Image Classification on OxfordPets (Clean and Robust Accuracy)
87.46Robust AccuracyATAC
Evaluation results
| Method | Links | |||
|---|---|---|---|---|
| ATACDefense Category=Test-time Defense2025.11 | 87.46 | 85.15 | — | |
| ATACAttack Strategy=PGD, Epsilon=4/2552025.11 | 87.46 | — | — | |
| CLBPShots=16, Training Epochs=10, Training Attack (PGD)=2-step (1/255), Evaluation Attack (PGD-100)=100-step (1/255)2026.05 | 85.2 | 90.84 | — | |
| R-TPTBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 81.4 | 94.2 | — | |
| CLBPmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 80.4 | 85.04 | — | |
| FAREBackbone=CLIP-L/14, Method category=Adversarial Fine-tuning2026.01 | 79.4 | 86.6 | — | |
| ATACmode=Test-time Defense, attack=10-step PGD, epsilon=1/2552025.11 | 77.11 | 87.3 | — | |
| CSRBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 76.4 | 93.1 | — | |
| SCCmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 75.06 | 86.48 | — | |
| TeCoABackbone=CLIP-L/14, Method category=Adversarial Fine-tuning2026.01 | 72.9 | 76.1 | — | |
| R-TPTmode=Test-time Defense, attack=10-step PGD, epsilon=1/2552025.11 | 71.79 | 84.46 | — | |
| AGFTFine-tuned on=ImageNet2026.03 | 71.03 | — | — | |
| GLADIATORFine-tuned on=ImageNet2026.03 | 68.1 | — | — | |
| PMG-AFTFine-tuned on=ImageNet2026.03 | 65.34 | — | — | |
| TGA-ZSRFine-tuned on=ImageNet2026.03 | 65.12 | — | — | |
| TeCoABackbone=CLIP-B/32, Category=Adversarial Fine-tuning2026.01 | 64.3 | 68.6 | — | |
| TeCoAFine-tuned on=ImageNet2026.03 | 61.9 | — | — | |
| LPFBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 61.7 | 88.3 | — | |
| FAREBackbone=CLIP-B/32, Category=Adversarial Fine-tuning2026.01 | 61.6 | 67.5 | — | |
| Anti-AdvBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 61.1 | 91.7 | — | |
| R-TPTBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 60.2 | 84.2 | — | |
| TTCmode=Test-time Defense, attack=10-step PGD, epsilon=1/2552025.11 | 57.87 | 83.35 | — | |
| TTCmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 57.15 | 83.35 | — | |
| TTEmode=Test-time Defense, attack=10-step PGD, epsilon=1/2552025.11 | 50.33 | 88.13 | — | |
| CSRBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 49.4 | 83.9 | — | |
| TTCBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 46.8 | 84.8 | — | |
| ATACAttack Strategy=Avoid, Epsilon=4/255, Running time (s)=0.6552025.11 | 45.83 | — | — | |
| R-TPTDefense Category=Test-time Defense2025.11 | 44.15 | 84.46 | — | |
| PMG-AFTmode=Adversarial Finetuning, attack=10-step PGD, epsilon=1/2552025.11 | 41.18 | 65.88 | — | |
| FAPShots=16, Training Epochs=10, Training Attack (PGD)=2-step (1/255), Evaluation Attack (PGD-100)=100-step (1/255)2026.05 | 41 | 81.9 | — | |
| PMG-AFTmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 39.28 | 65.88 | — | |
| TeCoAmode=Adversarial Finetuning, attack=10-step PGD, epsilon=1/2552025.11 | 38.35 | 62.12 | — | |
| TeCoAmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 37.91 | 62.12 | — | |
| AdvMaPLeShots=16, Training Epochs=10, Training Attack (PGD)=2-step (1/255), Evaluation Attack (PGD-100)=100-step (1/255)2026.05 | 36.87 | 83.27 | — | |
| TTEBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 36 | 90.1 | — | |
| AdvVLPShots=16, Training Epochs=10, Training Attack (PGD)=2-step (1/255), Evaluation Attack (PGD-100)=100-step (1/255)2026.05 | 35.57 | 82.93 | — | |
| FAREmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 33.85 | 79.37 | — | |
| FAREmode=Adversarial Finetuning, attack=10-step PGD, epsilon=1/2552025.11 | 31.07 | 79.37 | — | |
| TTCBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 30.7 | 82.2 | — | |
| LPFBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 25.2 | 74.6 | — | |
| TTEBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 24.8 | 81.7 | — | |
| TTCDefense Category=Test-time Defense2025.11 | 24.64 | 64.7 | — | |
| TTCAttack Strategy=PGD, Epsilon=4/2552025.11 | 24.64 | — | — | |
| Anti-advmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 22.99 | 80.62 | — | |
| Anti-AdvBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 19.9 | 83.6 | — | |
| AdvVPShots=16, Training Epochs=10, Training Attack (PGD)=2-step (1/255), Evaluation Attack (PGD-100)=100-step (1/255)2026.05 | 16.43 | 56.4 | — | |
| HDBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 13.9 | 90.5 | — | |
| ATACAttack Strategy=Lure, Epsilon=4/255, Running time (s)=0.6512025.11 | 10.83 | — | — | |
| HPT-GPDEvaluation Protocol=Zero-shot, Attack Strategy=AutoAttack, Perturbation Budget=1/2552026.01 | 10.06 | — | — | |
| SAFT-LAttack=PGD-100, Epsilon=4/255, Evaluation Protocol=Zero-shot2026.02 | 7.2 | — | — | |
| TGA-ZSRAttack=PGD-100, Epsilon=4/255, Evaluation Protocol=Zero-shot2026.02 | 6.8 | — | — | |
| HDBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 6.4 | 84.2 | — | |
| PMG-AFTDefense Category=Adversarial Finetuning2025.11 | 5.1 | 56.66 | — | |
| TeCoADefense Category=Adversarial Finetuning2025.11 | 3.71 | 53.94 | — | |
| TTEDefense Category=Test-time Defense2025.11 | 3.18 | 88.13 | — | |
| PMG-AFTAttack=PGD-100, Epsilon=4/255, Evaluation Protocol=Zero-shot2026.02 | 2.73 | — | — | |
| CLIPMode=Zero-shot2026.03 | 2.37 | — | — | |
| CLIP-FTmode=Adversarial Finetuning, attack=10-step PGD, epsilon=1/2552025.11 | 2.1 | 84.14 | — | |
| TTCAttack Strategy=Avoid, Epsilon=4/255, Running time (s)=0.1142025.11 | 1.67 | — | — | |
| CLIP-FTDefense Category=Adversarial Finetuning2025.11 | 1.66 | 84.14 | — | |
| CLIPmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 1.64 | 87.44 | — | |
| TeCoAAttack=PGD-100, Epsilon=4/255, Evaluation Protocol=Zero-shot2026.02 | 1.25 | — | — | |
| CLIP-FTmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 1.14 | 84.14 | — | |
| CLIPattack=10-step PGD, epsilon=1/2552025.11 | 1.04 | 87.44 | — | |
| PMGEvaluation Protocol=Zero-shot, Attack Strategy=AutoAttack, Perturbation Budget=1/2552026.01 | 0.63 | — | — | |
| CLIPBackbone=CLIP-L/14, Method category=Original2026.01 | 0.3 | 93.5 | — | |
| FAREDefense Category=Adversarial Finetuning2025.11 | 0.3 | 70.1 | — | |
| CLIPBackbone=CLIP-B/32, Category=Original2026.01 | 0.2 | 84.2 | — | |
| CLIPEvaluation Protocol=Zero-shot, Attack Strategy=AutoAttack, Perturbation Budget=1/2552026.01 | 0 | — | — | |
| CLIPDefense Category=None2025.11 | 0 | 87.44 | — | |
| TTCAttack Strategy=Lure, Epsilon=4/255, Running time (s)=0.1492025.11 | 0 | — | — | |
| AGFTBackbone=ViT-B/32, Evaluation Protocol=Zero-shot, Training Strategy=Adversarially fine-tuned2026.03 | — | 85.58 | — | |
| CLIPBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=02026.01 | — | 86.95 | 8.98 | |
| CLIPBackbone=ViT-B/32, Evaluation Protocol=Zero-shot2026.03 | — | 87.32 | — | |
| FT-StandardBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=4062026.01 | — | 75 | 1.56 | |
| FT-TeCoABackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=11122026.01 | — | 70.31 | 28.13 | |
| GLADIATORBackbone=ViT-B/32, Evaluation Protocol=Zero-shot, Training Strategy=Adversarially fine-tuned2026.03 | — | 84.25 | — | |
| HPT-GPDBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=14862026.01 | — | 81.68 | 50.45 | |
| PMGBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=18172026.01 | — | 84.46 | 42 | |
| PMG-AFTBackbone=ViT-B/32, Evaluation Protocol=Zero-shot, Training Strategy=Adversarially fine-tuned2026.03 | — | 82.58 | — | |
| TeCoABackbone=ViT-B/32, Evaluation Protocol=Zero-shot, Training Strategy=Adversarially fine-tuned2026.03 | — | 82.01 | — | |
| TGA-ZSRBackbone=ViT-B/32, Evaluation Protocol=Zero-shot, Training Strategy=Adversarially fine-tuned2026.03 | — | 79.91 | — |