Adversarial Robustness Evaluation on FGVC Aircraft (Image Classification)
71.9Robust AccuracyDBD
Evaluation Results
| Method | Links | |||||
|---|---|---|---|---|---|---|
| DBDBackbone=ViT-B/16, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 71.9 | 29.7 | — | — | — | |
| DBDBackbone=ViT-B/32, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 66.3 | 22.4 | — | — | — | |
| DBDBackbone=ResNet50, Attack Protocol=PGD-10, Epsilon (ε)=1/255, Evaluation Setting=Zero-shot2026.06 | 56.3 | 21.6 | — | — | — | |
| R-TPTBackbone=ViT-B/16, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 14.4 | 24 | — | — | — | |
| R-TPTBackbone=ResNet50, Attack Protocol=PGD-10, Epsilon (ε)=1/255, Evaluation Setting=Zero-shot2026.06 | 12.3 | 18.1 | — | — | — | |
| TTCBackbone=ViT-B/32, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 11.1 | 15.4 | — | — | — | |
| R-TPTBackbone=ViT-B/32, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 10.1 | 19.6 | — | — | — | |
| APTBackbone=ViT-B/32, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Few-shot2026.06 | 6.8 | 28.7 | — | — | — | |
| Comp-TGAProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 5.41 | — | — | — | — | |
| TGA-ZSRProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 4.75 | — | — | — | — | |
| Comp-TGAMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 4.56 | — | — | — | — | |
| SAFT-LZero-shot evaluation=true, Adversarial Attack=PGD-100 (epsilon = 1/255), Backbone=ViT-B/322026.02 | 4.53 | 13.39 | — | — | — | |
| TGA-ZSRMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 4.26 | — | — | — | — | |
| SAFT-MZero-shot evaluation=true, Adversarial Attack=PGD-100 (epsilon = 1/255), Backbone=ViT-B/322026.02 | 4.02 | 13.86 | — | — | — | |
| Comp-TGAZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | 3.97 | — | — | — | — | |
| TGA-ZSRZero-shot evaluation=true, Adversarial Attack=PGD-100 (epsilon = 1/255), Backbone=ViT-B/322026.02 | 3.51 | 11.98 | — | — | — | |
| TGA-ZSRZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | 3.12 | — | — | — | — | |
| T-VSSBackbone=TeCoA-pretrained CLIP-ViT-B/32, Epsilon (ϵ)=4/2552026.06 | 2.9 | 7.3 | — | — | — | |
| TTCBackbone=ViT-B/16, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 2.8 | 21.7 | — | — | — | |
| R-TPTBackbone=TeCoA-pretrained CLIP-ViT-B/32, Epsilon (ϵ)=4/2552026.06 | 2.7 | 6.1 | — | — | — | |
| TeCoABackbone=ResNet50, Attack Protocol=PGD-10, Epsilon (ε)=1/255, Evaluation Setting=Zero-shot2026.06 | 2.4 | 6.6 | — | — | — | |
| EnsembleBackbone=TeCoA-pretrained CLIP-ViT-B/32, Epsilon (ϵ)=4/2552026.06 | 2 | 4.2 | — | — | — | |
| PMG-AFTProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 1.98 | — | — | — | — | |
| Comp-TGAZero-shot=true2026.03 | 1.95 | — | — | — | — | |
| TeCoAZero-shot evaluation=true, Adversarial Attack=PGD-100 (epsilon = 1/255), Backbone=ViT-B/322026.02 | 1.87 | 6.42 | — | — | — | |
| PMG-AFTZero-shot evaluation=true, Adversarial Attack=PGD-100 (epsilon = 1/255), Backbone=ViT-B/322026.02 | 1.85 | 3.84 | — | — | — | |
| FT-Adv.Protocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 1.83 | — | — | — | — | |
| FT-Adv.Zero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | 1.8 | — | — | — | — | |
| PMG-AFTZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | 1.71 | — | — | — | — | |
| TPTBackbone=TeCoA-pretrained CLIP-ViT-B/32, Epsilon (ϵ)=4/2552026.06 | 1.7 | 6.7 | — | — | — | |
| TeCoAZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | 1.68 | — | — | — | — | |
| TeCoAMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 1.62 | — | — | — | — | |
| LAATMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 1.62 | — | — | — | — | |
| TeCoAProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 1.62 | — | — | — | — | |
| TGA-ZSRZero-shot=true2026.03 | 1.61 | — | — | — | — | |
| MTABackbone=TeCoA-pretrained CLIP-ViT-B/32, Epsilon (ϵ)=4/2552026.06 | 1.6 | 6.5 | — | — | — | |
| PMG-AFTMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 1.56 | — | — | — | — | |
| LAATZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | 1.53 | — | — | — | — | |
| LAATProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 1.38 | — | — | — | — | |
| FT-Adv.Mode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 1.26 | — | — | — | — | |
| FAREZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | 1.08 | — | — | — | — | |
| PMG-AFTZero-shot=true2026.03 | 0.9 | — | — | — | — | |
| FAREZero-shot evaluation=true, Adversarial Attack=PGD-100 (epsilon = 1/255), Backbone=ViT-B/322026.02 | 0.84 | 14.19 | — | — | — | |
| FAREMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 0.84 | — | — | — | — | |
| FAREProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 0.84 | — | — | — | — | |
| FT-Adv.Zero-shot=true2026.03 | 0.83 | — | — | — | — | |
| C-TPTBackbone=TeCoA-pretrained CLIP-ViT-B/32, Epsilon (ϵ)=4/2552026.06 | 0.7 | 6.4 | — | — | — | |
| TeCoAZero-shot=true2026.03 | 0.63 | — | — | — | — | |
| LAATZero-shot=true2026.03 | 0.63 | — | — | — | — | |
| TeCoABackbone=ViT-B/32, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 0.6 | 6.7 | — | — | — | |
| CLIP-TeCoABackbone=TeCoA-pretrained CLIP-ViT-B/32, Epsilon (ϵ)=4/2552026.06 | 0.5 | 6.6 | — | — | — | |
| FAREZero-shot=true2026.03 | 0.28 | — | — | — | — | |
| CLIPZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | 0.06 | — | — | — | — | |
| CLIPZero-shot evaluation=true, Adversarial Attack=PGD-100 (epsilon = 1/255), Backbone=ViT-B/322026.02 | 0.03 | 9.3 | — | — | — | |
| FT-CleanProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 0.03 | — | — | — | — | |
| FT-CleanZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | 0.03 | — | — | — | — | |
| FT-CleanZero-shot=true2026.03 | 0.01 | — | — | — | — | |
| CLIPZero-shot=true2026.03 | 0 | — | — | — | — | |
| CLIPProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 0 | — | — | — | — | |
| CLIPBackbone=ResNet50, Attack Protocol=PGD-10, Epsilon (ε)=1/255, Evaluation Setting=Zero-shot2026.06 | 0 | 19.6 | — | — | — | |
| CLIPBackbone=ViT-B/32, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 0 | 20.6 | — | — | — | |
| CLIPBackbone=ViT-B/16, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 0 | 27.1 | — | — | — | |
| ACATFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/255, Evaluation protocol=Zero-shot2025.12 | — | 4.41 | 1.59 | — | — | |
| CLIPFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/255, Evaluation protocol=Zero-shot2025.12 | — | 20.16 | 0 | — | — | |
| CLIPTraining Data=ImageNet-1k, Adversarial Training=2-step PGD, Epsilon=1/2552025.12 | — | 20.16 | 0 | 0.23 | — | |
| CLIP2025.12 | — | 20.16 | 0.23 | 0 | 0 | |
| DKLFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/255, Evaluation protocol=Zero-shot2025.12 | — | 3.96 | 1.65 | — | — | |
| FARETraining Data=ImageNet-1k, Adversarial Training=2-step PGD, Epsilon=1/2552025.12 | — | 17.1 | 5.28 | 4.08 | — | |
| FAREFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/2552025.12 | — | 15.63 | 0.06 | 0.54 | 1.11 | |
| PMG-AFTFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/2552025.12 | — | 11.79 | 0.51 | 3.21 | 0.99 | |
| TeCoATraining Data=ImageNet-1k, Adversarial Training=2-step PGD, Epsilon=1/2552025.12 | — | 13.89 | 5.1 | 4.05 | — | |
| TeCoAFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/2552025.12 | — | 5.19 | 1.86 | 2.16 | 2.1 | |
| TGA-ZSRFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/2552025.12 | — | 8.82 | 2.34 | 2.88 | 2.85 | |
| TRADESFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/255, Evaluation protocol=Zero-shot2025.12 | — | 3.6 | 1.23 | — | — | |
| UCATFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/255, Evaluation protocol=Zero-shot2025.12 | — | 10.95 | 2.61 | — | — | |
| UCATTraining Data=ImageNet-1k, Adversarial Training=2-step PGD, Epsilon=1/2552025.12 | — | 15.24 | 5.73 | 4.5 | — | |
| UCATFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/2552025.12 | — | 10.95 | 2.61 | 3.45 | 3.21 |