Robust Image Classification on FGVC
20.5Clean AccuracyCLIP
Evaluation Results
| Method | Links | |||
|---|---|---|---|---|
| CLIPBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=02026.01 | 20.5 | — | 0.39 | |
| CLIPYear=20212026.04 | 20.13 | — | — | |
| OursModel Configuration=5 trees2026.04 | 17.76 | — | — | |
| OursModel Configuration=1 tree2026.04 | 17.39 | — | — | |
| AoSYear=20252026.04 | 17 | — | — | |
| FAREYear=20242026.04 | 16.23 | — | — | |
| WISE-FTBackbone=ViT-B/32, Pre-training Dataset=ImageNet, Evaluation Protocol=Zero-shot2026.03 | 16.08 | — | 0 | |
| CLIPBackbone=ViT-B/32, Evaluation Protocol=Zero-shot2026.03 | 15.93 | — | 0 | |
| PMGBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=18172026.01 | 15.75 | — | 3.3 | |
| GRACEBackbone=ViT-B/32, Pre-training Dataset=ImageNet, Evaluation Protocol=Zero-shot2026.03 | 15.5 | — | 70 | |
| SPDBackbone=ViT-B/32, Pre-training Dataset=ImageNet, Evaluation Protocol=Zero-shot2026.03 | 15.03 | — | 0 | |
| PMG-FTYear=20242026.04 | 14.76 | — | — | |
| Vanilla FTBackbone=ViT-B/32, Pre-training Dataset=ImageNet, Evaluation Protocol=Zero-shot2026.03 | 14.16 | — | 0 | |
| HPT-GPDBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=14862026.01 | 14.07 | — | 3.69 | |
| TPGMBackbone=ViT-B/32, Pre-training Dataset=ImageNet, Evaluation Protocol=Zero-shot2026.03 | 13.86 | — | 0 | |
| TeCoAYear=20232026.04 | 12.15 | — | — | |
| FLYPBackbone=ViT-B/32, Pre-training Dataset=ImageNet, Evaluation Protocol=Zero-shot2026.03 | 11.76 | — | 0 | |
| FAREBackbone=ViT-B/32, Pre-training Dataset=ImageNet, Evaluation Protocol=Zero-shot2026.03 | 8.73 | — | 60 | |
| FT-StandardBackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=4062026.01 | 8.57 | — | 0 | |
| PMG-AFTBackbone=ViT-B/32, Pre-training Dataset=ImageNet, Evaluation Protocol=Zero-shot2026.03 | 7.9 | — | 80 | |
| FT-TeCoABackbone=ViT-B/32, Proxy CLIP=ViT-B/16, Attack Protocol=PGD-10, Training time per epoch (s)=11122026.01 | 7.81 | — | 3.13 | |
| LAATBackbone=ViT-B/32, Pre-training Dataset=ImageNet, Evaluation Protocol=Zero-shot2026.03 | 6.1 | — | 70 | |
| TeCoABackbone=ViT-B/32, Pre-training Dataset=ImageNet, Evaluation Protocol=Zero-shot2026.03 | 4.56 | — | 50 | |
| AGFTFine-tuned on=ImageNet2026.03 | — | 7.94 | — | |
| AoSZero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/2552026.04 | — | 8.03 | — | |
| CLIPEvaluation Protocol=Zero-shot, Attack Strategy=AutoAttack, Perturbation Budget=1/2552026.01 | — | 12 | — | |
| CLIPMode=Zero-shot2026.03 | — | 0 | — | |
| CLIPZero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/2552026.04 | — | 0 | — | |
| FAREZero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/2552026.04 | — | 4.3 | — | |
| GLADIATORFine-tuned on=ImageNet2026.03 | — | 6.23 | — | |
| HPT-GPDEvaluation Protocol=Zero-shot, Attack Strategy=AutoAttack, Perturbation Budget=1/2552026.01 | — | 33 | — | |
| OursZero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/2552026.04 | — | 8.58 | — | |
| Ours (5 trees)Zero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/255, Number of trees=52026.04 | — | 9.9 | — | |
| PMGEvaluation Protocol=Zero-shot, Attack Strategy=AutoAttack, Perturbation Budget=1/2552026.01 | — | 15 | — | |
| PMG-AFTFine-tuned on=ImageNet2026.03 | — | 5.93 | — | |
| PMG-FTZero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/2552026.04 | — | 6.06 | — | |
| TeCoAFine-tuned on=ImageNet2026.03 | — | 4.85 | — | |
| TeCoAZero-shot=true, Adversarial fine-tuning=ImageNet, PGD attack steps=20, Perturbation radius (epsilon)=1/2552026.04 | — | 5.88 | — | |
| TGA-ZSRFine-tuned on=ImageNet2026.03 | — | 4.85 | — |