Fine-grained classification on UCF101
75.1AccuracyC-TPT
Evaluation results
| Method | Links | ||
|---|---|---|---|
| C-TPTPre-trained Backbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.04 | 75.1 | 0 | |
| TTCBackbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.12 | 75 | 2.2 | |
| TTCBackbone=ViT-L/14, Epsilon=4/2552026.05 | 75 | 2.2 | |
| TPTPre-trained Backbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.04 | 74.7 | 0 | |
| MTAPre-trained Backbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.04 | 74.7 | 47.5 | |
| MTABackbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.12 | 74.7 | 47.5 | |
| MTABackbone=ViT-L/14, Epsilon=4/2552026.05 | 74.7 | 47.5 | |
| MTACategory=Tuning-free, Backbone=CLIP-ViT-L/14, Attack Protocol=PGD-100, eps=4.02026.06 | 74.7 | 47.5 | |
| R-TPTPre-trained Backbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.04 | 74.3 | 55.6 | |
| R-TPTBackbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.12 | 74.3 | 55.6 | |
| R-TPTBackbone=ViT-L/14, Epsilon=4/2552026.05 | 74.3 | 55.6 | |
| R-TPTCategory=Tuning-based, Backbone=CLIP-ViT-L/14, Attack Protocol=PGD-100, eps=4.02026.06 | 74.3 | 55.6 | |
| CLIPPre-trained Backbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.04 | 73.7 | 0 | |
| CLIPBackbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.12 | 73.7 | 0 | |
| CLIPBackbone=ViT-L/14, Epsilon=4/2552026.05 | 73.7 | 0 | |
| CLIPCategory=Baseline, Backbone=CLIP-ViT-L/14, Attack Protocol=PGD-100, eps=4.02026.06 | 73.7 | 0 | |
| TTPBackbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.12 | 73.6 | 57.4 | |
| TTPBackbone=ViT-L/14, Epsilon=4/2552026.05 | 73.6 | 57.4 | |
| AGCBackbone=ViT-L/14, Epsilon=4/2552026.05 | 73.1 | 97.4 | |
| MACCategory=Tuning-free, Backbone=CLIP-ViT-L/14, Attack Protocol=PGD-100, eps=4.02026.06 | 73.1 | 68.7 | |
| TTCCategory=Tuning-free, Backbone=CLIP-ViT-L/14, Attack Protocol=PGD-100, eps=4.02026.06 | 72.7 | 2.5 | |
| APMPre-trained on ImageNet=false2024.10 | 72.6 | — | |
| EnsembleBackbone=ViT-L/14, Epsilon=4/2552026.05 | 72.6 | 57.3 | |
| EnsemblePre-trained Backbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.04 | 71.7 | 48.3 | |
| EnsembleBackbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.12 | 71.7 | 48.3 | |
| TransCLIPBackbone=CLIP-RN50, BP-free=true, Evaluation Protocol=Transductive2025.08 | 68.8 | — | |
| CoCoOpPre-trained on ImageNet=true2024.10 | 68.4 | — | |
| TPTPre-trained on ImageNet=false2024.10 | 68 | — | |
| StatABackbone=CLIP-RN50, BP-free=true, Evaluation Protocol=Transductive2025.08 | 67.5 | — | |
| MTABackbone=ViT-B/16, Epsilon (ε)=4/2552026.05 | 67.5 | 27.5 | |
| R-TPTBackbone=ViT-B/16, Epsilon (ε)=4/2552026.05 | 67.2 | 43.2 | |
| Clean (Reference)Backbone=CLIP-ViT-B/16, Labeling Strategy=none (clean accuracy)2026.06 | 67 | — | |
| ADAPTBackbone=CLIP-RN50, BP-free=true, Evaluation Protocol=Transductive2025.08 | 66.75 | — | |
| CoOpPre-trained on ImageNet=true2024.10 | 66.5 | — | |
| TTCBackbone=ViT-B/16, Epsilon (ε)=4/2552026.05 | 65.8 | 1.6 | |
| DMNBackbone=CLIP-RN50, BP-free=false, Evaluation Protocol=Online2025.08 | 65.34 | — | |
| EnsemblePre-trained on ImageNet=false2024.10 | 65.2 | — | |
| CLIPBackbone=ViT-B/16, Epsilon (ε)=4/2552026.05 | 65.2 | 0 | |
| AGCBackbone=ViT-B/16, Epsilon (ε)=4/2552026.05 | 65.2 | 98 | |
| CLIP-VIT-B/16Pre-trained on ImageNet=false2024.10 | 65.1 | — | |
| DotaBackbone=CLIP-RN50, BP-free=true, Evaluation Protocol=Online2025.08 | 65.08 | — | |
| TTPBackbone=ViT-B/16, Epsilon (ε)=4/2552026.05 | 65 | 47.2 | |
| TPSBackbone=CLIP-RN50, BP-free=false, Evaluation Protocol=Online2025.08 | 64.3 | — | |
| TDABackbone=CLIP-RN50, BP-free=true, Evaluation Protocol=Online2025.08 | 64.18 | — | |
| EnsembleBackbone=ViT-B/16, Epsilon (ε)=4/2552026.05 | 63.9 | 43.4 | |
| BCABackbone=CLIP-RN50, BP-free=true, Evaluation Protocol=Online2025.08 | 63.51 | — | |
| MTABackbone=ViT-B/32, Epsilon (ε)=4/2552026.05 | 63.3 | 39.1 | |
| MTABackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Test-time Defense2026.06 | 63.3 | 39.1 | |
| ADAPTBackbone=CLIP-RN50, BP-free=true, Evaluation Protocol=Online2025.08 | 63.12 | — | |
| R-TPTPre-trained Backbone=ViT-B/32, Perturbation budget (epsilon)=4.02025.04 | 62.8 | 41 | |
| R-TPTBackbone=ViT-B/32, Epsilon (ε)=4/2552026.05 | 62.8 | 41 | |
| R-TPTBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Test-time Defense2026.06 | 62.8 | 41 | |
| DiffTPTBackbone=CLIP-RN50, BP-free=false, Evaluation Protocol=Online2025.08 | 62.67 | — | |
| TTCBackbone=ViT-B/32, Epsilon (ε)=4/2552026.05 | 62.6 | 6.1 | |
| TTCBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Test-time Defense2026.06 | 62.6 | 6.1 | |
| DPEBackbone=CLIP-RN50, BP-free=false, Evaluation Protocol=Online2025.08 | 61.98 | — | |
| T-VSSBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Test-time Defense2026.06 | 61.7 | 43.8 | |
| CLIPPre-trained Backbone=ViT-B/32, Perturbation budget (epsilon)=4.02025.04 | 61.6 | 0 | |
| CLIPBackbone=ViT-B/32, Epsilon (ε)=4/2552026.05 | 61.6 | 0 | |
| CLIPBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Baseline2026.06 | 61.6 | 0 | |
| TTPBackbone=ViT-B/32, Epsilon (ε)=4/2552026.05 | 61.3 | 46.6 | |
| TTPBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Test-time Defense2026.06 | 61.3 | 46.6 | |
| TPTBackbone=CLIP-RN50, BP-free=false, Evaluation Protocol=Online2025.08 | 60.82 | — | |
| AGCBackbone=ViT-B/32, Epsilon (ε)=4/2552026.05 | 60.5 | 91.3 | |
| R-TPTPre-trained Backbone=ResNet50, Perturbation budget (epsilon)=1.02025.04 | 59.7 | 50.9 | |
| C-TPTBackbone=CLIP-RN50, BP-free=false, Evaluation Protocol=Online2025.08 | 59.7 | — | |
| R-TPTBackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 59.7 | 50.9 | |
| AGCBackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 59.4 | 79.7 | |
| EnsembleBackbone=ViT-B/32, Epsilon (ε)=4/2552026.05 | 59.3 | 44.1 | |
| TTPBackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 59.1 | 50.3 | |
| CLIPPre-trained Backbone=ResNet50, Perturbation budget (epsilon)=1.02025.04 | 59 | 0 | |
| CLIPBackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 59 | 0 | |
| CLIPBackbone=CLIP-RN50, BP-free=N/A, Evaluation Protocol=Online2025.08 | 58.84 | — | |
| EnsembleBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Test-time Defense2026.06 | 54.9 | 36.9 | |
| APT+TeCoAPre-trained Backbone=ResNet50, Perturbation budget (epsilon)=1.02025.04 | 51.5 | 51.4 | |
| APT+TeCoABackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 51.5 | 51.4 | |
| FAREPre-trained Backbone=ViT-B/32, Perturbation budget (epsilon)=4.02025.04 | 44.2 | 41.9 | |
| FAREBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Training-time Defense2026.06 | 44.2 | 41.9 | |
| APT+TeCoAPre-trained Backbone=ViT-B/32, Perturbation budget (epsilon)=4.02025.04 | 40.2 | 39.4 | |
| APT+TeCoABackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Training-time Defense2026.06 | 40.2 | 39.4 | |
| TeCoAPre-trained Backbone=ResNet50, Perturbation budget (epsilon)=1.02025.04 | 38.4 | 38.1 | |
| TeCoABackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 38.4 | 38.1 | |
| ET3Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Lightweight Defense, Input Modality=Vision Only2026.03 | 37.35 | 16.02 | |
| R-TPT + ET3Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations + Prompt Tuning, Input Modality=Vision + Text2026.03 | 36.93 | 24.72 | |
| C-TPT*Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations + Prompt Tuning, Input Modality=Vision + Text2026.03 | 36.4 | 8.1 | |
| TPT*Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations + Prompt Tuning, Input Modality=Vision + Text2026.03 | 34.9 | 10.2 | |
| TeCoAPre-trained Backbone=ViT-B/32, Perturbation budget (epsilon)=4.02025.04 | 34.6 | 33.4 | |
| MTA*Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations, Input Modality=Vision Only2026.03 | 34.6 | 12.5 | |
| TeCoABackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Training-time Defense2026.06 | 34.6 | 33.4 | |
| CLIP (Robust)Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Baseline2026.03 | 34.58 | 6.71 | |
| TTCPre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Lightweight Defense, Input Modality=Vision Only2026.03 | 32.91 | 10.45 | |
| Ensemble + ET3Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations, Input Modality=Vision Only2026.03 | 32.62 | 21.44 | |
| R-TPTPre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations + Prompt Tuning, Input Modality=Vision + Text2026.03 | 31.48 | 17.63 | |
| EnsemblePre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations, Input Modality=Vision Only2026.03 | 26.35 | 14.12 | |
| APTPre-trained Backbone=ResNet50, Perturbation budget (epsilon)=1.02025.04 | 11.2 | 0.9 | |
| APTBackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 11.2 | 0.9 | |
| APTPre-trained Backbone=ViT-B/32, Perturbation budget (epsilon)=4.02025.04 | 3.7 | 0.2 | |
| APTBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Training-time Defense2026.06 | 3.7 | 0.2 | |
| CLIPBackbone=CLIP-ViT-B/16, Attack Type=PGD-100, Perturbation Budget (epsilon)=4/255, Labeling Strategy=pseudo-labels2026.06 | — | 4.5 | |
| DBDBackbone=CLIP-ViT-B/16, Attack Type=PGD-100, Perturbation Budget (epsilon)=4/255, Labeling Strategy=pseudo-labels2026.06 | — | 66.5 |