Image Classification on CIFAR-10 (Adversarial Robustness PGD/CW Analysis)
96.1Clean AccuracyStandard Training
Evaluation results
| Method | Links | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Standard TrainingType=Standard2025.05 | 96.1 | 0.06 | — | — | — | 0 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TRADESModel=ResNet-342026.06 | 94.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 21.8 | 42.1 | 58.6 | 73.6 | 55.8 | 51.5 | 62.1 | 52.2 | — | — | — | — | |
| Mean-ATModel=ResNet-342026.06 | 93.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 26 | 47.5 | 61.6 | 74.7 | 59.2 | 49.7 | 64.1 | 54.7 | — | — | — | — | |
| TaFDModel=ResNet-342026.06 | 93.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 34.4 | 51 | 69.6 | 80.2 | 68.7 | 47.2 | 70.3 | 60.2 | — | — | — | — | |
| FACEModel=ResNet-342026.06 | 93.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 0 | 0 | 2 | 5.8 | 28.4 | 0 | 3.3 | 5.6 | — | — | — | — | |
| BenignArchitecture=SENet-182026.05 | 93.03 | — | — | — | — | 0 | — | — | — | — | — | 8.9 | 0 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FedAvgAdversarial Training Status=False, Backbone=MobileNetV2, Attack Type=L2-norm PGD, Step size (α)=0.01, Number of steps (K)=10, Perturbation budget (ϵ)=0.12025.11 | 93 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 0 | — | — | — | — | — | — | — | — | — | — | — | — | |
| BenignArchitecture=ResNet-182026.05 | 92.99 | — | — | — | — | 0 | — | — | — | — | — | 8.65 | 0 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| No defenseQuantization=8-bit, Attack Type=Exploiting LLM, Backbone=VGG132026.06 | 92.94 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 97.02 | — | — | — | |
| MNGModel=ResNet-342026.06 | 92.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 1.7 | 17.8 | 60.2 | 71.5 | 54.6 | 6.7 | 60.6 | 39 | — | — | — | — | |
| TaFDModel=MobileViT-XS2026.06 | 92.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 40.8 | 63.4 | 52.6 | 69.8 | 47.5 | 47 | 51.9 | 53.3 | — | — | — | — | |
| No defenseQuantization=4-bit, Attack Type=Exploiting LLM, Backbone=VGG132026.06 | 92.66 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 96.62 | — | — | — | |
| Gaussian NoiseQuantization=8-bit, Attack Type=Exploiting LLM, Backbone=VGG132026.06 | 92.31 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 8.56 | — | — | — | |
| LACQuantization=8-bit, Attack Type=Qu-Anti-zation, Backbone=VGG132026.06 | 92.27 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 9.74 | — | — | — | |
| LACQuantization=4-bit, Attack Type=Exploiting LLM, Backbone=VGG132026.06 | 91.98 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 0.78 | — | — | — | |
| LACQuantization=8-bit, Attack Type=Exploiting LLM, Backbone=VGG132026.06 | 91.85 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 0.23 | — | — | — | |
| FACEModel=MobileViT-XS2026.06 | 91.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 0 | 1.3 | 1 | 28.5 | 4.8 | 0.1 | 1.5 | 5.3 | — | — | — | — | |
| EFRAPQuantization=8-bit, Attack Type=Exploiting LLM, Backbone=VGG132026.06 | 91.58 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 0.2 | — | — | — | |
| Gaussian NoiseQuantization=8-bit, Attack Type=Qu-Anti-zation, Backbone=VGG132026.06 | 91.46 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 46.87 | — | — | — | |
| QVec (0.98)Quantization=4-bit, Attack Type=Exploiting LLM, Backbone=VGG132026.06 | 91.46 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 0.87 | — | — | — | |
| EFRAPQuantization=4-bit, Attack Type=Exploiting LLM, Backbone=VGG132026.06 | 91.41 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 0.81 | — | — | — | |
| EFRAPQuantization=8-bit, Attack Type=Qu-Anti-zation, Backbone=VGG132026.06 | 91.35 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 47.48 | — | — | — | |
| 6-layer-CNN-SLModel=6-layer-CNN-SL2026.06 | 90.82 | — | — | — | — | — | — | — | — | — | — | — | — | 15.42 | 13.58 | 13.58 | 11.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| 6-layer-CNN-SLBackbone=6-layer CNN, Training=Supervised Learning2026.06 | 90.74 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 5 | — | — | — | — | — | — | — | — | — | — | — | — | |
| QVec (0.98)Quantization=8-bit, Attack Type=Qu-Anti-zation, Backbone=VGG132026.06 | 90.58 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 0.37 | — | — | — | |
| QVec (0.98)Quantization=8-bit, Attack Type=Exploiting LLM, Backbone=VGG132026.06 | 90.51 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 0.12 | — | — | — | |
| GBNModel=ResNet-342026.06 | 90.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 0.1 | 1.2 | 50.2 | 54.8 | 40.2 | 22.3 | 51.5 | 31.5 | — | — | — | — | |
| EB-JDAT-SADAJEMbase_model=SADAJEM2025.05 | 90.37 | 68.76 | — | — | — | 66.12 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| EB-JDAT-JEM++base_model=JEM++2025.05 | 90.3 | 64.88 | — | — | — | 64.78 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| 6-layer-CNN-SL-advBackbone=6-layer CNN, Training=Adversarial Supervised Learning2026.06 | 90.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 4.96 | — | — | — | — | — | — | — | — | — | — | — | — | |
| EFRAPQuantization=4-bit, Attack Type=Qu-Anti-zation, Backbone=VGG132026.06 | 89.89 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 2.52 | — | — | — | |
| QVec (0.95)Quantization=8-bit, Attack Type=Exploiting LLM, Backbone=VGG132026.06 | 89.89 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 0.08 | — | — | — | |
| QVec (0.95)Quantization=4-bit, Attack Type=Exploiting LLM, Backbone=VGG132026.06 | 89.82 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 1.02 | — | — | — | |
| LACQuantization=4-bit, Attack Type=Qu-Anti-zation, Backbone=VGG132026.06 | 89.75 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 5.22 | — | — | — | |
| TRADESModel=MobileViT-XS2026.06 | 89.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 29.7 | 64.7 | 38.3 | 51.9 | 32.4 | 16.7 | 34.1 | 38.3 | — | — | — | — | |
| Gaussian NoiseQuantization=4-bit, Attack Type=Exploiting LLM, Backbone=VGG132026.06 | 88.85 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 17.21 | — | — | — | |
| 6-layer-CNN-RLModel=6-layer-CNN-RL2026.06 | 88.62 | — | — | — | — | — | — | — | — | — | — | — | — | 16.71 | 13.73 | 13.73 | 11.96 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| 6-layer-CNN-RLBackbone=6-layer CNN, Training=Reinforcement Learning2026.06 | 88.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 55.77 | — | — | — | — | — | — | — | — | — | — | — | — | |
| Gaussian NoiseQuantization=4-bit, Attack Type=Qu-Anti-zation, Backbone=VGG132026.06 | 88.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 77.08 | — | — | — | |
| No defenseQuantization=8-bit, Attack Type=Qu-Anti-zation, Backbone=VGG132026.06 | 88.35 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 96.62 | — | — | — | |
| QVec (0.95)Quantization=8-bit, Attack Type=Qu-Anti-zation, Backbone=VGG132026.06 | 88.15 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 0.26 | — | — | — | |
| MedFedPureStep Size (alpha)=0.007, Attack Type=L-infinity PGD, Number of steps (K)=7, Perturbation budget (epsilon)=0.015, Backbone=ResNet-182025.11 | 88.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 77.98 | — | — | — | — | — | — | — | — | — | — | — | — | |
| QVec (0.98)Quantization=4-bit, Attack Type=Qu-Anti-zation, Backbone=VGG132026.06 | 88.03 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 10.14 | — | — | — | |
| LAS-AWP2025.05 | 87.74 | 60.16 | — | — | — | 55.52 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| 6-layer-CNN-RL-advBackbone=6-layer CNN, Training=Adversarial Reinforcement Learning2026.06 | 87.63 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 48.63 | — | — | — | — | — | — | — | — | — | — | — | — | |
| No defenseQuantization=4-bit, Attack Type=Qu-Anti-zation, Backbone=VGG132026.06 | 87.39 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 96.61 | — | — | — | |
| ATASArchitecture=SENet-182026.05 | 87.38 | — | — | — | — | 37.25 | — | — | — | — | — | 52.37 | 41.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ATASArchitecture=ResNet-182026.05 | 87.23 | — | — | — | — | 38.06 | — | — | — | — | — | 52.44 | 42.43 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| CAAT-LoRABackbone=ViT-B, Tuned params (M)=1.09, Tuned / Total (%)=1.272026.04 | 87.12 | 51.21 | 49.33 | — | — | 46.37 | 48.97 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| 6-layer-CNN-SL-advModel=6-layer-CNN-SL-adv2026.06 | 87.03 | — | — | — | — | — | — | — | — | — | — | — | — | 24.87 | 21.77 | 21.77 | 19.55 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AGR-TRADES2025.05 | 86.5 | 52.56 | — | — | — | 52.56 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NuATArchitecture=SENet-182026.05 | 86.39 | — | — | — | — | 10.53 | — | — | — | — | — | 56.69 | 30.74 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| 6-layer-CNN-RL-advModel=6-layer-CNN-RL-adv2026.06 | 86.29 | — | — | — | — | — | — | — | — | — | — | — | — | 36.27 | 35.4 | 35.4 | 32.41 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| LBGAT2025.05 | 86.22 | 52.66 | — | — | — | 50.23 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SGLR2025.05 | 85.72 | 56.1 | — | — | — | 53.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| CAAT-ADAPTERBackbone=ViT-B, Tuned params (M)=1.08, Tuned / Total (%)=1.262026.04 | 85.57 | 50.15 | 49.11 | — | — | 45.48 | 48.25 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RiFTBackbone=ResNet-18, Training Strategy=AT2026.06 | 85.57 | — | 49.45 | — | — | 46.21 | — | — | — | — | — | 57.92 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 50.79 | 49.19 | 47.59 | |
| FPCMBackbone=ResNet-18, Training Strategy=AT2026.06 | 85.51 | — | 49.44 | — | — | 46.14 | — | — | — | — | — | 58.07 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 49.92 | 48.22 | 47.25 | |
| FGSMArchitecture=ResNet-182026.05 | 85.21 | — | — | — | — | 0 | — | — | — | — | — | 85.99 | 0.06 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| QVec (0.95)Quantization=4-bit, Attack Type=Qu-Anti-zation, Backbone=VGG132026.06 | 85.06 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 8.27 | — | — | — | |
| ATBackbone=ResNet-18, Training Strategy=AT2026.06 | 85.04 | — | 48.19 | — | — | 44.28 | — | — | — | — | — | 56.96 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 49.12 | 47.51 | 46.05 | |
| RAMPModel=ResNet-342026.06 | 85 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 3.3 | 25.6 | 38.4 | 58 | 45.7 | 2.8 | 40.2 | 30.6 | — | — | — | — | |
| FULLLORA-ATBackbone=ViT-B, Tuned params (M)=2.46, Tuned / Total (%)=2.872026.04 | 84.93 | 50.3 | 47.67 | — | — | 45.28 | 47.75 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RiFTBackbone=ResNet-18, Training Strategy=TRADES2026.06 | 84.75 | — | 50.01 | — | — | 48.24 | — | — | — | — | — | 58.48 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 52.47 | 51.26 | 49.35 | |
| Mean-ATModel=MobileViT-XS2026.06 | 84.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 38.9 | 66.5 | 35.9 | 47.8 | 30.5 | 25.6 | 30.3 | 39.4 | — | — | — | — | |
| DHAT-CFA2025.05 | 84.49 | 62.38 | — | — | — | 54.05 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| A3Backbone=ResNet-18, Training Strategy=AT2026.06 | 84.37 | — | 52.33 | — | — | 47.28 | — | — | — | — | — | 62.43 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 58.66 | 57.01 | 51.04 | |
| NuATArchitecture=ResNet-182026.05 | 84.32 | — | — | — | — | 18.6 | — | — | — | — | — | 53.88 | 35.53 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PGD-2Architecture=SENet-182026.05 | 84.28 | — | — | — | — | 42.72 | — | — | — | — | — | 53.85 | 47.28 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FGSMArchitecture=SENet-182026.05 | 84.13 | — | — | — | — | 0 | — | — | — | — | — | 80.13 | 0.07 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TRADESBackbone=ResNet-18, Training Strategy=TRADES2026.06 | 84.02 | — | 48.93 | — | — | 46.98 | — | — | — | — | — | 57.83 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 51.59 | 50.48 | 48.26 | |
| FTA2CBackbone=ResNet-18, Training Strategy=TRADES2026.06 | 83.97 | — | 50.27 | — | — | 48.68 | — | — | — | — | — | 58.19 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 52.99 | 51.9 | 49.6 | |
| PGD-2Architecture=ResNet-182026.05 | 83.78 | — | — | — | — | 42.24 | — | — | — | — | — | 53.48 | 46.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| A3Backbone=ResNet-18, Training Strategy=TRADES2026.06 | 83.77 | — | 51.52 | — | — | 49.27 | — | — | — | — | — | 58.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 55.1 | 54.26 | 50.97 | |
| FPCMBackbone=ResNet-18, Training Strategy=TRADES2026.06 | 83.73 | — | 50.61 | — | — | 48.67 | — | — | — | — | — | 58.41 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 53.14 | 52.27 | 49.68 | |
| HYPERATBackbone=ViT-B, Tuned params (M)=5.47, Tuned / Total (%)=6.422026.04 | 83.7 | 50.46 | 48.73 | — | — | 45.32 | 48.17 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ELLEArchitecture=SENet-182026.05 | 83.68 | — | — | — | — | 40.86 | — | — | — | — | — | 52.64 | 45.44 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| RiFTBackbone=ResNet-18, Training Strategy=MART2026.06 | 83.53 | — | 48.73 | — | — | 46.31 | — | — | — | — | — | 58.73 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 52.87 | 51.43 | 47.93 | |
| FSRBackbone=ResNet-18, Training Strategy=TRADES2026.06 | 83.46 | — | 49.09 | — | — | 47.5 | — | — | — | — | — | 57.49 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 51.67 | 50.78 | 48.39 | |
| EMFFBackbone=ResNet-18, Training Strategy=TRADES2026.06 | 83.4 | — | 48.91 | — | — | 47.13 | — | — | — | — | — | 57.96 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 52.09 | 50.67 | 48.23 | |
| ELLEArchitecture=ResNet-182026.05 | 83.3 | — | — | — | — | 40.33 | — | — | — | — | — | 52.21 | 45.02 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| LoRA-16Backbone=ViT-B, Tuned params (M)=1.24, Tuned / Total (%)=1.462026.04 | 83.24 | 48.96 | 46.71 | — | — | 44.96 | 46.88 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FSRBackbone=ResNet-18, Training Strategy=MART2026.06 | 83.21 | — | 48.95 | — | — | 46.16 | — | — | — | — | — | 58.38 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 52.5 | 51.02 | 47.78 | |
| MNGModel=MobileViT-XS2026.06 | 83.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 40.1 | 67.1 | 40 | 49.8 | 32.3 | 30.8 | 33.6 | 42 | — | — | — | — | |
| CASBackbone=ResNet-18, Training Strategy=TRADES2026.06 | 83.19 | — | 49.05 | — | — | 45.12 | — | — | — | — | — | 57.02 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 51.24 | 50.31 | 47.99 | |
| MART2025.05 | 82.99 | 55.48 | — | — | — | 50.67 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| UIAT2025.05 | 82.94 | 58.12 | — | — | — | 52.17 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FSRBackbone=ResNet-18, Training Strategy=AT2026.06 | 82.78 | — | 49.24 | — | — | 45.92 | — | — | — | — | — | 57.51 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 51.45 | 50.05 | 47.67 | |
| GradAlignArchitecture=SENet-182026.05 | 82.75 | — | — | — | — | 42.41 | — | — | — | — | — | 53.75 | 47.26 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| A3Backbone=ResNet-18, Training Strategy=MART2026.06 | 82.69 | — | 51.7 | — | — | 47.29 | — | — | — | — | — | 62.83 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 59.05 | 57.05 | 50.86 | |
| AWP2025.05 | 82.67 | 57.21 | — | — | — | 51.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FULLBackbone=ViT-B, Tuned params (M)=85.15, Tuned / Total (%)=1002026.04 | 82.65 | 53.66 | 50.69 | — | — | 47.14 | 50.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| CASBackbone=ResNet-18, Training Strategy=AT2026.06 | 82.45 | — | 50.2 | — | — | 43.4 | — | — | — | — | — | 56.81 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 50.02 | 48.93 | 46.97 | |
| GradAlignArchitecture=ResNet-182026.05 | 82.4 | — | — | — | — | 42.49 | — | — | — | — | — | 53.7 | 47.29 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FTA2CBackbone=ResNet-18, Training Strategy=AT2026.06 | 82.35 | — | 48.7 | — | — | 45.42 | — | — | — | — | — | 57.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 52.03 | 50.88 | 47.14 | |
| MedFedPureAdversarial Training Status=True, Backbone=MobileNetV2, Attack Type=L2-norm PGD, Step size (α)=0.01, Number of steps (K)=10, Perturbation budget (ϵ)=0.12025.11 | 82.31 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 51.43 | — | — | — | — | — | — | — | — | — | — | — | — | |
| TDAT2025.05 | 82.25 | 56.03 | — | — | — | 54.06 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FTA2CBackbone=ResNet-18, Training Strategy=MART2026.06 | 82.16 | — | 48.32 | — | — | 45.69 | — | — | — | — | — | 58 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 52.64 | 51.37 | 47.34 | |
| EMFFBackbone=ResNet-18, Training Strategy=MART2026.06 | 82.13 | — | 48.14 | — | — | 45.61 | — | — | — | — | — | 57.87 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 51.59 | 50.16 | 46.99 | |
| MARTBackbone=ResNet-18, Training Strategy=MART2026.06 | 81.92 | — | 48.25 | — | — | 45.88 | — | — | — | — | — | 57.98 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 52.12 | 51.08 | 47.56 |