Image Classification on Caltech101 (Top-1 Clean & Robust Accuracy)
99.4Top-1 Robust AccuracyDBD
Evaluation results
| Method | Links | ||
|---|---|---|---|
| DBDBackbone=ViT-B/16, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 99.4 | 94.8 | |
| DBDBackbone=ViT-B/32, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 99 | 93.8 | |
| DBD†Backbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/2552026.06 | 98.8 | 90.4 | |
| DBDBackbone=ResNet50, Attack Protocol=PGD-10, Epsilon (ε)=1/255, Evaluation Setting=Zero-shot2026.06 | 98.7 | 90.1 | |
| CLBPmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 86.94 | 91.12 | |
| Original CLIPAttacks=PGD-10 (ϵ=1/255)2026.06 | 84.26 | — | |
| R-TPTBackbone=ViT-B/16, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 83.1 | 93.7 | |
| APT+TeCoABackbone=CLIP-ResNet50, Augmented Views=63, Adversarial perturbation budget (epsilon)=1.02026.06 | 82.8 | 82.8 | |
| SS-TPTBackbone=CLIP-ResNet50, Augmented Views=63, Adversarial perturbation budget (epsilon)=1.0, mode=test-time2026.06 | 81.2 | 86.4 | |
| Original CLIPAttacks=PGD-100 (ϵ=4/255)2026.06 | 81.05 | — | |
| R-TPTBackbone=ResNet50, Attack Protocol=PGD-10, Epsilon (ε)=1/255, Evaluation Setting=Zero-shot2026.06 | 79.9 | 86 | |
| TeCoABackbone=CLIP-ResNet50, Augmented Views=63, Adversarial perturbation budget (epsilon)=1.02026.06 | 78.3 | 78.3 | |
| R-TPTBackbone=ViT-B/32, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 77.8 | 91 | |
| T-VSSBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/2552026.06 | 76.6 | 91.7 | |
| SCCmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 76.59 | 86.44 | |
| R-TPTBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/2552026.06 | 76.4 | 90.6 | |
| TTCmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 66.17 | 86.53 | |
| TeCoABackbone=ResNet50, Attack Protocol=PGD-10, Epsilon (ε)=1/255, Evaluation Setting=Zero-shot2026.06 | 64.1 | 78.2 | |
| T-VSSBackbone=TeCoA-CLIP-ViT-B/32, Epsilon (ϵ)=4/2552026.06 | 62.4 | 77 | |
| PMG-AFTmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 61.58 | 75.45 | |
| DBD†Backbone=TeCoA-CLIP-ViT-B/32, Epsilon (ϵ)=4/2552026.06 | 60.9 | 70.9 | |
| R-TPTBackbone=TeCoA-CLIP-ViT-B/32, Epsilon (ϵ)=4/2552026.06 | 60.5 | 76.1 | |
| APTBackbone=ViT-B/32, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Few-shot2026.06 | 57.6 | 86.6 | |
| TeCoAmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 56.23 | 71.68 | |
| FAREmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 54.86 | 80.95 | |
| CLIP with DBDAttacks=PGD-10 (ϵ=1/255)2026.06 | 50.79 | — | |
| TTCBackbone=ViT-B/32, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 47.6 | 89.5 | |
| TeCoABackbone=ViT-B/32, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 46.1 | 81.5 | |
| CLIP-TeCoABackbone=TeCoA-CLIP-ViT-B/32, Epsilon (ϵ)=4/2552026.06 | 44.3 | 79.3 | |
| Anti-advmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 41.47 | 84.02 | |
| CLIPmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 20.88 | 85.66 | |
| TTCBackbone=ViT-B/16, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 16.1 | 90.3 | |
| CLIP-FTmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 15.95 | 83.63 | |
| CLIPBackbone=CLIP-ResNet50, Augmented Views=63, Adversarial perturbation budget (epsilon)=1.02026.06 | 2.6 | 85.9 | |
| CLIPBackbone=ResNet50, Attack Protocol=PGD-10, Epsilon (ε)=1/255, Evaluation Setting=Zero-shot2026.06 | 2.1 | 89.1 | |
| APTBackbone=CLIP-ResNet50, Augmented Views=63, Adversarial perturbation budget (epsilon)=1.02026.06 | 1.7 | 2.9 | |
| CLIP with DBDAttacks=PGD-100 (ϵ=4/255)2026.06 | 1.29 | — | |
| CLIPBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/2552026.06 | 0.2 | 91.4 | |
| CLIPBackbone=ViT-B/32, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 0.1 | 93.3 | |
| CLIPBackbone=ViT-B/16, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 0 | 94.2 |