Image Classification on CIFAR-10 (Robust Accuracy)
94.78Clean AccuracyDefault
Evaluation results
| Method | Links | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DefaultBackbone=WRN-28-10, Evaluation Protocol=AutoAttack-EOT, Number of evaluation samples=1282026.05 | 94.78 | 0 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DefaultType=Default, Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-infinity, Budget=epsilon=8/2552026.05 | 94.78 | 0 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DefaultType=Default, Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-2, Budget=epsilon=0.52026.05 | 94.78 | 0 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Score SDE VP-SDE (Contin. Diffusion)Attack Type=l_2, Hd=50, Backbone=WRN-28-102026.05 | 94.62 | — | — | — | — | 77.65 | — | — | — | — | — | — | — | — | — | — | |
| Score-Opt-NType=Adversarial Purification, Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-infinity, Budget=epsilon=8/2552026.05 | 94.43 | 65.62 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Score-Opt-NType=Adversarial Purification, Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-2, Budget=epsilon=0.52026.05 | 94.43 | 84.86 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Augustin et al.Type=Adversarial Training, Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-2, Budget=epsilon=0.52026.05 | 93.96 | 86.14 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TARO-3Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-2, Budget=epsilon=0.52026.05 | 93.55 | 68.86 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TARO-3-AABackbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-2, Budget=epsilon=0.52026.05 | 93.47 | 88.39 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TARO-3Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-infinity, Budget=epsilon=8/2552026.05 | 93.45 | 88.57 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TARO-3-AABackbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-infinity, Budget=epsilon=8/2552026.05 | 93.45 | 87.46 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TARO-2Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-2, Budget=epsilon=0.52026.05 | 93.43 | 69.21 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TARO-2 + Cons.Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-2, Budget=epsilon=0.5, Condition=Consistency Constraint2026.05 | 93.43 | 88.99 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TARO-2Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-infinity, Budget=epsilon=8/2552026.05 | 93.41 | 88.27 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Score SDE VP-SDE (Contin. Diffusion)Attack Type=l_inf, Hd=50, Backbone=WRN-28-102026.05 | 93.33 | — | — | — | — | 41.76 | — | — | — | — | — | — | — | — | — | — | |
| TARO-2-AABackbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-infinity, Budget=epsilon=8/2552026.05 | 92.61 | 86.91 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TARO-2-AABackbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-2, Budget=epsilon=0.52026.05 | 92.61 | 88.19 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Rebuffi et al.Type=Adversarial Training, Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-2, Budget=epsilon=0.52026.05 | 91.79 | 85.05 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AAOptBackbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-infinity, Budget=epsilon=8/2552026.05 | 91.53 | 85.12 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AAOptBackbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-2, Budget=epsilon=0.52026.05 | 91.48 | 86.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Nie et al.Type=Adversarial Purification, Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-infinity, Budget=epsilon=8/2552026.05 | 91.41 | 51.25 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Nie et al.Type=Adversarial Purification, Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-2, Budget=epsilon=0.52026.05 | 91.41 | 82.11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| TARO-3 + Cons.Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-2, Budget=epsilon=0.5, Condition=Consistency Constraint2026.05 | 91.27 | 86.97 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Score-Opt-OType=Adversarial Purification, Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-infinity, Budget=epsilon=8/2552026.05 | 91.21 | 64.96 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Score-Opt-OType=Adversarial Purification, Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-2, Budget=epsilon=0.52026.05 | 91.21 | 79.09 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| HICATBackbone=WRN-70-16, Aug. Data=200K, Epochs=1002026.06 | 91.08 | — | — | — | — | 62.17 | — | — | — | — | — | — | — | — | — | — | |
| TARO-2-AABackbone=WRN-28-10, Evaluation Protocol=AutoAttack-EOT, Number of evaluation samples=1282026.05 | 91.01 | 87.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Score SDE VP-SDE (Contin. Diffusion)Attack Type=l_2, Hd=1, Backbone=WRN-28-102026.05 | 90.79 | — | — | — | — | 70 | — | — | — | — | — | — | — | — | — | — | |
| 2DUnet DDPM (Discrete Diffusion)Attack Type=l_inf, Hd=50, Backbone=WRN-28-102026.05 | 90.79 | — | — | — | — | 35.48 | — | — | — | — | — | — | — | — | — | — | |
| HICATBackbone=WRN-70-16, Aug. Data=100K, Epochs=1002026.06 | 90.75 | — | — | — | — | 61.68 | — | — | — | — | — | — | — | — | — | — | |
| TARO-2Backbone=WRN-28-10, Evaluation Protocol=AutoAttack-EOT, Number of evaluation samples=1282026.05 | 90.62 | 71.09 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| HICATBackbone=WRN-28-10, Aug. Data=200K, Epochs=1002026.06 | 90.61 | — | — | — | — | 61.32 | — | — | — | — | — | — | — | — | — | — | |
| HICATBackbone=WRN-70-16, Aug. Data=50K, Epochs=1002026.06 | 90.44 | — | — | — | — | 60.81 | — | — | — | — | — | — | — | — | — | — | |
| Lin et al.Type=Adversarial Purification, Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-infinity, Budget=epsilon=8/2552026.05 | 90.42 | 64.06 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Lin et al.Type=Adversarial Purification, Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-2, Budget=epsilon=0.52026.05 | 90.42 | 85.55 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| HICATBackbone=WRN-28-10, Aug. Data=100K, Epochs=1002026.06 | 90.18 | — | — | — | — | 59.96 | — | — | — | — | — | — | — | — | — | — | |
| HICATBackbone=WRN-28-10, Aug. Data=50K, Epochs=1002026.06 | 89.85 | — | — | — | — | 58.11 | — | — | — | — | — | — | — | — | — | — | |
| Score-Opt-OBackbone=WRN-28-10, Evaluation Protocol=AutoAttack-EOT, Number of evaluation samples=1282026.05 | 89.84 | 74.22 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| 2DUnet DDPM (Discrete Diffusion)Attack Type=l_2, Hd=50, Backbone=WRN-28-102026.05 | 89.81 | — | — | — | — | 68.23 | — | — | — | — | — | — | — | — | — | — | |
| RAATBackbone=ResNet-18, Threat Model=l22026.04 | 89.17 | — | 69.76 | 68.67 | 68.13 | 67.95 | — | — | — | — | — | — | — | — | — | — | |
| HICATBackbone=WRN-70-16, Aug. Data=5K, Epochs=1002026.06 | 89.12 | — | — | — | — | 57.83 | — | — | — | — | — | — | — | — | — | — | |
| AAOptBackbone=WRN-28-10, Evaluation Protocol=AutoAttack-EOT, Number of evaluation samples=1282026.05 | 89.06 | 85.54 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Gowal et al.Backbone=WRN-70-16, Aug. Data=100M, Epochs=20002026.06 | 88.94 | — | — | — | — | 62.2 | — | — | — | — | — | — | — | — | — | — | |
| Score SDE VP-SDE (Contin. Diffusion)Attack Type=l_inf, Hd=1, Backbone=WRN-28-102026.05 | 88.82 | — | — | — | — | 43.53 | — | — | — | — | — | — | — | — | — | — | |
| Cons-ATBackbone=ResNet-18, Threat Model=l22026.04 | 88.76 | — | 70.21 | 69.16 | 68.1 | 67.46 | — | — | — | — | — | — | — | — | — | — | |
| Pang et al.Backbone=WRN-70-16, Aug. Data=1M, Epochs=8002026.06 | 88.7 | — | — | — | — | 60.2 | — | — | — | — | — | — | — | — | — | — | |
| Pang et al.Type=Adversarial Training, Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-infinity, Budget=epsilon=8/2552026.05 | 88.62 | 64.95 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Gowal et al. [2020]Type=Adversarial Training, Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-infinity, Budget=epsilon=8/2552026.05 | 88.54 | 65.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Pang et al.Backbone=WRN-28-10, Aug. Data=1M, Epochs=8002026.06 | 88.02 | — | — | — | — | 57.52 | — | — | — | — | — | — | — | — | — | — | |
| HICATBackbone=ResNet-18, Unlabeled images=500K, Evaluation protocol=Unified evaluation protocol2026.06 | 87.96 | — | — | — | — | 55.18 | — | — | — | — | — | — | — | 0.96 | — | — | |
| RiFTBackbone=WideResNet-34-10, Training Strategy=AT2026.06 | 87.85 | — | — | 50.38 | 52.05 | 48.74 | — | — | — | — | — | 60.83 | — | — | 52.32 | 49.84 | |
| PGD-ATBackbone=ResNet-18, Threat Model=l22026.04 | 87.76 | — | 68.82 | 67.72 | 66.64 | 66.36 | — | — | — | — | — | — | — | — | — | — | |
| BaselineBackbone=WideResNet-34-10, Training Strategy=AT2026.06 | 87.57 | — | — | 49.83 | 51.6 | 48.18 | — | — | — | — | — | 60.12 | — | — | 51.58 | 49.27 | |
| Gowal et al. [2021]Type=Adversarial Training, Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-infinity, Budget=epsilon=8/2552026.05 | 87.51 | 66.01 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Gowal et al.Backbone=WRN-28-10, Aug. Data=100M, Epochs=20002026.06 | 87.37 | — | — | — | — | 61.38 | — | — | — | — | — | — | — | — | — | — | |
| RiFTBackbone=WideResNet-34-10, Training Strategy=TRADES2026.06 | 87.29 | — | — | 51.26 | 52.54 | 49.64 | — | — | — | — | — | 61.92 | — | — | 53.25 | 50.58 | |
| RiFTBackbone=WideResNet-34-10, Training Strategy=MART2026.06 | 87.29 | — | — | 51.26 | 52.54 | 49.64 | — | — | — | — | — | 61.92 | — | — | 53.25 | 50.58 | |
| FPCMBackbone=WideResNet-34-10, Training Strategy=AT2026.06 | 87.13 | — | — | 48.54 | 50.12 | 47.36 | — | — | — | — | — | 58.7 | — | — | 50.48 | 48.31 | |
| FSRBackbone=WideResNet-34-10, Training Strategy=AT2026.06 | 87.07 | — | — | 51.97 | 52.41 | 48.8 | — | — | — | — | — | 61.13 | — | — | 53.81 | 50.65 | |
| DHATBackbone=ResNet-18, Unlabeled images=500K, Evaluation protocol=Unified evaluation protocol2026.06 | 86.94 | — | — | — | — | 53.67 | — | — | — | — | — | — | — | 1.21 | — | — | |
| FSRBackbone=WideResNet-34-10, Training Strategy=TRADES2026.06 | 86.92 | — | — | 51.97 | 52.98 | 50.08 | — | — | — | — | — | 62.86 | — | — | 54.24 | 51.1 | |
| BaselineBackbone=WideResNet-34-10, Training Strategy=MART2026.06 | 86.79 | — | — | 51.08 | 51 | 48.51 | — | — | — | — | — | 60.78 | — | — | 53.05 | 49.62 | |
| HICATBackbone=WRN-28-10, Aug. Data=5K, Epochs=1002026.06 | 86.74 | — | — | — | — | 55.38 | — | — | — | — | — | — | — | — | — | — | |
| A3Backbone=WideResNet-34-10, Training Strategy=MART2026.06 | 86.65 | — | — | 56 | 54.54 | 50.59 | — | — | — | — | — | 63.61 | — | — | 58.36 | 53.32 | |
| A3Backbone=WideResNet-34-10, Training Strategy=AT2026.06 | 86.64 | — | — | 56.72 | 55.32 | 51.62 | — | — | — | — | — | 63.01 | — | — | 58.33 | 53.82 | |
| RAAT++Backbone=ResNet-18, Threat Model=l22026.04 | 86.54 | — | 70.84 | 70.01 | 69.07 | 67.96 | — | — | — | — | — | — | — | — | — | — | |
| EMFFBackbone=WideResNet-34-10, Training Strategy=TRADES2026.06 | 86.51 | — | — | 52.24 | 52.01 | 49.66 | — | — | — | — | — | 62.41 | — | — | 54.3 | 50.47 | |
| CASBackbone=WideResNet-34-10, Training Strategy=AT2026.06 | 86.43 | — | — | 50.02 | 51.43 | 46.62 | — | — | — | — | — | 60.16 | — | — | 51.67 | 49.23 | |
| FPCMBackbone=WideResNet-34-10, Training Strategy=MART2026.06 | 86.41 | — | — | 52.17 | 52.05 | 49.36 | — | — | — | — | — | 61.69 | — | — | 54.14 | 50.87 | |
| BaselineBackbone=WideResNet-34-10, Training Strategy=TRADES2026.06 | 86.39 | — | — | 50.86 | 52.12 | 49.33 | — | — | — | — | — | 61.14 | — | — | 52.69 | 50.25 | |
| FTA2CBackbone=WideResNet-34-10, Training Strategy=AT2026.06 | 86.36 | — | — | 51.07 | 52.22 | 48.1 | — | — | — | — | — | 60.44 | — | — | 52.7 | 49.73 | |
| CIFSBackbone=WideResNet-34-10, Training Strategy=MART2026.06 | 86.36 | — | — | 51.31 | 51.35 | 47.16 | — | — | — | — | — | 61.67 | — | — | 53.44 | 50.39 | |
| FSRBackbone=WideResNet-34-10, Training Strategy=MART2026.06 | 86.31 | — | — | 52.5 | 51.75 | 49.15 | — | — | — | — | — | 61.6 | — | — | 54.29 | 50.53 | |
| CASBackbone=WideResNet-34-10, Training Strategy=TRADES2026.06 | 86.3 | — | — | 51.12 | 52.81 | 47.61 | — | — | — | — | — | 61.62 | — | — | 52.84 | 50.56 | |
| EMFFBackbone=WideResNet-34-10, Training Strategy=AT2026.06 | 86.1 | — | — | 51.75 | 51.78 | 49.1 | — | — | — | — | — | 62.29 | — | — | 53.92 | 50.38 | |
| CIFSBackbone=WideResNet-34-10, Training Strategy=TRADES2026.06 | 86.08 | — | — | 51.27 | 52.34 | 47.96 | — | — | — | — | — | 61.27 | — | — | 52.98 | 50.71 | |
| CIFSBackbone=WideResNet-34-10, Training Strategy=AT2026.06 | 85.96 | — | — | 50.18 | 52.07 | 46.59 | — | — | — | — | — | 60.91 | — | — | 51.78 | 49.58 | |
| EMFFBackbone=WideResNet-34-10, Training Strategy=MART2026.06 | 85.92 | — | — | 54.45 | 52.51 | 49.94 | — | — | — | — | — | 63.11 | — | — | 55.6 | 51.42 | |
| FPCMBackbone=WideResNet-34-10, Training Strategy=TRADES2026.06 | 85.83 | — | — | 50.12 | 50.85 | 48.54 | — | — | — | — | — | 58.96 | — | — | 51.76 | 49.36 | |
| CASBackbone=WideResNet-34-10, Training Strategy=MART2026.06 | 85.75 | — | — | 51.22 | 51.57 | 47.27 | — | — | — | — | — | 61.32 | — | — | 53.21 | 50.2 | |
| SGLRBackbone=ResNet-18, Unlabeled images=500K, Evaluation protocol=Unified evaluation protocol2026.06 | 85.67 | — | — | — | — | 50.93 | — | — | — | — | — | — | — | 3.08 | — | — | |
| Yoon et al.Type=Adversarial Purification, Backbone=WRN-28-10, Attack Protocol=PGD-EOT-20, Perturbation Constraint=l-infinity, Budget=epsilon=8/2552026.05 | 85.66 | 37.27 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| A3Backbone=WideResNet-34-10, Training Strategy=TRADES2026.06 | 85.46 | — | — | 55.12 | 54.84 | 51.41 | — | — | — | — | — | 65.34 | — | — | 58.19 | 53.28 | |
| FTA2CBackbone=WideResNet-34-10, Training Strategy=MART2026.06 | 84.93 | — | — | 52.29 | 51.18 | 49.18 | — | — | — | — | — | 61.3 | — | — | 54.09 | 50.57 | |
| UIATBackbone=ResNet-18, Unlabeled images=500K, Evaluation protocol=Unified evaluation protocol2026.06 | 84.78 | — | — | — | — | 51.62 | — | — | — | — | — | — | — | 3.32 | — | — | |
| Smooth EBMAttack Type=l_inf, Hd=50, Backbone=WRN-28-102026.05 | 84.51 | — | — | — | — | 6.08 | — | — | — | — | — | — | — | — | — | — | |
| Smooth EBMAttack Type=l_2, Hd=50, Backbone=WRN-28-102026.05 | 84.51 | — | — | — | — | 41.76 | — | — | — | — | — | — | — | — | — | — | |
| FTA2CBackbone=WideResNet-34-10, Training Strategy=TRADES2026.06 | 84.44 | — | — | 52.15 | 52.36 | 50.17 | — | — | — | — | — | 62.08 | — | — | 54.38 | 50.95 | |
| CFABackbone=ResNet-18, Unlabeled images=500K, Evaluation protocol=Unified evaluation protocol2026.06 | 84.31 | — | — | — | — | 50.22 | — | — | — | — | — | — | — | 3.31 | — | — | |
| MARTBackbone=ResNet-18, Threat Model=l22026.04 | 84.09 | — | 68.96 | 68.19 | 67.22 | 66.28 | — | — | — | — | — | — | — | — | — | — | |
| TRADESBackbone=ResNet-18, Threat Model=l22026.04 | 83.99 | — | 68.74 | 68.59 | 67.05 | 65.93 | — | — | — | — | — | — | — | — | — | — | |
| AWPBackbone=ResNet-18, Unlabeled images=500K, Evaluation protocol=Unified evaluation protocol2026.06 | 83.26 | — | — | — | — | 50.11 | — | — | — | — | — | — | — | 2.36 | — | — | |
| MARTBackbone=ResNet-18, Unlabeled images=500K, Evaluation protocol=Unified evaluation protocol2026.06 | 82.91 | — | — | — | — | 48.86 | — | — | — | — | — | — | — | 3.2 | — | — | |
| FSRBackbone=ResNet-18, Unlabeled images=500K, Evaluation protocol=Unified evaluation protocol2026.06 | 82.78 | — | — | — | — | 49.84 | — | — | — | — | — | — | — | 2.63 | — | — | |
| 2DUnet DDPM (Discrete Diffusion)Attack Type=l_2, Hd=1, Backbone=WRN-28-102026.05 | 82.74 | — | — | — | — | 64.71 | — | — | — | — | — | — | — | — | — | — | |
| 2DUnet DDPM (Discrete Diffusion)Attack Type=l_inf, Hd=1, Backbone=WRN-28-102026.05 | 82.55 | — | — | — | — | 41.56 | — | — | — | — | — | — | — | — | — | — | |
| SGDNorm=l2, Optimizer=SGD, Checkpoint=Last, Backbone=ViT-B2026.05 | 76.5 | — | — | — | — | — | 18.61 | 52.99 | 33.55 | 18.46 | — | — | — | — | — | — | |
| Smooth EBMAttack Type=l_inf, Hd=1, Backbone=WRN-28-102026.05 | 75.88 | — | — | — | — | 8.43 | — | — | — | — | — | — | — | — | — | — | |
| Smooth EBMAttack Type=l_2, Hd=1, Backbone=WRN-28-102026.05 | 75.88 | — | — | — | — | 41.96 | — | — | — | — | — | — | — | — | — | — | |
| SGDNorm=l1, Optimizer=SGD, Checkpoint=Last, Backbone=ViT-B2026.05 | 72.24 | — | — | — | — | — | 17.19 | 49.72 | 43.06 | 17.19 | — | — | — | — | — | — |