Image Classification on Food101 (Top-1 Clean and Robust Accuracy)
84.88Top-1 Clean AccuracyCLIP
Evaluation Results
| Method | Links | ||
|---|---|---|---|
| CLIPmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 84.88 | 1.09 | |
| DBDBackbone=ViT-B/16, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 84.7 | 99.5 | |
| R-TPTBackbone=ViT-B/16, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 84.3 | 49.7 | |
| CLIPBackbone=ViT-B/16, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 84.2 | 0 | |
| TTCmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 82.18 | 54.65 | |
| SCCmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 82.13 | 59.73 | |
| TTCBackbone=ViT-B/16, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 81 | 21.2 | |
| CLBPShots=16, Training Epochs=10, Training Attack (PGD)=2-step (1/255), Evaluation Attack (PGD-100)=100-step (1/255)2026.05 | 80.7 | 68.94 | |
| DBDBackbone=ViT-B/32, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 80.1 | 98.4 | |
| CLIPBackbone=ViT-B/32, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 78.7 | 0 | |
| R-TPTBackbone=ViT-B/32, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 78.5 | 43.5 | |
| CLBPmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 77.46 | 65.22 | |
| Anti-advmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 75.81 | 15.03 | |
| CLIPBackbone=ResNet50, Attack Protocol=PGD-10, Epsilon (ε)=1/255, Evaluation Setting=Zero-shot2026.06 | 75.6 | 0 | |
| DBDBackbone=ResNet50, Attack Protocol=PGD-10, Epsilon (ε)=1/255, Evaluation Setting=Zero-shot2026.06 | 75 | 97.4 | |
| TTCBackbone=ViT-B/32, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 74.4 | 32.2 | |
| R-TPTBackbone=ResNet50, Attack Protocol=PGD-10, Epsilon (ε)=1/255, Evaluation Setting=Zero-shot2026.06 | 73.3 | 57.8 | |
| AdvMaPLeShots=16, Training Epochs=10, Training Attack (PGD)=2-step (1/255), Evaluation Attack (PGD-100)=100-step (1/255)2026.05 | 65.13 | 25.27 | |
| CLIP-FTmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 64.86 | 0.55 | |
| FAPShots=16, Training Epochs=10, Training Attack (PGD)=2-step (1/255), Evaluation Attack (PGD-100)=100-step (1/255)2026.05 | 64.03 | 26.67 | |
| FAREmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 55.31 | 12.93 | |
| AdvVLPShots=16, Training Epochs=10, Training Attack (PGD)=2-step (1/255), Evaluation Attack (PGD-100)=100-step (1/255)2026.05 | 43.3 | 16.5 | |
| PMG-AFTmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 36.61 | 16.57 | |
| APTBackbone=ViT-B/32, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Few-shot2026.06 | 33.3 | 6.8 | |
| TeCoAmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 29.98 | 12.87 | |
| TeCoABackbone=ResNet50, Attack Protocol=PGD-10, Epsilon (ε)=1/255, Evaluation Setting=Zero-shot2026.06 | 29.2 | 12.3 | |
| TeCoABackbone=ViT-B/32, Attack Protocol=PGD-100, Epsilon (ε)=4/255, Evaluation Setting=Zero-shot2026.06 | 22.4 | 3 | |
| AdvVPShots=16, Training Epochs=10, Training Attack (PGD)=2-step (1/255), Evaluation Attack (PGD-100)=100-step (1/255)2026.05 | 1.07 | 0.8 |