Zero-shot Image Classification on 16-dataset ZSAR Evaluation Suite
69.78TinyImageNet AccuracyTGA-ZSR
Evaluation results
| Method | Links | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TGA-ZSRAttack Protocol=Clean, Fine-tuning Dataset=TinyImageNet, Adversarial Training Protocol=10-step PGD, Attack Budget (epsilon)=2/2552025.12 | 69.78 | 83.98 | 52.32 | 91.36 | 44.7 | 50.17 | 72.55 | 45.05 | 26.92 | 27.58 | 10.68 | 41.84 | 80.04 | 71.94 | 33.14 | 50.02 | 53.25 | — | |
| UCATAttack Protocol=Clean, Fine-tuning Dataset=TinyImageNet, Adversarial Training Protocol=10-step PGD, Attack Budget (epsilon)=2/2552025.12 | 67.18 | 66.52 | 41.07 | 86.73 | 30.1 | 36.97 | 62.66 | 36.69 | 24.95 | 19.39 | 7.26 | 32.61 | 75 | 60.15 | 26.39 | 49.66 | 45.21 | — | |
| TeCoAAttack Protocol=Clean, Fine-tuning Dataset=TinyImageNet, Adversarial Training Protocol=10-step PGD, Attack Budget (epsilon)=2/2552025.12 | 63.2 | 58.62 | 31.75 | 80.59 | 25.71 | 19.15 | 49.25 | 24.61 | 17.34 | 15.89 | 2.88 | 24.7 | 63.04 | 47.67 | 13.11 | 49.97 | 36.72 | — | |
| CLIPAttack Protocol=Clean2025.12 | 57.96 | 88.02 | 60.47 | 97.03 | 57.26 | 83.89 | 87.38 | 65.52 | 40.69 | 42.65 | 20.16 | 59.15 | 85.33 | 81.73 | 51.98 | 52.08 | 64.46 | — | |
| PMG-AFTAttack Protocol=Clean, Fine-tuning Dataset=TinyImageNet, Adversarial Training Protocol=10-step PGD, Attack Budget (epsilon)=2/2552025.12 | 46.62 | 70.37 | 38.49 | 90.34 | 52.02 | 57.11 | 79.75 | 49.36 | 32.23 | 23.43 | 12.03 | 47.7 | 82.49 | 73.65 | 41.6 | 55.87 | 53.32 | — | |
| TeCoAAttack Protocol=CAA, Fine-tuning Dataset=TinyImageNet, Adversarial Training Protocol=10-step PGD, Attack Budget (epsilon)=2/2552025.12 | 35.52 | 23.4 | 14.38 | 53.25 | 9.98 | 6.49 | 22.65 | 10.95 | 10.69 | 11.62 | 0.57 | 10.33 | 40.03 | 26.83 | 3.43 | 49.28 | 20.59 | 26.38 | |
| TeCoAAttack Protocol=A3, Fine-tuning Dataset=TinyImageNet, Adversarial Training Protocol=10-step PGD, Attack Budget (epsilon)=2/2552025.12 | 35.38 | 23.21 | 14.22 | 53.11 | 9.95 | 6.46 | 22.57 | 10.83 | 10.59 | 11.62 | 0.57 | 10.29 | 39.98 | 26.75 | 3.47 | 49.27 | 20.52 | 26.32 | |
| UCATAttack Protocol=CAA, Fine-tuning Dataset=TinyImageNet, Adversarial Training Protocol=10-step PGD, Attack Budget (epsilon)=2/2552025.12 | 35.12 | 25.69 | 15.42 | 58.33 | 11.16 | 10.91 | 26.9 | 14.73 | 13.83 | 4.33 | 1.08 | 12.75 | 51.11 | 34.33 | 6.29 | 33.45 | 22.21 | 29.79 | |
| UCATAttack Protocol=A3, Fine-tuning Dataset=TinyImageNet, Adversarial Training Protocol=10-step PGD, Attack Budget (epsilon)=2/2552025.12 | 34.9 | 25.44 | 15.33 | 58.14 | 11.08 | 10.82 | 26.41 | 14.67 | 13.83 | 4.33 | 1.08 | 12.69 | 51.02 | 34.22 | 6.19 | 33.34 | 22.09 | 29.68 | |
| TGA-ZSRAttack Protocol=A3, Fine-tuning Dataset=TinyImageNet, Adversarial Training Protocol=10-step PGD, Attack Budget (epsilon)=2/2552025.12 | 30.02 | 19.54 | 11.59 | 51.6 | 9.02 | 6.44 | 19.98 | 12.21 | 10.64 | 11.13 | 0.54 | 9.85 | 40.07 | 28.5 | 3.2 | 49.95 | 19.64 | 28.7 | |
| TGA-ZSRAttack Protocol=CAA, Fine-tuning Dataset=TinyImageNet, Adversarial Training Protocol=10-step PGD, Attack Budget (epsilon)=2/2552025.12 | 18.64 | 10.77 | 8.41 | 42.23 | 5.78 | 4.51 | 11.72 | 7.81 | 7.87 | 10.54 | 0.27 | 6.73 | 33.71 | 22.49 | 1.62 | 42.37 | 14.72 | 23.06 | |
| FAREAttack Protocol=Clean, Fine-tuning Dataset=TinyImageNet, Adversarial Training Protocol=10-step PGD, Attack Budget (epsilon)=2/2552025.12 | 16.92 | 40.23 | 11.96 | 64.56 | 7.89 | 8.07 | 19.24 | 11.82 | 7.93 | 12.52 | 2.55 | 7.98 | 47.14 | 27.61 | 6.06 | 50.02 | 21.41 | — | |
| FAREAttack Protocol=CAA, Fine-tuning Dataset=TinyImageNet, Adversarial Training Protocol=10-step PGD, Attack Budget (epsilon)=2/2552025.12 | 8.5 | 17.74 | 5.51 | 40.86 | 3.39 | 2.8 | 6.95 | 5.14 | 5.05 | 8.86 | 0.93 | 3.41 | 31.72 | 15.32 | 1.65 | 50.02 | 12.99 | 16.17 | |
| FAREAttack Protocol=A3, Fine-tuning Dataset=TinyImageNet, Adversarial Training Protocol=10-step PGD, Attack Budget (epsilon)=2/2552025.12 | 8.46 | 17.55 | 5.49 | 40.65 | 3.39 | 2.78 | 6.87 | 5.12 | 5.05 | 8.89 | 0.93 | 3.4 | 31.69 | 15.31 | 1.65 | 50.02 | 12.95 | 16.14 | |
| PMG-AFTAttack Protocol=CAA, Fine-tuning Dataset=TinyImageNet, Adversarial Training Protocol=10-step PGD, Attack Budget (epsilon)=2/2552025.12 | 7.18 | 13.18 | 3.79 | 56.18 | 3.37 | 8.21 | 13.63 | 4.36 | 3.19 | 0.32 | 0 | 4.43 | 39.61 | 26.36 | 0.44 | 0.39 | 11.54 | 18.97 | |
| PMG-AFTAttack Protocol=A3, Fine-tuning Dataset=TinyImageNet, Adversarial Training Protocol=10-step PGD, Attack Budget (epsilon)=2/2552025.12 | 7.02 | 13.16 | 3.65 | 55.74 | 3.37 | 7.9 | 12.87 | 4.68 | 4.95 | 4.45 | 0 | 4.37 | 39.6 | 26.18 | 0.44 | 0.89 | 11.83 | 19.36 | |
| CLIPAttack Protocol=CAA2025.12 | 1.9 | 5.84 | 0.32 | 28.99 | 0.63 | 9.8 | 5.04 | 1.29 | 0.05 | 0.04 | 0 | 1.02 | 16.63 | 13.17 | 0.42 | 0 | 5.32 | 9.83 | |
| CLIPAttack Protocol=A32025.12 | 1.26 | 6.47 | 0.33 | 30.7 | 0.7 | 9.73 | 4.8 | 1.11 | 0.11 | 0.1 | 0 | 1 | 19.11 | 13.56 | 0.37 | 0 | 5.58 | 10.28 |