Image Classification on ImageNet (test) (Standard Accuracy)
100Top-1 AccuracyNo Defense
Evaluation results
| Method | Links | |||||
|---|---|---|---|---|---|---|
| No DefenseBackbone=WideResNet-50, Attack Generator=None, Attack Tactic=None2026.02 | 100 | — | — | — | — | |
| AAABackbone=WideResNet-50, Attack Generator=None, Attack Tactic=None, Defense Configuration=sine2026.02 | 100 | — | — | — | — | |
| AAABackbone=WideResNet-50, Attack Generator=None, Attack Tactic=None, Defense Configuration=linear2026.02 | 100 | — | — | — | — | |
| DLDBackbone=WideResNet-50, Attack Generator=None, Attack Tactic=None, Defense Configuration=rand2026.02 | 100 | — | — | — | — | |
| DLDBackbone=WideResNet-50, Attack Generator=None, Attack Tactic=None, Defense Configuration=determine2026.02 | 100 | — | — | — | — | |
| No DefenseBackbone=RegNet-Y 1.6GF, Attack Generator=None, Attack Tactic=None2026.02 | 100 | — | — | — | — | |
| AAABackbone=RegNet-Y 1.6GF, Attack Generator=None, Attack Tactic=None, Defense Configuration=sine2026.02 | 100 | — | — | — | — | |
| AAABackbone=RegNet-Y 1.6GF, Attack Generator=None, Attack Tactic=None, Defense Configuration=linear2026.02 | 100 | — | — | — | — | |
| DLDBackbone=RegNet-Y 1.6GF, Attack Generator=None, Attack Tactic=None, Defense Configuration=rand2026.02 | 100 | — | — | — | — | |
| DLDBackbone=RegNet-Y 1.6GF, Attack Generator=None, Attack Tactic=None, Defense Configuration=determine2026.02 | 100 | — | — | — | — | |
| No DefenseBackbone=MaxViT-T, Attack Generator=None, Attack Tactic=None2026.02 | 100 | — | — | — | — | |
| AAABackbone=MaxViT-T, Attack Generator=None, Attack Tactic=None, Defense Configuration=sine2026.02 | 100 | — | — | — | — | |
| AAABackbone=MaxViT-T, Attack Generator=None, Attack Tactic=None, Defense Configuration=linear2026.02 | 100 | — | — | — | — | |
| DLDBackbone=MaxViT-T, Attack Generator=None, Attack Tactic=None, Defense Configuration=rand2026.02 | 100 | — | — | — | — | |
| DLDBackbone=MaxViT-T, Attack Generator=None, Attack Tactic=None, Defense Configuration=determine2026.02 | 100 | — | — | — | — | |
| RNDBackbone=MaxViT-T, Attack Generator=None, Attack Tactic=None, Defense Configuration=0.012026.02 | 98.6 | — | — | — | — | |
| RNDBackbone=RegNet-Y 1.6GF, Attack Generator=None, Attack Tactic=None, Defense Configuration=0.012026.02 | 97.7 | — | — | — | — | |
| RNDBackbone=MaxViT-T, Attack Generator=None, Attack Tactic=None, Defense Configuration=0.022026.02 | 97.5 | — | — | — | — | |
| RNDBackbone=WideResNet-50, Attack Generator=None, Attack Tactic=None, Defense Configuration=0.012026.02 | 97.4 | — | — | — | — | |
| RNDBackbone=WideResNet-50, Attack Generator=None, Attack Tactic=None, Defense Configuration=0.022026.02 | 95.8 | — | — | — | — | |
| RNDBackbone=RegNet-Y 1.6GF, Attack Generator=None, Attack Tactic=None, Defense Configuration=0.022026.02 | 95.7 | — | — | — | — | |
| AAABackbone=MaxViT-T, Attack Generator=Square Attack, Attack Tactic=standard, Defense Configuration=linear2026.02 | 92.2 | — | — | — | — | |
| DLDBackbone=MaxViT-T, Attack Generator=Square Attack, Attack Tactic=reverse, Defense Configuration=rand2026.02 | 90.7 | — | — | — | — | |
| DLDBackbone=MaxViT-T, Attack Generator=Square Attack, Attack Tactic=standard, Defense Configuration=determine2026.02 | 90.5 | — | — | — | — | |
| DLDBackbone=MaxViT-T, Attack Generator=Square Attack, Attack Tactic=reverse, Defense Configuration=determine2026.02 | 90.4 | — | — | — | — | |
| AAABackbone=RegNet-Y 1.6GF, Attack Generator=Square Attack, Attack Tactic=standard, Defense Configuration=linear2026.02 | 90.1 | — | — | — | — | |
| DLDBackbone=MaxViT-T, Attack Generator=Square Attack, Attack Tactic=standard, Defense Configuration=rand2026.02 | 89.2 | — | — | — | — | |
| AAABackbone=MaxViT-T, Attack Generator=Square Attack, Attack Tactic=explore, Defense Configuration=linear2026.02 | 88.5 | — | — | — | — | |
| DLDBackbone=RegNet-Y 1.6GF, Attack Generator=Square Attack, Attack Tactic=reverse, Defense Configuration=determine2026.02 | 87.7 | — | — | — | — | |
| DLDBackbone=RegNet-Y 1.6GF, Attack Generator=Square Attack, Attack Tactic=standard, Defense Configuration=determine2026.02 | 87.6 | — | — | — | — | |
| AAABackbone=WideResNet-50, Attack Generator=Square Attack, Attack Tactic=standard, Defense Configuration=linear2026.02 | 87.4 | — | — | — | — | |
| DLDBackbone=RegNet-Y 1.6GF, Attack Generator=Square Attack, Attack Tactic=reverse, Defense Configuration=rand2026.02 | 87 | — | — | — | — | |
| DLDBackbone=WideResNet-50, Attack Generator=Square Attack, Attack Tactic=standard, Defense Configuration=determine2026.02 | 85.9 | — | — | — | — | |
| DLDBackbone=WideResNet-50, Attack Generator=Square Attack, Attack Tactic=reverse, Defense Configuration=determine2026.02 | 85.9 | — | — | — | — | |
| DLDBackbone=RegNet-Y 1.6GF, Attack Generator=Square Attack, Attack Tactic=standard, Defense Configuration=rand2026.02 | 85.9 | — | — | — | — | |
| DLDBackbone=WideResNet-50, Attack Generator=Square Attack, Attack Tactic=reverse, Defense Configuration=rand2026.02 | 85.6 | — | — | — | — | |
| DLDBackbone=WideResNet-50, Attack Generator=Square Attack, Attack Tactic=standard, Defense Configuration=rand2026.02 | 84.6 | — | — | — | — | |
| PCBM-ReDInterpretability=true, Evaluation Setting=Fully-supervised, Backbone=CLIP ViT-L/142026.01 | 84.48 | — | — | — | — | |
| AAABackbone=RegNet-Y 1.6GF, Attack Generator=Square Attack, Attack Tactic=explore, Defense Configuration=linear2026.02 | 84.2 | — | — | — | — | |
| V2C-CBMInterpretability=true, Evaluation Setting=Fully-supervised, Backbone=CLIP ViT-L/142026.01 | 84.15 | — | — | — | — | |
| LaBoInterpretability=true, Evaluation Setting=Fully-supervised, Backbone=CLIP ViT-L/142026.01 | 83.97 | — | — | — | — | |
| Linear ProbeInterpretability=false, Evaluation Setting=Fully-supervised, Backbone=CLIP ViT-L/142026.01 | 83.9 | — | — | — | — | |
| SGConvNeXt-B2D Bias=false, FLOPs=14.6G2024.08 | 83.9 | — | — | — | — | |
| MRConvNeXt-B2D Bias=false, FLOPs=14.6G2024.08 | 83.9 | — | — | — | — | |
| ConvNeXt-B2D Bias=true, FLOPs=15.4G2024.08 | 83.8 | — | — | — | — | |
| AAABackbone=MaxViT-T, Attack Generator=Square Attack, Attack Tactic=SA, Defense Configuration=linear2026.02 | 83.7 | — | — | — | — | |
| DLDBackbone=MaxViT-T, Attack Generator=Square Attack, Attack Tactic=explore, Defense Configuration=rand2026.02 | 83.6 | — | — | — | — | |
| SGConvNeXt-S2D Bias=false, FLOPs=8.3G2024.08 | 83.4 | — | — | — | — | |
| MRConvNeXt-S2D Bias=false, FLOPs=8.3G2024.08 | 83.4 | — | — | — | — | |
| DLDBackbone=MaxViT-T, Attack Generator=Square Attack, Attack Tactic=explore, Defense Configuration=determine2026.02 | 83.3 | — | — | — | — | |
| ConvNeXt-S2D Bias=true, FLOPs=8.7G2024.08 | 83.1 | — | — | — | — | |
| Res-CBMInterpretability=true, Evaluation Setting=Fully-supervised, Backbone=CLIP ViT-L/142026.01 | 82.98 | — | — | — | — | |
| MRConvNeXt-T2D Bias=false, FLOPs=4.3G2024.08 | 82.2 | — | — | — | — | |
| ConvNeXt-T2D Bias=true, FLOPs=4.5G2024.08 | 82.1 | — | — | — | — | |
| SGConvNeXt-T2D Bias=false, FLOPs=4.3G2024.08 | 82 | — | — | — | — | |
| AAABackbone=WideResNet-50, Attack Generator=Square Attack, Attack Tactic=explore, Defense Configuration=linear2026.02 | 81.8 | — | — | — | — | |
| ARFCBackbone=SigLip 2 (ViT-B/16), Compression Ratio=50%, Evaluation Protocol=Zero-shot2026.02 | 81.7 | — | — | — | — | |
| DLDBackbone=MaxViT-T, Attack Generator=Square Attack, Attack Tactic=SA, Defense Configuration=rand2026.02 | 81.7 | — | — | — | — | |
| No DefenseBackbone=MaxViT-T, Attack Generator=Square Attack, Attack Tactic=SA2026.02 | 81.6 | — | — | — | — | |
| DLDBackbone=MaxViT-T, Attack Generator=Square Attack, Attack Tactic=SA, Defense Configuration=determine2026.02 | 81.5 | — | — | — | — | |
| BaselineBackbone=SigLip 2 (ViT-B/16), Compression Ratio=0%, Evaluation Protocol=Zero-shot2026.02 | 81.2 | — | — | — | — | |
| AAABackbone=MaxViT-T, Attack Generator=Square Attack, Attack Tactic=standard, Defense Configuration=sine2026.02 | 80.6 | — | — | — | — | |
| Ens.Model=ResNet-1522025.12 | 80.35 | — | — | — | — | |
| DSM-NAS+Search Space=MobileNet-like, #MAdds (M)=582, #Queries (k)=10, Search Time (GPU days)=51.7+0.82022.10 | 80.2 | — | — | 94.9 | — | |
| Linear Probe2026.01 | 80.2 | — | — | — | — | |
| AAABackbone=MaxViT-T, Attack Generator=Square Attack, Attack Tactic=SA, Defense Configuration=sine2026.02 | 80.2 | — | — | — | — | |
| OFA-LargeSearch Space=MobileNet-like, #MAdds (M)=595, #Queries (k)=20, Search Time (GPU days)=51.72022.10 | 80 | — | — | 94.9 | — | |
| Cream-LSearch Space=MobileNet-like, #MAdds (M)=604, Search Time (GPU days)=122022.10 | 80 | — | — | 94.7 | — | |
| NEAS-LSearch Space=MobileNet-like, #MAdds (M)=574, Search Time (GPU days)=<132022.10 | 80 | — | — | 94.8 | — | |
| DSM-NASSearch Space=MobileNet-like, #MAdds (M)=597, #Queries (k)=10, Search Time (GPU days)=0.82022.10 | 79.9 | — | — | 94.8 | — | |
| AAABackbone=MaxViT-T, Attack Generator=Square Attack, Attack Tactic=explore, Defense Configuration=sine2026.02 | 79.9 | — | — | — | — | |
| DPSModel=ResNet-1522025.12 | 79.88 | — | — | — | — | |
| KDModel=ResNet-1522025.12 | 79.73 | — | — | — | — | |
| Ens.Model=DenseNet-2642025.12 | 79.69 | — | — | — | — | |
| DN-CBMSpatial Grounding=global2026.01 | 79.5 | — | — | — | — | |
| ZiCoSearch Space=MobileNet-like, #MAdds (M)=603, Search Time (GPU days)=0.42022.10 | 79.4 | — | — | — | — | |
| CDMSpatial Grounding=global2026.01 | 79.3 | — | — | — | — | |
| RNDBackbone=MaxViT-T, Attack Generator=Square Attack, Attack Tactic=SA, Defense Configuration=0.012026.02 | 79.3 | — | — | — | — | |
| EfficientNet-B1Search Space=MobileNet-like, #MAdds (M)=7342022.10 | 79.2 | — | — | 94.5 | — | |
| PS-KDModel=ResNet-1522025.12 | 79.18 | — | — | — | — | |
| DLDBackbone=RegNet-Y 1.6GF, Attack Generator=Square Attack, Attack Tactic=explore, Defense Configuration=rand2026.02 | 79.1 | — | — | — | — | |
| LaBoSpatial Grounding=global2026.01 | 78.9 | — | — | — | — | |
| INSIGHTSpatial Grounding=spatially grounded2026.01 | 78.9 | — | — | — | — | |
| DPSModel=DenseNet-2642025.12 | 78.79 | — | — | — | — | |
| HQBackbone=ViT-B2025.01 | 78.7 | — | — | — | — | |
| KDModel=DenseNet-2642025.12 | 78.56 | — | — | — | — | |
| DLBModel=ResNet-1522025.12 | 78.54 | — | — | — | — | |
| CF-CBMSpatial Grounding=partial2026.01 | 78.5 | — | — | — | — | |
| TEModel=ResNet-1522025.12 | 78.46 | — | — | — | — | |
| DNASearch Space=MobileNet-like, #MAdds (M)=611, Search Time (GPU days)=32.62022.10 | 78.4 | — | — | 94 | — | |
| BaselineModel=ResNet-1522025.12 | 78.4 | — | — | — | — | |
| TA (Wide)Backbone=ResNet-502021.03 | 78.07 | — | — | 93.92 | — | |
| PS-KDModel=DenseNet-2642025.12 | 77.83 | — | — | — | — | |
| BiFTABackbone=ViT-L/14, Zero-shot=true2026.01 | 77.82 | — | — | — | — | |
| DLDBackbone=RegNet-Y 1.6GF, Attack Generator=Square Attack, Attack Tactic=explore, Defense Configuration=determine2026.02 | 77.8 | — | — | — | — | |
| UABackbone=ResNet-502021.03 | 77.63 | — | — | — | — | |
| Fast AABackbone=ResNet-502021.03 | 77.6 | — | — | 93.7 | — | |
| AABackbone=ResNet-502021.03 | 77.6 | — | — | 93.8 | — | |
| RABackbone=ResNet-502021.03 | 77.6 | — | — | 93.8 | — | |
| FairNASSearch Space=MobileNet-like, #MAdds (M)=392, #Queries (k)=11.2, Search Time (GPU days)=122022.10 | 77.5 | — | — | 93.7 | — |