Image Classification on GTSRB (Accuracy, ∆CA, ASR)
98.9AccuracyTraditional MTL
Evaluation Results
| Method | Links | |||
|---|---|---|---|---|
| Traditional MTLBackbone=CLIP ViT-B/32, Merging Category=Non-merging2026.05 | 98.9 | — | — | |
| IndividualBackbone=CLIP ViT-B/32, Merging Category=Non-merging2026.05 | 98.7 | — | — | |
| No DefenseModel=ResNet18, Attack=BadNets2026.07 | 98.01 | — | 100 | |
| RN50 BaselineIR=12.5, Backbone=ResNet-502026.01 | 97.8 | — | — | |
| No DefenseModel=ResNet18, Attack=IAB2026.07 | 97.62 | — | 99.99 | |
| No DefenseModel=WRN16-1, Attack=CLB2026.07 | 97.41 | — | 100 | |
| No DefenseModel=WRN16-1, Attack=Trojan2026.07 | 97.32 | — | 100 | |
| HARVEYModel=WRN16-1, Attack=IAB2026.07 | 97.32 | — | 0.02 | |
| No DefenseModel=ResNet18, Attack=Average2026.07 | 97.25 | — | 99.84 | |
| No DefenseModel=ResNet18, Attack=CLB2026.07 | 97.22 | — | 100 | |
| No DefenseModel=WRN16-1, Attack=IAB2026.07 | 97.1 | — | 100 | |
| No DefenseModel=ResNet18, Attack=WaNet2026.07 | 97.09 | — | 99.44 | |
| No DefenseModel=ResNet18, Attack=Trojan2026.07 | 97.06 | — | 99.98 | |
| HARVEYModel=ResNet18, Attack=Trojan2026.07 | 97.05 | — | 0 | |
| HARVEYModel=WRN16-1, Attack=BadNets2026.07 | 96.96 | — | 0 | |
| HARVEYModel=ResNet18, Attack=BadNets2026.07 | 96.9 | — | 0 | |
| HARVEYModel=WRN16-1, Attack=Trojan2026.07 | 96.78 | — | 0.13 | |
| HARVEYModel=WRN16-1, Attack=CLB2026.07 | 96.78 | — | 0.02 | |
| HARVEYModel=WRN16-1, Attack=Average2026.07 | 96.77 | — | 0.18 | |
| HARVEYModel=WRN16-1, Attack=Blend2026.07 | 96.66 | — | 0.04 | |
| No DefenseModel=WRN16-1, Attack=Average2026.07 | 96.65 | — | 99.99 | |
| No DefenseModel=WRN16-1, Attack=BadNets2026.07 | 96.58 | — | 100 | |
| HARVEYModel=ResNet18, Attack=Average2026.07 | 96.57 | — | 0 | |
| HARVEYModel=ResNet18, Attack=IAB2026.07 | 96.56 | — | 0.01 | |
| D-STModel=WRN16-1, Attack=IAB2026.07 | 96.54 | — | 0 | |
| No DefenseModel=ResNet18, Attack=Blend2026.07 | 96.52 | — | 99.61 | |
| No DefenseModel=ResNet18, Attack=Worst Case2026.07 | 96.52 | — | 100 | |
| ABLModel=WRN16-1, Attack=IAB2026.07 | 96.38 | — | 3.89 | |
| ABLModel=ResNet18, Attack=IAB2026.07 | 96.33 | — | 11.32 | |
| HARVEYModel=ResNet18, Attack=WaNet2026.07 | 96.32 | — | 0 | |
| HARVEYModel=ResNet18, Attack=CLB2026.07 | 96.3 | — | 0 | |
| HARVEYModel=ResNet18, Attack=Blend2026.07 | 96.29 | — | 0 | |
| HARVEYModel=ResNet18, Attack=Worst Case2026.07 | 96.29 | — | 0.01 | |
| ABLModel=ResNet18, Attack=Trojan2026.07 | 96.21 | — | 0.01 | |
| D-STModel=ResNet18, Attack=Trojan2026.07 | 96.2 | — | 0 | |
| HARVEYModel=WRN16-1, Attack=WaNet2026.07 | 96.14 | — | 0.87 | |
| HARVEYModel=WRN16-1, Attack=Worst Case2026.07 | 96.14 | — | 0.87 | |
| D-STModel=ResNet18, Attack=IAB2026.07 | 96.09 | — | 0 | |
| ABLModel=WRN16-1, Attack=BadNets2026.07 | 96.01 | — | 0.05 | |
| ABLModel=ResNet18, Attack=BadNets2026.07 | 95.99 | — | 0.02 | |
| No DefenseModel=WRN16-1, Attack=WaNet2026.07 | 95.94 | — | 99.92 | |
| D-STModel=ResNet18, Attack=BadNets2026.07 | 95.83 | — | 0 | |
| CBDModel=WRN16-1, Attack=Trojan2026.07 | 95.65 | — | 0.08 | |
| CBDModel=ResNet18, Attack=BadNets2026.07 | 95.59 | — | 0.14 | |
| No DefenseModel=WRN16-1, Attack=Blend2026.07 | 95.57 | — | 100 | |
| No DefenseModel=WRN16-1, Attack=Worst Case2026.07 | 95.57 | — | 100 | |
| D-STModel=WRN16-1, Attack=Trojan2026.07 | 95.52 | — | 32.01 | |
| ABLModel=WRN16-1, Attack=CLB2026.07 | 95.39 | — | 5.44 | |
| ABLModel=WRN16-1, Attack=Trojan2026.07 | 95.29 | — | 0.24 | |
| D-STModel=WRN16-1, Attack=BadNets2026.07 | 95.24 | — | 0 | |
| SA-MergingBackbone=CLIP ViT-B/32, Merging Category=Data-free model merging2026.05 | 95 | — | — | |
| WUDI-MergingBackbone=CLIP ViT-B/32, Merging Category=Data-free model merging2026.05 | 94.7 | — | — | |
| ABLModel=WRN16-1, Attack=Average2026.07 | 94.11 | — | 7.81 | |
| D-STModel=WRN16-1, Attack=Blend2026.07 | 94.03 | — | 98.77 | |
| D-STModel=ResNet18, Attack=Blend2026.07 | 93.96 | — | 40.86 | |
| DBDModel=ResNet18, Attack=Trojan2026.07 | 93.91 | — | 0 | |
| ABLModel=WRN16-1, Attack=WaNet2026.07 | 93.83 | — | 5.56 | |
| D-STModel=WRN16-1, Attack=WaNet2026.07 | 93.75 | — | 71.8 | |
| D-STModel=WRN16-1, Attack=Average2026.07 | 93.49 | — | 33.91 | |
| D-STModel=ResNet18, Attack=WaNet2026.07 | 93.41 | — | 67.26 | |
| ABLModel=ResNet18, Attack=Average2026.07 | 93.3 | — | 34.83 | |
| DBDModel=ResNet18, Attack=Blend2026.07 | 93.21 | — | 99.98 | |
| CBDModel=WRN16-1, Attack=IAB2026.07 | 92.84 | — | 0 | |
| DBDModel=ResNet18, Attack=WaNet2026.07 | 92.76 | — | 0 | |
| DBDModel=ResNet18, Attack=BadNets2026.07 | 92.68 | — | 0.29 | |
| ABLModel=ResNet18, Attack=CLB2026.07 | 92.56 | — | 0.01 | |
| D-STModel=ResNet18, Attack=Average2026.07 | 92.26 | — | 18.38 | |
| DBDModel=ResNet18, Attack=Average2026.07 | 92.02 | — | 33.26 | |
| DBDModel=ResNet18, Attack=CLB2026.07 | 91.99 | — | 0 | |
| AdaMergingBackbone=CLIP ViT-B/32, Merging Category=Test-time / data-assisted2026.05 | 91.9 | — | — | |
| CBDModel=WRN16-1, Attack=Blend2026.07 | 91.81 | — | 97.19 | |
| CBDModel=WRN16-1, Attack=Average2026.07 | 90.77 | — | 22.96 | |
| ABLModel=ResNet18, Attack=Blend2026.07 | 90.41 | — | 97.7 | |
| CBDModel=WRN16-1, Attack=BadNets2026.07 | 90.21 | — | 1.26 | |
| AdaMerging++Backbone=CLIP ViT-B/32, Merging Category=Test-time / data-assisted2026.05 | 89 | — | — | |
| CBDModel=WRN16-1, Attack=CLB2026.07 | 88.81 | — | 19.13 | |
| ABLModel=ResNet18, Attack=WaNet2026.07 | 88.27 | — | 99.92 | |
| ABLModel=ResNet18, Attack=Worst Case2026.07 | 88.27 | — | 99.92 | |
| CBDModel=ResNet18, Attack=WaNet2026.07 | 87.96 | — | 19.36 | |
| ABLModel=WRN16-1, Attack=Blend2026.07 | 87.76 | — | 31.67 | |
| ABLModel=WRN16-1, Attack=Worst Case2026.07 | 87.76 | — | 31.67 | |
| DBDModel=ResNet18, Attack=IAB2026.07 | 87.55 | — | 99.31 | |
| DBDModel=ResNet18, Attack=Worst Case2026.07 | 87.55 | — | 99.98 | |
| Rep. SurgeryBackbone=CLIP ViT-B/32, Merging Category=Test-time / data-assisted2026.05 | 87 | — | — | |
| D-STModel=WRN16-1, Attack=CLB2026.07 | 85.86 | — | 0.9 | |
| D-STModel=WRN16-1, Attack=Worst Case2026.07 | 85.86 | — | 98.77 | |
| CBDModel=WRN16-1, Attack=WaNet2026.07 | 85.27 | — | 20.07 | |
| CBDModel=WRN16-1, Attack=Worst Case2026.07 | 85.27 | — | 97.19 | |
| CBDModel=ResNet18, Attack=IAB2026.07 | 82.29 | — | 99.36 | |
| CBDModel=ResNet18, Attack=Blend2026.07 | 79.92 | — | 65.37 | |
| DBDModel=WRN16-1, Attack=CLB2026.07 | 79.46 | — | 2.41 | |
| CBDModel=ResNet18, Attack=Average2026.07 | 79.26 | — | 31.63 | |
| DBDModel=WRN16-1, Attack=Trojan2026.07 | 78.72 | — | 0 | |
| D-STModel=ResNet18, Attack=CLB2026.07 | 78.06 | — | 2.15 | |
| D-STModel=ResNet18, Attack=Worst Case2026.07 | 78.06 | — | 67.26 | |
| PCB MergingBackbone=CLIP ViT-B/32, Merging Category=Data-free model merging2026.05 | 77.1 | — | — | |
| DBDModel=WRN16-1, Attack=BadNets2026.07 | 76.81 | — | 0 | |
| CBDModel=ResNet18, Attack=CLB2026.07 | 75.58 | — | 0 | |
| DBDModel=WRN16-1, Attack=Average2026.07 | 72.93 | — | 21.16 | |
| TIES-MergingBackbone=CLIP ViT-B/32, Merging Category=Data-free model merging2026.05 | 72.1 | — | — |