Image Classification on CIFAR10 (test) (Standard & Robust Accuracy)
91.1Standard AccuracyOTAD-T-NN with ResNet
Evaluation results
| Method | Links | ||
|---|---|---|---|
| OTAD-T-NN with ResNetDefense Category=Ours, Backbone=ResNet, Attack=AutoAttack (ϵ = 0.5)2024.08 | 91.1 | 76.3 | |
| TRADES (ResNet-18)Defense Category=Adversarial Training with l2, Backbone=ResNet-18, Attack=AutoAttack (ϵ = 0.5)2024.08 | 90.2 | 67 | |
| TRADES + AWP (ResNet-18)Defense Category=Adversarial Training with l∞, Backbone=ResNet-18, Attack=AutoAttack (ϵ = 0.5)2024.08 | 89.7 | 62.5 | |
| PGD adversarial training (ResNet-18)Defense Category=Adversarial Training with l2, Backbone=ResNet-18, Attack=AutoAttack (ϵ = 0.5)2024.08 | 89.7 | 63 | |
| MART (ResNet-18)Defense Category=Adversarial Training with l2, Backbone=ResNet-18, Attack=AutoAttack (ϵ = 0.5)2024.08 | 89.5 | 68.8 | |
| TRADES + AWP (ResNet-18)Defense Category=Adversarial Training with l2, Backbone=ResNet-18, Attack=AutoAttack (ϵ = 0.5)2024.08 | 89.4 | 71.7 | |
| TRADESDefense Category=Adversarial Training with l2, Attack=AutoAttack (ϵ = 0.5)2024.08 | 88.8 | 62.4 | |
| TRADES (ResNet-18)Defense Category=Adversarial Training with l∞, Backbone=ResNet-18, Attack=AutoAttack (ϵ = 0.5)2024.08 | 88.6 | 59.3 | |
| DiffPureDefense Category=Adversarial Purification, Attack=AutoAttack (ϵ = 0.5)2024.08 | 88.1 | 74.3 | |
| TRADES + AWPDefense Category=Adversarial Training with l2, Attack=AutoAttack (ϵ = 0.5)2024.08 | 86.4 | 64.1 | |
| PGD adversarial trainingDefense Category=Adversarial Training with l2, Attack=AutoAttack (ϵ = 0.5)2024.08 | 85.7 | 59.2 | |
| MART (ResNet-18)Defense Category=Adversarial Training with l∞, Backbone=ResNet-18, Attack=AutoAttack (ϵ = 0.5)2024.08 | 85.2 | 60.1 | |
| MARTDefense Category=Adversarial Training with l2, Attack=AutoAttack (ϵ = 0.5)2024.08 | 85.2 | 59.5 | |
| TRADES + AWPDefense Category=Adversarial Training with l∞, Attack=AutoAttack (ϵ = 0.5)2024.08 | 84.5 | 62.4 | |
| TRADESDefense Category=Adversarial Training with l∞, Attack=AutoAttack (ϵ = 0.5)2024.08 | 84.4 | 61.8 | |
| APE-GANDefense Category=Adversarial Purification, Attack=AutoAttack (ϵ = 0.5)2024.08 | 84.3 | 0 | |
| PGD adversarial training (ResNet-18)Defense Category=Adversarial Training with l∞, Backbone=ResNet-18, Attack=AutoAttack (ϵ = 0.5)2024.08 | 82.6 | 57.9 | |
| SOC+Defense Category=Lipschitz Networks, Attack=AutoAttack (ϵ = 0.5)2024.08 | 77.8 | 41.8 | |
| PGD adversarial trainingDefense Category=Adversarial Training with l∞, Attack=AutoAttack (ϵ = 0.5)2024.08 | 77.7 | 58.1 | |
| MARTDefense Category=Adversarial Training with l∞, Attack=AutoAttack (ϵ = 0.5)2024.08 | 71 | 54.7 | |
| OTAD-T-NN with attentionDefense Category=Ours, Attention=true, Attack=AutoAttack (ϵ = 0.5)2024.08 | 61.9 | 31.3 | |
| l∞-dist netDefense Category=Lipschitz Networks, Attack=AutoAttack (ϵ = 0.5)2024.08 | 56.1 | 1 |