Image Classification on Flowers102 (Robustness Metrics)
84.2Clean AccuracyCLIP
Evaluation results
| Method | Links | ||||||
|---|---|---|---|---|---|---|---|
| CLIPBackbone=CLIP-L/14, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 84.2 | — | — | — | — | 0.3 | |
| R-TPTBackbone=CLIP-L/14, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 83.5 | — | — | — | — | 70.3 | |
| CSRBackbone=CLIP-L/14, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 83.5 | — | — | — | — | 73.6 | |
| Anti-AdvBackbone=CLIP-L/14, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 82.4 | — | — | — | — | 48 | |
| TTEBackbone=CLIP-L/14, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 81.6 | — | — | — | — | 32.3 | |
| HDBackbone=CLIP-L/14, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 79.7 | — | — | — | — | 9.3 | |
| LPFBackbone=CLIP-L/14, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 78.8 | — | — | — | — | 51.7 | |
| CLIPBackbone=CLIP-L/14, Method category=Original2026.01 | 73.5 | — | — | — | — | 0.5 | |
| Anti-AdvBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 73.5 | — | — | — | — | 46.3 | |
| CSRBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 73.3 | — | — | — | — | 67 | |
| TTEBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 73 | — | — | — | — | 34.9 | |
| LPFBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 72.5 | — | — | — | — | 50.1 | |
| CLIPBackbone=CLIP-B/32, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 71.8 | — | — | — | — | 0.3 | |
| R-TPTBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 71.5 | — | — | — | — | 60.8 | |
| R-TPTBackbone=CLIP-B/32, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 71.4 | — | — | — | — | 45.4 | |
| CSRBackbone=CLIP-B/32, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 71.4 | — | — | — | — | 41.1 | |
| HDBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 70.9 | — | — | — | — | 10.3 | |
| Anti-AdvBackbone=CLIP-B/32, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 70.3 | — | — | — | — | 12.6 | |
| TTCBackbone=CLIP-L/14, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 70.3 | — | — | — | — | 39.7 | |
| HDBackbone=CLIP-B/32, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 68.6 | — | — | — | — | 4.9 | |
| TTEBackbone=CLIP-B/32, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 68.6 | — | — | — | — | 27.9 | |
| TTCBackbone=CLIP-B/32, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 66.5 | — | — | — | — | 27.5 | |
| TTCBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 66 | — | — | — | — | 33.6 | |
| CLIPBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=02026.01 | 65.72 | — | 4.88 | — | — | — | |
| CLIPTraining Data=ImageNet-1k, Adversarial Training=2-step PGD, Epsilon=1/2552025.12 | 65.49 | — | — | 1.19 | 0.02 | — | |
| CLIPmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 65.46 | — | — | — | — | 1.35 | |
| TTCmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 64.16 | — | — | — | — | 36.84 | |
| SCCmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 64.16 | — | — | — | — | 49.76 | |
| FAREBackbone=CLIP-L/14, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 63.9 | — | — | — | — | 57.6 | |
| CLBPmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 63.58 | — | — | — | — | 54.61 | |
| CLIPBackbone=CLIP-B/32, Category=Original2026.01 | 62.7 | 0.008 | — | — | — | — | |
| Anti-advmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 62.66 | — | — | — | — | 8.06 | |
| CSRBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 62.6 | 0.32 | — | — | — | — | |
| LPFBackbone=CLIP-B/32, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 62 | — | — | — | — | 18.9 | |
| TTCBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 61.9 | 0.264 | — | — | — | — | |
| TTEBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 61.5 | 0.142 | — | — | — | — | |
| Anti-AdvBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 60.9 | 0.142 | — | — | — | — | |
| FARETraining Data=ImageNet-1k, Adversarial Training=2-step PGD, Epsilon=1/2552025.12 | 60.48 | — | — | 31.91 | 29.55 | — | |
| HDBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 59.8 | 0.062 | — | — | — | — | |
| R-TPTBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 59.2 | 0.352 | — | — | — | — | |
| UCATTraining Data=ImageNet-1k, Adversarial Training=2-step PGD, Epsilon=1/2552025.12 | 58.3 | — | — | 33.26 | 30.64 | — | |
| LPFBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 57.8 | 0.25 | — | — | — | — | |
| PMGBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=18172026.01 | 56.77 | — | 27.58 | — | — | — | |
| FAREBackbone=CLIP-L/14, Method category=Adversarial Fine-tuning2026.01 | 55 | — | — | — | — | 50.8 | |
| CLIP-FTmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 53.37 | — | — | — | — | 0.8 | |
| FAREBackbone=CLIP-B/32, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 52.6 | — | — | — | — | 48.3 | |
| TeCoATraining Data=ImageNet-1k, Adversarial Training=2-step PGD, Epsilon=1/2552025.12 | 50.92 | — | — | 30.69 | 28.93 | — | |
| HPT-GPDBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=14862026.01 | 50.11 | — | 28.04 | — | — | — | |
| FAREmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 47.98 | — | — | — | — | 17.25 | |
| TeCoABackbone=CLIP-L/14, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 45.6 | — | — | — | — | 41.6 | |
| FAREBackbone=CLIP-B/32, Category=Adversarial Fine-tuning2026.01 | 44.3 | 0.427 | — | — | — | — | |
| FT-StandardBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=4062026.01 | 41.6 | — | 7.61 | — | — | — | |
| PMG-AFTmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 37 | — | — | — | — | 21.34 | |
| TeCoAmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 36.8 | — | — | — | — | 21.13 | |
| FT-TeCoABackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=11122026.01 | 36.13 | — | 23.05 | — | — | — | |
| TeCoABackbone=CLIP-L/14, Method category=Adversarial Fine-tuning2026.01 | 35.6 | — | — | — | — | 34 | |
| TeCoABackbone=CLIP-B/32, Evaluation Protocol=Zero-shot, Attack Protocol=10-step PGD (l_inf = 1/255)2026.01 | 35.1 | — | — | — | — | 32.4 | |
| TeCoABackbone=CLIP-B/32, Category=Adversarial Fine-tuning2026.01 | 21.5 | 0.226 | — | — | — | — | |
| CLIPEvaluation Protocol=Zero-shot, Attack Strategy=AutoAttack, Perturbation Budget=1/2552026.01 | — | — | — | — | — | 0 | |
| CLIPProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | — | 0.0119 | — | — | — | — | |
| CLIPZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | — | — | — | — | — | 0.03 | |
| Comp-TGAMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | — | — | — | — | — | 33.68 | |
| Comp-TGAProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | — | 0.3584 | — | — | — | — | |
| Comp-TGAZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | — | — | — | — | — | 21.96 | |
| FAREMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | — | — | — | — | — | 15.48 | |
| FAREProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | — | 0.1548 | — | — | — | — | |
| FAREZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | — | — | — | — | — | 15.56 | |
| FT-Adv.Mode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | — | — | — | — | — | 17.81 | |
| FT-Adv.Protocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | — | 0.1992 | — | — | — | — | |
| FT-Adv.Zero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | — | — | — | — | — | 18.95 | |
| FT-CleanProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | — | 0.0068 | — | — | — | — | |
| FT-CleanZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | — | — | — | — | — | 0.07 | |
| HPT-GPDEvaluation Protocol=Zero-shot, Attack Strategy=AutoAttack, Perturbation Budget=1/2552026.01 | — | — | — | — | — | 4.75 | |
| LAATMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | — | — | — | — | — | 18.15 | |
| LAATProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | — | 0.1929 | — | — | — | — | |
| LAATZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | — | — | — | — | — | 18.7 | |
| PMGEvaluation Protocol=Zero-shot, Attack Strategy=AutoAttack, Perturbation Budget=1/2552026.01 | — | — | — | — | — | 0.54 | |
| PMG-AFTMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | — | — | — | — | — | 20.83 | |
| PMG-AFTProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | — | 0.2345 | — | — | — | — | |
| PMG-AFTZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | — | — | — | — | — | 21.21 | |
| TeCoAMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | — | — | — | — | — | 22.46 | |
| TeCoAProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | — | 0.2246 | — | — | — | — | |
| TeCoAZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | — | — | — | — | — | 21.3 | |
| TGA-ZSRMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | — | — | — | — | — | 31.79 | |
| TGA-ZSRProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | — | 0.3455 | — | — | — | — | |
| TGA-ZSRZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | — | — | — | — | — | 21.83 |