Image Classification on StanfordCars (Clean/Robust Accuracy)
70.8Robust AccuracyATAC
Evaluation results
| Method | Links | ||||||
|---|---|---|---|---|---|---|---|
| ATACDefense Category=Test-time Defense2025.11 | 70.8 | 51.41 | — | — | — | — | |
| ATACAttack Strategy=PGD, Epsilon=4/2552025.11 | 70.8 | — | — | — | — | — | |
| CSRBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 65.1 | 76.9 | — | — | — | — | |
| R-TPTBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 59.8 | 77.5 | — | — | — | — | |
| FAREBackbone=CLIP-L/14, Method category=Adversarial Fine-tuning2026.01 | 52.3 | 64.7 | — | — | — | — | |
| FAREBackbone=CLIP-B/32, Category=Adversarial Fine-tuning2026.01 | 52.1 | 60.3 | — | — | — | — | |
| CLBPmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 47.68 | 60.05 | — | — | — | — | |
| R-TPTmode=Test-time Defense, attack=10-step PGD, epsilon=1/2552025.11 | 43.75 | 61.75 | — | — | — | — | |
| SCCmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 37.96 | 51.19 | — | — | — | — | |
| LPFBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 33.9 | 67.6 | — | — | — | — | |
| TTCmode=Test-time Defense, attack=10-step PGD, epsilon=1/2552025.11 | 33.01 | 48.16 | — | — | — | — | |
| Anti-AdvBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 31.6 | 76.8 | — | — | — | — | |
| TTCmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 30.38 | 48.16 | — | — | — | — | |
| TTCBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 30.3 | 61.9 | — | — | — | — | |
| PMG-AFTAttack=PGD-100, Epsilon=4/255, Evaluation Protocol=Zero-shot2026.02 | 29 | — | — | — | — | — | |
| R-TPTBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 28.1 | 60.2 | — | — | — | — | |
| AGFTFine-tuned on=ImageNet2026.03 | 27.34 | — | — | — | — | — | |
| ATACmode=Test-time Defense, attack=10-step PGD, epsilon=1/2552025.11 | 27.12 | 51.45 | — | — | — | — | |
| TTEBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 26.6 | 51.2 | — | — | — | — | |
| CSRBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 25.4 | 59.6 | — | — | — | — | |
| TeCoABackbone=CLIP-L/14, Method category=Adversarial Fine-tuning2026.01 | 24.7 | 34.5 | — | — | — | — | |
| TTEmode=Test-time Defense, attack=10-step PGD, epsilon=1/2552025.11 | 22.36 | 52.73 | — | — | — | — | |
| Comp-TGAProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 22.17 | — | — | — | — | — | |
| TTEBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 21.4 | 73.4 | — | — | — | — | |
| R-TPTDefense Category=Test-time Defense2025.11 | 20.76 | 61.75 | — | — | — | — | |
| GLADIATORFine-tuned on=ImageNet2026.03 | 20.65 | — | — | — | — | — | |
| TeCoABackbone=CLIP-B/32, Category=Adversarial Fine-tuning2026.01 | 20.5 | 26.1 | — | — | — | — | |
| TGA-ZSRProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 20.4 | — | — | — | — | — | |
| PMG-AFTFine-tuned on=ImageNet2026.03 | 20.33 | — | — | — | — | — | |
| Comp-TGAMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 20.07 | — | — | — | — | — | |
| ATACAttack Strategy=Avoid, Epsilon=4/255, Running time (s)=0.6522025.11 | 18.33 | — | — | — | — | — | |
| TGA-ZSRMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 17.26 | — | — | — | — | — | |
| TTCBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 16.3 | 49 | — | — | — | — | |
| TGA-ZSRAttack=PGD-100, Epsilon=4/255, Evaluation Protocol=Zero-shot2026.02 | 16 | — | — | — | — | — | |
| TGA-ZSRFine-tuned on=ImageNet2026.03 | 14.78 | — | — | — | — | — | |
| TeCoAFine-tuned on=ImageNet2026.03 | 14.06 | — | — | — | — | — | |
| TTCDefense Category=Test-time Defense2025.11 | 12.84 | 41.52 | — | — | — | — | |
| TTCAttack Strategy=PGD, Epsilon=4/2552025.11 | 12.84 | — | — | — | — | — | |
| TGA-ZSRZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | 12.71 | — | — | — | — | — | |
| Comp-TGAZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | 12.02 | — | — | — | — | — | |
| PMG-AFTProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 11.72 | — | — | — | — | — | |
| PMG-AFTmode=Adversarial Finetuning, attack=10-step PGD, epsilon=1/2552025.11 | 11.65 | 25.44 | — | — | — | — | |
| PMG-AFTZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | 11.06 | — | — | — | — | — | |
| PMG-AFTmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 10.53 | 25.44 | — | — | — | — | |
| PMG-AFTMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 10.12 | — | — | — | — | — | |
| SAFT-LAttack=PGD-100, Epsilon=4/255, Evaluation Protocol=Zero-shot2026.02 | 10 | — | — | — | — | — | |
| FAREmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 9.14 | 38.68 | — | — | — | — | |
| FAREZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | 8.86 | — | — | — | — | — | |
| TeCoAZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | 8.81 | — | — | — | — | — | |
| TeCoAmode=Adversarial Finetuning, attack=10-step PGD, epsilon=1/2552025.11 | 8.76 | 20.91 | — | — | — | — | |
| TeCoAmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 8.74 | 20.91 | — | — | — | — | |
| TeCoAMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 8.49 | — | — | — | — | — | |
| TeCoAProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 8.49 | — | — | — | — | — | |
| FT-Adv.Protocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 8.42 | — | — | — | — | — | |
| FT-Adv.Zero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | 8.38 | — | — | — | — | — | |
| Comp-TGAZero-shot=true2026.03 | 7.75 | — | — | — | — | — | |
| LAATZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | 7.28 | — | — | — | — | — | |
| FAREmode=Adversarial Finetuning, attack=10-step PGD, epsilon=1/2552025.11 | 6.75 | 38.68 | — | — | — | — | |
| TGA-ZSRZero-shot=true2026.03 | 6.73 | — | — | — | — | — | |
| LAATProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 6.6 | — | — | — | — | — | |
| FT-Adv.Mode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 6.11 | — | — | — | — | — | |
| HDBackbone=CLIP-L/14, Method category=Test-Time Defense2026.01 | 5.8 | 68.8 | — | — | — | — | |
| LAATMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 5.48 | — | — | — | — | — | |
| PMG-AFTZero-shot=true2026.03 | 5.4 | — | — | — | — | — | |
| PMGEvaluation Protocol=Zero-shot, Attack Strategy=AutoAttack, Perturbation Budget=1/2552026.01 | 5.18 | — | — | — | — | — | |
| LPFBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 5.1 | 44.4 | — | — | — | — | |
| Anti-AdvBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 4.9 | 58.1 | — | — | — | — | |
| Anti-advmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 4.76 | 36.21 | — | — | — | — | |
| FAREProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 4.38 | — | — | — | — | — | |
| FAREMode=Zero-shot, Attack=Adaptive Attack, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 4.32 | — | — | — | — | — | |
| ATACAttack Strategy=Lure, Epsilon=4/255, Running time (s)=0.6522025.11 | 4.17 | — | — | — | — | — | |
| TeCoAAttack=PGD-100, Epsilon=4/255, Evaluation Protocol=Zero-shot2026.02 | 4 | — | — | — | — | — | |
| CLIPZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | 3.89 | — | — | — | — | — | |
| FT-Adv.Zero-shot=true2026.03 | 3.8 | — | — | — | — | — | |
| TeCoAZero-shot=true2026.03 | 3.45 | — | — | — | — | — | |
| HDBackbone=CLIP-B/32, Category=Test-Time Defense2026.01 | 3.2 | 50.5 | — | — | — | — | |
| LAATZero-shot=true2026.03 | 2.97 | — | — | — | — | — | |
| FT-CleanZero-shot=true, Attack=APGD (epsilon=1/255)2026.03 | 2.41 | — | — | — | — | — | |
| CLIPmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 2.38 | 52.02 | — | — | — | — | |
| CLIP-FTmode=zero-shot, attack=CW-ℓ∞, epsilon_a=1/2552026.05 | 2.04 | 42.11 | — | — | — | — | |
| FAREZero-shot=true2026.03 | 1.48 | — | — | — | — | — | |
| TTEDefense Category=Test-time Defense2025.11 | 1.46 | 52.73 | — | — | — | — | |
| HPT-GPDEvaluation Protocol=Zero-shot, Attack Strategy=AutoAttack, Perturbation Budget=1/2552026.01 | 1.2 | — | — | — | — | — | |
| TeCoADefense Category=Adversarial Finetuning2025.11 | 0.41 | 15.18 | — | — | — | — | |
| PMG-AFTDefense Category=Adversarial Finetuning2025.11 | 0.4 | 16.79 | — | — | — | — | |
| CLIPMode=Zero-shot2026.03 | 0.21 | — | — | — | — | — | |
| CLIPBackbone=CLIP-L/14, Method category=Original2026.01 | 0.2 | 79.1 | — | — | — | — | |
| CLIPProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 0.2 | — | — | — | — | — | |
| CLIPZero-shot=true2026.03 | 0.11 | — | — | — | — | — | |
| CLIPEvaluation Protocol=Zero-shot, Attack Strategy=AutoAttack, Perturbation Budget=1/2552026.01 | 0.09 | — | — | — | — | — | |
| FT-CleanProtocol=Zero-shot, Attack=PGD, Epsilon=1/255, Training Dataset=Tiny-ImageNet2026.03 | 0.09 | — | — | — | — | — | |
| CLIP-FTmode=Adversarial Finetuning, attack=10-step PGD, epsilon=1/2552025.11 | 0.06 | 42.11 | — | — | — | — | |
| FAREDefense Category=Adversarial Finetuning2025.11 | 0.04 | 32.09 | — | — | — | — | |
| FT-CleanZero-shot=true2026.03 | 0.03 | — | — | — | — | — | |
| CLIPattack=10-step PGD, epsilon=1/2552025.11 | 0.02 | 52.02 | — | — | — | — | |
| CLIPBackbone=CLIP-B/32, Category=Original2026.01 | 0 | 59.9 | — | — | — | — | |
| CLIPDefense Category=None2025.11 | 0 | 52.02 | — | — | — | — | |
| CLIP-FTDefense Category=Adversarial Finetuning2025.11 | 0 | 42.11 | — | — | — | — | |
| TTCAttack Strategy=Lure, Epsilon=4/255, Running time (s)=0.1472025.11 | 0 | — | — | — | — | — | |
| TTCAttack Strategy=Avoid, Epsilon=4/255, Running time (s)=0.1222025.11 | 0 | — | — | — | — | — |