Robust Image Classification on CIFAR-10
95.32Clean AccuracyRandomized Input Defense
Evaluation results
| Method | Links | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Randomized Input DefenseModel=ResNet50, Attack=None2023.10 | 95.32 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=ResNet50, Attack=None2023.10 | 95.21 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=VGG19, Attack=None2023.10 | 94.93 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=VGG19, Attack=None2023.10 | 94.92 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=VGG19, Attack=NES, M (EOT query samples)=5, QC (Query budget)=10002023.10 | 94.8 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=VGG19, Attack=NES, M (EOT query samples)=10, QC (Query budget)=10002023.10 | 94.5 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=VGG19, Attack=NES, M (EOT query samples)=10, QC (Query budget)=10002023.10 | 94.4 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=ResNet50, Attack=NES, M (EOT query samples)=5, QC (Query budget)=10002023.10 | 94 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=ResNet50, Attack=NES, M (EOT query samples)=10, QC (Query budget)=10002023.10 | 94 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=ResNet50, Attack=NES, M (EOT query samples)=10, QC (Query budget)=10002023.10 | 93.9 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=ResNet50, Attack=NES, M (EOT query samples)=5, QC (Query budget)=10002023.10 | 93.8 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=VGG19, Attack=NES, M (EOT query samples)=5, QC (Query budget)=10002023.10 | 93.4 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=ResNet50, Attack=NES, M (EOT query samples)=1, QC (Query budget)=10002023.10 | 92.4 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=VGG19, Attack=NES, M (EOT query samples)=1, QC (Query budget)=10002023.10 | 92.2 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=ResNet50, Attack=NES, M (EOT query samples)=1, QC (Query budget)=10002023.10 | 91.8 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=ResNet50, Attack=NES, M (EOT query samples)=5, QC (Query budget)=50002023.10 | 91.3 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=ResNet50, Attack=NES, M (EOT query samples)=5, QC (Query budget)=50002023.10 | 90.8 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=ResNet50, Attack=NES, M (EOT query samples)=10, QC (Query budget)=100002023.10 | 90.7 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=ResNet50, Attack=NES, M (EOT query samples)=10, QC (Query budget)=100002023.10 | 90.4 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=VGG19, Attack=NES, M (EOT query samples)=1, QC (Query budget)=10002023.10 | 89.5 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=VGG19, Attack=NES, M (EOT query samples)=5, QC (Query budget)=50002023.10 | 88.4 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=VGG19, Attack=NES, M (EOT query samples)=10, QC (Query budget)=100002023.10 | 86 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=VGG19, Attack=NES, M (EOT query samples)=5, QC (Query budget)=50002023.10 | 82.1 | — | — | — | — | — | — | — | |
| RoCL + TAROEvaluation type=Self-supervised linear evaluation, Attack Type=Lours-rocl, Backbone=ResNet182022.10 | 80.06 | — | 45.37 | 27.95 | — | — | — | — | |
| ACLEvaluation type=Self-supervised linear evaluation, Attack Type=Lacl, Backbone=ResNet182022.10 | 79.96 | — | 39.37 | 35.97 | — | — | — | — | |
| Randomized Input DefenseModel=VGG19, Attack=NES, M (EOT query samples)=10, QC (Query budget)=100002023.10 | 78.8 | — | — | — | — | — | — | — | |
| ACL + TAROEvaluation type=Self-supervised linear evaluation, Attack Type=Lours-acl, Backbone=ResNet182022.10 | 78.45 | — | 39.71 | 35.81 | — | — | — | — | |
| RoCLEvaluation type=Self-supervised linear evaluation, Attack Type=Lrocl, Backbone=ResNet182022.10 | 78.14 | — | 42.89 | 27.19 | — | — | — | — | |
| Randomized Feature DefenseModel=VGG19, Attack=Square, M (EOT query samples)=1, QC (Query budget)=10002023.10 | 61 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=ResNet50, Attack=Square, M (EOT query samples)=1, QC (Query budget)=10002023.10 | 54.5 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=VGG19, Attack=Square, M (EOT query samples)=5, QC (Query budget)=10002023.10 | 53 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=ResNet50, Attack=Square, M (EOT query samples)=1, QC (Query budget)=10002023.10 | 52.9 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=VGG19, Attack=Square, M (EOT query samples)=10, QC (Query budget)=10002023.10 | 46.7 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=VGG19, Attack=Square, M (EOT query samples)=5, QC (Query budget)=50002023.10 | 45.5 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=ResNet50, Attack=Square, M (EOT query samples)=5, QC (Query budget)=10002023.10 | 45.1 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=VGG19, Attack=SignHunt, M (EOT query samples)=1, QC (Query budget)=10002023.10 | 43.2 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=ResNet50, Attack=Square, M (EOT query samples)=5, QC (Query budget)=10002023.10 | 42 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=ResNet50, Attack=Square, M (EOT query samples)=5, QC (Query budget)=50002023.10 | 40.4 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=ResNet50, Attack=Square, M (EOT query samples)=10, QC (Query budget)=10002023.10 | 37.3 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=ResNet50, Attack=SignHunt, M (EOT query samples)=1, QC (Query budget)=10002023.10 | 35.1 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=ResNet50, Attack=Square, M (EOT query samples)=10, QC (Query budget)=10002023.10 | 35 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=ResNet50, Attack=Square, M (EOT query samples)=5, QC (Query budget)=50002023.10 | 34.8 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=VGG19, Attack=SignHunt, M (EOT query samples)=10, QC (Query budget)=10002023.10 | 31.7 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=VGG19, Attack=Square, M (EOT query samples)=1, QC (Query budget)=10002023.10 | 30.6 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=VGG19, Attack=Square, M (EOT query samples)=10, QC (Query budget)=10002023.10 | 30.2 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=ResNet50, Attack=SignHunt, M (EOT query samples)=1, QC (Query budget)=10002023.10 | 29.9 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=VGG19, Attack=SignHunt, M (EOT query samples)=5, QC (Query budget)=10002023.10 | 27.1 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=VGG19, Attack=Square, M (EOT query samples)=5, QC (Query budget)=10002023.10 | 24.2 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=VGG19, Attack=SignHunt, M (EOT query samples)=10, QC (Query budget)=10002023.10 | 23.3 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=VGG19, Attack=Square, M (EOT query samples)=10, QC (Query budget)=100002023.10 | 23.1 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=VGG19, Attack=SignHunt, M (EOT query samples)=5, QC (Query budget)=50002023.10 | 23 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=VGG19, Attack=SignHunt, M (EOT query samples)=1, QC (Query budget)=10002023.10 | 22.7 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=ResNet50, Attack=SignHunt, M (EOT query samples)=10, QC (Query budget)=10002023.10 | 21.5 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=ResNet50, Attack=Square, M (EOT query samples)=10, QC (Query budget)=100002023.10 | 21.1 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=ResNet50, Attack=SignHunt, M (EOT query samples)=10, QC (Query budget)=10002023.10 | 21.1 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=ResNet50, Attack=SignHunt, M (EOT query samples)=5, QC (Query budget)=10002023.10 | 17.6 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=ResNet50, Attack=SignHunt, M (EOT query samples)=5, QC (Query budget)=10002023.10 | 17.3 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=VGG19, Attack=SignHunt, M (EOT query samples)=10, QC (Query budget)=100002023.10 | 17 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=ResNet50, Attack=SignHunt, M (EOT query samples)=5, QC (Query budget)=50002023.10 | 16.4 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=VGG19, Attack=SignHunt, M (EOT query samples)=5, QC (Query budget)=10002023.10 | 15.9 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=ResNet50, Attack=SignHunt, M (EOT query samples)=5, QC (Query budget)=50002023.10 | 13.5 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=ResNet50, Attack=Square, M (EOT query samples)=10, QC (Query budget)=100002023.10 | 13.3 | — | — | — | — | — | — | — | |
| Randomized Feature DefenseModel=ResNet50, Attack=SignHunt, M (EOT query samples)=10, QC (Query budget)=100002023.10 | 11.3 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=VGG19, Attack=Square, M (EOT query samples)=5, QC (Query budget)=50002023.10 | 10.5 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=VGG19, Attack=SignHunt, M (EOT query samples)=5, QC (Query budget)=50002023.10 | 10.4 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=ResNet50, Attack=SignHunt, M (EOT query samples)=10, QC (Query budget)=100002023.10 | 9.4 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=VGG19, Attack=SignHunt, M (EOT query samples)=10, QC (Query budget)=100002023.10 | 7.6 | — | — | — | — | — | — | — | |
| Randomized Input DefenseModel=VGG19, Attack=Square, M (EOT query samples)=10, QC (Query budget)=100002023.10 | 3.2 | — | — | — | — | — | — | — | |
| AAOptBackbone=WRN-28-10, EOT=20, Attack Type=transfer-DiffBreak low-frequency (LF)2026.05 | — | 93.2 | — | — | — | — | — | — | |
| AdamWNorm=ℓ∞ + ℓ1, Checkpoint=Best, Backbone=WRN-34-102026.05 | — | — | — | — | 39.47 | 40.64 | 61.38 | 61.05 | |
| AdamWNorm=ℓ∞ + ℓ1, Checkpoint=Last, Backbone=WRN-34-102026.05 | — | — | — | — | 37.89 | 39.02 | 62.8 | 62.44 | |
| AdamWNorm=ℓ∞, Checkpoint=Best, Backbone=WRN-34-102026.05 | — | — | — | — | 44.56 | 43.93 | 51.65 | 50.63 | |
| AdamWNorm=ℓ∞, Checkpoint=Last, Backbone=WRN-34-102026.05 | — | — | — | — | 44.21 | 43.92 | 50.87 | 49.89 | |
| AdamWNorm=ℓ1, Checkpoint=Best, Backbone=WRN-34-102026.05 | — | — | — | — | 25.42 | 26.1 | 52.07 | 51.42 | |
| AdamWNorm=ℓ1, Checkpoint=Last, Backbone=WRN-34-102026.05 | — | — | — | — | 23.29 | 26.12 | 56.51 | 56.57 | |
| AdamWNorm=ℓ2, Checkpoint=Best, Backbone=WRN-34-102026.05 | — | — | — | — | 25.54 | 27.19 | 53.4 | 53.03 | |
| AdamWNorm=ℓ2, Checkpoint=Last, Backbone=WRN-34-102026.05 | — | — | — | — | 23.75 | 25.18 | 61.53 | 62.36 | |
| DiffPure-EDMBackbone=WRN-28-10, EOT=20, Attack Type=transfer-DiffBreak low-frequency (LF)2026.05 | — | 0 | — | — | — | — | — | — | |
| MuonNorm=ℓ∞ + ℓ1, Checkpoint=Best, Backbone=WRN-34-102026.05 | — | — | — | — | 41.98 | 41.14 | 60.19 | 58.93 | |
| MuonNorm=ℓ∞ + ℓ1, Checkpoint=Last, Backbone=WRN-34-102026.05 | — | — | — | — | 39.43 | 39.69 | 65.35 | 65.48 | |
| MuonNorm=ℓ∞, Checkpoint=Best, Backbone=WRN-34-102026.05 | — | — | — | — | 49.41 | 48.8 | 60.48 | 59.53 | |
| MuonNorm=ℓ∞, Checkpoint=Last, Backbone=WRN-34-102026.05 | — | — | — | — | 44.81 | 45.05 | 54.72 | 55.12 | |
| MuonNorm=ℓ1, Checkpoint=Best, Backbone=WRN-34-102026.05 | — | — | — | — | 27.2 | 28.89 | 60.53 | 59.87 | |
| MuonNorm=ℓ1, Checkpoint=Last, Backbone=WRN-34-102026.05 | — | — | — | — | 22.5 | 22.77 | 63.32 | 63.48 | |
| MuonNorm=ℓ2, Checkpoint=Best, Backbone=WRN-34-102026.05 | — | — | — | — | 28.77 | 28.96 | 68.33 | 68.59 | |
| MuonNorm=ℓ2, Checkpoint=Last, Backbone=WRN-34-102026.05 | — | — | — | — | 28.85 | 29.04 | 68.76 | 68.99 | |
| PMG-AFTAttack=PGD-100, Epsilon=4/255, Evaluation Protocol=Zero-shot2026.02 | — | 3.77 | — | — | — | — | — | — | |
| SAFT-LAttack=PGD-100, Epsilon=4/255, Evaluation Protocol=Zero-shot2026.02 | — | 19.09 | — | — | — | — | — | — | |
| SGDNorm=ℓ∞ + ℓ1, Checkpoint=Best, Backbone=WRN-34-102026.05 | — | — | — | — | 40.48 | 40.6 | 64.59 | 63.73 | |
| SGDNorm=ℓ∞ + ℓ1, Checkpoint=Last, Backbone=WRN-34-102026.05 | — | — | — | — | 33.3 | 33.89 | 61.91 | 61.98 | |
| SGDNorm=ℓ∞, Checkpoint=Best, Backbone=WRN-34-102026.05 | — | — | — | — | 46.53 | 46.35 | 59.66 | 58.65 | |
| SGDNorm=ℓ∞, Checkpoint=Last, Backbone=WRN-34-102026.05 | — | — | — | — | 38.68 | 39.34 | 54.03 | 54.25 | |
| SGDNorm=ℓ1, Checkpoint=Best, Backbone=WRN-34-102026.05 | — | — | — | — | 22.24 | 21.26 | 38.47 | 37.33 | |
| SGDNorm=ℓ1, Checkpoint=Last, Backbone=WRN-34-102026.05 | — | — | — | — | 18.85 | 18.89 | 58.27 | 58.55 | |
| SGDNorm=ℓ2, Checkpoint=Best, Backbone=WRN-34-102026.05 | — | — | — | — | 24.1 | 25.48 | 55.21 | 54.72 | |
| SGDNorm=ℓ2, Checkpoint=Last, Backbone=WRN-34-102026.05 | — | — | — | — | 23.47 | 23.44 | 62.58 | 62.77 | |
| TARO-2-AABackbone=WRN-28-10, EOT=20, Attack Type=transfer-DiffBreak low-frequency (LF)2026.05 | — | 94.7 | — | — | — | — | — | — | |
| TeCoAAttack=PGD-100, Epsilon=4/255, Evaluation Protocol=Zero-shot2026.02 | — | 0.29 | — | — | — | — | — | — | |
| TGA-ZSRAttack=PGD-100, Epsilon=4/255, Evaluation Protocol=Zero-shot2026.02 | — | 12.04 | — | — | — | — | — | — |