Image Classification on CIFAR100 (Adversarial Robustness - Clean & PGD)
76.25Clean AccuracyRoLI - Full-FT
Evaluation Results
| Method | Links | ||
|---|---|---|---|
| RoLI - Full-FTBackbone=Swin Transformer, Initialization=Robust Linear Initialization, Finetuning Protocol=Full Finetuning2023.12 | 76.25 | 37.38 | |
| RanLI - Full-FTBackbone=Swin Transformer, Initialization=Random Initialization, Finetuning Protocol=Full Finetuning2023.12 | 74.36 | 35.62 | |
| TTEBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 72.9 | 37.9 | |
| RoLI - LoRABackbone=Swin Transformer, Initialization=Robust Linear Initialization, Finetuning Protocol=LoRA2023.12 | 72.87 | 35.18 | |
| LPFBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 72.8 | 40.3 | |
| RanLI - VPTBackbone=Swin Transformer, Initialization=Random Initialization, Finetuning Protocol=Visual Prompt Tuning2023.12 | 72.37 | 35.6 | |
| RoLI - BiasBackbone=Swin Transformer, Initialization=Robust Linear Initialization, Finetuning Protocol=Bias-only2023.12 | 72.17 | 35.17 | |
| RanLI - LoRABackbone=Swin Transformer, Initialization=Random Initialization, Finetuning Protocol=LoRA2023.12 | 71.98 | 34.83 | |
| RoLI - AdapterBackbone=Swin Transformer, Initialization=Robust Linear Initialization, Finetuning Protocol=Adapter2023.12 | 71.75 | 34.33 | |
| RanLI - AdapterBackbone=Swin Transformer, Initialization=Random Initialization, Finetuning Protocol=Adapter2023.12 | 71.57 | 34.74 | |
| RanLI - BiasBackbone=Swin Transformer, Initialization=Random Initialization, Finetuning Protocol=Bias-only2023.12 | 71.5 | 36.72 | |
| TTCBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 71 | 7 | |
| TWINS-ATBackbone=ResNet-502023.12 | 70.72 | 31.08 | |
| HDBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 67.9 | 26.7 | |
| RanLI - LinearBackbone=Swin Transformer, Initialization=Random Initialization, Finetuning Protocol=Linear Probing2023.12 | 67.65 | 25.46 | |
| AutoLoRaBackbone=ResNet-502023.12 | 66.2 | 35.25 | |
| R-TPTBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 65.7 | 58.3 | |
| CLIPBackbone=CLIP-L/14, Method category=Original2026.01 | 65 | 0.1 | |
| HPT-GPDBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=14862026.01 | 64.83 | 40.1 | |
| Anti-AdvBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 64.7 | 51.8 | |
| CSRBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 62.9 | 60.5 | |
| CLIPBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=02026.01 | 60.39 | 17.57 | |
| CLIP-FTDefense Category=Adversarial Finetuning, Attack Type=10-step PGD, Epsilon=4/2552025.11 | 59.51 | 0.67 | |
| FT-StandardBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=4062026.01 | 58.78 | 12.3 | |
| TTEDefense Category=Test-time Defense, Attack Type=10-step PGD, Epsilon=4/2552025.11 | 58.61 | 1.37 | |
| CLIPDefense Category=None, Attack Type=10-step PGD, Epsilon=4/2552025.11 | 57.14 | 0.05 | |
| TTCDefense Category=Test-time Defense, Attack Type=10-step PGD, Epsilon=4/2552025.11 | 56.34 | 9.06 | |
| R-TPTDefense Category=Test-time Defense, Attack Type=10-step PGD, Epsilon=4/2552025.11 | 52.69 | 18.52 | |
| ATACDefense Category=Test-time Defense, Attack Type=10-step PGD, Epsilon=4/2552025.11 | 52.65 | 86.27 | |
| PMGBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=18172026.01 | 52.28 | 33.31 | |
| FAREDefense Category=Adversarial Finetuning, Attack Type=10-step PGD, Epsilon=4/2552025.11 | 47.38 | 4.54 | |
| FAREBackbone=CLIP-L/14, Method category=Adversarial Fine-tuning2026.01 | 45.9 | 45.7 | |
| TeCoABackbone=CLIP-L/14, Method category=Adversarial Fine-tuning2026.01 | 44 | 43.8 | |
| PMG-AFTDefense Category=Adversarial Finetuning, Attack Type=10-step PGD, Epsilon=4/2552025.11 | 41.51 | 10.8 | |
| FT-TeCoABackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=11122026.01 | 41.01 | 24.41 | |
| TeCoADefense Category=Adversarial Finetuning, Attack Type=10-step PGD, Epsilon=4/2552025.11 | 36.3 | 9.25 |