Fine-grained classification on Aircraft (Acc., Rob.)
32.7AccuracyMTA
Evaluation Results
| Method | Links | ||
|---|---|---|---|
| MTABackbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.12 | 32.7 | 8 | |
| MTACategory=Tuning-free, Backbone=CLIP-ViT-L/14, Attack Protocol=PGD-100, eps=4.02026.06 | 32.7 | 8 | |
| TTCBackbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.12 | 31.7 | 0.5 | |
| EnsembleBackbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.12 | 31.7 | 12.7 | |
| R-TPTBackbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.12 | 31.7 | 17.2 | |
| R-TPTCategory=Tuning-based, Backbone=CLIP-ViT-L/14, Attack Protocol=PGD-100, eps=4.02026.06 | 31.7 | 17.2 | |
| CLIPBackbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.12 | 30 | 0 | |
| CLIPCategory=Baseline, Backbone=CLIP-ViT-L/14, Attack Protocol=PGD-100, eps=4.02026.06 | 30 | 0 | |
| TTPBackbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.12 | 29.2 | 17.7 | |
| MACCategory=Tuning-free, Backbone=CLIP-ViT-L/14, Attack Protocol=PGD-100, eps=4.02026.06 | 28 | 31.3 | |
| TTCCategory=Tuning-free, Backbone=CLIP-ViT-L/14, Attack Protocol=PGD-100, eps=4.02026.06 | 27.9 | 0.4 | |
| MTABackbone=ViT-B/16, Pre-train=CLIP, Epsilon (ϵ)=4/255, Attack Protocol=PGD-1002026.05 | 25 | 4.3 | |
| AGCBackbone=ViT-B/16, Pre-train=CLIP, Epsilon (ϵ)=4/255, Attack Protocol=PGD-1002026.05 | 24.2 | 68.6 | |
| CLIPBackbone=ViT-B/16, Pre-train=CLIP, Epsilon (ϵ)=4/255, Attack Protocol=PGD-1002026.05 | 23.9 | 0 | |
| R-TPTBackbone=ViT-B/16, Pre-train=CLIP, Epsilon (ϵ)=4/255, Attack Protocol=PGD-1002026.05 | 23.9 | 13.2 | |
| TTPBackbone=ViT-B/16, Pre-train=CLIP, Epsilon (ϵ)=4/255, Attack Protocol=PGD-1002026.05 | 23.9 | 14.8 | |
| EnsembleBackbone=ViT-B/16, Pre-train=CLIP, Epsilon (ϵ)=4/255, Attack Protocol=PGD-1002026.05 | 23.5 | 12.7 | |
| TTCBackbone=ViT-B/16, Pre-train=CLIP, Epsilon (ϵ)=4/255, Attack Protocol=PGD-1002026.05 | 23.3 | 0.5 | |
| R-TPTBackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 17.5 | 12.6 | |
| AGCBackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 16.6 | 36.3 | |
| TTPBackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 16.1 | 11.7 | |
| CLIPBackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 15.7 | 0 | |
| APT+TeCoABackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 9.9 | 9.7 | |
| TTCPre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Lightweight Defense, Input Modality=Vision Only2026.03 | 6.93 | 0.69 | |
| TPT*Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations + Prompt Tuning, Input Modality=Vision + Text2026.03 | 6.7 | 1.7 | |
| CLIP (Robust)Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Baseline2026.03 | 6.6 | 0.45 | |
| MTA*Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations, Input Modality=Vision Only2026.03 | 6.5 | 1.6 | |
| C-TPT*Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations + Prompt Tuning, Input Modality=Vision + Text2026.03 | 6.4 | 0.7 | |
| R-TPT + ET3Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations + Prompt Tuning, Input Modality=Vision + Text2026.03 | 5.85 | 3.51 | |
| TeCoABackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 5.8 | 5.8 | |
| R-TPTPre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations + Prompt Tuning, Input Modality=Vision + Text2026.03 | 5.73 | 2.46 | |
| ET3Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Lightweight Defense, Input Modality=Vision Only2026.03 | 5.28 | 0.87 | |
| EnsemblePre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations, Input Modality=Vision Only2026.03 | 4.29 | 1.89 | |
| Ensemble + ET3Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations, Input Modality=Vision Only2026.03 | 3.93 | 2.22 | |
| APTBackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 0.9 | 0.9 |