Robust Image Classification on CIFAR-10 512-image subset (test)
95.9Clean AccuracyAT-EDM-l2
Evaluation results
| Method | Links | ||||||
|---|---|---|---|---|---|---|---|
| AT-EDM-l2Architecture=WRN70-162023.05 | 95.9 | 53.32 | 84.77 | 5.08 | 47.72 | — | |
| HybViTArchitecture=ViT2023.05 | 95.9 | 0 | 0 | 0 | 0 | — | |
| Base ClassifierType=Base Classifier, Architecture=WRN-28-102023.07 | 95.32 | — | — | — | 0 | — | |
| SBGCArchitecture=UNet2023.05 | 95.04 | 0 | 0 | 0 | 0 | — | |
| Song et al.Type=Adversarial Purification, Architecture=ResNet622023.07 | 95 | — | — | — | 9 | 52 | |
| Yang et al.Type=Adversarial Purification, Architecture=ResNet182023.07 | 94.8 | — | — | — | 40.8 | 67.8 | |
| DCArchitecture=UNet2023.05 | 93.55 | 35.94 | 76.95 | 93.55 | 68.81 | — | |
| Wang et al.Type=Adversarial Purification, Architecture=WRN-28-102023.07 | 93.5 | — | — | — | 79.83 | 86.67 | |
| ScoreOpt-NType=Adversarial Purification, Architecture=WRN-28-102023.07 | 93.44 | — | — | — | 90.59 | 92.02 | |
| AT-EDM-l_infArchitecture=WRN70-162023.05 | 93.36 | 70.9 | 69.73 | 2.93 | 47.85 | — | |
| AT-DDPM-l2Architecture=WRN70-162023.05 | 93.16 | 49.41 | 81.05 | 5.27 | 45.24 | — | |
| JEMArchitecture=WRN28-102023.05 | 92.9 | 8.2 | 26.37 | 0.05 | 11.54 | — | |
| DiffPureArchitecture=UNet+WRN70-16, t*=0.12023.05 | 90.97 | 44.53 | 72.65 | 12.89 | 43.35 | — | |
| ScoreOpt-OType=Adversarial Purification, Architecture=WRN-28-102023.07 | 90.78 | — | — | — | 82.85 | 86.82 | |
| RDC (LM+DC)Architecture=UNet2023.05 | 89.85 | 75.67 | 82.03 | 89.45 | 82.38 | — | |
| Carmon et al.Type=Adversarial Training, Architecture=WRN-28-102023.07 | 89.67 | — | — | — | 63.1 | 76.39 | |
| Gowal et al.Type=Adversarial Training, Architecture=WRN-28-102023.07 | 89.48 | — | — | — | 64.08 | 77.28 | |
| Nie et al.Type=Adversarial Purification, Architecture=WRN-28-102023.07 | 89.02 | — | — | — | 81.4 | 85.21 | |
| AT-DDPM-l_infArchitecture=WRN70-162023.05 | 88.87 | 63.28 | 64.65 | 4.88 | 44.27 | — | |
| LMArchitecture=UNet+WRN70-162023.05 | 87.89 | 71.68 | 75 | 87.5 | 78.06 | — | |
| DiffPureArchitecture=UNet+WRN70-16, t*=0.1252023.05 | 87.5 | 40.62 | 75.59 | 12.89 | 43.03 | — | |
| Madry et al.Type=Adversarial Training, Architecture=ResNet182023.07 | 87.3 | — | — | — | 45.8 | 66.55 | |
| Yoon et al.Type=Adversarial Purification, Architecture=WRN-28-102023.07 | 86.14 | — | — | — | 70.01 | 78.08 | |
| Zhang et al.Type=Adversarial Training, Architecture=ResNet182023.07 | 84.9 | — | — | — | 45.8 | 65.35 | |
| Hill et al.Type=Adversarial Purification, Architecture=WRN-28-102023.07 | 84.12 | — | — | — | 54.9 | 69.51 | |
| PAT-selfArchitecture=AlexNet2023.05 | 75.59 | 47.07 | 64.06 | 39.65 | 50.26 | — |