Image Classification on CIFAR-10 (test) (Adversarial Robustness Suite)
99.97Attack Success Rate (ASR)BackWeak
Evaluation results
| Method | Links | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| BackWeakKD Method=Response, Model=ResNet-34 (Teacher), Trigger Only=false2025.11 | 99.97 | — | — | — | — | — | — | — | — | — | — | 87.97 | 89.03 | — | |
| BackWeakKD Method=Feature, Model=ResNet-34 (Teacher), Trigger Only=false2025.11 | 99.97 | — | — | — | — | — | — | — | — | — | — | 87.97 | 89.03 | — | |
| BackWeakKD Method=Relation, Model=ResNet-34 (Teacher), Trigger Only=false2025.11 | 99.97 | — | — | — | — | — | — | — | — | — | — | 87.97 | 89.03 | — | |
| BackWeakKD Method=Feature, Model=DenseNet-BC-121 (Student C), Trigger Only=false2025.11 | 99.88 | — | — | — | — | — | — | — | — | — | — | 88.05 | 88.48 | — | |
| BackWeakKD Method=Response, Model=DenseNet-BC-121 (Student C), Trigger Only=false2025.11 | 99.21 | — | — | — | — | — | — | — | — | — | — | 90.58 | 89.34 | — | |
| BackWeakKD Method=Feature, Model=MobileNet-V2 (Student A), Trigger Only=false2025.11 | 98.96 | — | — | — | — | — | — | — | — | — | — | 85.56 | 88.23 | — | |
| BackWeakKD Method=Relation, Model=MobileNet-V2 (Student A), Trigger Only=false2025.11 | 97.88 | — | — | — | — | — | — | — | — | — | — | 88.71 | 87.9 | — | |
| BackWeakKD Method=Relation, Model=DenseNet-BC-121 (Student C), Trigger Only=false2025.11 | 97.82 | — | — | — | — | — | — | — | — | — | — | 88.16 | 87.34 | — | |
| ADBAKD Method=Response, Model=ResNet-34 (Teacher), Trigger Only=false2025.11 | 97.64 | — | — | — | — | — | — | — | — | — | — | 73.75 | 71.3 | — | |
| ADBAKD Method=Feature, Model=ResNet-34 (Teacher), Trigger Only=false2025.11 | 97.64 | — | — | — | — | — | — | — | — | — | — | 73.75 | 71.3 | — | |
| ADBAKD Method=Relation, Model=ResNet-34 (Teacher), Trigger Only=false2025.11 | 97.64 | — | — | — | — | — | — | — | — | — | — | 73.75 | 71.3 | — | |
| BackWeakKD Method=Response, Model=MobileNet-V2 (Student A), Trigger Only=false2025.11 | 97.5 | — | — | — | — | — | — | — | — | — | — | 89.79 | 87.75 | — | |
| ADBAKD Method=Relation, Model=DenseNet-BC-121 (Student C), Trigger Only=true2025.11 | 97.04 | — | — | — | — | — | — | — | — | — | — | 89.86 | 87.7 | — | |
| FedSACAttack Type=Bounded-Scaling, Architecture=CNN2026.05 | 96.9 | — | — | — | — | — | — | — | — | — | 77.03 | — | — | — | |
| ADBAKD Method=Feature, Model=DenseNet-BC-121 (Student C), Trigger Only=false2025.11 | 96.79 | — | — | — | — | — | — | — | — | — | — | 73.49 | 69.32 | — | |
| ADBAKD Method=Feature, Model=DenseNet-BC-121 (Student C), Trigger Only=true2025.11 | 96.67 | — | — | — | — | — | — | — | — | — | — | 89.59 | 86.88 | — | |
| ADBAKD Method=Relation, Model=MobileNet-V2 (Student A), Trigger Only=true2025.11 | 96.61 | — | — | — | — | — | — | — | — | — | — | 89.78 | 87.17 | — | |
| ADBAKD Method=Response, Model=DenseNet-BC-121 (Student C), Trigger Only=true2025.11 | 96.4 | — | — | — | — | — | — | — | — | — | — | 91.24 | 86.9 | — | |
| ADBAKD Method=Feature, Model=MobileNet-V2 (Student A), Trigger Only=true2025.11 | 95.77 | — | — | — | — | — | — | — | — | — | — | 87.73 | 86.59 | — | |
| ADBAKD Method=Response, Model=MobileNet-V2 (Student A), Trigger Only=true2025.11 | 95.64 | — | — | — | — | — | — | — | — | — | — | 90.33 | 86.4 | — | |
| ADBAKD Method=Response, Model=DenseNet-BC-121 (Student C), Trigger Only=false2025.11 | 95.63 | — | — | — | — | — | — | — | — | — | — | 80.74 | 74.43 | — | |
| ADBAKD Method=Response, Model=ShuffleNet-V2 (Student B), Trigger Only=true2025.11 | 95.33 | — | — | — | — | — | — | — | — | — | — | 90.39 | 86.19 | — | |
| ADBAKD Method=Response, Model=ResNet-34 (Teacher), Trigger Only=true2025.11 | 94.41 | — | — | — | — | — | — | — | — | — | — | 90.63 | 85.06 | — | |
| ADBAKD Method=Feature, Model=ResNet-34 (Teacher), Trigger Only=true2025.11 | 94.41 | — | — | — | — | — | — | — | — | — | — | 90.63 | 85.06 | — | |
| ADBAKD Method=Relation, Model=ResNet-34 (Teacher), Trigger Only=true2025.11 | 94.41 | — | — | — | — | — | — | — | — | — | — | 90.63 | 85.06 | — | |
| ADBAKD Method=Response, Model=ShuffleNet-V2 (Student B), Trigger Only=false2025.11 | 94.27 | — | — | — | — | — | — | — | — | — | — | 80.49 | 73.24 | — | |
| HA_{Rob-MoM}^{CSFT}Total number of clients (n)=20, Evaluation protocol=fine-tuning, Attack scenario=adaptive attacks2025.09 | 94.26 | 81.18 | — | — | — | — | — | — | 2 | — | — | — | — | — | |
| ADBAKD Method=Feature, Model=ShuffleNet-V2 (Student B), Trigger Only=false2025.11 | 93.56 | — | — | — | — | — | — | — | — | — | — | 72.59 | 65.78 | — | |
| BackWeakKD Method=Response, Model=ShuffleNet-V2 (Student B), Trigger Only=false2025.11 | 93.07 | — | — | — | — | — | — | — | — | — | — | 89.88 | 83.61 | — | |
| ADBAKD Method=Feature, Model=MobileNet-V2 (Student A), Trigger Only=false2025.11 | 92.62 | — | — | — | — | — | — | — | — | — | — | 73.34 | 65.89 | — | |
| ADBAKD Method=Response, Model=MobileNet-V2 (Student A), Trigger Only=false2025.11 | 91.62 | — | — | — | — | — | — | — | — | — | — | 80.34 | 70.77 | — | |
| ADBAKD Method=Relation, Model=DenseNet-BC-121 (Student C), Trigger Only=false2025.11 | 90.68 | — | — | — | — | — | — | — | — | — | — | 76.29 | 66.06 | — | |
| ℓ2 Norm TieringAttack Type=Bounded-Scaling, Architecture=CNN2026.05 | 90.25 | — | — | — | — | — | — | — | — | — | 77.57 | — | — | — | |
| ADBAKD Method=Relation, Model=ShuffleNet-V2 (Student B), Trigger Only=false2025.11 | 89.8 | — | — | — | — | — | — | — | — | — | — | 75.22 | 64.2 | — | |
| ADBAKD Method=Relation, Model=MobileNet-V2 (Student A), Trigger Only=false2025.11 | 89.76 | — | — | — | — | — | — | — | — | — | — | 75.7 | 64.82 | — | |
| ADBAKD Method=Feature, Model=ShuffleNet-V2 (Student B), Trigger Only=true2025.11 | 89.53 | — | — | — | — | — | — | — | — | — | — | 87 | 80.33 | — | |
| BEVAttack Type=Bounded-Scaling, Architecture=CNN2026.05 | 89.5 | — | — | — | — | — | — | — | — | — | 79.04 | — | — | — | |
| BackWeakKD Method=Feature, Model=ShuffleNet-V2 (Student B), Trigger Only=false2025.11 | 89.13 | — | — | — | — | — | — | — | — | — | — | 84.7 | 79.21 | — | |
| FedSACAttack Type=Euc-constrained, Architecture=CNN2026.05 | 87.32 | — | — | — | — | — | — | — | — | — | 77.75 | — | — | — | |
| ADBAKD Method=Relation, Model=ShuffleNet-V2 (Student B), Trigger Only=true2025.11 | 85.36 | — | — | — | — | — | — | — | — | — | — | 89.06 | 76.87 | — | |
| HA_{MoM}^{CSFT}Total number of clients (n)=20, Evaluation protocol=fine-tuning, Attack scenario=adaptive attacks2025.09 | 84.73 | 79.11 | — | — | — | — | — | — | 2 | — | — | — | — | — | |
| FedSACAttack Type=Cos-constrained, Architecture=CNN2026.05 | 80.3 | — | — | — | — | — | — | — | — | — | 80.7 | — | — | — | |
| ℓ2 Norm TieringAttack Type=Euc-constrained, Architecture=CNN2026.05 | 77.41 | — | — | — | — | — | — | — | — | — | 73.65 | — | — | — | |
| FedSACAttack Type=Neurotoxin, Architecture=CNN2026.05 | 76.67 | — | — | — | — | — | — | — | — | — | 79.88 | — | — | — | |
| HA_{Norm}^{CSFT}Total number of clients (n)=20, Evaluation protocol=fine-tuning, Attack scenario=adaptive attacks2025.09 | 67.86 | 83.5 | — | — | — | — | — | — | 4 | — | — | — | — | — | |
| TDA TieringAttack Type=Cos-constrained, Architecture=CNN2026.05 | 62.78 | — | — | — | — | — | — | — | — | — | 80.92 | — | — | — | |
| Model-wise InspectionAttack Type=Neurotoxin, Architecture=CNN2026.05 | 62.1 | — | — | — | — | — | — | — | — | — | 74.65 | — | — | — | |
| BackWeakKD Method=Relation, Model=ShuffleNet-V2 (Student B), Trigger Only=false2025.11 | 60.77 | — | — | — | — | — | — | — | — | — | — | 88.43 | 53.96 | — | |
| BEVAttack Type=Euc-constrained, Architecture=CNN2026.05 | 54.49 | — | — | — | — | — | — | — | — | — | 72.68 | — | — | — | |
| Spikiness TieringAttack Type=Neurotoxin, Architecture=CNN2026.05 | 54.04 | — | — | — | — | — | — | — | — | — | 72.68 | — | — | — | |
| ℓ2 Norm TieringAttack Type=Cos-constrained, Architecture=CNN2026.05 | 46.43 | — | — | — | — | — | — | — | — | — | 76.15 | — | — | — | |
| BEVAttack Type=Cos-constrained, Architecture=CNN2026.05 | 45.24 | — | — | — | — | — | — | — | — | — | 79.78 | — | — | — | |
| HA_{Multi-Metrics}^{CSFT}Total number of clients (n)=20, Evaluation protocol=fine-tuning, Attack scenario=adaptive attacks2025.09 | 35.51 | 79.56 | — | — | — | — | — | — | 8 | — | — | — | — | — | |
| BEVAttack Type=Neurotoxin, Architecture=CNN2026.05 | 31.85 | — | — | — | — | — | — | — | — | — | 74.86 | — | — | — | |
| HA_{Krum}^{CSFT}Total number of clients (n)=20, Evaluation protocol=fine-tuning, Attack scenario=adaptive attacks2025.09 | 26.87 | 76.03 | — | — | — | — | — | — | 8 | — | — | — | — | — | |
| TDA TieringAttack Type=Neurotoxin, Architecture=CNN2026.05 | 16.09 | — | — | — | — | — | — | — | — | — | 78.51 | — | — | — | |
| HA_{Flame}^{CSFT}Total number of clients (n)=20, Evaluation protocol=fine-tuning, Attack scenario=adaptive attacks2025.09 | 13.66 | 74.86 | — | — | — | — | — | — | 8 | — | — | — | — | — | |
| Model-wise InspectionAttack Type=Cos-constrained, Architecture=CNN2026.05 | 11.61 | — | — | — | — | — | — | — | — | — | 78.45 | — | — | — | |
| Model-wise InspectionAttack Type=Bounded-Scaling, Architecture=CNN2026.05 | 11.58 | — | — | — | — | — | — | — | — | — | 77.77 | — | — | — | |
| TTIAttack Type=Neurotoxin, Architecture=CNN2026.05 | 11.17 | — | — | — | — | — | — | — | — | — | 76.92 | — | — | — | |
| TDA TieringAttack Type=Bounded-Scaling, Architecture=CNN2026.05 | 11.15 | — | — | — | — | — | — | — | — | — | 76.9 | — | — | — | |
| Spikiness TieringAttack Type=Cos-constrained, Architecture=CNN2026.05 | 10.94 | — | — | — | — | — | — | — | — | — | 75.86 | — | — | — | |
| ℓ2 Norm TieringAttack Type=Neurotoxin, Architecture=CNN2026.05 | 10.94 | — | — | — | — | — | — | — | — | — | 77.84 | — | — | — | |
| TTIAttack Type=Bounded-Scaling, Architecture=CNN2026.05 | 10.92 | — | — | — | — | — | — | — | — | — | 77.91 | — | — | — | |
| Spikiness TieringAttack Type=Bounded-Scaling, Architecture=CNN2026.05 | 10.83 | — | — | — | — | — | — | — | — | — | 75.79 | — | — | — | |
| TDA TieringAttack Type=Euc-constrained, Architecture=CNN2026.05 | 10.78 | — | — | — | — | — | — | — | — | — | 78.54 | — | — | — | |
| Model-wise InspectionAttack Type=Euc-constrained, Architecture=CNN2026.05 | 10.28 | — | — | — | — | — | — | — | — | — | 78.49 | — | — | — | |
| Spikiness TieringAttack Type=Euc-constrained, Architecture=CNN2026.05 | 9.73 | — | — | — | — | — | — | — | — | — | 76.62 | — | — | — | |
| TTIAttack Type=Euc-constrained, Architecture=CNN2026.05 | 9.6 | — | — | — | — | — | — | — | — | — | 76.88 | — | — | — | |
| TTIAttack Type=Cos-constrained, Architecture=CNN2026.05 | 9.28 | — | — | — | — | — | — | — | — | — | 75.71 | — | — | — | |
| BackWeakKD Method=Response, Model=ResNet-34 (Teacher), Trigger Only=true2025.11 | 4.89 | — | — | — | — | — | — | — | — | — | — | 90.63 | 3.17 | — | |
| BackWeakKD Method=Feature, Model=ResNet-34 (Teacher), Trigger Only=true2025.11 | 4.89 | — | — | — | — | — | — | — | — | — | — | 90.63 | 3.17 | — | |
| BackWeakKD Method=Relation, Model=ResNet-34 (Teacher), Trigger Only=true2025.11 | 4.89 | — | — | — | — | — | — | — | — | — | — | 90.63 | 3.17 | — | |
| BackWeakKD Method=Feature, Model=DenseNet-BC-121 (Student C), Trigger Only=true2025.11 | 4.54 | — | — | — | — | — | — | — | — | — | — | 89.59 | 2.46 | — | |
| BackWeakKD Method=Relation, Model=DenseNet-BC-121 (Student C), Trigger Only=true2025.11 | 4.46 | — | — | — | — | — | — | — | — | — | — | 89.86 | 2.67 | — | |
| BackWeakKD Method=Feature, Model=ShuffleNet-V2 (Student B), Trigger Only=true2025.11 | 4.39 | — | — | — | — | — | — | — | — | — | — | 87 | 1.57 | — | |
| BackWeakKD Method=Feature, Model=MobileNet-V2 (Student A), Trigger Only=true2025.11 | 4.13 | — | — | — | — | — | — | — | — | — | — | 87.73 | 1.92 | — | |
| BackWeakKD Method=Relation, Model=MobileNet-V2 (Student A), Trigger Only=true2025.11 | 3.83 | — | — | — | — | — | — | — | — | — | — | 89.78 | 1.99 | — | |
| BackWeakKD Method=Response, Model=MobileNet-V2 (Student A), Trigger Only=true2025.11 | 3.73 | — | — | — | — | — | — | — | — | — | — | 90.33 | 1.95 | — | |
| BackWeakKD Method=Response, Model=DenseNet-BC-121 (Student C), Trigger Only=true2025.11 | 3.63 | — | — | — | — | — | — | — | — | — | — | 91.24 | 2.03 | — | |
| BackWeakKD Method=Response, Model=ShuffleNet-V2 (Student B), Trigger Only=true2025.11 | 3.4 | — | — | — | — | — | — | — | — | — | — | 90.39 | 1.54 | — | |
| BackWeakKD Method=Relation, Model=ShuffleNet-V2 (Student B), Trigger Only=true2025.11 | 3.38 | — | — | — | — | — | — | — | — | — | — | 89.06 | 1.23 | — | |
| FGSMBackbone=WRN-28-10, Perturbation magnitude (255 * epsilon)=22025.05 | — | 90.81 | — | — | — | — | — | — | — | 74.72 | — | — | — | — | |
| FGSMBackbone=WRN-28-10, Perturbation magnitude (255 * epsilon)=42025.05 | — | 87.86 | — | — | — | — | — | — | — | 61.58 | — | — | — | — | |
| FGSMBackbone=WRN-28-10, Perturbation magnitude (255 * epsilon)=82025.05 | — | 84.89 | — | — | — | — | — | — | — | 0 | — | — | — | — | |
| FGSMBackbone=WRN-28-10, Perturbation magnitude (255 * epsilon)=122025.05 | — | 80.23 | — | — | — | — | — | — | — | 0 | — | — | — | — | |
| FGSMBackbone=WRN-28-10, Perturbation magnitude (255 * epsilon)=162025.05 | — | 74.61 | — | — | — | — | — | — | — | 0 | — | — | — | — | |
| lp-FGSMBackbone=WRN-28-10, Perturbation magnitude (255 * epsilon)=2, beta=0.012025.05 | — | 89.02 | — | — | — | — | — | — | — | 76.14 | — | — | — | — | |
| lp-FGSMBackbone=WRN-28-10, Perturbation magnitude (255 * epsilon)=4, beta=0.012025.05 | — | 85.71 | — | — | — | — | — | — | — | 62.12 | — | — | — | — | |
| lp-FGSMBackbone=WRN-28-10, Perturbation magnitude (255 * epsilon)=8, beta=0.012025.05 | — | 79.81 | — | — | — | — | — | — | — | 42.43 | — | — | — | — | |
| lp-FGSMBackbone=WRN-28-10, Perturbation magnitude (255 * epsilon)=12, beta=0.012025.05 | — | 71.12 | — | — | — | — | — | — | — | 32.13 | — | — | — | — | |
| lp-FGSMBackbone=WRN-28-10, Perturbation magnitude (255 * epsilon)=16, beta=0.012025.05 | — | 58.43 | — | — | — | — | — | — | — | 25.89 | — | — | — | — | |
| N-FGSMBackbone=WRN-28-10, Perturbation magnitude (255 * epsilon)=2, k=22025.05 | — | 89.27 | — | — | — | — | — | — | — | 73.14 | — | — | — | — | |
| N-FGSMBackbone=WRN-28-10, Perturbation magnitude (255 * epsilon)=4, k=22025.05 | — | 86.34 | — | — | — | — | — | — | — | 59.81 | — | — | — | — | |
| N-FGSMBackbone=WRN-28-10, Perturbation magnitude (255 * epsilon)=8, k=22025.05 | — | 74.73 | — | — | — | — | — | — | — | 41.65 | — | — | — | — | |
| N-FGSMBackbone=WRN-28-10, Perturbation magnitude (255 * epsilon)=12, k=22025.05 | — | 62.56 | — | — | — | — | — | — | — | 30.17 | — | — | — | — | |
| N-FGSMBackbone=WRN-28-10, Perturbation magnitude (255 * epsilon)=16, k=22025.05 | — | 52.89 | — | — | — | — | — | — | — | 22.5 | — | — | — | — | |
| RS-FGSMBackbone=WRN-28-10, Perturbation magnitude (255 * epsilon)=22025.05 | — | 90.64 | — | — | — | — | — | — | — | 71.47 | — | — | — | — | |
| RS-FGSMBackbone=WRN-28-10, Perturbation magnitude (255 * epsilon)=42025.05 | — | 86.58 | — | — | — | — | — | — | — | 54.85 | — | — | — | — | |
| RS-FGSMBackbone=WRN-28-10, Perturbation magnitude (255 * epsilon)=82025.05 | — | 80.14 | — | — | — | — | — | — | — | 35.77 | — | — | — | — |