Table 4: Complete list of adversarial accuracies under  $\left( {{\mathcal{W}}_{\infty },{l}_{\infty }}\right)$  and  $\left( {{\mathcal{W}}_{2},{l}_{\infty }}\right)$  threat models.
δ=2/255	δ=4/255	δ=8/255
Network	Clean	W∞	W2	W∞	W2	W∞	W2
Addepalli2021Towards_RN18	80.23	73.85	68.54	66.70	58.76	51.06	42.91
Addepalli2021Towards_WRN34	85.32	79.87	73.41	73.18	64.60	58.04	48.12
Addepalli2022Efficient_RN18	85.71	79.16	71.75	71.37	59.59	52.48	37.84
Addepalli2022Efficient_WRN_34_10	88.70	82.95	74.75	75.52	63.35	57.81	42.03
Andriushchenko2020Understanding	79.85	72.30	66.16	64.45	55.83	43.93	37.86
Carmon2019Unlabeled	89.69	84.59	77.02	77.87	66.59	59.53	46.32
Chen2020Adversarial	86.04	79.68	67.45	71.61	51.23	51.56	29.66
Chen2020Efficient	85.34	78.48	70.91	70.64	59.24	51.12	39.32
Chen2021LTD_WRN34_10	85.21	79.78	72.74	72.97	61.86	56.94	41.48
Chen2021LTD_WRN34_20	86.03	80.71	75.31	74.19	64.95	57.71	44.87
Cui2020Learnable_34_10	88.22	81.95	71.25	74.20	57.88	52.86	40.14
Cui2020Learnable_34_20	88.70	82.20	72.16	74.46	57.74	53.57	37.73
Dai2021Parameterizing	87.02	82.39	77.35	76.96	69.28	61.55	52.43
Debenedetti2022Light_XCiT-L12	91.73	86.59	78.09	79.42	66.77	57.58	44.90
Debenedetti2022Light_XCiT-M12	91.30	86.14	77.83	78.89	66.86	57.27	43.90
Debenedetti2022Light_XCiT-S12	90.06	84.91	77.11	77.50	65.35	56.14	44.28
Engstrom2019Robustness	87.03	80.34	74.30	72.22	63.43	49.25	41.85
Gowal2020Uncovering_28_10Extra	89.48	84.78	78.08	78.77	67.93	62.80	48.51
Gowal2020Uncovering_34_20	85.64	79.84	73.22	73.47	62.78	56.86	42.87
Gowal2020Uncovering_70_16	85.29	79.81	72.89	73.47	62.25	57.20	43.29
Gowal2020Uncovering_70_16Extra	91.10	86.86	79.81	81.06	70.01	65.88	50.55
Gowal2021Improving_28_10_dpm_100m	87.50	83.37	78.46	78.30	70.50	63.44	54.95
Gowal2021Improving_70_16_dpm_100m	88.74	84.76	80.48	80.08	73.27	66.11	59.34
Gowal2021Improving_R18_dpm_100m	87.35	82.08	76.83	76.22	68.16	58.63	51.17
Hendrycks2019Using	87.11	81.36	74.48	74.21	63.45	54.92	44.19
Huang2020Self	83.48	77.59	69.33	70.55	58.46	53.34	38.96
Huang2021Exploring	90.56	85.77	77.78	79.50	67.52	61.56	47.30
Huang2021Exploring_ema	91.23	86.84	79.28	80.79	69.02	62.54	48.46
Huang2022Revisiting_WRN-A4	91.59	87.35	79.76	81.69	69.62	65.79	50.22
Jia2022LAS-AT_34_10	84.98	79.26	73.00	72.44	62.88	56.26	43.92
Jia2022LAS-AT_70_16	85.66	80.29	73.90	73.52	63.76	57.61	44.19
Pang2020Boosting	85.14	79.34	71.93	72.60	61.17	53.74	39.40
Pang2022Robustness_WRN28_10	88.61	83.73	78.46	77.16	69.51	61.04	51.67
Pang2022Robustness_WRN70_16	89.01	84.77	79.57	78.58	70.61	63.35	52.93
Rade2021Helper.ddpm	88.16	83.26	77.54	76.83	67.49	60.97	47.37
Rade2021Helperextra	91.47	86.72	80.47	80.29	69.48	62.83	47.57
Rade2021HelperR18.ddpm	86.86	81.12	75.67	74.39	64.92	57.09	43.99
Rade2021HelperR18Extra	89.02	83.21	77.16	76.36	66.10	57.67	43.38
Rebuffi2021Fixing_106_16_cutmix.ddpm	88.50	84.32	78.88	78.83	70.59	64.64	52.31
Rebuffi2021Fixing_28_10_cutmix.ddpm	87.33	82.36	76.33	76.08	66.35	60.75	46.73
Rebuffi2021Fixing_70_16_cutmix.ddpm	88.54	84.31	78.64	78.79	68.95	64.25	49.75
Rebuffi2021Fixing_70_16_cutmixExtra	92.23	88.02	81.21	82.76	70.39	66.58	47.97
Rebuffi2021Fixing_R18.ddpm	83.53	77.99	71.46	71.68	61.83	56.66	44.26
Rice2020Overfitting	85.34	79.60	74.06	72.82	64.81	53.42	43.66
Sehwag2020Hydra	88.98	83.49	76.02	76.18	65.38	57.14	44.37
Sehwag2021Proxy	86.68	81.72	76.91	76.39	68.84	60.27	53.29
Sehwag2021Proxy_R18	84.59	79.25	73.87	72.74	64.73	55.54	46.58
Sehwag2021Proxy_ResNest152	87.21	82.55	78.08	77.30	70.78	62.79	56.67
Sitawarin2020Improving	86.84	80.21	74.16	72.47	63.54	50.72	43.25
Sridhar2021Robust	89.46	84.34	77.42	78.03	66.42	59.66	46.45
Sridhar2021Robust_34_15	86.53	81.45	73.95	75.63	64.18	60.41	45.77
Wang2020Improving	87.51	82.15	74.59	75.47	63.17	56.29	42.57
Wang2023Better_WRN-28-10	92.44	88.40	81.51	83.10	71.42	67.31	52.03
Wang2023Better_WRN-70-16	93.26	89.72	82.88	84.90	73.95	70.69	55.17
Wong2020Fast	83.34	75.77	69.60	67.23	58.38	43.21	36.96
Wu2020Adversarial	85.36	79.69	73.33	72.90	62.64	56.17	42.28
Wu2020AdversarialExtra	88.25	82.98	76.83	76.61	66.45	60.04	46.70
Zhang2019Theoretically	84.92	78.96	71.68	71.15	60.30	53.08	40.05
Zhang2019You	87.20	79.42	72.40	70.29	60.61	44.83	36.65
Zhang2020Attacks	84.52	78.48	71.10	71.32	59.45	53.51	40.76
Zhang2020Geometry	89.36	84.01	81.57	77.10	73.45	59.64	53.50