# Image Classification on ImageNet (test) (Adversarial Robustness L\_p Metrics) Source: [Image Classification on ImageNet (test) (Adversarial Robustness L\_p Metrics)]() Collection index: [llms.txt]() Data updated: 2026-06-04T10:12:41.238Z Evaluation of Image Classification performance on the test split of ImageNet, reporting robustness metrics against adversarial attacks measured using L\_infinity (delta=4/255) and L\_2 (delta=3.0) norms, including Clean Accuracy and Average Accuracy (AA). A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. | Scope | Recorded value | | --- | --- | | Task | Image Classification | | Dataset (including any stated split) | ImageNet (test) | | Metric | Clean Accuracy (L\_inf, delta=4/255) | | Unit | PERCENT | | Direction | Higher is better | | Results loaded | 18 of 18 | | Coverage | All results currently returned for this benchmark | Evaluation settings may differ between results. The original papers and recorded configurations are needed to establish comparability. A shared metric name alone does not establish an identical protocol. ## Metrics - [Clean Accuracy (L\_inf, delta=4/255)](): Higher is better; unit: PERCENT. - [Average Accuracy (AA) (L\_inf, delta=4/255)](): Higher is better; unit: PERCENT. - [Clean Accuracy (L\_2, delta=3.0)](): Higher is better; unit: PERCENT. - [Average Accuracy (AA) (L\_2, delta=3.0)](): Higher is better; unit: PERCENT. - [Clean Accuracy](): Higher is better; unit: PERCENT. - [Average Accuracy (AA)](): Higher is better; unit: PERCENT. - [Robustness Gap](): Lower is better; unit: PERCENT. ## Recorded results | Method | Clean Accuracy (L\_inf, delta=4/255) | Result date | Report paper | | --- | --- | --- | --- | | TRADES(base) | 79.5 | Not recorded | 68fa6dfe1e209131cea3d3ef | | TRADES(TrH) | 75.9 | Not recorded | 68fa6dfe1e209131cea3d3ef | | AT(TrH) | 75 | Not recorded | 68fa6dfe1e209131cea3d3ef | | TRADES(S20) | 73.8 | Not recorded | 68fa6dfe1e209131cea3d3ef | | TRADES(SWA) | 72.9 | Not recorded | 68fa6dfe1e209131cea3d3ef | | AT(S20) | 72.8 | Not recorded | 68fa6dfe1e209131cea3d3ef | | AT(SWA) | 72.7 | Not recorded | 68fa6dfe1e209131cea3d3ef | | AT(base) | 72.6 | Not recorded | 68fa6dfe1e209131cea3d3ef | | AT(AWP) | 67.7 | Not recorded | 68fa6dfe1e209131cea3d3ef | | TRADES(AWP) | 66.4 | Not recorded | 68fa6dfe1e209131cea3d3ef | ### TRADES(base) Clean Accuracy (L\_inf, delta=4/255): 79.5. Result ID: 698ffdf13a6c314849fd5193. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Backbone":"Hybrid-L16","Defense Strategy":"TRADES"}. This record does not assert independent reproduction. ### TRADES(TrH) Clean Accuracy (L\_inf, delta=4/255): 75.9. Result ID: 698ffdf13a6c314849fd5197. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Backbone":"Hybrid-L16","Defense Strategy":"TRADES","Regularization":"Trace of Hessian (TrH)"}. This record does not assert independent reproduction. ### AT(TrH) Clean Accuracy (L\_inf, delta=4/255): 75. Result ID: 698ffdf13a6c314849fd5192. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Backbone":"Hybrid-L16","Defense Strategy":"Adversarial Training (AT)","Regularization":"Trace of Hessian (TrH)"}. This record does not assert independent reproduction. ### TRADES(S20) Clean Accuracy (L\_inf, delta=4/255): 73.8. Result ID: 698ffdf13a6c314849fd5195. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Backbone":"Hybrid-L16","Defense Strategy":"TRADES","Optimization":"S20"}. This record does not assert independent reproduction. ### TRADES(SWA) Clean Accuracy (L\_inf, delta=4/255): 72.9. Result ID: 698ffdf13a6c314849fd5194. [Reporting paper]() [Method origin paper]() [Implementation]() Recorded evaluation configuration: {"Backbone":"Hybrid-L16","Defense Strategy":"TRADES","Regularization":"Stochastic Weight Averaging (SWA)"}. This record does not assert independent reproduction. ### AT(S20) Clean Accuracy (L\_inf, delta=4/255): 72.8. Result ID: 698ffdf13a6c314849fd5190. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Backbone":"Hybrid-L16","Defense Strategy":"Adversarial Training (AT)","Optimization":"S20"}. This record does not assert independent reproduction. ### AT(SWA) Clean Accuracy (L\_inf, delta=4/255): 72.7. Result ID: 698ffdf13a6c314849fd518f. [Reporting paper]() [Method origin paper]() [Implementation]() Recorded evaluation configuration: {"Backbone":"Hybrid-L16","Defense Strategy":"Adversarial Training (AT)","Regularization":"Stochastic Weight Averaging (SWA)"}. This record does not assert independent reproduction. ### AT(base) Clean Accuracy (L\_inf, delta=4/255): 72.6. Result ID: 698ffdf13a6c314849fd518e. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Backbone":"Hybrid-L16","Defense Strategy":"Adversarial Training (AT)"}. This record does not assert independent reproduction. ### AT(AWP) Clean Accuracy (L\_inf, delta=4/255): 67.7. Result ID: 698ffdf13a6c314849fd5191. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Backbone":"Hybrid-L16","Defense Strategy":"Adversarial Training (AT)","Regularization":"Adversarial Weight Perturbation (AWP)"}. This record does not assert independent reproduction. ### TRADES(AWP) Clean Accuracy (L\_inf, delta=4/255): 66.4. Result ID: 698ffdf13a6c314849fd5196. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Backbone":"Hybrid-L16","Defense Strategy":"TRADES","Regularization":"Adversarial Weight Perturbation (AWP)"}. This record does not assert independent reproduction. Page 1 of 1. This is an index page, not the full collection.