Image Classification on ImageNet-D
79.8Top-1 AccuracyPDA
Evaluation results
| Method | Links | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| PDAVictim Model=LLaVA-1.5-13B, Input Condition=Clean2026.04 | 79.8 | — | — | — | — | — | — | — | |
| PDAVictim Model=LLaVA-1.5-7B, Input Condition=Clean2026.04 | 75.8 | — | — | — | — | — | — | — | |
| TeCoAVictim Model=LLaVA-1.5-13B, Input Condition=Clean2026.04 | 69.7 | — | — | — | — | — | — | — | |
| FAREVictim Model=LLaVA-1.5-13B, Input Condition=Clean2026.04 | 69.5 | — | — | — | — | — | — | — | |
| SemanticSmooth-ParaphraseVictim Model=LLaVA-1.5-13B, Input Condition=Clean2026.04 | 65.7 | — | — | — | — | — | — | — | |
| SemanticSmooth-SummariseVictim Model=LLaVA-1.5-13B, Input Condition=Clean2026.04 | 64.9 | — | — | — | — | — | — | — | |
| No DefenseVictim Model=LLaVA-1.5-13B, Input Condition=Clean2026.04 | 64.6 | — | — | — | — | — | — | — | |
| FAREVictim Model=LLaVA-1.5-7B, Input Condition=Clean2026.04 | 64 | — | — | — | — | — | — | — | |
| SemanticSmooth-ParaphraseVictim Model=LLaVA-1.5-7B, Input Condition=Clean2026.04 | 63.8 | — | — | — | — | — | — | — | |
| SmoothLLM-PatchVictim Model=LLaVA-1.5-7B, Input Condition=Clean2026.04 | 63.2 | — | — | — | — | — | — | — | |
| SmoothLLM-SwapVictim Model=LLaVA-1.5-13B, Input Condition=Clean2026.04 | 63 | — | — | — | — | — | — | — | |
| No DefenseVictim Model=LLaVA-1.5-7B, Input Condition=Clean2026.04 | 62.5 | — | — | — | — | — | — | — | |
| FAREVictim Model=LLaVA-1.5-13B, Input Condition=Adversarial2026.04 | 62.5 | — | — | — | — | — | — | — | |
| TeCoAVictim Model=LLaVA-1.5-7B, Input Condition=Clean2026.04 | 61.3 | — | — | — | — | — | — | — | |
| SmoothLLM-PatchVictim Model=LLaVA-1.5-13B, Input Condition=Clean2026.04 | 61.1 | — | — | — | — | — | — | — | |
| TeCoAVictim Model=LLaVA-1.5-13B, Input Condition=Adversarial2026.04 | 61.1 | — | — | — | — | — | — | — | |
| SmoothLLM-SwapVictim Model=LLaVA-1.5-7B, Input Condition=Clean2026.04 | 61 | — | — | — | — | — | — | — | |
| SemanticSmooth-SummariseVictim Model=LLaVA-1.5-7B, Input Condition=Clean2026.04 | 61 | — | — | — | — | — | — | — | |
| SmoothLLM-InsertVictim Model=LLaVA-1.5-13B, Input Condition=Clean2026.04 | 60.5 | — | — | — | — | — | — | — | |
| SmoothLLM-InsertVictim Model=LLaVA-1.5-7B, Input Condition=Clean2026.04 | 59.6 | — | — | — | — | — | — | — | |
| PDAVictim Model=LLaVA-1.5-7B, Input Condition=Adversarial2026.04 | 57 | — | — | — | — | — | — | — | |
| TeCoAVictim Model=LLaVA-1.5-7B, Input Condition=Adversarial2026.04 | 56.9 | — | — | — | — | — | — | — | |
| PDAVictim Model=LLaVA-1.5-13B, Input Condition=Adversarial2026.04 | 56.6 | — | — | — | — | — | — | — | |
| FAREVictim Model=LLaVA-1.5-7B, Input Condition=Adversarial2026.04 | 51.1 | — | — | — | — | — | — | — | |
| SemanticSmooth-SummariseVictim Model=LLaVA-1.5-13B, Input Condition=Adversarial2026.04 | 37.9 | — | — | — | — | — | — | — | |
| SemanticSmooth-ParaphraseVictim Model=LLaVA-1.5-13B, Input Condition=Adversarial2026.04 | 35.8 | — | — | — | — | — | — | — | |
| SmoothLLM-InsertVictim Model=LLaVA-1.5-13B, Input Condition=Adversarial2026.04 | 33 | — | — | — | — | — | — | — | |
| SmoothLLM-SwapVictim Model=LLaVA-1.5-13B, Input Condition=Adversarial2026.04 | 32.7 | — | — | — | — | — | — | — | |
| No DefenseVictim Model=LLaVA-1.5-13B, Input Condition=Adversarial2026.04 | 32 | — | — | — | — | — | — | — | |
| SmoothLLM-PatchVictim Model=LLaVA-1.5-13B, Input Condition=Adversarial2026.04 | 31.4 | — | — | — | — | — | — | — | |
| SemanticSmooth-SummariseVictim Model=LLaVA-1.5-7B, Input Condition=Adversarial2026.04 | 28.9 | — | — | — | — | — | — | — | |
| SemanticSmooth-ParaphraseVictim Model=LLaVA-1.5-7B, Input Condition=Adversarial2026.04 | 27.6 | — | — | — | — | — | — | — | |
| SmoothLLM-PatchVictim Model=LLaVA-1.5-7B, Input Condition=Adversarial2026.04 | 26.1 | — | — | — | — | — | — | — | |
| SmoothLLM-SwapVictim Model=LLaVA-1.5-7B, Input Condition=Adversarial2026.04 | 26 | — | — | — | — | — | — | — | |
| SmoothLLM-InsertVictim Model=LLaVA-1.5-7B, Input Condition=Adversarial2026.04 | 25.4 | — | — | — | — | — | — | — | |
| No DefenseVictim Model=LLaVA-1.5-7B, Input Condition=Adversarial2026.04 | 24.8 | — | — | — | — | — | — | — | |
| Claude 3.5 SonnetDefense setting=No Defense, Attack protocol=Transfer-attack (PGD on LLaVA)2026.04 | — | — | — | — | — | — | — | 61 | |
| EffNet-L2 Noisy Studentadapt=w/o2021.04 | — | 29.2 | 42.7 | 45 | 56.4 | 77.9 | 98.4 | — | |
| EffNet-L2 Noisy Studentadapt=w/2021.04 | — | 27.9 | 40.9 | 37.9 | 51.5 | 94.3 | 99.4 | — | |
| Gemini 1.5 ProDefense setting=No Defense, Attack protocol=Transfer-attack (PGD on LLaVA)2026.04 | — | — | — | — | — | — | — | 67 | |
| GPT-4oDefense setting=No Defense, Attack protocol=Transfer-attack (PGD on LLaVA)2026.04 | — | — | — | — | — | — | — | 67 | |
| No DefenseAttack=Transfer-based2026.04 | — | — | — | — | — | — | — | 58 | |
| No DefenseAttack=AttackVLM2026.04 | — | — | — | — | — | — | — | 56 | |
| No DefenseAttack=AnyAttack2026.04 | — | — | — | — | — | — | — | 61 | |
| PDABase Model=GPT-4o, Attack protocol=Transfer-attack (PGD on LLaVA)2026.04 | — | — | — | — | — | — | — | 76 | |
| PDABase Model=Claude 3.5 Sonnet, Attack protocol=Transfer-attack (PGD on LLaVA)2026.04 | — | — | — | — | — | — | — | 70 | |
| PDABase Model=Gemini 1.5 Pro, Attack protocol=Transfer-attack (PGD on LLaVA)2026.04 | — | — | — | — | — | — | — | 72 | |
| PDAAttack=Transfer-based2026.04 | — | — | — | — | — | — | — | 62 | |
| PDAAttack=AttackVLM2026.04 | — | — | — | — | — | — | — | 61 | |
| PDAAttack=AnyAttack2026.04 | — | — | — | — | — | — | — | 64 | |
| ResNet 50 vanillaadapt=w/o2021.04 | — | 40.1 | 65.1 | 76 | 82 | 89.6 | 99.2 | — | |
| ResNet 50 vanillaadapt=w/2021.04 | — | 37.3 | 57.8 | 63.6 | 73 | 85.1 | 99.8 | — | |
| ResNet50 DAug+AMadapt=w/o2021.04 | — | 39.2 | 58.7 | 68.4 | 75.2 | 88.1 | 98.2 | — | |
| ResNet50 DAug+AMadapt=w/2021.04 | — | 36.5 | 53.4 | 57 | 61.3 | 83.2 | 99.1 | — |