Image Classification on CIFAR-10 v1 (Clean) (Accuracy and Ranking Metrics)
92.36AccuracyTRADES-EMFF
Evaluation Results
| Method | Links | ||||
|---|---|---|---|---|---|
| TRADES-EMFFData Augmentation=AutoAug, Backbone=WRN-34-10, Threat Model=l2, Venue=TPAMI’252026.07 | 92.36 | 1.3 | 1.08 | 88.76 | |
| EV-ATData Augmentation=AutoAug, Backbone=WRN-34-10, Threat Model=l22026.07 | 91.98 | 1.34 | 1.14 | 88.95 | |
| TRADES-AWPData Augmentation=AutoAug, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’202026.07 | 91.53 | 1.57 | 1.32 | 87.59 | |
| AT-AWPData Augmentation=Basic, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’202026.07 | 91.47 | 1.25 | 1.09 | 90.68 | |
| TRADESData Augmentation=AutoAug, Backbone=WRN-34-10, Threat Model=l2, Venue=ICML’192026.07 | 91.47 | 1.39 | 1.17 | 89.65 | |
| EV-ATData Augmentation=Basic, Backbone=WRN-34-10, Threat Model=l22026.07 | 91.41 | 1.29 | 1.1 | 90.71 | |
| TRADES-EMFFData Augmentation=Cutout, Backbone=WRN-34-10, Threat Model=l2, Venue=TPAMI’252026.07 | 91.16 | 1.58 | 1.29 | 88.83 | |
| ATData Augmentation=AutoAug, Backbone=WRN-34-10, Threat Model=l2, Venue=ICML’182026.07 | 91.13 | 1.34 | 1.17 | 90.34 | |
| ATData Augmentation=Basic, Backbone=WRN-34-10, Threat Model=l2, Venue=ICML’182026.07 | 90.79 | 1.31 | 1.14 | 91.4 | |
| EV-ATData Augmentation=AugMix, Backbone=WRN-34-10, Threat Model=l22026.07 | 90.69 | 1.6 | 1.34 | 89.22 | |
| EV-ATData Augmentation=Cutout, Backbone=WRN-34-10, Threat Model=l22026.07 | 90.61 | 1.7 | 1.42 | 88.45 | |
| AT-AWPData Augmentation=AutoAug, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’202026.07 | 90.6 | 1.73 | 1.48 | 87.87 | |
| AT-AWPData Augmentation=AugMix, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’202026.07 | 90.35 | 1.7 | 1.45 | 88.69 | |
| ATData Augmentation=AugMix, Backbone=WRN-34-10, Threat Model=l2, Venue=ICML’182026.07 | 90.08 | 1.61 | 1.39 | 89.93 | |
| TRADES-EMFFData Augmentation=Basic, Backbone=WRN-34-10, Threat Model=l2, Venue=TPAMI’252026.07 | 90.05 | 2.06 | 1.67 | 86.85 | |
| TRADES-EMFFData Augmentation=AugMix, Backbone=WRN-34-10, Threat Model=l2, Venue=TPAMI’252026.07 | 90.03 | 2.17 | 1.72 | 86.43 | |
| ATData Augmentation=Cutout, Backbone=WRN-34-10, Threat Model=l2, Venue=ICML’182026.07 | 89.89 | 1.67 | 1.44 | 89.8 | |
| TRADES-AWPData Augmentation=Cutout, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’202026.07 | 89.82 | 1.92 | 1.62 | 87.95 | |
| AT-AWPData Augmentation=Cutout, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’202026.07 | 89.68 | 1.87 | 1.6 | 88.46 | |
| IKL-ATData Augmentation=AutoAug, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’242026.07 | 89.64 | 2.67 | 2.11 | 83.05 | |
| TRADES-AWPData Augmentation=Basic, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’202026.07 | 89.53 | 2.12 | 1.75 | 87.13 | |
| TRADES-AWPData Augmentation=AugMix, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’202026.07 | 89.29 | 2.15 | 1.79 | 87.33 | |
| TRADESData Augmentation=Cutout, Backbone=WRN-34-10, Threat Model=l2, Venue=ICML’192026.07 | 89.26 | 2.08 | 1.71 | 88.24 | |
| IKL-ATData Augmentation=Basic, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’242026.07 | 89.08 | 2.31 | 1.87 | 86.93 | |
| TRADESData Augmentation=Basic, Backbone=WRN-34-10, Threat Model=l2, Venue=ICML’192026.07 | 89.06 | 2.25 | 1.86 | 87.11 | |
| TRADES-EMFFData Augmentation Strategy=AutoAug, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=TPAMI'252026.07 | 88.9 | 3.23 | 2.47 | 81.19 | |
| TRADESData Augmentation=AugMix, Backbone=WRN-34-10, Threat Model=l2, Venue=ICML’192026.07 | 88.46 | 2.71 | 2.19 | 85.1 | |
| EV-ATData Augmentation Strategy=AutoAug, Backbone=WRN-34-10, Threat Model=l_infinity2026.07 | 88.4 | 2.82 | 2.24 | 84.68 | |
| IKL-ATData Augmentation=AugMix, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’242026.07 | 88.22 | 3.03 | 2.37 | 83.83 | |
| EV-ATData Augmentation Strategy=Basic, Backbone=WRN-34-10, Threat Model=l_infinity2026.07 | 88.16 | 2.78 | 2.2 | 85.68 | |
| IKL-ATData Augmentation=Cutout, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’242026.07 | 87.64 | 3.38 | 2.6 | 83.03 | |
| EV-ATData Augmentation Strategy=Cutout, Backbone=WRN-34-10, Threat Model=l_infinity2026.07 | 87.37 | 3.45 | 2.64 | 83.28 | |
| TRADESData Augmentation Strategy=AutoAug, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=ICML'192026.07 | 87.37 | 3.95 | 2.99 | 80.16 | |
| EV-ATData Augmentation Strategy=AugMix, Backbone=WRN-34-10, Threat Model=l_infinity2026.07 | 87.1 | 3.65 | 2.78 | 82.66 | |
| TRADES-EMFFData Augmentation Strategy=Cutout, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=TPAMI'252026.07 | 87.04 | 3.8 | 2.85 | 82.16 | |
| TRADES-AWPData Augmentation Strategy=AutoAug, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=NeurIPS'202026.07 | 87.03 | 4.52 | 3.31 | 78.16 | |
| TRADESData Augmentation Strategy=Cutout, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=ICML'192026.07 | 85.63 | 4.43 | 3.32 | 81.42 | |
| TRADES-AWPData Augmentation Strategy=Cutout, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=NeurIPS'202026.07 | 85.4 | 4.87 | 3.57 | 79.91 | |
| AT-AWPData Augmentation Strategy=Basic, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=NeurIPS'202026.07 | 85.28 | 3.65 | 2.96 | 85.07 | |
| IKL-ATData Augmentation Strategy=AutoAug, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=NeurIPS'242026.07 | 85.28 | 5.23 | 3.79 | 78.42 | |
| ATData Augmentation Strategy=Basic, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=ICML'182026.07 | 85.11 | 3.4 | 2.79 | 86.78 | |
| IKL-ATData Augmentation Strategy=Basic, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=NeurIPS'242026.07 | 85.04 | 4.75 | 3.48 | 81.42 | |
| TRADES-EMFFData Augmentation Strategy=Basic, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=TPAMI'252026.07 | 84.97 | 5.05 | 3.67 | 80.09 | |
| ATData Augmentation Strategy=AutoAug, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=ICML'182026.07 | 84.91 | 4.09 | 3.27 | 83.41 | |
| TRADES-AWPData Augmentation Strategy=Basic, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=NeurIPS'202026.07 | 84.89 | 4.82 | 3.58 | 81.03 | |
| TRADES-AWPData Augmentation Strategy=AugMix, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=NeurIPS'202026.07 | 84.64 | 5.39 | 3.9 | 79.29 | |
| TRADESData Augmentation Strategy=Basic, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=ICML'192026.07 | 84.53 | 5.23 | 3.83 | 79.9 | |
| ATData Augmentation Strategy=Cutout, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=ICML'182026.07 | 84.42 | 3.78 | 3.09 | 85.76 | |
| TRADES-EMFFData Augmentation Strategy=AugMix, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=TPAMI'252026.07 | 84.23 | 6.04 | 4.25 | 77.38 | |
| TRADESData Augmentation Strategy=AugMix, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=ICML'192026.07 | 84.06 | 5.67 | 4.06 | 79.3 | |
| AT-AWPData Augmentation Strategy=AutoAug, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=NeurIPS'202026.07 | 83.86 | 4.93 | 3.83 | 81.35 | |
| TRADES-AWPData Augmentation=AutoAug, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’202026.07 | 83.78 | 2.93 | 2.51 | 91.51 | |
| EV-ATData Augmentation=AutoAug, Backbone=WRN-34-10, Threat Model=l22026.07 | 83.6 | 2.75 | 2.38 | 92.97 | |
| ATData Augmentation Strategy=AugMix, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=ICML'182026.07 | 83.38 | 4.38 | 3.51 | 84.64 | |
| EV-ATData Augmentation=Cutout, Backbone=WRN-34-10, Threat Model=l22026.07 | 82.87 | 3.01 | 2.58 | 92.5 | |
| IKL-ATData Augmentation Strategy=AugMix, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=NeurIPS'242026.07 | 82.85 | 6.81 | 4.65 | 77.59 | |
| EV-ATData Augmentation=Basic, Backbone=WRN-34-10, Threat Model=l22026.07 | 82.71 | 2.81 | 2.44 | 94.31 | |
| IKL-ATData Augmentation Strategy=Cutout, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=NeurIPS'242026.07 | 82.67 | 6.9 | 4.73 | 77.48 | |
| AT-AWPData Augmentation Strategy=Cutout, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=NeurIPS'202026.07 | 82.65 | 5.01 | 3.94 | 83.02 | |
| EV-ATData Augmentation=AugMix, Backbone=WRN-34-10, Threat Model=l22026.07 | 82.64 | 2.98 | 2.57 | 93.12 | |
| TRADES-AWPData Augmentation=Cutout, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’202026.07 | 82.63 | 3.18 | 2.72 | 91.81 | |
| IKL-ATData Augmentation=AutoAug, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’242026.07 | 82.24 | 4.33 | 3.48 | 87.06 | |
| AT-AWPData Augmentation=Basic, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’202026.07 | 82.1 | 2.99 | 2.62 | 94.25 | |
| TRADESData Augmentation=AutoAug, Backbone=WRN-34-10, Threat Model=l2, Venue=ICML’192026.07 | 82.01 | 3.2 | 2.75 | 93.4 | |
| TRADES-EMFFData Augmentation=AutoAug, Backbone=WRN-34-10, Threat Model=l2, Venue=TPAMI’252026.07 | 81.65 | 3.59 | 3.04 | 92.51 | |
| TRADES-AWPData Augmentation=Basic, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’202026.07 | 81.64 | 3.6 | 3.04 | 91.28 | |
| AT-AWPData Augmentation=AugMix, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’202026.07 | 81.63 | 3.37 | 2.91 | 92.58 | |
| TRADES-AWPData Augmentation=AugMix, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’202026.07 | 81.63 | 3.56 | 3.02 | 91.42 | |
| IKL-ATData Augmentation=Basic, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’242026.07 | 81.47 | 3.82 | 3.16 | 90.77 | |
| TRADES-EMFFData Augmentation=Cutout, Backbone=WRN-34-10, Threat Model=l2, Venue=TPAMI’252026.07 | 81.41 | 3.64 | 3.05 | 92.47 | |
| AT-AWPData Augmentation Strategy=AugMix, Backbone=WRN-34-10, Threat Model=l_infinity, Venue=NeurIPS'202026.07 | 81.41 | 5.61 | 4.37 | 82.55 | |
| AT-AWPData Augmentation=Cutout, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’202026.07 | 81.4 | 3.45 | 2.98 | 92.35 | |
| IKL-ATData Augmentation=AugMix, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’242026.07 | 81.04 | 4.64 | 3.71 | 87.7 | |
| AT-AWPData Augmentation=AutoAug, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’202026.07 | 80.97 | 3.73 | 3.19 | 91.98 | |
| ATData Augmentation=AutoAug, Backbone=WRN-34-10, Threat Model=l2, Venue=ICML’182026.07 | 80.93 | 3.31 | 2.9 | 94.34 | |
| IKL-ATData Augmentation=Cutout, Backbone=WRN-34-10, Threat Model=l2, Venue=NeurIPS’242026.07 | 80.74 | 4.93 | 3.88 | 87 | |
| ATData Augmentation=Cutout, Backbone=WRN-34-10, Threat Model=l2, Venue=ICML’182026.07 | 80.73 | 3.39 | 2.96 | 93.84 | |
| TRADESData Augmentation=Cutout, Backbone=WRN-34-10, Threat Model=l2, Venue=ICML’192026.07 | 80.59 | 3.77 | 3.18 | 92.38 | |
| ATData Augmentation=Basic, Backbone=WRN-34-10, Threat Model=l2, Venue=ICML’182026.07 | 80.48 | 3.34 | 2.93 | 95.09 | |
| ATData Augmentation=AugMix, Backbone=WRN-34-10, Threat Model=l2, Venue=ICML’182026.07 | 80.15 | 3.54 | 3.09 | 94.12 | |
| TRADESData Augmentation=Basic, Backbone=WRN-34-10, Threat Model=l2, Venue=ICML’192026.07 | 80.08 | 4.1 | 3.44 | 91.46 | |
| TRADES-EMFFData Augmentation=AugMix, Backbone=WRN-34-10, Threat Model=l2, Venue=TPAMI’252026.07 | 79.89 | 4.47 | 3.66 | 90.81 | |
| TRADESData Augmentation=AugMix, Backbone=WRN-34-10, Threat Model=l2, Venue=ICML’192026.07 | 79.72 | 4.58 | 3.78 | 89.75 | |
| TRADES-EMFFData Augmentation=Basic, Backbone=WRN-34-10, Threat Model=l2, Venue=TPAMI’252026.07 | 79.65 | 4.47 | 3.7 | 91.09 |