Certified Robustness on ImageNet (L2 Perturbation Bounds)
6.2Inference Time (s)AS
Evaluation results
| Method | Links | ||||||
|---|---|---|---|---|---|---|---|
| ASTraining Augmentation=standard (w/o), sigma=0.5, N=100,0002026.04 | 6.2 | 4 | 3.2 | 2.6 | 0.6 | 0 | |
| ASTraining Augmentation=noise-augmented (w/), sigma=0.5, N=100,0002026.04 | 6.2 | 58.4 | 57 | 53.9 | 48.1 | 34.8 | |
| LBSsigma=0.5, N=100,0002026.04 | 10.8 | 67 | 64.9 | 62.5 | 58.2 | 46.5 | |
| Betting CSTraining Augmentation=standard (w/o), sigma=0.5, N=100,0002026.04 | 24.9 | 0.6 | 0.6 | 0.4 | 0.4 | 0 | |
| Betting CSTraining Augmentation=noise-augmented (w/), sigma=0.5, N=100,0002026.04 | 24.9 | 56.4 | 55.4 | 53 | 45.6 | 34.2 | |
| ISSTraining Augmentation=standard (w/o), sigma=0.5, N=100,0002026.04 | 109.9 | 0.4 | 0.4 | 0.4 | 0.2 | 0 | |
| ISSTraining Augmentation=noise-augmented (w/), sigma=0.5, N=100,0002026.04 | 109.9 | 53.6 | 50.5 | 48.7 | 41 | 30.4 | |
| EnsembleTraining Augmentation=noise-augmented (w/), sigma=0.5, N=100,0002026.04 | 120.3 | 61.2 | 59.8 | 56.5 | 50.1 | 39.6 | |
| UCANTraining Augmentation=standard (w/o), sigma=0.5, N=100,0002026.04 | 121.6 | 4 | 3.2 | 2.4 | 0.6 | 0 | |
| UCANTraining Augmentation=noise-augmented (w/), sigma=0.5, N=100,0002026.04 | 121.6 | 65.3 | 63.7 | 62 | 58.9 | 50.1 | |
| ADRETraining Augmentation=standard (w/o), sigma=0.5, N=100,0002026.04 | 122.7 | 4.2 | 2.8 | 2.2 | 0.6 | 0 | |
| ADRETraining Augmentation=noise-augmented (w/), sigma=0.5, N=100,0002026.04 | 122.8 | 60.1 | 57.5 | 55.3 | 49.9 | 38.8 | |
| RSTraining Augmentation=standard (w/o), sigma=0.5, N=100,0002026.04 | 123.5 | 0.4 | 0.4 | 0.4 | 0.2 | 0 | |
| RSTraining Augmentation=noise-augmented (w/), sigma=0.5, N=100,0002026.04 | 123.5 | 56.5 | 55.4 | 52.7 | 45.4 | 34.6 | |
| GENELLIPS2026.05 | 163.74 | — | — | — | — | — | |
| Randomized Smoothing2026.05 | 180.9 | — | — | — | — | — | |
| Denoising with Pre-trained Diffusion Models2026.05 | 1,535.94 | — | — | — | — | — | |
| DensePure2026.05 | 2,188.2 | — | — | — | — | — |