Image Classification on MNIST (Standard and Robust Accuracy)
99.9Standard AccuracyWaveAttack
Evaluation results
| Method | Links | |||
|---|---|---|---|---|
| WaveAttackPoisoning Rate (ρ)=1%, Defense=No defense2026.05 | 99.9 | — | 100 | |
| WaveAttackPoisoning Rate (ρ)=1%, Defense=FST2026.05 | 99.7 | — | 0.1 | |
| WaveAttackPoisoning Rate (ρ)=0.5%, Defense=FST2026.05 | 99.7 | — | 0.2 | |
| BppAttackPoisoning Rate (ρ)=0.5%, Defense=No defense2026.05 | 99.6 | — | 9.9 | |
| BppAttackPoisoning Rate (ρ)=1%, Defense=No defense2026.05 | 99.5 | — | 14 | |
| WideResNet-50Setup=Robust Baseline (frb), Compression=None2024.03 | 99.37 | 92.24 | — | |
| WideResNet-50Setup=Standard Baseline (fst), Compression=None2024.03 | 99.26 | 51.03 | — | |
| WaveAttackPoisoning Rate (ρ)=5%, Defense=No defense2026.05 | 99.2 | — | 99.7 | |
| WideResNet-50Setup=Adversarial Fine-tuning (Tad), Compression=INT8 Quantization2024.03 | 99.1 | 92.43 | — | |
| BlendedPoisoning Rate (ρ)=5%, Defense=No defense2026.05 | 99.1 | — | 100 | |
| SSBAPoisoning Rate (ρ)=1%, Defense=No defense2026.05 | 99.1 | — | 100 | |
| Adapt-BlendPoisoning Rate (ρ)=0.5%, Defense=No defense2026.05 | 99.1 | — | 92.8 | |
| WideResNet-50Setup=Standard Fine-tuning (Tst), Compression=INT8 Quantization2024.03 | 99.07 | 53.82 | — | |
| BadNetsPoisoning Rate (ρ)=5%, Defense=No defense2026.05 | 99 | — | 100 | |
| BadNetsPoisoning Rate (ρ)=1%, Defense=No defense2026.05 | 99 | — | 96.7 | |
| BadNetsPoisoning Rate (ρ)=0.5%, Defense=No defense2026.05 | 99 | — | 96.1 | |
| BlendedPoisoning Rate (ρ)=0.5%, Defense=No defense2026.05 | 99 | — | 100 | |
| SSBAPoisoning Rate (ρ)=5%, Defense=No defense2026.05 | 99 | — | 100 | |
| SSBAPoisoning Rate (ρ)=0.5%, Defense=No defense2026.05 | 99 | — | 100 | |
| WaveAttackPoisoning Rate (ρ)=0.5%, Defense=No defense2026.05 | 99 | — | 99.9 | |
| BlendedPoisoning Rate (ρ)=1%, Defense=No defense2026.05 | 98.9 | — | 100 | |
| Adapt-BlendPoisoning Rate (ρ)=5%, Defense=No defense2026.05 | 98.9 | — | 99.2 | |
| DSAPoisoning Rate (ρ)=1%, Defense=No defense2026.05 | 98.9 | — | 100 | |
| WideResNet-50Setup=Adversarial Fine-tuning (Tad), Compression=l1-Pruning (80% sparsity)2024.03 | 98.88 | 91.82 | — | |
| BppAttackPoisoning Rate (ρ)=5%, Defense=No defense2026.05 | 98.8 | — | 96.4 | |
| DSAPoisoning Rate (ρ)=5%, Defense=No defense2026.05 | 98.8 | — | 100 | |
| WaveAttackPoisoning Rate (ρ)=5%, Defense=FST2026.05 | 98.7 | — | 0.2 | |
| DSAPoisoning Rate (ρ)=0.5%, Defense=No defense2026.05 | 98.7 | — | 100 | |
| WideResNet-50Setup=Standard Fine-tuning (Tst), Compression=l1-Pruning (80% sparsity)2024.03 | 98.65 | 39.77 | — | |
| BppAttackPoisoning Rate (ρ)=1%, Defense=FST2026.05 | 98.4 | — | 0 | |
| SSBAPoisoning Rate (ρ)=1%, Defense=FST2026.05 | 98.1 | — | 0 | |
| BppAttackPoisoning Rate (ρ)=5%, Defense=FST2026.05 | 97.8 | — | 0.9 | |
| BlendedPoisoning Rate (ρ)=1%, Defense=FST2026.05 | 97.6 | — | 0.1 | |
| BppAttackPoisoning Rate (ρ)=0.5%, Defense=FST2026.05 | 97.6 | — | 0 | |
| Adapt-BlendPoisoning Rate (ρ)=1%, Defense=No defense2026.05 | 97.2 | — | 96.3 | |
| Adapt-BlendPoisoning Rate (ρ)=1%, Defense=FST2026.05 | 97.1 | — | 0.2 | |
| SSBAPoisoning Rate (ρ)=0.5%, Defense=FST2026.05 | 97 | — | 0 | |
| BadNetsPoisoning Rate (ρ)=5%, Defense=FST2026.05 | 96.8 | — | 0 | |
| Adapt-BlendPoisoning Rate (ρ)=5%, Defense=FST2026.05 | 96.4 | — | 1.5 | |
| FoggyTrustAttack Scenario=No Attack, Aggregation Strategy=FedAvg2026.06 | 96.27 | — | — | |
| FoggyTrustAttack Scenario=No Attack, Aggregation Strategy=SCAFFOLD2026.06 | 96.26 | — | — | |
| BlendedPoisoning Rate (ρ)=5%, Defense=FST2026.05 | 96.2 | — | 1 | |
| DSAPoisoning Rate (ρ)=1%, Defense=FST2026.05 | 96.2 | — | 96.7 | |
| SSBAPoisoning Rate (ρ)=5%, Defense=FST2026.05 | 96.1 | — | 0 | |
| FoggyTrustAttack Scenario=Scaling Attack, Aggregation Strategy=FedAvg2026.06 | 96.04 | — | 0.58 | |
| DSAPoisoning Rate (ρ)=5%, Defense=FST2026.05 | 95.9 | — | 100 | |
| FoggyTrustAttack Scenario=Scaling Attack, Aggregation Strategy=SCAFFOLD2026.06 | 95.8 | — | 0.49 | |
| FedAvgAttack Scenario=No Attack2026.06 | 95.5 | — | — | |
| FoggyTrustAttack Scenario=No Attack, Aggregation Strategy=FedAdam2026.06 | 95.49 | — | — | |
| FoggyTrustAttack Scenario=Trim Attack, Aggregation Strategy=FedAvg2026.06 | 95.31 | — | — | |
| FLTrustAttack Scenario=No Attack2026.06 | 95.22 | — | — | |
| FoggyTrustAttack Scenario=LF Attack, Aggregation Strategy=FedAdam2026.06 | 95.2 | — | — | |
| DSAPoisoning Rate (ρ)=0.5%, Defense=FST2026.05 | 95 | — | 100 | |
| FLTrustAttack Scenario=LF Attack2026.06 | 94.92 | — | — | |
| FoggyTrustAttack Scenario=LF Attack, Aggregation Strategy=SCAFFOLD2026.06 | 94.91 | — | — | |
| FoggyTrustAttack Scenario=LF Attack, Aggregation Strategy=FedAvg2026.06 | 94.8 | — | — | |
| FoggyTrustAttack Scenario=Trim Attack, Aggregation Strategy=SCAFFOLD2026.06 | 94.79 | — | — | |
| Adapt-BlendPoisoning Rate (ρ)=0.5%, Defense=FST2026.05 | 94.7 | — | 0.1 | |
| FoggyTrustAttack Scenario=Scaling Attack, Aggregation Strategy=FedAdam2026.06 | 94.65 | — | 0.68 | |
| FoggyTrustAttack Scenario=Trim Attack, Aggregation Strategy=FedAdam2026.06 | 94.53 | — | — | |
| BlendedPoisoning Rate (ρ)=0.5%, Defense=FST2026.05 | 94.3 | — | 0 | |
| MedianAttack Scenario=LF Attack2026.06 | 94.12 | — | — | |
| BadNetsPoisoning Rate (ρ)=1%, Defense=FST2026.05 | 94.1 | — | 0 | |
| Trim-MeanAttack Scenario=No Attack2026.06 | 94 | — | — | |
| FLTrustAttack Scenario=Krum Attack2026.06 | 93.91 | — | — | |
| FLTrustAttack Scenario=Scaling Attack2026.06 | 93.86 | — | 0.38 | |
| MedianAttack Scenario=No Attack2026.06 | 93.85 | — | — | |
| FedAvgAttack Scenario=LF Attack2026.06 | 93.77 | — | — | |
| FoggyTrustAttack Scenario=Krum Attack, Aggregation Strategy=FedAvg2026.06 | 93.66 | — | — | |
| FoggyTrustAttack Scenario=Krum Attack, Aggregation Strategy=FedAdam2026.06 | 93.62 | — | — | |
| FoggyTrustAttack Scenario=Krum Attack, Aggregation Strategy=SCAFFOLD2026.06 | 92.9 | — | — | |
| ViTSetup=Standard Baseline (fst), Compression=None2024.03 | 92.54 | 31.56 | — | |
| ViTSetup=Robust Baseline (frb), Compression=None2024.03 | 92.01 | 77.06 | — | |
| BadNetsPoisoning Rate (ρ)=0.5%, Defense=FST2026.05 | 92 | — | 0 | |
| FLTrustAttack Scenario=Trim Attack2026.06 | 91.99 | — | — | |
| ViTSetup=Standard Fine-tuning (Tst), Compression=l1-Pruning (80% sparsity)2024.03 | 91.33 | 21.96 | — | |
| ViTSetup=Standard Fine-tuning (Tst), Compression=INT8 Quantization2024.03 | 91.18 | 37.94 | — | |
| ViTSetup=Adversarial Fine-tuning (Tad), Compression=l1-Pruning (80% sparsity)2024.03 | 91.01 | 74.08 | — | |
| ViTSetup=Adversarial Fine-tuning (Tad), Compression=INT8 Quantization2024.03 | 90.45 | 74.25 | — | |
| KrumAttack Scenario=LF Attack2026.06 | 90.07 | — | — | |
| KrumAttack Scenario=Trim Attack2026.06 | 89.86 | — | — | |
| KrumAttack Scenario=No Attack2026.06 | 89.66 | — | — | |
| FedAvgAttack Scenario=Krum Attack2026.06 | 89.21 | — | — | |
| Trim-MeanAttack Scenario=LF Attack2026.06 | 89.15 | — | — | |
| KrumAttack Scenario=Scaling Attack2026.06 | 88.55 | — | 1.46 | |
| MedianAttack Scenario=Scaling Attack2026.06 | 87.88 | — | 0.95 | |
| Trim-MeanAttack Scenario=Krum Attack2026.06 | 79.79 | — | — | |
| FedAvgAttack Scenario=Trim Attack2026.06 | 74.89 | — | — | |
| Trim-MeanAttack Scenario=Trim Attack2026.06 | 70.43 | — | — | |
| MedianAttack Scenario=Trim Attack2026.06 | 67.8 | — | — | |
| Trim-MeanAttack Scenario=Scaling Attack2026.06 | 66.77 | — | 3.4 | |
| MedianAttack Scenario=Krum Attack2026.06 | 10.83 | — | — | |
| KrumAttack Scenario=Krum Attack2026.06 | 9.83 | — | — | |
| FedAvgAttack Scenario=Scaling Attack2026.06 | 9.8 | — | 100 | |
| CROWN-IBPModel Architecture=MNIST Toy Model, Epsilon=0.12026.06 | — | 0 | — | |
| CROWN-IBPModel Architecture=MNIST Toy Model, Epsilon=0.012026.06 | — | 17.9 | — | |
| CROWN-IBPModel Architecture=MNIST Toy Model, Epsilon=0.0012026.06 | — | 69.96 | — | |
| CROWN-IBPModel Architecture=MNIST Toy Model, Epsilon=0.00012026.06 | — | 82 | — | |
| CROWN-IBPModel Architecture=MNIST Toy Model, Epsilon=0.000012026.06 | — | 82.25 | — | |
| CROWN-IBPModel Architecture=MNIST Toy Model Large, Epsilon=0.12026.06 | — | 0 | — |