Image Classification on SUN397 (Clean and Robust Accuracy)
34.16Robust AccuracyOurs (5 trees)
Evaluation Results
| Method | Links | |||
|---|---|---|---|---|
| Ours (5 trees)Zero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/255, Number of trees=52026.04 | 34.16 | — | — | |
| OursZero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/2552026.04 | 33.53 | — | — | |
| AoSZero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/2552026.04 | 32.46 | — | — | |
| TeCoAZero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/2552026.04 | 31.55 | — | — | |
| PMG-FTZero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/2552026.04 | 31.07 | — | — | |
| SAFT-LZero-shot evaluation=true, Adversarial Attack=PGD-100 (epsilon = 1/255), Backbone=ViT-B/322026.02 | 26.33 | 51.91 | — | |
| FAREZero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/2552026.04 | 25.59 | — | — | |
| SAFT-MZero-shot evaluation=true, Adversarial Attack=PGD-100 (epsilon = 1/255), Backbone=ViT-B/322026.02 | 23.62 | 53.08 | — | |
| TGA-ZSRZero-shot evaluation=true, Adversarial Attack=PGD-100 (epsilon = 1/255), Backbone=ViT-B/322026.02 | 23.29 | 50.16 | — | |
| PMG-AFTZero-shot evaluation=true, Adversarial Attack=PGD-100 (epsilon = 1/255), Backbone=ViT-B/322026.02 | 16.37 | 27.58 | — | |
| TeCoAZero-shot evaluation=true, Adversarial Attack=PGD-100 (epsilon = 1/255), Backbone=ViT-B/322026.02 | 16.23 | 34.53 | — | |
| FAREZero-shot evaluation=true, Adversarial Attack=PGD-100 (epsilon = 1/255), Backbone=ViT-B/322026.02 | 8.3 | 49.91 | — | |
| HPT-GPDEvaluation Protocol=Zero-shot, Attack Strategy=AutoAttack, Perturbation Budget=1/2552026.01 | 4.55 | — | — | |
| PMG-AFTAttack=PGD-100, Epsilon=4/255, Evaluation Protocol=Zero-shot2026.02 | 1.51 | — | — | |
| CLIPZero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/2552026.04 | 1.21 | — | — | |
| TGA-ZSRAttack=PGD-100, Epsilon=4/255, Evaluation Protocol=Zero-shot2026.02 | 1.1 | — | — | |
| CLIPZero-shot evaluation=true, Adversarial Attack=PGD-100 (epsilon = 1/255), Backbone=ViT-B/322026.02 | 0.82 | 46.8 | — | |
| SAFT-LAttack=PGD-100, Epsilon=4/255, Evaluation Protocol=Zero-shot2026.02 | 0.78 | — | — | |
| PMGEvaluation Protocol=Zero-shot, Attack Strategy=AutoAttack, Perturbation Budget=1/2552026.01 | 0.47 | — | — | |
| TeCoAAttack=PGD-100, Epsilon=4/255, Evaluation Protocol=Zero-shot2026.02 | 0.26 | — | — | |
| CLIPEvaluation Protocol=Zero-shot, Attack Strategy=AutoAttack, Perturbation Budget=1/2552026.01 | 0.07 | — | — | |
| AoSYear=20252026.04 | — | 55.94 | — | |
| CLIPYear=20212026.04 | — | 57.68 | — | |
| FAREYear=20242026.04 | — | 54.05 | — | |
| OursModel Configuration=1 tree2026.04 | — | 55.76 | — | |
| OursModel Configuration=5 trees2026.04 | — | 56.29 | — | |
| PMG-FTYear=20242026.04 | — | 53.55 | — | |
| TeCoAYear=20232026.04 | — | 48.67 | — |