Table 7: Complete list of  $\mathcal{R}$  and its bounds under  $(\mathcal{W}_{\infty}, l_{\infty})$  threat model based on CE loss.
δ=2/255	δ=4/255
Network	R	ΔRu	ΔRl	R	ΔRu	ΔRl
Addepalli2021Towards_RN18	0.9205	0.0172	-0.0234	0.8314	0.0403	-0.0390
Addepalli2021Towards_WRN34	0.9361	0.0144	-0.0266	0.8577	0.0374	-0.0399
Addepalli2022Efficient_RN18	0.9236	0.0126	-0.0194	0.8327	0.0329	-0.0312
Addepalli2022Efficient_WRN_34_10	0.9352	0.0097	-0.0167	0.8514	0.0275	-0.0218
Andriushchenko2020Understanding	0.9054	0.0125	-0.0200	0.8071	0.0296	-0.0496
Carmon2019Unlabeled	0.9431	0.0056	-0.0122	0.8682	0.0236	-0.0144
Chen2020Adversarial	0.9261	0.0074	-0.0319	0.8323	0.0206	-0.0495
Chen2020Efficient	0.9199	0.0111	-0.0107	0.8273	0.0293	-0.0177
Chen2021LTD_WRN34_10	0.9363	0.0099	-0.0224	0.8564	0.0275	-0.0347
Chen2021LTD_WRN34_20	0.9382	0.0105	-0.0280	0.8624	0.0322	-0.0476
Cui2020Learnable_34_10	0.9290	0.0070	-0.0178	0.8410	0.0196	-0.0324
Cui2020Learnable_34_20	0.9267	0.0079	-0.0150	0.8395	0.0224	-0.0296
Dai2021Parameterizing	0.9468	0.0069	-0.0173	0.8844	0.0139	-0.0362
Debenedetti2022Light_XCiT-L12	0.9440	0.0041	-0.0154	0.8658	0.0162	-0.0233
Debenedetti2022Light_XCiT-M12	0.9435	0.0049	-0.0164	0.8641	0.0194	-0.0233
Debenedetti2022Light_XCiT-S12	0.9428	0.0048	-0.0239	0.8605	0.0198	-0.0357
Engstrom2019Robustness	0.9231	0.0101	-0.0203	0.8298	0.0263	-0.0406
Gowal2020Uncovering_28_10Extra	0.9476	0.0072	-0.0149	0.8803	0.0221	-0.0214
Gowal2020Uncovering_34_20	0.9323	0.0081	-0.0156	0.8579	0.0206	-0.0331
Gowal2020Uncovering_70_16	0.9357	0.0055	-0.0144	0.8614	0.0155	-0.0279
Gowal2020Uncovering_70_16Extra	0.9535	0.0050	-0.0129	0.8898	0.0196	-0.0137
Gowal2021Improving_28_10_dcpm_100m	0.9528	0.0073	-0.0192	0.8949	0.0177	-0.0347
Gowal2021Improving_70_16_dcpm_100m	0.9551	0.0061	-0.0147	0.9024	0.0169	-0.0265
Gowal2021Improving_R18_dcpm_100m	0.9397	0.0065	-0.0166	0.8726	0.0117	-0.0387
Hendrycks2019Using	0.9340	0.0057	-0.0250	0.8519	0.0215	-0.0447
Huang2020Self	0.9294	0.0075	-0.0139	0.8451	0.0270	-0.0201
Huang2021Exploring	0.9471	0.0051	-0.0091	0.8779	0.0227	-0.0091
Huang2021Exploring_ema	0.9519	0.0054	-0.0103	0.8856	0.0226	-0.0103
Huang2022Revisiting_WRN-A4	0.9537	0.0052	-0.0101	0.8919	0.0167	-0.0127
Jia2022LAS-AT_34_10	0.9327	0.0102	-0.0173	0.8524	0.0262	-0.0277
Jia2022LAS-AT_70_16	0.9372	0.0070	-0.0178	0.8585	0.0229	-0.0262
Pang2020Boosting	0.9319	0.0181	-0.0349	0.8526	0.0430	-0.0611
Pang2022Robustness_WRN28_10	0.9449	0.0095	-0.0199	0.8708	0.0229	-0.0325
Pang2022Robustness_WRN70_16	0.9524	0.0056	-0.0220	0.8828	0.0225	-0.0331
Rade2021Helper_dcpm	0.9444	0.0068	-0.0195	0.8715	0.0188	-0.0317
Rade2021Helperextra	0.9481	0.0057	-0.0158	0.8778	0.0186	-0.0247
Rade2021HelperR18_dcpm	0.9339	0.0098	-0.0203	0.8564	0.0220	-0.0407
Rade2021HelperR18extra	0.9347	0.0095	-0.0183	0.8578	0.0220	-0.0370
Rebuffi2021Fixing_106_16_cutmix_dcpm	0.9528	0.0063	-0.0196	0.8907	0.0226	-0.0295
Rebuffi2021Fixing_28_10_cutmix_dcpm	0.9432	0.0088	-0.0193	0.8713	0.0262	-0.0286
Rebuffi2021Fixing_70_16_cutmix_dcpm	0.9522	0.0071	-0.0204	0.8899	0.0208	-0.0311
Rebuffi2021Fixing_70_16_cutmixextra	0.9544	0.0051	-0.0169	0.8973	0.0191	-0.0282
Rebuffi2021Fixing_R18_dcpm	0.9337	0.0078	-0.0140	0.8584	0.0242	-0.0270
Rice2020Overfitting	0.9327	0.0091	-0.0273	0.8532	0.0199	-0.0548
Sehwag2020Hydra	0.9383	0.0055	-0.0123	0.8561	0.0262	-0.0126
Sehwag2021Proxy	0.9428	0.0073	-0.0150	0.8813	0.0166	-0.0348
Sehwag2021Proxy_R18	0.9369	0.0091	-0.0209	0.8598	0.0240	-0.0364
Sehwag2021Proxy_ResNest152	0.9466	0.0062	-0.0138	0.8864	0.0151	-0.0308
Sitawarin2020Improving	0.9237	0.0084	-0.0190	0.8345	0.0243	-0.0428
Sridhar2021Robust	0.9428	0.0063	-0.0112	0.8722	0.0221	-0.0171
Sridhar2021Robust_34_15	0.9413	0.0067	-0.0065	0.8740	0.0208	-0.0089
Wang2020Improving	0.9387	0.0119	-0.0216	0.8624	0.0362	-0.0303
Wang2023Better_WRN-28-10	0.9563	0.0067	-0.0149	0.8990	0.0166	-0.0248
Wang2023Better_WRN-70-16	0.9620	0.0049	-0.0149	0.9104	0.0165	-0.0239
Wong2020Fast	0.9093	0.0128	-0.0282	0.8068	0.0301	-0.0608
Wu2020Adversarial	0.9336	0.0068	-0.0161	0.8540	0.0225	-0.0267
Wu2020AdversarialExtra	0.9403	0.0073	-0.0139	0.8681	0.0228	-0.0230
Zhang2019Theoretically	0.9298	0.0061	-0.0190	0.8381	0.0238	-0.0289
Zhang2019You	0.9107	0.0073	-0.0196	0.8061	0.0203	-0.0506
Zhang2020Attacks	0.9285	0.0082	-0.0167	0.8438	0.0257	-0.0267
Zhang2020Geometry	0.9402	0.0187	-0.0307	0.8629	0.0404	-0.0514