Image Classification on ImageNet (test) (Adversarial Robustness L_p Metrics)
79.5Clean Accuracy (L_inf, delta=4/255)TRADES(base)
Evaluation results
| Method | Links | |||||||
|---|---|---|---|---|---|---|---|---|
| TRADES(base)Backbone=Hybrid-L16, Defense Strategy=TRADES2022.11 | 79.5 | 37.6 | 78 | 38.6 | — | — | — | |
| TRADES(TrH)Backbone=Hybrid-L16, Defense Strategy=TRADES, Regularization=Trace of Hessian (TrH)2022.11 | 75.9 | 45.7 | 73.3 | 45.6 | — | — | — | |
| AT(TrH)Backbone=Hybrid-L16, Defense Strategy=Adversarial Training (AT), Regularization=Trace of Hessian (TrH)2022.11 | 75 | 46.2 | 74.4 | 45.9 | — | — | — | |
| TRADES(S20)Backbone=Hybrid-L16, Defense Strategy=TRADES, Optimization=S202022.11 | 73.8 | 41.3 | 72.2 | 41.2 | — | — | — | |
| TRADES(SWA)Backbone=Hybrid-L16, Defense Strategy=TRADES, Regularization=Stochastic Weight Averaging (SWA)2022.11 | 72.9 | 40.9 | 71.3 | 40.8 | — | — | — | |
| AT(S20)Backbone=Hybrid-L16, Defense Strategy=Adversarial Training (AT), Optimization=S202022.11 | 72.8 | 43.6 | 72.3 | 40.9 | — | — | — | |
| AT(SWA)Backbone=Hybrid-L16, Defense Strategy=Adversarial Training (AT), Regularization=Stochastic Weight Averaging (SWA)2022.11 | 72.7 | 40.4 | 72.7 | 40.5 | — | — | — | |
| AT(base)Backbone=Hybrid-L16, Defense Strategy=Adversarial Training (AT)2022.11 | 72.6 | 40.7 | 72.2 | 40.6 | — | — | — | |
| AT(AWP)Backbone=Hybrid-L16, Defense Strategy=Adversarial Training (AT), Regularization=Adversarial Weight Perturbation (AWP)2022.11 | 67.7 | 39.4 | 67.9 | 40.3 | — | — | — | |
| TRADES(AWP)Backbone=Hybrid-L16, Defense Strategy=TRADES, Regularization=Adversarial Weight Perturbation (AWP)2022.11 | 66.4 | 38.8 | 65.3 | 40.9 | — | — | — | |
| AWPBackbone=ViT-B/16, Attack Protocol=AutoAttack, Epsilon=8/2552026.06 | — | — | — | — | 67.51 | 46.23 | 14.31 | |
| CFABackbone=ViT-B/16, Attack Protocol=AutoAttack, Epsilon=8/2552026.06 | — | — | — | — | 66.9 | 44.64 | 15.16 | |
| DHATBackbone=ViT-B/16, Attack Protocol=AutoAttack, Epsilon=8/2552026.06 | — | — | — | — | 68.59 | 48.91 | 11.82 | |
| FSRBackbone=ViT-B/16, Attack Protocol=AutoAttack, Epsilon=8/2552026.06 | — | — | — | — | 67.22 | 45.33 | 12.4 | |
| HICATBackbone=ViT-B/16, Attack Protocol=AutoAttack, Epsilon=8/2552026.06 | — | — | — | — | 69.77 | 50.24 | 9.79 | |
| MARTBackbone=ViT-B/16, Attack Protocol=AutoAttack, Epsilon=8/2552026.06 | — | — | — | — | 64.28 | 44.71 | 16.7 | |
| SGLRBackbone=ViT-B/16, Attack Protocol=AutoAttack, Epsilon=8/2552026.06 | — | — | — | — | 67.14 | 47.3 | 15.07 | |
| UIATBackbone=ViT-B/16, Attack Protocol=AutoAttack, Epsilon=8/2552026.06 | — | — | — | — | 66.87 | 46.38 | 17.56 |