Robust Image Classification on GTSRB
99.43Natural AccuracyNatural
Evaluation results
| Method | Links | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| NaturalApproach=Natural2019.11 | 99.43 | 68.74 | 76.48 | 19.9 | — | — | — | — | — | — | — | |
| MarksmanPoisoning rate=50%2022.10 | 98.6 | — | — | — | 0.1 | 99.9 | — | — | — | — | — | |
| ARTApproach=ART2019.11 | 98.47 | 91.96 | 89.34 | 84.66 | — | — | — | — | — | — | — | |
| PGD-7Approach=PGD-7, Attack Steps=72019.11 | 98.36 | 86.13 | 88.42 | 87.49 | — | — | — | — | — | — | — | |
| MarksmanPoisoning Rate=10%2022.10 | 97.9 | — | — | — | 1 | 99.7 | — | — | — | — | — | |
| IG NormApproach=IG Norm2019.11 | 97.02 | 74.81 | 75.55 | 75.24 | — | — | — | — | — | — | — | |
| UndefendedBackbone=ResNet182022.02 | 96.93 | — | — | — | — | 97.4 | — | — | — | — | — | |
| UndefendedBackbone=ResNet182022.02 | 96.67 | — | — | — | — | 99.84 | — | — | — | — | — | |
| NONEBackbone=ResNet182022.02 | 96.63 | — | — | — | — | 0.91 | — | — | — | — | — | |
| NADBackbone=NiN2022.02 | 96.53 | — | — | — | — | 26.15 | — | — | — | — | — | |
| NADBackbone=NiN2022.02 | 96.46 | — | — | — | — | 9.9 | — | — | — | — | — | |
| NONEBackbone=ResNet182022.02 | 96.39 | — | — | — | — | 0.76 | — | — | — | — | — | |
| NADBackbone=VGG162022.02 | 96.33 | — | — | — | — | 81.43 | — | — | — | — | — | |
| ABLBackbone=ResNet182022.02 | 96.24 | — | — | — | — | 0.93 | — | — | — | — | — | |
| WaNetMTPoisoning rate=50%2022.10 | 96.2 | — | — | — | 3.2 | 99.9 | — | — | — | — | — | |
| ABLBackbone=NiN2022.02 | 96.14 | — | — | — | — | 99.54 | — | — | — | — | — | |
| ABLBackbone=NiN2022.02 | 96.14 | — | — | — | — | 99.54 | — | — | — | — | — | |
| UndefendedBackbone=NiN2022.02 | 96.06 | — | — | — | — | 93.74 | — | — | — | — | — | |
| NONEBackbone=NiN2022.02 | 95.99 | — | — | — | — | 0.96 | — | — | — | — | — | |
| UndefendedBackbone=NiN2022.02 | 95.95 | — | — | — | — | 99.72 | — | — | — | — | — | |
| NADBackbone=ResNet182022.02 | 95.95 | — | — | — | — | 13.18 | — | — | — | — | — | |
| NADBackbone=VGG162022.02 | 95.94 | — | — | — | — | 86.1 | — | — | — | — | — | |
| PatchMTPoisoning Rate=10%2022.10 | 95.8 | — | — | — | 3.1 | 37.6 | — | — | — | — | — | |
| ACBackbone=ResNet182022.02 | 95.74 | — | — | — | — | 1.16 | — | — | — | — | — | |
| UndefendedBackbone=VGG162022.02 | 95.71 | — | — | — | — | 94.57 | — | — | — | — | — | |
| IG-SUM NormApproach=IG-SUM Norm2019.11 | 95.68 | 74.04 | 76.84 | 77.12 | — | — | — | — | — | — | — | |
| NONEBackbone=NiN2022.02 | 95.51 | — | — | — | — | 0.87 | — | — | — | — | — | |
| NONEBackbone=VGG162022.02 | 95.49 | — | — | — | — | 1.65 | — | — | — | — | — | |
| NADBackbone=ResNet182022.02 | 95.49 | — | — | — | — | 11.13 | — | — | — | — | — | |
| UndefendedBackbone=VGG162022.02 | 95.43 | — | — | — | — | 99.93 | — | — | — | — | — | |
| ACBackbone=NiN2022.02 | 95.36 | — | — | — | — | 99.52 | — | — | — | — | — | |
| WaNetMTPoisoning Rate=10%2022.10 | 95.3 | — | — | — | 4.1 | 1.2 | — | — | — | — | — | |
| RefoolMTPoisoning Rate=10%2022.10 | 95.1 | — | — | — | 4.3 | 80.2 | — | — | — | — | — | |
| ACBackbone=VGG162022.02 | 94.96 | — | — | — | — | 69.22 | — | — | — | — | — | |
| NONEBackbone=VGG162022.02 | 94.66 | — | — | — | — | 0.96 | — | — | — | — | — | |
| ACBackbone=ResNet182022.02 | 94.64 | — | — | — | — | 98.57 | — | — | — | — | — | |
| ABLBackbone=VGG162022.02 | 94.32 | — | — | — | — | 80.21 | — | — | — | — | — | |
| PatchMTPoisoning rate=50%2022.10 | 94.3 | — | — | — | 5.1 | 99.3 | — | — | — | — | — | |
| ABLBackbone=VGG162022.02 | 94.06 | — | — | — | — | 95.79 | — | — | — | — | — | |
| ACBackbone=NiN2022.02 | 94.02 | — | — | — | — | 6.17 | — | — | — | — | — | |
| ACBackbone=VGG162022.02 | 91.28 | — | — | — | — | 5.28 | — | — | — | — | — | |
| RefoolMTPoisoning rate=50%2022.10 | 90.9 | — | — | — | 8.5 | 97.7 | — | — | — | — | — | |
| ABLBackbone=ResNet182022.02 | 90.24 | — | — | — | — | 93.93 | — | — | — | — | — | |
| MarksmanPost-training Defense Method=Adversarial Neuron Pruning (ANP)2022.10 | 89 | — | — | — | — | 65.1 | — | — | — | — | — | |
| No Def. PoisonAttack Type=DRUPE2024.11 | 85.6 | — | — | — | — | 99.46 | — | — | — | — | — | |
| No Def. CleanAttack Type=No Attack2024.11 | 85.25 | — | — | — | — | 10.85 | — | — | — | — | — | |
| No Def. PoisonAttack Type=No Attack2024.11 | 85.14 | — | — | — | — | 19.16 | — | — | — | — | — | |
| ASSETAttack Type=BadEncoder2024.11 | 83.24 | — | — | — | — | 54.67 | — | — | — | — | — | |
| DeDeAttack Type=BadEncoder2024.11 | 82.86 | — | — | — | — | 2.99 | — | — | — | — | — | |
| No Def. CleanAttack Type=BadEncoder2024.11 | 82.26 | — | — | — | — | 97.27 | — | — | — | — | — | |
| No Def. PoisonAttack Type=BadEncoder2024.11 | 82.03 | — | — | — | — | 99.36 | — | — | — | — | — | |
| No Def. CleanAttack Type=DRUPE2024.11 | 81.6 | — | — | — | — | 97.03 | — | — | — | — | — | |
| ASSETAttack Type=DRUPE2024.11 | 80.85 | — | — | — | — | 54.07 | — | — | — | — | — | |
| DeDeAttack Type=DRUPE2024.11 | 80.46 | — | — | — | — | 0.91 | — | — | — | — | — | |
| No AttackAttack Type=None2024.05 | 80.32 | — | — | — | — | — | — | — | — | — | — | |
| No Def. CleanAttack Type=BadCLIP2024.11 | 79.74 | — | — | — | — | 11.69 | — | — | — | — | — | |
| LoricaBackbone=ViT-T/162025.06 | 79.21 | — | — | 68.84 | — | — | — | — | 70.13 | 71.06 | 71.2 | |
| No Def. PoisonAttack Type=BadCLIP2024.11 | 76.99 | — | — | — | — | 98.59 | — | — | — | — | — | |
| SylvaBackbone=ViT-T/162025.06 | 76.9 | — | — | 68.9 | — | — | — | — | 68.75 | 69.93 | 69.03 | |
| DeDeAttack Type=BadCLIP2024.11 | 76.2 | — | — | — | — | 30.6 | — | — | — | — | — | |
| ASSETAttack Type=BadCLIP2024.11 | 76.19 | — | — | — | — | 98.38 | — | — | — | — | — | |
| FP-Gen-AFFederated Strategy=FedProx, Local Defense=Gen-AF, Backbone=ViT-T/162025.06 | 75.92 | — | — | 66.48 | — | — | — | — | 66.1 | 67.75 | 69.71 | |
| DBFATBackbone=ViT-T/162025.06 | 75.4 | — | — | 65.53 | — | — | — | — | 65.38 | 66.75 | 68.95 | |
| FA-Gen-AFFederated Strategy=FedAvg, Local Defense=Gen-AF, Backbone=ViT-T/162025.06 | 74.85 | — | — | 66.1 | — | — | — | — | 65.49 | 67.5 | 68.1 | |
| No Def. CleanAttack Type=CLIP Backdoor2024.11 | 74.51 | — | — | — | — | 98.05 | — | — | — | — | — | |
| DeDeAttack Type=CLIP Backdoor2024.11 | 74.41 | — | — | — | — | 2.21 | — | — | — | — | — | |
| Per-LoRABackbone=ViT-T/162025.06 | 74.33 | — | — | 65.71 | — | — | — | — | 65.8 | 67.05 | 68.32 | |
| ASSETAttack Type=CLIP Backdoor2024.11 | 73.92 | — | — | — | — | 96.42 | — | — | — | — | — | |
| No Def. PoisonAttack Type=CTRL2024.11 | 73.9 | — | — | — | — | 91.57 | — | — | — | — | — | |
| No Def. PoisonAttack Type=CLIP Backdoor2024.11 | 73.76 | — | — | — | — | 97.24 | — | — | — | — | — | |
| FP-TRADESFederated Strategy=FedProx, Local Defense=TRADES, Backbone=ViT-T/162025.06 | 72.3 | — | — | 66.52 | — | — | — | — | 65.75 | 67.37 | 68.2 | |
| FA-TRADESFederated Strategy=FedAvg, Local Defense=TRADES, Backbone=ViT-T/162025.06 | 71.15 | — | — | 65.28 | — | — | — | — | 64.1 | 67.39 | 68.52 | |
| DeDeAttack Type=CTRL2024.11 | 68.61 | — | — | — | — | 4.43 | — | — | — | — | — | |
| No Def. CleanAttack Type=CTRL2024.11 | 67.48 | — | — | — | — | 64.26 | — | — | — | — | — | |
| ASSETAttack Type=CTRL2024.11 | 67.45 | — | — | — | — | 50.51 | — | — | — | — | — | |
| Per-AdvBackbone=ViT-T/162025.06 | 60.73 | — | — | 64.25 | — | — | — | — | 63.06 | 67.21 | 67.53 | |
| DP-SGDBackbone=ResNet182022.02 | 60.59 | — | — | — | — | 6.61 | — | — | — | — | — | |
| FP-PGD-ATFederated Strategy=FedProx, Local Defense=PGD-AT, Backbone=ViT-T/162025.06 | 59.15 | — | — | 65.45 | — | — | — | — | 64.38 | 68.23 | 67.9 | |
| DP-SGDBackbone=ResNet182022.02 | 55.73 | — | — | — | — | 90.88 | — | — | — | — | — | |
| FA-PGD-ATFederated Strategy=FedAvg, Local Defense=PGD-AT, Backbone=ViT-T/162025.06 | 55.73 | — | — | 64.25 | — | — | — | — | 63.52 | 69.12 | 68.22 | |
| DP-SGDBackbone=VGG162022.02 | 54.6 | — | — | — | — | 86.83 | — | — | — | — | — | |
| DP-SGDBackbone=VGG162022.02 | 53.9 | — | — | — | — | 6.71 | — | — | — | — | — | |
| DP-SGDBackbone=NiN2022.02 | 31.54 | — | — | — | — | 74.78 | — | — | — | — | — | |
| DP-SGDBackbone=NiN2022.02 | 24.7 | — | — | — | — | 7.39 | — | — | — | — | — | |
| MarksmanPost-training Defense Method=Neural Attention Distillation (NAD)2022.10 | 11.4 | — | — | — | — | 2.2 | — | — | — | — | — | |
| Authority BackdoorBackbone=ResNet-182025.12 | 9.4 | — | — | — | — | — | — | 98.55 | — | — | — | |
| AdvParamsBackbone=ResNet-182025.12 | 6.94 | — | — | — | — | — | — | 94.85 | — | — | — | |
| FGSM-Neuro-Symbolicepsilon (ε)=0.03, Training Attack=FGSM2026.01 | — | — | — | 42.68 | — | — | — | — | 63.1 | — | — | |
| FGSM-Neuro-Symbolicepsilon (ε)=0.5, Training Attack=FGSM2026.01 | — | — | — | 25 | — | — | — | — | 74 | — | — | |
| INACTIVEAttack Type=Backdoor Attack2024.05 | — | — | — | — | — | 96 | 82.84 | — | — | — | — | |
| ISSBAAttack Type=Backdoor Attack2024.05 | — | — | — | — | — | 5.1 | 66.29 | — | — | — | — | |
| LNL-MoEx-SModel Scale=S, Data Augmentation=True2026.01 | — | — | — | 59.4 | — | — | — | — | 77.8 | — | — | |
| LNL-MoEx-TiModel Scale=Ti, Data Augmentation=True2026.01 | — | — | — | 55.4 | — | — | — | — | 71.3 | — | — | |
| LNL-SModel Scale=S, Data Augmentation=False2026.01 | — | — | — | 45.7 | — | — | — | — | 64.5 | — | — | |
| LNL-TiModel Scale=Ti, Data Augmentation=False2026.01 | — | — | — | 37.9 | — | — | — | — | 57.7 | — | — | |
| PGD-Neuro-Symbolicepsilon (ε)=0.03, Training Attack=PGD2026.01 | — | — | — | 56 | — | — | — | — | 65.75 | — | — |