Image Classification on Food101 (Robust Accuracy)
96.11Robust AccuracyATAC
Evaluation Results
| Method | Links | ||
|---|---|---|---|
| ATACDefense Category=Test-time Defense2025.11 | 96.11 | 82.87 | |
| ATACmode=Test-time Defense, attack=10-step PGD, epsilon=1/2552025.11 | 76.47 | 83.57 | |
| R-TPTmode=Test-time Defense, attack=10-step PGD, epsilon=1/2552025.11 | 68.04 | 83.41 | |
| TTCmode=Test-time Defense, attack=10-step PGD, epsilon=1/2552025.11 | 57.84 | 82.18 | |
| AGFTFine-tuned on=ImageNet2026.03 | 44.76 | — | |
| TTEmode=Test-time Defense, attack=10-step PGD, epsilon=1/2552025.11 | 43.94 | 83.96 | |
| R-TPTDefense Category=Test-time Defense2025.11 | 39.97 | 83.41 | |
| PMG-AFTFine-tuned on=ImageNet2026.03 | 39.37 | — | |
| Ours (5 trees)Zero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/255, Number of trees=52026.04 | 35.89 | — | |
| GLADIATORFine-tuned on=ImageNet2026.03 | 34.92 | — | |
| OursZero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/2552026.04 | 34.85 | — | |
| AoSZero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/2552026.04 | 34.42 | — | |
| TGA-ZSRProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 33.97 | — | |
| Comp-TGAProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 33.57 | — | |
| FAREZero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/2552026.04 | 32.05 | — | |
| PMG-FTZero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/2552026.04 | 31.1 | — | |
| Comp-TGAMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 30.88 | — | |
| TGA-ZSRMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 30.73 | — | |
| TeCoAFine-tuned on=ImageNet2026.03 | 29.01 | — | |
| TGA-ZSRFine-tuned on=ImageNet2026.03 | 28.81 | — | |
| TeCoAZero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/2552026.04 | 27.28 | — | |
| PMG-AFTProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 19.58 | — | |
| PMG-AFTmode=Adversarial Finetuning, attack=10-step PGD, epsilon=1/2552025.11 | 18.57 | 36.61 | |
| TTCDefense Category=Test-time Defense2025.11 | 17.89 | 80 | |
| PMG-AFTMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 17.25 | — | |
| TeCoAMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 14.76 | — | |
| TeCoAProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 14.76 | — | |
| TeCoAmode=Adversarial Finetuning, attack=10-step PGD, epsilon=1/2552025.11 | 13.9 | 29.98 | |
| Comp-TGAZero-shot=true2026.03 | 13.66 | — | |
| LAATProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 12.64 | — | |
| TGA-ZSRZero-shot=true2026.03 | 12.57 | — | |
| FT-Adv.Protocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 12.55 | — | |
| FAREmode=Adversarial Finetuning, attack=10-step PGD, epsilon=1/2552025.11 | 11.65 | 55.31 | |
| LAATMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 11.38 | — | |
| FAREProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 10.97 | — | |
| FAREMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 10.75 | — | |
| FT-Adv.Mode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 10.38 | — | |
| PMG-AFTZero-shot=true2026.03 | 9.49 | — | |
| CLIPZero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/2552026.04 | 6.94 | — | |
| CLIPProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 6.6 | — | |
| TeCoAZero-shot=true2026.03 | 6.53 | — | |
| LAATZero-shot=true2026.03 | 6.03 | — | |
| CLIPZero-shot=true2026.03 | 5.94 | — | |
| FT-Adv.Zero-shot=true2026.03 | 5.65 | — | |
| TTEDefense Category=Test-time Defense2025.11 | 5.31 | 83.96 | |
| FAREZero-shot=true2026.03 | 4.75 | — | |
| CLIPMode=Zero-shot2026.03 | 4.06 | — | |
| PMG-AFTDefense Category=Adversarial Finetuning2025.11 | 2.12 | 27.97 | |
| TeCoADefense Category=Adversarial Finetuning2025.11 | 1.35 | 21.9 | |
| CLIPattack=10-step PGD, epsilon=1/2552025.11 | 0.7 | 83.88 | |
| FT-CleanProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 0.64 | — | |
| FT-CleanZero-shot=true2026.03 | 0.52 | — | |
| CLIP-FTmode=Adversarial Finetuning, attack=10-step PGD, epsilon=1/2552025.11 | 0.42 | 64.86 | |
| FAREDefense Category=Adversarial Finetuning2025.11 | 0.24 | 41.98 | |
| CLIP-FTDefense Category=Adversarial Finetuning2025.11 | 0.04 | 64.86 | |
| CLIPDefense Category=None2025.11 | 0 | 83.88 |