Adversarial Robustness Evaluation on Fashion-MNIST (test)
96.93Accuracy (%)L2P-AHIL
Evaluation results
| Method | Links | |||||||
|---|---|---|---|---|---|---|---|---|
| L2P-AHILBag Size=162026.03 | 96.93 | — | — | — | — | — | — | |
| Fully Supervised BaselineSupervision=Fully Supervised2026.03 | 96.39 | — | — | — | — | — | — | |
| LLP-DCBag Size=162026.03 | 95.9 | — | — | — | — | — | — | |
| SoftMatchBag Size=322026.03 | 95.86 | — | — | — | — | — | — | |
| LLP-DCBag Size=322026.03 | 95.86 | — | — | — | — | — | — | |
| SoftMatchBag Size=162026.03 | 95.85 | — | — | — | — | — | — | |
| L2P-AHILBag Size=322026.03 | 95.78 | — | — | — | — | — | — | |
| L2P-AHILBag Size=642026.03 | 95.27 | — | — | — | — | — | — | |
| LLP-DCBag Size=642026.03 | 95.19 | — | — | — | — | — | — | |
| SoftMatchBag Size=642026.03 | 95.18 | — | — | — | — | — | — | |
| LLP-DCBag Size=1282026.03 | 94.74 | — | — | — | — | — | — | |
| SoftMatchBag Size=1282026.03 | 94.73 | — | — | — | — | — | — | |
| LLP-VATBag Size=162026.03 | 94.69 | — | — | — | — | — | — | |
| ROTBag Size=162026.03 | 94.25 | — | — | — | — | — | — | |
| DLLPBag Size=162026.03 | 94.2 | — | — | — | — | — | — | |
| L2P-AHILBag Size=1282026.03 | 94.19 | — | — | — | — | — | — | |
| LLP-VATBag Size=322026.03 | 94.17 | — | — | — | — | — | — | |
| DLLPBag Size=322026.03 | 93.7 | — | — | — | — | — | — | |
| 2-layer TACNNLayers=22026.04 | 93.7 | — | — | — | — | — | — | |
| GoogLeNet2026.04 | 93.7 | — | — | — | — | — | — | |
| ROTBag Size=322026.03 | 93.68 | — | — | — | — | — | — | |
| VGG-162026.04 | 93.5 | — | — | — | — | — | — | |
| LLP-VATBag Size=642026.03 | 93.25 | — | — | — | — | — | — | |
| DLLPBag Size=642026.03 | 93.18 | — | — | — | — | — | — | |
| 1-layer TACNNLayers=12026.04 | 93.1 | — | — | — | — | — | — | |
| ROTBag Size=642026.03 | 92.53 | — | — | — | — | — | — | |
| Deep TTN2026.04 | 92.4 | — | — | — | — | — | — | |
| LLP-VATBag Size=1282026.03 | 92.3 | — | — | — | — | — | — | |
| ROTBag Size=1282026.03 | 91.84 | — | — | — | — | — | — | |
| DLLPBag Size=1282026.03 | 91.7 | — | — | — | — | — | — | |
| Residual MPS2026.04 | 91.5 | — | — | — | — | — | — | |
| Low-rank TTN2026.04 | 90.3 | — | — | — | — | — | — | |
| GCN-HViT-12026.04 | 90.26 | — | — | — | — | — | — | |
| GCN-HViT-2position embeddings=bidirectional adjacency matrix2026.04 | 90.03 | — | — | — | — | — | — | |
| AlexNet2026.04 | 89.9 | — | — | — | — | — | — | |
| HViT2026.04 | 89.85 | — | — | — | — | — | — | |
| XGBoost2026.04 | 89.8 | — | — | — | — | — | — | |
| K-SVM2026.04 | 89.7 | — | — | — | — | — | — | |
| FLTrustAttack Type=Trim Attack2026.06 | 89.52 | — | — | — | — | — | — | |
| FoggyTrust (FedAvg)Attack Type=Scaling Attack2026.06 | 89.52 | — | — | — | — | — | 0 | |
| LoTeNet2026.04 | 89.5 | — | — | — | — | — | — | |
| ViT-16patch size=162026.04 | 89.46 | — | — | — | — | — | — | |
| FedAvgAttack Type=LF Attack2026.06 | 89.43 | — | — | — | — | — | — | |
| Snake-SBS2026.04 | 89.2 | — | — | — | — | — | — | |
| ViT-4patch size=42026.04 | 89.13 | — | — | — | — | — | — | |
| CNN (Clean)Model=CNN (Clean), Perturbation budget (epsilon)=0.18, Perturbation norm=l_infinity2025.10 | 89 | 0.11 | 0.788 | 0.998 | 1 | — | — | |
| CNNSetting=Clean Training, Mode=clean2025.10 | 89 | 0.11 | — | — | — | — | — | |
| MPS + TTN2026.04 | 89 | — | — | — | — | — | — | |
| FLTrustAttack Type=No Attack2026.06 | 88.98 | — | — | — | — | — | — | |
| FedAvgAttack Type=No Attack2026.06 | 88.94 | — | — | — | — | — | — | |
| FoggyTrust (FedAvg)Attack Type=No Attack2026.06 | 88.88 | — | — | — | — | — | — | |
| FLTrustAttack Type=Scaling Attack2026.06 | 88.65 | — | — | — | — | — | 0 | |
| EPS + SBS2026.04 | 88.6 | — | — | — | — | — | — | |
| PEPS2026.04 | 88.3 | — | — | — | — | — | — | |
| FLTrustAttack Type=LF Attack2026.06 | 88.13 | — | — | — | — | — | — | |
| DNN (Clean)Model=DNN (Clean), Perturbation budget (epsilon)=0.18, Perturbation norm=l_infinity2025.10 | 88.1 | 0.119 | 0.986 | — | — | — | — | |
| DNNSetting=Clean Training, Mode=clean2025.10 | 88.1 | 0.119 | — | — | — | — | — | |
| MPS2026.04 | 88 | — | — | — | — | — | — | |
| FoggyTrust (FedAvg)Attack Type=Krum Attack2026.06 | 87.93 | — | — | — | — | — | — | |
| FoggyTrust (FedAvg)Attack Type=Trim Attack2026.06 | 87.91 | — | — | — | — | — | — | |
| FoggyTrust (FedAvg)Attack Type=LF Attack2026.06 | 87.84 | — | — | — | — | — | — | |
| FLTrustAttack Type=Krum Attack2026.06 | 86.55 | — | — | — | — | — | — | |
| Trim-MeanAttack Type=No Attack2026.06 | 86.5 | — | — | — | — | — | — | |
| MedianAttack Type=No Attack2026.06 | 85.78 | — | — | — | — | — | — | |
| KrumAttack Type=LF Attack2026.06 | 84.08 | — | — | — | — | — | — | |
| KrumAttack Type=Trim Attack2026.06 | 83.89 | — | — | — | — | — | — | |
| KrumAttack Type=Scaling Attack2026.06 | 83.78 | — | — | — | — | — | 100 | |
| MedianAttack Type=LF Attack2026.06 | 83.26 | — | — | — | — | — | — | |
| KrumAttack Type=No Attack2026.06 | 81.98 | — | — | — | — | — | — | |
| FGSM (Robust CNN)Model=FGSM (Robust CNN), Perturbation budget (epsilon)=0.18, Perturbation norm=l_infinity2025.10 | 76.8 | — | 0.232 | — | — | — | — | |
| Robust CNNSetting=Adversarial Training, Inference Attack=FGSM2025.10 | 76.8 | — | — | — | — | 0.232 | — | |
| Trim-MeanAttack Type=LF Attack2026.06 | 76.7 | — | — | — | — | — | — | |
| Robust CNN (BIM Train)Model=Robust CNN (BIM Train), Perturbation budget (epsilon)=0.18, Perturbation norm=l_infinity2025.10 | 73.2 | 0.158 | 0.232 | 0.269 | — | — | — | |
| Robust CNNSetting=Adversarial Training, Training Attack=BIM2025.10 | 73.2 | 0.158 | — | — | — | 0.268 | — | |
| BIM (Robust CNN)Model=BIM (Robust CNN), Perturbation budget (epsilon)=0.18, Perturbation norm=l_infinity2025.10 | 73.1 | — | — | 0.269 | — | — | — | |
| Robust CNNSetting=Adversarial Training, Inference Attack=BIM2025.10 | 73.1 | — | — | — | — | 0.269 | — | |
| MedianAttack Type=Trim Attack2026.06 | 72.67 | — | — | — | — | — | — | |
| Trim-MeanAttack Type=Trim Attack2026.06 | 72.18 | — | — | — | — | — | — | |
| MedianAttack Type=Krum Attack2026.06 | 71.21 | — | — | — | — | — | — | |
| Trim-MeanAttack Type=Krum Attack2026.06 | 69.61 | — | — | — | — | — | — | |
| CNNSetting=No Defense, Attack=FGSM2025.10 | 21.2 | — | — | — | — | 0.788 | — | |
| FedAvgAttack Type=Krum Attack2026.06 | 10 | — | — | — | — | — | — | |
| FedAvgAttack Type=Trim Attack2026.06 | 10 | — | — | — | — | — | — | |
| FedAvgAttack Type=Scaling Attack2026.06 | 10 | — | — | — | — | — | 100 | |
| KrumAttack Type=Krum Attack2026.06 | 10 | — | — | — | — | — | — | |
| Trim-MeanAttack Type=Scaling Attack2026.06 | 10 | — | — | — | — | — | 100 | |
| MedianAttack Type=Scaling Attack2026.06 | 10 | — | — | — | — | — | 100 | |
| DNNSetting=No Defense, Attack=FGSM2025.10 | 1.4 | — | — | — | — | 0.986 | — | |
| CNNSetting=No Defense, Attack=BIM2025.10 | 0.2 | — | — | — | — | 0.998 | — | |
| CNNSetting=No Defense, Attack=PGD2025.10 | 0 | — | — | — | — | 1 | — |