Image Classification on Caltech256 (Robustness Metrics)
88.84Accuracy (Clean)AWT
Evaluation Results
| Method | Links | ||||||
|---|---|---|---|---|---|---|---|
| AWTTrain=false2024.07 | 88.84 | — | — | — | — | — | |
| SuS-X-SDTrain=false2024.07 | 87.45 | — | — | — | — | — | |
| VisDescTrain=false2024.07 | 87.16 | — | — | — | — | — | |
| WaffleCLIPTrain=false2024.07 | 87.04 | — | — | — | — | — | |
| POMPTrain=true2024.07 | 86.76 | — | — | — | — | — | |
| CuPLTrain=false2024.07 | 86.3 | — | — | — | — | — | |
| PromptAlignTrain=true2024.07 | 86.05 | — | — | — | — | — | |
| TPTTrain=true2024.07 | 85.71 | — | — | — | — | — | |
| MaPLeTrain=true2024.07 | 85.58 | — | — | — | — | — | |
| CoCoOpTrain=true2024.07 | 85.39 | — | — | — | — | — | |
| PLOT++Train=true2024.07 | 84.3 | — | — | — | — | — | |
| RoLI - Full-FTBackbone=Swin Transformer, Initialization=Robust Linear Initialization, Finetuning Protocol=Full Finetuning2023.12 | 83.78 | 55.42 | — | — | — | — | |
| CoOpTrain=true2024.07 | 82.91 | — | — | — | — | — | |
| CLIPTrain=false2024.07 | 82.5 | — | — | — | — | — | |
| TTEmode=Test-time Defense, attack=10-step PGD, epsilon=1/2552025.11 | 82.49 | — | — | 60.09 | — | — | |
| TTEDefense Category=Test-time Defense2025.11 | 82.48 | — | — | 23.23 | — | — | |
| TTEBackbone=CLIP-ViT-B/322026.06 | 82.48 | — | — | 23.23 | — | — | |
| RanLI - LinearBackbone=Swin Transformer, Initialization=Random Initialization, Finetuning Protocol=Linear Probing2023.12 | 81.79 | 54.47 | — | — | — | — | |
| RoLI - LoRABackbone=Swin Transformer, Initialization=Robust Linear Initialization, Finetuning Protocol=LoRA2023.12 | 81.79 | 54.5 | — | — | — | — | |
| RoLI - BiasBackbone=Swin Transformer, Initialization=Robust Linear Initialization, Finetuning Protocol=Bias-only2023.12 | 81.78 | 54.49 | — | — | — | — | |
| RoLI - AdapterBackbone=Swin Transformer, Initialization=Robust Linear Initialization, Finetuning Protocol=Adapter2023.12 | 81.74 | 54.32 | — | — | — | — | |
| CLIPFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/255, Evaluation protocol=Zero-shot2025.12 | 81.73 | — | — | — | — | 13.56 | |
| CLIPTraining Data=ImageNet-1k, Adversarial Training=2-step PGD, Epsilon=1/2552025.12 | 81.73 | 0.26 | — | — | — | 7.19 | |
| CLIP2025.12 | 81.73 | 7.19 | — | — | 8.17 | 0.26 | |
| CLIPDefense Category=None2025.11 | 81.72 | — | — | 0.12 | — | — | |
| CLIPattack=10-step PGD, epsilon=1/2552025.11 | 81.72 | — | — | 8.47 | — | — | |
| CLIPBackbone=CLIP-ViT-B/322026.06 | 81.72 | — | — | 0.12 | — | — | |
| MACBackbone=CLIP-ViT-B/322026.06 | 81.57 | — | — | 52.56 | — | — | |
| RNBackbone=CLIP-ViT-B/322026.06 | 81.25 | — | — | 0.16 | — | — | |
| ATACmode=Test-time Defense, attack=10-step PGD, epsilon=1/2552025.11 | 80.72 | — | — | 68.02 | — | — | |
| FARETraining Data=ImageNet-1k, Adversarial Training=2-step PGD, Epsilon=1/2552025.12 | 80.57 | 58.87 | — | — | — | 59.95 | |
| UCATTraining Data=ImageNet-1k, Adversarial Training=2-step PGD, Epsilon=1/2552025.12 | 80.27 | 61.64 | — | — | — | 62.71 | |
| RanLI - AdapterBackbone=Swin Transformer, Initialization=Random Initialization, Finetuning Protocol=Adapter2023.12 | 80.24 | 52.73 | — | — | — | — | |
| FT-StandardBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=4062026.01 | 79.88 | — | — | 23.82 | — | — | |
| RanLI - VPTBackbone=Swin Transformer, Initialization=Random Initialization, Finetuning Protocol=Visual Prompt Tuning2023.12 | 79.74 | 53.07 | — | — | — | — | |
| TTCmode=Test-time Defense, attack=10-step PGD, epsilon=1/2552025.11 | 79.66 | — | — | 60.11 | — | — | |
| HPT-GPDBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=14862026.01 | 79.63 | — | — | 50.06 | — | — | |
| RanLI - BiasBackbone=Swin Transformer, Initialization=Random Initialization, Finetuning Protocol=Bias-only2023.12 | 79.5 | 52.43 | — | — | — | — | |
| CLIPBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=02026.01 | 79.43 | — | — | 23.76 | — | — | |
| Anti-advBackbone=CLIP-ViT-B/322026.06 | 79.4 | — | — | 1.44 | — | — | |
| HDBackbone=CLIP-ViT-B/322026.06 | 79.12 | — | — | 0.34 | — | — | |
| ATACDefense Category=Test-time Defense2025.11 | 79.1 | — | — | 90.86 | — | — | |
| CLIP-FTDefense Category=Adversarial Finetuning2025.11 | 78.53 | — | — | 1.41 | — | — | |
| CLIP-FTmode=Adversarial Finetuning, attack=10-step PGD, epsilon=1/2552025.11 | 78.53 | — | — | 6.76 | — | — | |
| CLIP-FTBackbone=CLIP-ViT-B/322026.06 | 78.53 | — | — | 1.41 | — | — | |
| R-TPTDefense Category=Test-time Defense2025.11 | 77.67 | — | — | 54.45 | — | — | |
| R-TPTmode=Test-time Defense, attack=10-step PGD, epsilon=1/2552025.11 | 77.67 | — | — | 67.51 | — | — | |
| TWINS-ATwarmup=true2023.03 | 77.35 | 49.13 | 43.92 | — | — | — | |
| RanLI - Full-FTBackbone=Swin Transformer, Initialization=Random Initialization, Finetuning Protocol=Full Finetuning2023.12 | 77.35 | 49.13 | — | — | — | — | |
| RanLI - LoRABackbone=Swin Transformer, Initialization=Random Initialization, Finetuning Protocol=LoRA2023.12 | 77.02 | 50.25 | — | — | — | — | |
| TWINS-ATwarmup=false2023.03 | 76.86 | 48.4 | 43.69 | — | — | — | |
| TWINS-ATBackbone=ResNet-502023.12 | 76.86 | 48.4 | — | — | — | — | |
| PMGBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=18172026.01 | 76.82 | — | — | 41.21 | — | — | |
| TTCDefense Category=Test-time Defense2025.11 | 76.59 | — | — | 27.25 | — | — | |
| TTCBackbone=CLIP-ViT-B/322026.06 | 76.59 | — | — | 27.25 | — | — | |
| TeCoATraining Data=ImageNet-1k, Adversarial Training=2-step PGD, Epsilon=1/2552025.12 | 76.51 | 58.59 | — | — | — | 59.54 | |
| AT2023.03 | 75.9 | 48.37 | 43.85 | — | — | — | |
| PMG-AFTFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/2552025.12 | 73.59 | 43.46 | — | — | 35.68 | 28.29 | |
| TWINS-TRADESwarmup=true2023.03 | 73.39 | 48.53 | 43.55 | — | — | — | |
| FAREmode=Adversarial Finetuning, attack=10-step PGD, epsilon=1/2552025.11 | 73.32 | — | — | 38.79 | — | — | |
| FAREBackbone=CLIP-ViT-B/32, Adversarial Fine-tuning Attack Budget (ε)=12026.06 | 73.32 | — | — | 2.18 | — | — | |
| FT-TeCoABackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=11122026.01 | 72.98 | — | — | 40.56 | — | — | |
| FAREFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/2552025.12 | 72.05 | 20.7 | — | — | 20.85 | 5.59 | |
| UCATFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/255, Evaluation protocol=Zero-shot2025.12 | 71.53 | — | — | — | — | 48.66 | |
| UCATFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/2552025.12 | 71.53 | 50.47 | — | — | 49.54 | 48.66 | |
| TWINS-TRADESwarmup=false2023.03 | 71.12 | 47.31 | 41.77 | — | — | — | |
| AutoLoRaBackbone=ResNet-502023.12 | 69.85 | 47.82 | — | — | — | — | |
| TRADES2023.03 | 69.7 | 47.28 | 43.39 | — | — | — | |
| FAREDefense Category=Adversarial Finetuning2025.11 | 67.22 | — | — | 5.09 | — | — | |
| FAREBackbone=CLIP-ViT-B/32, Adversarial Fine-tuning Attack Budget (ε)=42026.06 | 67.22 | — | — | 5.09 | — | — | |
| TGA-ZSRFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/2552025.12 | 66.31 | 46.18 | — | — | 45.84 | 45.16 | |
| PMG-AFTmode=Adversarial Finetuning, attack=10-step PGD, epsilon=1/2552025.11 | 62.24 | — | — | 45.91 | — | — | |
| PMG-AFTBackbone=CLIP-ViT-B/32, Adversarial Fine-tuning Attack Budget (ε)=12026.06 | 62.24 | — | — | 10.65 | — | — | |
| TeCoAmode=Adversarial Finetuning, attack=10-step PGD, epsilon=1/2552025.11 | 61.14 | — | — | 43.19 | — | — | |
| TeCoABackbone=CLIP-ViT-B/32, Adversarial Fine-tuning Attack Budget (ε)=12026.06 | 61.14 | — | — | 8.29 | — | — | |
| TeCoAFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/2552025.12 | 59 | 42.38 | — | — | 41.7 | 41.19 | |
| PMG-AFTDefense Category=Adversarial Finetuning2025.11 | 53.32 | — | — | 13.68 | — | — | |
| PMG-AFTBackbone=CLIP-ViT-B/32, Adversarial Fine-tuning Attack Budget (ε)=42026.06 | 53.32 | — | — | 13.68 | — | — | |
| TeCoADefense Category=Adversarial Finetuning2025.11 | 52.05 | — | — | 11.76 | — | — | |
| TeCoABackbone=CLIP-ViT-B/32, Adversarial Fine-tuning Attack Budget (ε)=42026.06 | 52.05 | — | — | 11.76 | — | — | |
| DKLFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/255, Evaluation protocol=Zero-shot2025.12 | 52 | — | — | — | — | 38.33 | |
| TRADESFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/255, Evaluation protocol=Zero-shot2025.12 | 50.89 | — | — | — | — | 37.84 | |
| ACATFine-tuning dataset=TinyImageNet, Adversarial training=2-step PGD, Epsilon=1/255, Evaluation protocol=Zero-shot2025.12 | 50.89 | — | — | — | — | 34.84 | |
| ATACAttack Strategy=PGD, Epsilon=4/2552025.11 | — | — | — | 90.86 | — | — | |
| ATACAttack Strategy=Lure, Epsilon=4/255, Running time (s)=0.6562025.11 | — | — | — | 15.83 | — | — | |
| ATACAttack Strategy=Avoid, Epsilon=4/255, Running time (s)=0.6582025.11 | — | — | — | 47.5 | — | — | |
| CLIPEvaluation Protocol=Zero-shot, Attack Strategy=AutoAttack, Perturbation Budget=1/2552026.01 | — | — | — | 0.15 | — | — | |
| HPT-GPDEvaluation Protocol=Zero-shot, Attack Strategy=AutoAttack, Perturbation Budget=1/2552026.01 | — | — | — | 19.52 | — | — | |
| PMGEvaluation Protocol=Zero-shot, Attack Strategy=AutoAttack, Perturbation Budget=1/2552026.01 | — | — | — | 1.54 | — | — | |
| TTCAttack Strategy=PGD, Epsilon=4/2552025.11 | — | — | — | 27.25 | — | — | |
| TTCAttack Strategy=Lure, Epsilon=4/255, Running time (s)=0.1492025.11 | — | — | — | 4.58 | — | — | |
| TTCAttack Strategy=Avoid, Epsilon=4/255, Running time (s)=0.1112025.11 | — | — | — | 8.75 | — | — |