Adversarial Robustness on CIFAR-10 (Auto-Attack)
99.2FGSM Robust AccuracyProposed method (FGSM)
Evaluation results
| Method | Links | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Proposed method (FGSM)Re-attacking method=FGSM2026.01 | 99.2 | — | — | — | 100 | 100 | 100 | 99.4 | 91.1 | 100 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DDGSteps=1, Checkpoint Type=Best2026.04 | 68.44 | — | — | — | 59.79 | — | 49.86 | — | — | — | 82.67 | — | — | — | — | — | — | — | — | 60.44 | 59.57 | 59.33 | 48.08 | 59.48 | |
| DDGSteps=1, Checkpoint Type=Final2026.04 | 68.27 | — | — | — | 59.12 | — | 50.01 | — | — | — | 82.84 | — | — | — | — | — | — | — | — | 59.7 | 59.07 | 58.83 | 48.06 | 58.23 | |
| TDATSteps=1, Checkpoint Type=Final2026.04 | 66.29 | — | — | — | 55.62 | — | 49.74 | — | — | — | 82.72 | — | — | — | — | — | — | — | — | 56.27 | 55.53 | 55.26 | 47.26 | 54.98 | |
| TDATSteps=1, Checkpoint Type=Best2026.04 | 66.28 | — | — | — | 55.87 | — | 49.99 | — | — | — | 82.46 | — | — | — | — | — | — | — | — | 56.36 | 55.63 | 55.41 | 48.06 | 55.1 | |
| LAS-AWPSteps=10, Checkpoint Type=Best2026.04 | 65.86 | — | — | — | 55.97 | — | 51.53 | — | — | — | 82.92 | — | — | — | — | — | — | — | — | 56.37 | 55.57 | 55.2 | 49.46 | 54.18 | |
| LAS-AWPSteps=10, Checkpoint Type=Final2026.04 | 65.86 | — | — | — | 55.97 | — | 51.53 | — | — | — | 82.92 | — | — | — | — | — | — | — | — | 56.37 | 55.57 | 55.2 | 49.46 | 54.18 | |
| MARTSteps=10, Checkpoint Type=Final2026.04 | 65.12 | — | — | — | 53.9 | — | 49.66 | — | — | — | 82.33 | — | — | — | — | — | — | — | — | 54.38 | 52.98 | 52.6 | 47.46 | 52.77 | |
| FGSM-PGISteps=1, Checkpoint Type=Best2026.04 | 65.02 | — | — | — | 54.87 | — | 50.88 | — | — | — | 81.71 | — | — | — | — | — | — | — | — | 55.26 | 54.54 | 54.38 | 48.6 | 54.62 | |
| FGSM-PGISteps=1, Checkpoint Type=Final2026.04 | 65.02 | — | — | — | 54.87 | — | 50.88 | — | — | — | 81.71 | — | — | — | — | — | — | — | — | 55.26 | 54.54 | 54.38 | 48.6 | 54.62 | |
| FGSM-PGKSteps=1, Checkpoint Type=Final2026.04 | 65.01 | — | — | — | 55.02 | — | 50.75 | — | — | — | 81.63 | — | — | — | — | — | — | — | — | 55.79 | 55.34 | 55.09 | 48.85 | 55.28 | |
| FGSM-PGKSteps=1, Checkpoint Type=Best2026.04 | 64.95 | — | — | — | 55.28 | — | 50.9 | — | — | — | 81.52 | — | — | — | — | — | — | — | — | 56.14 | 55.58 | 55.36 | 48.94 | 55.44 | |
| MARTSteps=10, Checkpoint Type=Best2026.04 | 64.94 | — | — | — | 54.48 | — | 49.68 | — | — | — | 82.03 | — | — | — | — | — | — | — | — | 54.83 | 53.72 | 53.53 | 47.74 | 53.51 | |
| GATSteps=1, Checkpoint Type=Final2026.04 | 64.3 | — | — | — | 52.89 | — | 49.71 | — | — | — | 81.88 | — | — | — | — | — | — | — | — | 53.23 | 52.16 | 51.86 | 47.08 | 52.05 | |
| GATSteps=1, Checkpoint Type=Best2026.04 | 64.18 | — | — | — | 53.72 | — | 49.76 | — | — | — | 81.53 | — | — | — | — | — | — | — | — | 54.05 | 53.26 | 52.95 | 47.68 | 53.24 | |
| FGSM-SDISteps=1, Checkpoint Type=Final2026.04 | 63.75 | — | — | — | 51.28 | — | 49.42 | — | — | — | 83.73 | — | — | — | — | — | — | — | — | 51.88 | 50.49 | 50.09 | 46.34 | 50.43 | |
| FGSM-SDISteps=1, Checkpoint Type=Best2026.04 | 63.6 | — | — | — | 51.46 | — | 49.09 | — | — | — | 83.55 | — | — | — | — | — | — | — | — | 51.94 | 50.65 | 50.34 | 46.31 | 50.61 | |
| FGSM-RSSteps=1, Checkpoint Type=Best2026.04 | 62 | — | — | — | 47.2 | — | 46.1 | — | — | — | 83.69 | — | — | — | — | — | — | — | — | 47.66 | 46.29 | 45.96 | 42.8 | 46.13 | |
| FGSM-RSSteps=1, Checkpoint Type=Final2026.04 | 62 | — | — | — | 47.2 | — | 46.1 | — | — | — | 83.69 | — | — | — | — | — | — | — | — | 47.66 | 46.29 | 45.96 | 42.8 | 46.13 | |
| N-FGSMSteps=1, Checkpoint Type=Best2026.04 | 60.93 | — | — | — | 49.59 | — | 47.37 | — | — | — | 80.35 | — | — | — | — | — | — | — | — | 49.83 | 48.77 | 48.51 | 44.54 | 48.59 | |
| N-FGSMSteps=1, Checkpoint Type=Final2026.04 | 60.93 | — | — | — | 49.59 | — | 47.37 | — | — | — | 80.35 | — | — | — | — | — | — | — | — | 49.83 | 48.77 | 48.51 | 44.54 | 48.59 | |
| FGSM-FreeSteps=-, Checkpoint Type=Best2026.04 | 60.81 | — | — | — | 48.74 | — | 46.98 | — | — | — | 81.38 | — | — | — | — | — | — | — | — | 49.07 | 48.03 | 47.62 | 44.37 | 47.9 | |
| FGSM-FreeSteps=-, Checkpoint Type=Final2026.04 | 60.81 | — | — | — | 48.74 | — | 46.98 | — | — | — | 81.38 | — | — | — | — | — | — | — | — | 49.07 | 48.03 | 47.62 | 44.37 | 47.9 | |
| GradAlignSteps=1, Checkpoint Type=Best2026.04 | 60.56 | — | — | — | 48.8 | — | 46.94 | — | — | — | 80.45 | — | — | — | — | — | — | — | — | 49.11 | 47.96 | 47.63 | 43.92 | 47.85 | |
| GradAlignSteps=1, Checkpoint Type=Final2026.04 | 60.56 | — | — | — | 48.8 | — | 46.94 | — | — | — | 80.45 | — | — | — | — | — | — | — | — | 49.11 | 47.96 | 47.63 | 43.92 | 47.85 | |
| RS&Vp=12026.01 | 57 | — | — | — | 79.7 | 69.6 | 81.8 | 58.9 | 17 | 68.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RS&Vp=102026.01 | 13.9 | — | — | — | 15.2 | 14.7 | 14.9 | 14.9 | 4 | 14.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RS&Vp=0.12026.01 | 7.9 | — | — | — | 78.7 | 45.7 | 78.8 | 7.2 | 1.6 | 71.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RS&Vp=0.012026.01 | 0.6 | — | — | — | 28.8 | 7.8 | 13.8 | 0.8 | 0.3 | 55.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RS&Vp=0.0012026.01 | 0.1 | — | — | — | 13.9 | 3.2 | 3.8 | 0.4 | 0.1 | 52.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ADBMAttack Norm=L2, Setting=preprocessor-blind2025.05 | — | — | — | — | — | — | — | — | — | — | — | 90.66 | 75.8 | 90.22 | 74.8 | 91.65 | 77.51 | 90.93 | 76.34 | — | — | — | — | — | |
| ATNorm=l_inf2021.11 | — | 47.29 | 41.08 | 6.21 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ATNorm=l_22021.11 | — | 65.66 | 63.93 | 1.73 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Better DMGenerate data=1M, Epoch=400, Time=≈ 1,438 h2025.05 | — | — | 63.35 | — | — | — | — | — | — | — | 91.12 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DiffPureAttack Norm=L2, Setting=preprocessor-blind2025.05 | — | — | — | — | — | — | — | — | — | — | — | 89.25 | 72.6 | 89.13 | 72.08 | 89.76 | 73.46 | 89.63 | 72.96 | — | — | — | — | — | |
| EB-JDAT-JEM++Generate data=n/a, Epoch=100, Time=31.66 h2025.05 | — | — | 64.61 | — | — | — | — | — | — | — | 90.37 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| EB-JDAT-SADAJEMGenerate data=n/a, Epoch=100, Time=66.64 h2025.05 | — | — | 66.3 | — | — | — | — | — | — | — | 90.39 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FlowPureCWAttack Norm=L2, Setting=preprocessor-blind2025.05 | — | — | — | — | — | — | — | — | — | — | — | 51.84 | 51.48 | 46.66 | 46.66 | 93.77 | 93.77 | 85.34 | 85.34 | — | — | — | — | — | |
| FlowPureGaussAttack Norm=L2, Setting=preprocessor-blind2025.05 | — | — | — | — | — | — | — | — | — | — | — | 89.07 | 73.71 | 89.14 | 73.45 | 89.41 | 74.22 | 89.12 | 73.17 | — | — | — | — | — | |
| FlowPurePGDAttack Norm=L2, Setting=preprocessor-blind2025.05 | — | — | — | — | — | — | — | — | — | — | — | 16.4 | 16.4 | 10 | 10 | 91.84 | 91.84 | 80.96 | 80.96 | — | — | — | — | — | |
| GDMPAttack Norm=L2, Setting=preprocessor-blind2025.05 | — | — | — | — | — | — | — | — | — | — | — | 91.73 | 79.33 | 91.64 | 78.63 | 92.4 | 80.6 | 92.07 | 79.9 | — | — | — | — | — | |
| LMAttack Norm=L2, Setting=preprocessor-blind2025.05 | — | — | — | — | — | — | — | — | — | — | — | 70.62 | 49.03 | 70.45 | 48.29 | 79.96 | 59.48 | 79.63 | 60.12 | — | — | — | — | — | |
| SCOREGenerate data=1M, Epoch=400, Time=≈ 1,438 h2025.05 | — | — | 61.51 | — | — | — | — | — | — | — | 88.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Sub-ATNorm=l_inf2021.11 | — | 48.37 | 47.88 | 0.49 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Sub-ATNorm=l_22021.11 | — | 66.99 | 67.15 | -0.16 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| The method proposed by [15]Generate data=100M, Epoch=2000, Time=≈ 719,460 h2025.05 | — | — | 63.38 | — | — | — | — | — | — | — | 87.5 | — | — | — | — | — | — | — | — | — | — | — | — | — |