03 | 27.27 | 26.28 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AdaptiveBudgetTraining Objective=MAX, Budget Norm=l12023.06 | 56.48 | — | — | — | — | — | — | 20.6 | — | — | 29.27 | 40 | 25.34 | 24.14 | 23 | 35.6 | 21.5 | — | — | — | — | |
| AdvRush (7@96)#P (M)=32.6, #F (G)=4.972022.12 | 56.4 | — | — | — | — | 30.4 | 26.16 | 25.27 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| WRN-28-10#P (M)=36.5, #F (G)=5.202022.12 | 56.3 | — | — | — | — | 29.91 | 26.22 | 25.26 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RACL (7@104)#P (M)=32.5, #F (G)=4.932022.12 | 56.09 | — | — | — | — | 30.38 | 26.65 | 25.65 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MSDTraining Objective=MSD, AdaptiveBudget=None2023.06 | 56.09 | — | — | — | — | — | — | 21 | — | — | 35.5 | 40.14 | 24.83 | 25.1 | 25.1 | 37.6 | 21.8 | — | — | — | — | |
| WRN-34-12#P (M)=66.5, #F (G)=9.602022.12 | 56.08 | — | — | — | — | 29.87 | 26.51 | 25.47 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ResNet-18Architecture=ResNet-182024.05 | 55.57 | 26.03 | — | — | — | 21.44 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AdaptiveBudgetTraining Objective=MAX, Budget Norm=l22023.06 | 55.53 | — | — | — | — | — | — | 18.6 | — | — | 29.78 | 39.85 | 25.87 | 24.76 | 20.9 | 36.4 | 22.3 | — | — | — | — | |
| AdaptiveBudgetTraining Objective=MSD, Budget Norm=l12023.06 | 55.52 | — | — | — | — | — | — | 21.3 | — | — | 30.31 | 40.28 | 26.19 | 25.03 | 24 | 35.8 | 22.8 | — | — | — | — | |
| MAXTraining Objective=MAX, AdaptiveBudget=None2023.06 | 55.49 | — | — | — | — | — | — | 12.2 | — | — | 25.45 | 39.55 | 25.03 | 21.11 | 13 | 36.3 | 22 | — | — | — | — | |
| RobNet-large-v2#P (M)=33.3, #F (G)=5.102022.12 | 55.27 | — | — | — | — | 29.23 | 24.63 | 23.69 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AdaptiveBudgetTraining Objective=MSD, Budget Norm=l22023.06 | 54.94 | — | — | — | — | — | — | 21.5 | — | — | 28.87 | 39.28 | 25.59 | 24.43 | 24.2 | 36.4 | 22.7 | — | — | — | — | |
| DiffPure2023.05 | 39.06 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 7.81 | — | — | |
| DiffPure2024.10 | 39.06 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 7.81 | — | — | |
| Adv. w/o DistillAttack=PGD-100, Exit=12023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 16.82 | — | — | — | |
| Adv. w/o DistillAttack=PGD-100, Exit=22023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 17.24 | — | — | — | |
| Adv. w/o DistillAttack=PGD-100, Exit=32023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 19.03 | — | — | — | |
| Adv. w/o DistillAttack=PGD-100, Exit=42023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 19.41 | — | — | — | |
| Adv. w/o DistillAttack=PGD-100, Exit=52023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 18.97 | — | — | — | |
| Adv. w/o DistillAttack=PGD-100, Exit=62023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 17.9 | — | — | — | |
| Adv. w/o DistillAttack=PGD-100, Exit=72023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 16.96 | — | — | — | |
| Adv. w/o DistillAttack=PGD-100, Exit=Average2023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 18.05 | — | — | — | |
| Adv. w/o DistillAttack=CW, Exit=12023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 35.31 | — | — | — | |
| Adv. w/o DistillAttack=CW, Exit=22023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 35.72 | — | — | — | |
| Adv. w/o DistillAttack=CW, Exit=32023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 36.47 | — | — | — | |
| Adv. w/o DistillAttack=CW, Exit=42023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 36.85 | — | — | — | |
| Adv. w/o DistillAttack=CW, Exit=52023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 37.2 | — | — | — | |
| Adv. w/o DistillAttack=CW, Exit=62023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 37.19 | — | — | — | |
| Adv. w/o DistillAttack=CW, Exit=72023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 36.68 | — | — | — | |
| Adv. w/o DistillAttack=CW, Exit=Average2023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 36.49 | — | — | — | |
| Adv. w/o DistillAttack=AutoAttack, Exit=12023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 31.32 | — | — | — | |
| Adv. w/o DistillAttack=AutoAttack, Exit=22023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 34.24 | — | — | — | |
| Adv. w/o DistillAttack=AutoAttack, Exit=32023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 37.27 | — | — | — | |
| Adv. w/o DistillAttack=AutoAttack, Exit=42023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 39.67 | — | — | — | |
| Adv. w/o DistillAttack=AutoAttack, Exit=52023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 41.2 | — | — | — | |
| Adv. w/o DistillAttack=AutoAttack, Exit=62023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 41.73 | — | — | — | |
| Adv. w/o DistillAttack=AutoAttack, Exit=72023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 40.45 | — | — | — | |
| Adv. w/o DistillAttack=AutoAttack, Exit=Average2023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 37.98 | — | — | — | |
| NEO-KDAttack=PGD-100, Exit=12023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 20.38 | — | — | — | |
| NEO-KDAttack=PGD-100, Exit=22023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 21.29 | — | — | — | |
| NEO-KDAttack=PGD-100, Exit=32023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 23.22 | — | — | — | |
| NEO-KDAttack=PGD-100, Exit=42023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 24.38 | — | — | — | |
| NEO-KDAttack=PGD-100, Exit=52023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 24.44 | — | — | — | |
| NEO-KDAttack=PGD-100, Exit=62023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 23.82 | — | — | — | |
| NEO-KDAttack=PGD-100, Exit=72023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 22.21 | — | — | — | |
| NEO-KDAttack=PGD-100, Exit=Average2023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 22.82 | — | — | — | |
| NEO-KDAttack=CW, Exit=12023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 31.56 | — | — | — | |
| NEO-KDAttack=CW, Exit=22023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 34.55 | — | — | — | |
| NEO-KDAttack=CW, Exit=32023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 38.2 | — | — | — | |
| NEO-KDAttack=CW, Exit=42023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 40.6 | — | — | — | |
| NEO-KDAttack=CW, Exit=52023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 43.48 | — | — | — | |
| NEO-KDAttack=CW, Exit=62023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 44.03 | — | — | — | |
| NEO-KDAttack=CW, Exit=72023.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 43.01 | — | — | — |