Adversarial Robustness on CIFAR-10 (test)
47.7Attack Success Rate (ASR)FGSM
Evaluation results
| Method | Links | ||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| FGSMModel=VGG-16, Norm=l2, epsilon=0.52026.01 | 47.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 17 | 0.113 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FGSMModel=VGG-16, Norm=l_inf, epsilon=4/2552026.01 | 51.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 60 | 0.031 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ConvNormBackbone=ResNet18, BN Layers=None, Attack=SimBA black box2021.03 | 53.5 | 2,966.16 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| OCNNBackbone=ResNet18, BN Layers=None, Attack=SimBA black box2021.03 | 54.5 | 2,892.81 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FGSMModel=VGG-16, Norm=l2, epsilon=1.02026.01 | 54.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 10 | 0.194 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ONIBackbone=ResNet18, BN Layers=None, Attack=SimBA black box2021.03 | 55.9 | 2,817.09 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FGSMModel=ResNet-32, Norm=l2, epsilon=0.52026.01 | 56.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 12 | 0.16 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=VGG-16, k_adv=10, Norm=l_inf, epsilon=4/2552026.01 | 58.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 44 | 0.035 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FGSMModel=VGG-16, Norm=l_inf, epsilon=8/2552026.01 | 59.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 28 | 0.064 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SNBackbone=ResNet18, BN Layers=None, Attack=SimBA black box2021.03 | 60.6 | 2,519.32 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=VGG-16, k_adv=20, Norm=l_inf, epsilon=4/2552026.01 | 62.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 40 | 0.035 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=VGG-16, k_adv=10, Norm=l2, epsilon=0.52026.01 | 62.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 12 | 0.142 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FGSMModel=ResNet-32, Norm=l2, epsilon=1.02026.01 | 63.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 8 | 0.231 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FGSMModel=ResNet-32, Norm=l_inf, epsilon=4/2552026.01 | 65.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 31 | 0.057 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=VGG-16, k_adv=50, Norm=l_inf, epsilon=4/2552026.01 | 69.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 37 | 0.033 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MI-FGSMModel=VGG-16, Norm=l2, epsilon=0.52026.01 | 69.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 12 | 0.126 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=VGG-16, k_adv=20, Norm=l2, epsilon=0.52026.01 | 70.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 11 | 0.132 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=VGG-16, k_adv=100, Norm=l_inf, epsilon=4/2552026.01 | 72.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 37 | 0.032 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=VGG-16, k_adv=10, Norm=l_inf, epsilon=8/2552026.01 | 72.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 20 | 0.076 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FGSMModel=ResNet-32, Norm=l_inf, epsilon=8/2552026.01 | 73.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 17 | 0.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MI-FGSMModel=VGG-16, Norm=l_inf, epsilon=4/2552026.01 | 73.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 38 | 0.031 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=VGG-16, k_adv=10, Norm=l2, epsilon=1.02026.01 | 74.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 6 | 0.289 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=VGG-16, k_adv=20, Norm=l_inf, epsilon=8/2552026.01 | 77.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 18 | 0.077 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGNModel=VGG-16, Norm=l_inf, epsilon=4/2552026.01 | 78.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 39 | 0.029 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGD-5Model=VGG-16, Norm=l2, epsilon=0.52026.01 | 80.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 20 | 0.056 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=ResNet-32, k_adv=10, Norm=l_inf, epsilon=4/2552026.01 | 81 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 23 | 0.067 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=VGG-16, k_adv=50, Norm=l2, epsilon=0.52026.01 | 81.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 15 | 0.081 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=VGG-16, k_adv=20, Norm=l2, epsilon=1.02026.01 | 81.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 7 | 0.279 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=ResNet-32, k_adv=20, Norm=l_inf, epsilon=4/2552026.01 | 86 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 21 | 0.067 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MI-FGSMModel=VGG-16, Norm=l2, epsilon=1.02026.01 | 86 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 8 | 0.225 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=VGG-16, k_adv=50, Norm=l_inf, epsilon=8/2552026.01 | 86.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 19 | 0.064 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=VGG-16, k_adv=100, Norm=l2, epsilon=0.52026.01 | 86.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 17 | 0.067 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=ResNet-32, k_adv=10, Norm=l2, epsilon=0.52026.01 | 87.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 7 | 0.25 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGD-5Model=VGG-16, Norm=l_inf, epsilon=4/2552026.01 | 87.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 76 | 0.014 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGD-5Model=VGG-16, Norm=l2, epsilon=1.02026.01 | 89.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 18 | 0.074 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=VGG-16, k_adv=100, Norm=l_inf, epsilon=8/2552026.01 | 89.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 20 | 0.057 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MI-FGSMModel=VGG-16, Norm=l_inf, epsilon=8/2552026.01 | 90.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 21 | 0.057 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=VGG-16, k_adv=50, Norm=l2, epsilon=1.02026.01 | 92.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 9 | 0.196 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGNModel=VGG-16, Norm=l2, epsilon=0.52026.01 | 92.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 20 | 0.054 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=ResNet-32, k_adv=10, Norm=l_inf, epsilon=8/2552026.01 | 93 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 12 | 0.13 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MI-FGSMModel=ResNet-32, Norm=l2, epsilon=0.52026.01 | 94.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 8 | 0.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=ResNet-32, k_adv=20, Norm=l2, epsilon=0.52026.01 | 94.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 8 | 0.22 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=ResNet-32, k_adv=50, Norm=l_inf, epsilon=4/2552026.01 | 94.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 21 | 0.061 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=ResNet-32, k_adv=10, Norm=l2, epsilon=1.02026.01 | 95 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 4 | 0.43 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGD-5Model=ResNet-32, Norm=l2, epsilon=1.02026.01 | 95 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 15 | 0.111 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGD-5Model=VGG-16, Norm=l_inf, epsilon=8/2552026.01 | 95.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 52 | 0.021 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGNModel=VGG-16, Norm=l_inf, epsilon=8/2552026.01 | 95.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 23 | 0.05 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=VGG-16, k_adv=100, Norm=l2, epsilon=1.02026.01 | 96 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 10 | 0.171 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGD-20Model=VGG-16, Norm=l2, epsilon=0.52026.01 | 96.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 23 | 0.041 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=ResNet-32, k_adv=20, Norm=l_inf, epsilon=8/2552026.01 | 97 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 11 | 0.13 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGD-5Model=ResNet-32, Norm=l2, epsilon=0.52026.01 | 97.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 15 | 0.088 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGD-20Model=VGG-16, Norm=l_inf, epsilon=4/2552026.01 | 97.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 84 | 0.012 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=ResNet-32, k_adv=100, Norm=l_inf, epsilon=4/2552026.01 | 97.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 22 | 0.056 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MI-FGSMModel=ResNet-32, Norm=l_inf, epsilon=4/2552026.01 | 98 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 23 | 0.056 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGNModel=VGG-16, Norm=l2, epsilon=1.02026.01 | 98.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 10 | 0.147 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=ResNet-32, k_adv=20, Norm=l2, epsilon=1.02026.01 | 98.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 5 | 0.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGNModel=ResNet-32, Norm=l_inf, epsilon=4/2552026.01 | 99.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 24 | 0.048 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=ResNet-32, k_adv=50, Norm=l2, epsilon=0.52026.01 | 99.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 11 | 0.13 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGD-5Model=ResNet-32, Norm=l_inf, epsilon=4/2552026.01 | 99.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 52 | 0.022 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGD-5Model=ResNet-32, Norm=l_inf, epsilon=8/2552026.01 | 99.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 40 | 0.028 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=ResNet-32, k_adv=50, Norm=l_inf, epsilon=8/2552026.01 | 99.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 13 | 0.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGNModel=ResNet-32, Norm=l2, epsilon=0.52026.01 | 99.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 15 | 0.086 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=ResNet-32, k_adv=100, Norm=l2, epsilon=0.52026.01 | 99.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 22 | 0.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MI-FGSMModel=ResNet-32, Norm=l_inf, epsilon=8/2552026.01 | 99.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 14 | 0.103 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MI-FGSMModel=ResNet-32, Norm=l2, epsilon=1.02026.01 | 99.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 6 | 0.311 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=ResNet-32, k_adv=50, Norm=l2, epsilon=1.02026.01 | 99.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 6 | 0.278 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=ResNet-32, k_adv=100, Norm=l_inf, epsilon=8/2552026.01 | 99.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 13 | 0.097 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DNModel=ResNet-32, k_adv=100, Norm=l2, epsilon=1.02026.01 | 99.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 7 | 0.252 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGD-20Model=ResNet-32, Norm=l_inf, epsilon=4/2552026.01 | 99.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 61 | 0.018 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGD-20Model=ResNet-32, Norm=l2, epsilon=0.52026.01 | 99.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 18 | 0.063 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGNModel=ResNet-32, Norm=l_inf, epsilon=8/2552026.01 | 99.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 17 | 0.079 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGD-20Model=VGG-16, Norm=l_inf, epsilon=8/2552026.01 | 99.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 56 | 0.018 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGD-20Model=VGG-16, Norm=l2, epsilon=1.02026.01 | 99.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 17 | 0.078 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGD-20Model=ResNet-32, Norm=l_inf, epsilon=8/2552026.01 | 100 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 44 | 0.032 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGD-20Model=ResNet-32, Norm=l2, epsilon=1.02026.01 | 100 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 14 | 0.108 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGNModel=ResNet-32, Norm=l2, epsilon=1.02026.01 | 100 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 8 | 0.214 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| 3-ensemble of self-ensemblesAdv. train=true, Model=ResNet152, Samples (#)=1282024.08 | — | — | — | — | — | — | 87 | — | — | — | — | — | — | — | 78.13 | 73.44 | 72.65 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| A-InfoNCE2023.04 | — | — | — | — | — | — | — | — | — | — | — | 42.68 | — | 83.18 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| A-InfoNCE-AIRRegularization=AIR2023.04 | — | — | — | — | — | — | — | — | — | — | — | 42.84 | — | 83.99 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ADBMNorm=L∞, Setting=Preprocessor-blind2025.05 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 90.37 | 72.19 | 90.05 | 71.32 | 89.87 | 73.64 | 89.06 | 71.79 | — | — | — | — | |
| AdjAttackPurification defense type=Score-based, Backbone=WideResNet-28-10, Attack constraint=l_inf (epsilon = 8/255)2023.10 | — | — | — | 70.64 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AdvCL2023.04 | — | — | — | — | — | — | — | — | — | — | — | 42.58 | — | 80.78 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AdvCL-AIRRegularization=AIR2023.04 | — | — | — | — | — | — | — | — | — | — | — | 43.24 | — | 81.53 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Adversarial PoisoningBackbone=VGG-162022.01 | — | — | — | — | — | — | 73.24 | 44.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Adversarial PoisoningDefense Strategy=PGD-AT, Defense budget=8/2552022.01 | — | — | — | — | — | — | 77.35 | 49.95 | 53.93 | 49.76 | 48.35 | 46.13 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ATWRN=32-10, Aug=P&C, Epo=100†2022.09 | — | — | — | — | — | — | 87.8 | — | — | — | — | 48.46 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ATArchitecture=WRN-34-10, Synthetic=None, Batch=128, Epoch=2002026.02 | — | — | — | — | — | — | 84.33 | — | — | — | — | 55.25 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ATModel=Resnet18, epsilon=82025.10 | — | — | — | — | — | — | — | — | 60.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 66.3 | — | — | — | |
| AT+ADRArchitecture=WRN-34-10, Synthetic=None, Batch=128, Epoch=2002026.02 | — | — | — | — | — | — | 86.11 | — | — | — | — | 55.26 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AT+DRAArchitecture=WRN-34-10, Synthetic=None, Batch=128, Epoch=2002026.02 | — | — | — | — | — | — | 88.54 | — | — | — | — | 57.29 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AT+IKLArchitecture=WRN-34-10, Synthetic=None, Batch=128, Epoch=2002026.02 | — | — | — | — | — | — | 84.8 | — | — | — | — | 57.09 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AWD + ASAMλawd=0.022, WRN=32-10, Aug=P&C, Epo=1002022.09 | — | — | — | — | — | — | 88.55 | — | — | — | — | 54.04 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AWPArchitecture=WRN-28-10, Parameters (M)=36.5, FLOPs (G)=5.202022.12 | — | — | — | — | — | — | — | — | — | — | — | 60.04 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AWPWRN=32-10, Aug=P&C, Epo=100†2022.09 | — | — | — | — | — | — | 57.55 | — | — | — | — | 53.08 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| BaseModel=ResNet322026.06 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 82.28 | 93.41 | 20.35 | |
| BaseModel=VGG162026.06 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 70.63 | 89.18 | 23.06 | |
| C-LEADModel=Resnet50, epsilon=82025.10 | — | — | — | — | — | — | — | — | 55.28 | — | 59.85 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 68.67 | — | — | — | |
| Croce et al. (2022)Radius=l_inf: 2/255, l_2: 0.5, l_1: 122026.03 | — | — | — | — | — | — | 87.2 | — | — | — | — | — | — | — | — | — | — | 64.1 | 55.4 | 55.4 | 73.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Croce et al. (2022)Radius=l_inf: 8/255, l_2: 1.5, l_1: 122026.03 | — | — | — | — | — | — | 83.5 | — | — | — | — | — | — | — | — | — | — | 25.5 | 52.9 | 25.5 | 41 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DeepConfuseDefense Strategy=PGD-AT, Defense budget=8/2552022.01 | — | — | — | — | — | — | 81.25 | 48.25 | 54.14 | 48.02 | 47.34 | 44.79 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — |