robustbench 1.1.1
This package provides the data for RobustBench together with the model zoo.

# RobustBench: a standardized adversarial robustness benchmark

**Francesco Croce\* (University of Tübingen), Maksym Andriushchenko\* (EPFL), Vikash Sehwag\* (Princeton University), Edoardo Debenedetti\* (EPFL),
Nicolas Flammarion (EPFL), Mung Chiang (Purdue University), Prateek Mittal (Princeton University), Matthias Hein (University of Tübingen)**

**Leaderboard**: [https://robustbench.github.io/](https://robustbench.github.io/)

**Paper:** [https://arxiv.org/abs/2010.09670](https://arxiv.org/abs/2010.09670)

**❗Note❗: if you experience problems with the automatic downloading of the models from Google Drive, install the latest version of `RobustBench` via `pip install git+https://github.com/RobustBench/robustbench.git`.**

<p align="center"><img src="images/leaderboard_screenshot_linf.png" width="700">
<p align="center"><img src="images/leaderboard_screenshot_l2.png" width="700">
<p align="center"><img src="images/leaderboard_screenshot_corruptions.png" width="700">

  
## News
- **May 2022**: We have extended the common corruptions leaderboard on ImageNet with [3D Common Corruptions](https://3dcommoncorruptions.epfl.ch/) (ImageNet-3DCC). ImageNet-3DCC evaluation is interesting since (1) it includes more realistic corruptions and (2) it can be used to assess generalization of the existing models which may have overfitted to ImageNet-C. For a quickstart, click [here](#new-evaluating-robustness-of-imagenet-models-against-3d-common-corruptions-imagenet-3dcc). Note that the entries in leaderboard are still sorted according to ImageNet-C performance.
  
- **May 2022**: We fixed the preprocessing issue for ImageNet corruption evaluations: previously we used resize to 256x256 and central crop to 224x224 which wasn't necessary since the ImageNet-C images are already 224x224 (see [this issue](https://github.com/RobustBench/robustbench/issues/59)). Note that this changed the ranking between the top-1 and top-2 entries.
  
  
## Main idea
  
The goal of **`RobustBench`** is to systematically track the *real* progress in adversarial robustness. 
There are already [more than 3'000 papers](https://nicholas.carlini.com/writing/2019/all-adversarial-example-papers.html) 
on this topic, but it is still often unclear which approaches really work and which only lead to [overestimated robustness](https://arxiv.org/abs/1802.00420).
We start from benchmarking the Linf, L2, and common corruption robustness since these are the most studied settings in the literature. 

Evaluation of the robustness to Lp perturbations *in general* is not straightforward and requires adaptive attacks ([Tramer et al., (2020)](https://arxiv.org/abs/2002.08347)).
Thus, in order to establish a reliable *standardized* benchmark, we need to impose some restrictions on the defenses we consider.
In particular, **we accept only defenses that are (1) have in general non-zero gradients wrt the inputs, (2) have a fully deterministic forward pass (i.e. no randomness) that
(3) does not have an optimization loop.** Often, defenses that violate these 3 principles only make gradient-based attacks 
harder but do not substantially improve robustness ([Carlini et al., (2019)](https://arxiv.org/abs/1902.06705)) except those
that can present concrete provable guarantees (e.g. [Cohen et al., (2019)](https://arxiv.org/abs/1902.02918)). 

To prevent potential overadaptation of new defenses to AutoAttack, we also welcome external evaluations based on **adaptive attacks**, especially where AutoAttack [flags](https://github.com/fra31/auto-attack/blob/master/flags_doc.md) a potential overestimation of robustness. For each model, we are interested in the best known robust accuracy and see AutoAttack and adaptive attacks as complementary to each other.

**`RobustBench`** consists of two parts: 
- a website [https://robustbench.github.io/](https://robustbench.github.io/) with the leaderboard based on many recent papers (plots below 👇)
- a collection of the most robust models, **Model Zoo**, which are easy to use for any downstream application (see the tutorial below after FAQ 👇)

<!-- <p align="center"><img src="images/aa_robustness_vs_venues.png" height="275">  <img src="images/aa_robustness_vs_years.png" height="275"></p> -->
<!-- <p align="center"><img src="images/aa_robustness_vs_reported.png" height="260">  <img src="images/aa_robustness_vs_standard.png" height="260"></p> -->
<p align="center"><img src="images/plots_analysis_jsons.png" width="800"></p>


## FAQ

**Q**: How does the RobustBench leaderboard differ from the [AutoAttack leaderboard](https://github.com/fra31/auto-attack)? 🤔 \
**A**: The [AutoAttack leaderboard](https://github.com/fra31/auto-attack) was the starting point of RobustBench. Now only the [RobustBench leaderboard](https://robustbench.github.io/) is actively maintained.

**Q**: How does the RobustBench leaderboard differ from [robust-ml.org](https://www.robust-ml.org/)? 🤔 \
**A**: [robust-ml.org](https://www.robust-ml.org/) focuses on *adaptive* evaluations, but we provide a **standardized benchmark**. Adaptive evaluations
have been very useful (e.g., see [Tramer et al., 2020](https://arxiv.org/abs/2002.08347)) but they are also very time-consuming and not standardized by definition. Instead, we argue that one can estimate robustness accurately mostly *without* adaptive attacks but for this one has to introduce some restrictions on the considered models. However, we do welcome adaptive evaluations and we are always interested in showing the best known robust accuracy.

**Q**: How is it related to libraries like `foolbox` / `cleverhans` / `advertorch`? 🤔 \
**A**: These libraries provide implementations of different *attacks*. Besides the standardized benchmark, **`RobustBench`** 
additionally provides a repository of the most robust models. So you can start using the
robust models in one line of code (see the tutorial below 👇).

**Q**: Why is Lp-robustness still interesting? 🤔 \
**A**: There are numerous interesting applications of Lp-robustness that span 
transfer learning ([Salman et al. (2020)](https://arxiv.org/abs/2007.08489), [Utrera et al. (2020)](https://arxiv.org/abs/2007.05869)), 
interpretability ([Tsipras et al. (2018)](https://arxiv.org/abs/1805.12152), [Kaur et al. (2019)](https://arxiv.org/abs/1910.08640), [Engstrom et al. (2019)](https://arxiv.org/abs/1906.00945)),
security ([Tramèr et al. (2018)](https://arxiv.org/abs/1811.03194), [Saadatpanah et al. (2019)](https://arxiv.org/abs/1906.07153)),
generalization ([Xie et al. (2019)](https://arxiv.org/abs/1911.09665), [Zhu et al. (2019)](https://arxiv.org/abs/1909.11764), [Bochkovskiy et al. (2020)](https://arxiv.org/abs/2004.10934)), 
robustness to unseen perturbations ([Xie et al. (2019)](https://arxiv.org/abs/1911.09665), [Kang et al. (2019)](https://arxiv.org/abs/1905.01034)),
stabilization of GAN training ([Zhong et al. (2020)](https://arxiv.org/abs/2008.03364)).

**Q**: What about verified adversarial robustness? 🤔 \
**A**: We mostly focus on defenses which improve empirical robustness, given the lack of clarity regarding 
which approaches really improve robustness and which only make some particular attacks unsuccessful.
However, we do not restrict submissions of verifiably robust models (e.g., we have [Zhang et al. (2019)](https://arxiv.org/abs/1906.06316) in our CIFAR-10 Linf leaderboard).
For methods targeting verified robustness, we encourage the readers to check out [Salman et al. (2019)](https://arxiv.org/abs/1902.08722) 
and [Li et al. (2020)](https://arxiv.org/abs/2009.04131).

**Q**: What if I have a better attack than the one used in this benchmark? 🤔 \
**A**: We will be happy to add a better attack or any adaptive evaluation that would complement our default standardized attacks.


## Model Zoo: quick tour

The goal of our **Model Zoo** is to simplify the usage of robust models as much as possible. Check
out our Colab notebook here
👉 [RobustBench: quick start](https://colab.research.google.com/drive/1MQY_7O9vj7ixD5ilVRbdQwlNPFvxifHV)
for a quick introduction. It is also summarized below 👇.

First, install the latest version of **`RobustBench`** (recommended):

```bash
pip install git+https://github.com/RobustBench/robustbench.git
```

or the latest *stable* version of **`RobustBench`** (it is possible that automatic downloading of the models may not work):

```bash
pip install git+https://github.com/RobustBench/robustbench.git@v1.0
```

Now let's try to load CIFAR-10 and some quite robust CIFAR-10 models from 
[Carmon2019Unlabeled](https://arxiv.org/abs/1905.13736) that achieves 59.53% robust accuracy evaluated with AA under 
`eps=8/255`:

```python
from robustbench.data import load_cifar10

x_test, y_test = load_cifar10(n_examples=50)

from robustbench.utils import load_model

model = load_model(model_name='Carmon2019Unlabeled', dataset='cifar10', threat_model='Linf')
```

Let's try to evaluate the robustness of this model. We can use any favourite library for this. For example, [FoolBox](https://github.com/bethgelab/foolbox)
implements many different attacks. We can start from a simple PGD attack:
```python
!pip install -q foolbox
import foolbox as fb
fmodel = fb.PyTorchModel(model, bounds=(0, 1))

_, advs, success = fb.attacks.LinfPGD()(fmodel, x_test.to('cuda:0'), y_test.to('cuda:0'), epsilons=[8/255])
print('Robust accuracy: {:.1%}'.format(1 - success.float().mean()))
```
```
>>> Robust accuracy: 58.0%
```
Wonderful! Can we do better with a more accurate attack?

Let's try to evaluate its robustness with a cheap version [AutoAttack](https://arxiv.org/abs/2003.01690) from ICML 2020 with 2/4 attacks (only APGD-CE and APGD-DLR):
```python
# autoattack is installed as a dependency of robustbench so there is not need to install it separately
from autoattack import AutoAttack
adversary = AutoAttack(model, norm='Linf', eps=8/255, version='custom', attacks_to_run=['apgd-ce', 'apgd-dlr'])
adversary.apgd.n_restarts = 1
x_adv = adversary.run_standard_evaluation(x_test, y_test)
```
```
>>> initial accuracy: 92.00%
>>> apgd-ce - 1/1 - 19 out of 46 successfully perturbed
>>> robust accuracy after APGD-CE: 54.00% (total time 10.3 s)
>>> apgd-dlr - 1/1 - 1 out of 27 successfully perturbed
>>> robust accuracy after APGD-DLR: 52.00% (total time 17.0 s)
>>> max Linf perturbation: 0.03137, nan in tensor: 0, max: 1.00000, min: 0.00000
>>> robust accuracy: 52.00%
```
Note that for our standardized evaluation of Linf-robustness we use the *full* version of AutoAttack which is slower but 
more accurate (for that just use `adversary = AutoAttack(model, norm='Linf', eps=8/255)`).

What about other types of perturbations? Is Lp-robustness useful there? We can evaluate the available models on more general perturbations. 
For example, let's take images corrupted by fog perturbations from CIFAR-10-C with the highest level of severity (5). 
Are different Linf robust models perform better on them?

```python
from robustbench.data import load_cifar10c
from robustbench.utils import clean_accuracy

corruptions = ['fog']
x_test, y_test = load_cifar10c(n_examples=1000, corruptions=corruptions, severity=5)

for model_name in ['Standard', 'Engstrom2019Robustness', 'Rice2020Overfitting',
                   'Carmon2019Unlabeled']:
 model = load_model(model_name, dataset='cifar10', threat_model='Linf')
 acc = clean_accuracy(model, x_test, y_test)
 print(f'Model: {model_name}, CIFAR-10-C accuracy: {acc:.1%}')
``` 
```
>>> Model: Standard, CIFAR-10-C accuracy: 74.4%
>>> Model: Engstrom2019Robustness, CIFAR-10-C accuracy: 38.8%
>>> Model: Rice2020Overfitting, CIFAR-10-C accuracy: 22.0%
>>> Model: Carmon2019Unlabeled, CIFAR-10-C accuracy: 31.1%
```
As we can see, **all** these Linf robust models perform considerably worse than the standard model on this type of corruptions. 
This curious phenomenon was first noticed in [Adversarial Examples Are a Natural Consequence of Test Error in Noise](https://arxiv.org/abs/1901.10513) 
and explained from the frequency perspective in [A Fourier Perspective on Model Robustness in Computer Vision](https://arxiv.org/abs/1906.08988). 

However, on average adversarial training *does* help on CIFAR-10-C. One can check this easily by loading all types of corruptions 
via `load_cifar10c(n_examples=1000, severity=5)`, and repeating evaluation on them.


### **\*New\***: Evaluating robustness of ImageNet models against 3D Common Corruptions (ImageNet-3DCC)

3D Common Corruptions (3DCC) is a recent benchmark by [Kar et al. (CVPR 2022)](https://3dcommoncorruptions.epfl.ch/) using scene geometry to generate realistic corruptions. You can evaluate robustness of a standard ResNet-50 against ImageNet-3DCC by following these steps:

1. Download the data from [here](https://github.com/EPFL-VILAB/3DCommonCorruptions#3dcc-data) using the provided tool. The data will be saved into a folder named `ImageNet-3DCC`.

2. Run the sample evaluation script to obtain accuracies and save them in a pickle file:
```python
import torch 
from robustbench.data import load_imagenet3dcc
from robustbench.utils import clean_accuracy, load_model

corruptions_3dcc = ['near_focus', 'far_focus', 'bit_error', 'color_quant', 
                   'flash', 'fog_3d', 'h265_abr', 'h265_crf',
                   'iso_noise', 'low_light', 'xy_motion_blur', 'z_motion_blur'] # 12 corruptions in ImageNet-3DCC

device = torch.device("cuda:0")
model = load_model('Standard_R50', dataset='imagenet', threat_model='corruptions').to(device)
for corruption in corruptions_3dcc:
    for s in [1, 2, 3, 4, 5]:  # 5 severity levels
        x_test, y_test = load_imagenet3dcc(n_examples=5000, corruptions=[corruption], severity=s, data_dir=$PATH_IMAGENET_3DCC)
        acc = clean_accuracy(model, x_test.to(device), y_test.to(device), device=device)
        print(f'Model: {model_name}, ImageNet-3DCC corruption: {corruption} severity: {s} accuracy: {acc:.1%}')
```



## Model Zoo
In order to use a model, you just need to know its ID, e.g. **Carmon2019Unlabeled**, and to run:

```python
from robustbench import load_model

model = load_model(model_name='Carmon2019Unlabeled', dataset='cifar10', threat_model='Linf')
```
which automatically downloads the model (all models are defined in `model_zoo/models.py`).

Reproducing evaluation of models from the Model Zoo can be done directly from the command line. Here is an example of 
an evaluation of `Salman2020Do_R18` model with AutoAttack on ImageNet for `eps=4/255=0.0156862745`:
```python
python -m robustbench.eval --n_ex=5000 --dataset=imagenet --threat_model=Linf --model_name=Salman2020Do_R18 --data_dir=/tmldata1/andriush/imagenet --batch_size=128 --eps=0.0156862745
```
The CIFAR-10, CIFAR-10-C, CIFAR-100, and CIFAR-100-C datasets are downloaded automatically. However, the ImageNet datasets should be downloaded manually due to their licensing:
- ImageNet: Obtain the download link [here](https://image-net.org/download.php) 
(requires just signing up from an academic email, the approval system there is automatic and happens instantly) and then follow
the instructions [here](https://github.com/soumith/imagenet-multiGPU.torch#data-processing) to extract the validation 
set in a pytorch-compatible format into folder `val`.
- ImageNet-C: Please visit [here](https://github.com/hendrycks/robustness#imagenet-c) for the instructions.
- ImageNet-3DCC: Download the data from [here](https://github.com/EPFL-VILAB/3DCommonCorruptions#3dcc-data) using the provided tool. The data will be saved into a folder named `ImageNet-3DCC`.

In order to use the models from the Model Zoo, you can find all available model IDs in the tables below. Note that the full [leaderboard](https://robustbench.github.io/) contains a bit more models which we either have not yet added to the Model Zoo or their authors don't want them to appear in the Model Zoo.


### CIFAR-10

#### Linf, eps=8/255
| <sub>#</sub> | <sub>Model ID</sub> | <sub>Paper</sub> | <sub>Clean accuracy</sub> | <sub>Robust accuracy</sub> | <sub>Architecture</sub> | <sub>Venue</sub> |
|:---:|---|---|:---:|:---:|:---:|:---:|
| <sub>**1**</sub> | <sub><sup>**Bartoldson2024Adversarial_WRN-94-16**</sup></sub> | <sub>*[Adversarial Robustness Limits via Scaling-Law and Human-Alignment Studies](https://arxiv.org/abs/2404.09349)*</sub> | <sub>93.68%</sub> | <sub>73.71%</sub> | <sub>WideResNet-94-16</sub> | <sub>ICML 2024</sub> |
| <sub>**2**</sub> | <sub><sup>**Amini2024MeanSparse_S-WRN-94-16**</sup></sub> | <sub>*[MeanSparse: Post-Training Robustness Enhancement Through Mean-Centered Feature Sparsification](https://arxiv.org/abs/2406.05927)*</sub> | <sub>93.60%</sub> | <sub>73.10%</sub> | <sub>MeanSparse WideResNet-94-16</sub> | <sub>arXiv, Jun 2024</sub> |
| <sub>**3**</sub> | <sub><sup>**Bartoldson2024Adversarial_WRN-82-8**</sup></sub> | <sub>*[Adversarial Robustness Limits via Scaling-Law and Human-Alignment Studies](https://arxiv.org/abs/2404.09349)*</sub> | <sub>93.11%</sub> | <sub>71.59%</sub> | <sub>WideResNet-82-8</sub> | <sub>ICML 2024</sub> |
| <sub>**4**</sub> | <sub><sup>**Peng2023Robust**</sup></sub> | <sub>*[Robust Principles: Architectural Design Principles for Adversarially Robust CNNs](https://arxiv.org/abs/2308.16258)*</sub> | <sub>93.27%</sub> | <sub>71.07%</sub> | <sub>RaWideResNet-70-16</sub> | <sub>BMVC 2023</sub> |
| <sub>**5**</sub> | <sub><sup>**Wang2023Better_WRN-70-16**</sup></sub> | <sub>*[Better Diffusion Models Further Improve Adversarial Training](https://arxiv.org/abs/2302.04638)*</sub> | <sub>93.25%</sub> | <sub>70.69%</sub> | <sub>WideResNet-70-16</sub> | <sub>ICML 2023</sub> |
| <sub>**6**</sub> | <sub><sup>**Bai2024MixedNUTS**</sup></sub> | <sub>*[MixedNUTS: Training-Free Accuracy-Robustness Balance via Nonlinearly Mixed Classifiers](https://arxiv.org/abs/2402.02263)*</sub> | <sub>95.19%</sub> | <sub>69.71%</sub> | <sub>ResNet-152 + WideResNet-70-16</sub> | <sub>TMLR, Aug 2024</sub> |
| <sub>**7**</sub> | <sub><sup>**Amini2024MeanSparse_Ra_WRN_70_16**</sup></sub> | <sub>*[MeanSparse: Post-Training Robustness Enhancement Through Mean-Centered Feature Sparsification](https://arxiv.org/abs/2406.05927)*</sub> | <sub>93.24%</sub> | <sub>68.94%</sub> | <sub>MeanSparse RaWideResNet-70-16</sub> | <sub>arXiv, Jun 2024</sub> |
| <sub>**8**</sub> | <sub><sup>**Bai2023Improving_edm**</sup></sub> | <sub>*[Improving the Accuracy-Robustness Trade-off of Classifiers via Adaptive Smoothing](https://arxiv.org/abs/2301.12554)*</sub> | <sub>95.23%</sub> | <sub>68.06%</sub> | <sub>ResNet-152 + WideResNet-70-16 + mixing network</sub> | <sub>SIMODS 2024</sub> |
| <sub>**9**</sub> | <sub><sup>**Cui2023Decoupled_WRN-28-10**</sup></sub> | <sub>*[Decoupled Kullback-Leibler Divergence Loss](https://arxiv.org/abs/2305.13948)*</sub> | <sub>92.16%</sub> | <sub>67.73%</sub> | <sub>WideResNet-28-10</sub> | <sub>NeurIPS 2024</sub> |
| <sub>**10**</sub> | <sub><sup>**Wang2023Better_WRN-28-10**</sup></sub> | <sub>*[Better Diffusion Models Further Improve Adversarial Training](https://arxiv.org/abs/2302.04638)*</sub> | <sub>92.44%</sub> | <sub>67.31%</sub> | <sub>WideResNet-28-10</sub> | <sub>ICML 2023</sub> |
| <sub>**11**</sub> | <sub><sup>**Rebuffi2021Fixing_70_16_cutmix_extra**</sup></sub> | <sub>*[Fixing Data Augmentation to Improve Adversarial Robustness](https://arxiv.org/abs/2103.01946)*</sub> | <sub>92.23%</sub> | <sub>66.56%</sub> | <sub>WideResNet-70-16</sub> | <sub>arXiv, Mar 2021</sub> |
| <sub>**12**</sub> | <sub><sup>**Gowal2021Improving_70_16_ddpm_100m**</sup></sub> | <sub>*[Improving Robustness using Generated Data](https://arxiv.org/abs/2110.09468)*</sub> | <sub>88.74%</sub> | <sub>66.10%</sub> | <sub>WideResNet-70-16</sub> | <sub>NeurIPS 2021</sub> |
| <sub>**13**</sub> | <sub><sup>**Gowal2020Uncovering_70_16_extra**</sup></sub> | <sub>*[Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples](https://arxiv.org/abs/2010.03593)*</sub> | <sub>91.10%</sub> | <sub>65.87%</sub> | <sub>WideResNet-70-16</sub> | <sub>arXiv, Oct 2020</sub> |
| <sub>**14**</sub> | <sub><sup>**Huang2022Revisiting_WRN-A4**</sup></sub> | <sub>*[Revisiting Residual Networks for Adversarial Robustness: An Architectural Perspective](https://arxiv.org/abs/2212.11005)*</sub> | <sub>91.58%</sub> | <sub>65.79%</sub> | <sub>WideResNet-A4</sub> | <sub>arXiv, Dec. 2022</sub> |
| <sub>**15**</sub> | <sub><sup>**Rebuffi2021Fixing_106_16_cutmix_ddpm**</sup></sub> | <sub>*[Fixing Data Augmentation to Improve Adversarial Robustness](https://arxiv.org/abs/2103.01946)*</sub> | <sub>88.50%</sub> | <sub>64.58%</sub> | <sub>WideResNet-106-16</sub> | <sub>arXiv, Mar 2021</sub> |
| <sub>**16**</sub> | <sub><sup>**Rebuffi2021Fixing_70_16_cutmix_ddpm**</sup></sub> | <sub>*[Fixing Data Augmentation to Improve Adversarial Robustness](https://arxiv.org/abs/2103.01946)*</sub> | <sub>88.54%</sub> | <sub>64.20%</sub> | <sub>WideResNet-70-16</sub> | <sub>arXiv, Mar 2021</sub> |
| <sub>**17**</sub> | <sub><sup>**Kang2021Stable**</sup></sub> | <sub>*[Stable Neural ODE with Lyapunov-Stable Equilibrium Points for Defending Against Adversarial Attacks](https://arxiv.org/abs/2110.12976)*</sub> | <sub>93.73%</sub> | <sub>64.20%</sub> | <sub>WideResNet-70-16, Neural ODE block</sub> | <sub>NeurIPS 2021</sub> |
| <sub>**18**</sub> | <sub><sup>**Xu2023Exploring_WRN-28-10**</sup></sub> | <sub>*[Exploring and Exploiting Decision Boundary Dynamics for Adversarial Robustness](https://arxiv.org/abs/2302.03015)*</sub> | <sub>93.69%</sub> | <sub>63.89%</sub> | <sub>WideResNet-28-10</sub> | <sub>ICLR 2023</sub> |
| <sub>**19**</sub> | <sub><sup>**Gowal2021Improving_28_10_ddpm_100m**</sup></sub> | <sub>*[Improving Robustness using Generated Data](https://arxiv.org/abs/2110.09468)*</sub> | <sub>87.50%</sub> | <sub>63.38%</sub> | <sub>WideResNet-28-10</sub> | <sub>NeurIPS 2021</sub> |
| <sub>**20**</sub> | <sub><sup>**Pang2022Robustness_WRN70_16**</sup></sub> | <sub>*[ Robustness and Accuracy Could Be Reconcilable by (Proper) Definition](https://arxiv.org/pdf/2202.10103.pdf)*</sub> | <sub>89.01%</sub> | <sub>63.35%</sub> | <sub>WideResNet-70-16</sub> | <sub>ICML 2022</sub> |
| <sub>**21**</sub> | <sub><sup>**Rade2021Helper_extra**</sup></sub> | <sub>*[Helper-based Adversarial Training: Reducing Excessive Margin to Achieve a Better Accuracy vs. Robustness Trade-off](https://openreview.net/forum?id=BuD2LmNaU3a)*</sub> | <sub>91.47%</sub> | <sub>62.83%</sub> | <sub>WideResNet-34-10</sub> | <sub>OpenReview, Jun 2021</sub> |
| <sub>**22**</sub> | <sub><sup>**Sehwag2021Proxy_ResNest152**</sup></sub> | <sub>*[Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?](https://arxiv.org/abs/2104.09425)*</sub> | <sub>87.30%</sub> | <sub>62.79%</sub> | <sub>ResNest152</sub> | <sub>ICLR 2022</sub> |
| <sub>**23**</sub> | <sub><sup>**Gowal2020Uncovering_28_10_extra**</sup></sub> | <sub>*[Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples](https://arxiv.org/abs/2010.03593)*</sub> | <sub>89.48%</sub> | <sub>62.76%</sub> | <sub>WideResNet-28-10</sub> | <sub>arXiv, Oct 2020</sub> |
| <sub>**24**</sub> | <sub><sup>**Huang2021Exploring_ema**</sup></sub> | <sub>*[Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networks](https://arxiv.org/abs/2110.03825)*</sub> | <sub>91.23%</sub> | <sub>62.54%</sub> | <sub>WideResNet-34-R</sub> | <sub>NeurIPS 2021</sub> |
| <sub>**25**</sub> | <sub><sup>**Huang2021Exploring**</sup></sub> | <sub>*[Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networks](https://arxiv.org/abs/2110.03825)*</sub> | <sub>90.56%</sub> | <sub>61.56%</sub> | <sub>WideResNet-34-R</sub> | <sub>NeurIPS 2021</sub> |
| <sub>**26**</sub> | <sub><sup>**Dai2021Parameterizing**</sup></sub> | <sub>*[Parameterizing Activation Functions for Adversarial Robustness](https://arxiv.org/abs/2110.05626)*</sub> | <sub>87.02%</sub> | <sub>61.55%</sub> | <sub>WideResNet-28-10-PSSiLU</sub> | <sub>arXiv, Oct 2021</sub> |
| <sub>**27**</sub> | <sub><sup>**Pang2022Robustness_WRN28_10**</sup></sub> | <sub>*[ Robustness and Accuracy Could Be Reconcilable by (Proper) Definition](https://arxiv.org/pdf/2202.10103.pdf)*</sub> | <sub>88.61%</sub> | <sub>61.04%</sub> | <sub>WideResNet-28-10</sub> | <sub>ICML 2022</sub> |
| <sub>**28**</sub> | <sub><sup>**Rade2021Helper_ddpm**</sup></sub> | <sub>*[Helper-based Adversarial Training: Reducing Excessive Margin to Achieve a Better Accuracy vs. Robustness Trade-off](https://openreview.net/forum?id=BuD2LmNaU3a)*</sub> | <sub>88.16%</sub> | <sub>60.97%</sub> | <sub>WideResNet-28-10</sub> | <sub>OpenReview, Jun 2021</sub> |
| <sub>**29**</sub> | <sub><sup>**Rebuffi2021Fixing_28_10_cutmix_ddpm**</sup></sub> | <sub>*[Fixing Data Augmentation to Improve Adversarial Robustness](https://arxiv.org/abs/2103.01946)*</sub> | <sub>87.33%</sub> | <sub>60.73%</sub> | <sub>WideResNet-28-10</sub> | <sub>arXiv, Mar 2021</sub> |
| <sub>**30**</sub> | <sub><sup>**Sridhar2021Robust_34_15**</sup></sub> | <sub>*[Improving Neural Network Robustness via Persistency of Excitation](https://arxiv.org/abs/2106.02078)*</sub> | <sub>86.53%</sub> | <sub>60.41%</sub> | <sub>WideResNet-34-15</sub> | <sub>ACC 2022</sub> |
| <sub>**31**</sub> | <sub><sup>**Sehwag2021Proxy**</sup></sub> | <sub>*[Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?](https://arxiv.org/abs/2104.09425)*</sub> | <sub>86.68%</sub> | <sub>60.27%</sub> | <sub>WideResNet-34-10</sub> | <sub>ICLR 2022</sub> |
| <sub>**32**</sub> | <sub><sup>**Wu2020Adversarial_extra**</sup></sub> | <sub>*[Adversarial Weight Perturbation Helps Robust Generalization](https://arxiv.org/abs/2004.05884)*</sub> | <sub>88.25%</sub> | <sub>60.04%</sub> | <sub>WideResNet-28-10</sub> | <sub>NeurIPS 2020</sub> |
| <sub>**33**</sub> | <sub><sup>**Sridhar2021Robust**</sup></sub> | <sub>*[Improving Neural Network Robustness via Persistency of Excitation](https://arxiv.org/abs/2106.02078)*</sub> | <sub>89.46%</sub> | <sub>59.66%</sub> | <sub>WideResNet-28-10</sub> | <sub>ACC 2022</sub> |
| <sub>**34**</sub> | <sub><sup>**Zhang2020Geometry**</sup></sub> | <sub>*[Geometry-aware Instance-reweighted Adversarial Training](https://arxiv.org/abs/2010.01736)*</sub> | <sub>89.36%</sub> | <sub>59.64%</sub> | <sub>WideResNet-28-10</sub> | <sub>ICLR 2021</sub> |
| <sub>**35**</sub> | <sub><sup>**Carmon2019Unlabeled**</sup></sub> | <sub>*[Unlabeled Data Improves Adversarial Robustness](https://arxiv.org/abs/1905.13736)*</sub> | <sub>89.69%</sub> | <sub>59.53%</sub> | <sub>WideResNet-28-10</sub> | <sub>NeurIPS 2019</sub> |
| <sub>**36**</sub> | <sub><sup>**Gowal2021Improving_R18_ddpm_100m**</sup></sub> | <sub>*[Improving Robustness using Generated Data](https://arxiv.org/abs/2110.09468)*</sub> | <sub>87.35%</sub> | <sub>58.50%</sub> | <sub>PreActResNet-18</sub> | <sub>NeurIPS 2021</sub> |
| <sub>**37**</sub> | <sub><sup>**Chen2024Data_WRN_34_20**</sup></sub> | <sub>*[Data filtering for efficient adversarial training](https://doi.org/10.1016/j.patcog.2024.110394)*</sub> | <sub>86.10%</sub> | <sub>58.09%</sub> | <sub>WideResNet-34-20</sub> | <sub>Pattern Recognition 2024</sub> |
| <sub>**38**</sub> | <sub><sup>**Addepalli2021Towards_WRN34**</sup></sub> | <sub>*[Scaling Adversarial Training to Large Perturbation Bounds](https://arxiv.org/abs/2210.09852)*</sub> | <sub>85.32%</sub> | <sub>58.04%</sub> | <sub>WideResNet-34-10</sub> | <sub>ECCV 2022</sub> |
| <sub>**39**</sub> | <sub><sup>**Addepalli2022Efficient_WRN_34_10**</sup></sub> | <sub>*[Efficient and Effective Augmentation Strategy for Adversarial Training](https://arxiv.org/abs/2210.15318)*</sub> | <sub>88.71%</sub> | <sub>57.81%</sub> | <sub>WideResNet-34-10</sub> | <sub>NeurIPS 2022</sub> |
| <sub>**40**</sub> | <sub><sup>**Chen2021LTD_WRN34_20**</sup></sub> | <sub>*[LTD: Low Temperature Distillation for Robust Adversarial Training](https://arxiv.org/abs/2111.02331)*</sub> | <sub>86.03%</sub> | <sub>57.71%</sub> | <sub>WideResNet-34-20</sub> | <sub>arXiv, Nov 2021</sub> |
| <sub>**41**</sub> | <sub><sup>**Rade2021Helper_R18_extra**</sup></sub> | <sub>*[Helper-based Adversarial Training: Reducing Excessive Margin to Achieve a Better Accuracy vs. Robustness Trade-off](https://openreview.net/forum?id=BuD2LmNaU3a)*</sub> | <sub>89.02%</sub> | <sub>57.67%</sub> | <sub>PreActResNet-18</sub> | <sub>OpenReview, Jun 2021</sub> |
| <sub>**42**</sub> | <sub><sup>**Jia2022LAS-AT_70_16**</sup></sub> | <sub>*[LAS-AT: Adversarial Training with Learnable Attack Strategy](https://arxiv.org/abs/2203.06616)*</sub> | <sub>85.66%</sub> | <sub>57.61%</sub> | <sub>WideResNet-70-16</sub> | <sub>arXiv, Mar 2022</sub> |
| <sub>**43**</sub> | <sub><sup>**Debenedetti2022Light_XCiT-L12**</sup></sub> | <sub>*[A Light Recipe to Train Robust Vision Transformers](https://arxiv.org/abs/2209.07399)*</sub> | <sub>91.73%</sub> | <sub>57.58%</sub> | <sub>XCiT-L12</sub> | <sub>arXiv, Sep 2022</sub> |
| <sub>**44**</sub> | <sub><sup>**Chen2024Data_WRN_34_10**</sup></sub> | <sub>*[Data filtering for efficient adversarial training](https://doi.org/10.1016/j.patcog.2024.110394)*</sub> | <sub>86.54%</sub> | <sub>57.30%</sub> | <sub>WideResNet-34-10</sub> | <sub>Pattern Recognition 2024</sub> |
| <sub>**45**</sub> | <sub><sup>**Debenedetti2022Light_XCiT-M12**</sup></sub> | <sub>*[A Light Recipe to Train Robust Vision Transformers](https://arxiv.org/abs/2209.07399)*</sub> | <sub>91.30%</sub> | <sub>57.27%</sub> | <sub>XCiT-M12</sub> | <sub>arXiv, Sep 2022</sub> |
| <sub>**46**</sub> | <sub><sup>**Sehwag2020Hydra**</sup></sub> | <sub>*[HYDRA: Pruning Adversarially Robust Neural Networks](https://arxiv.org/abs/2002.10509)*</sub> | <sub>88.98%</sub> | <sub>57.14%</sub> | <sub>WideResNet-28-10</sub> | <sub>NeurIPS 2020</sub> |
| <sub>**47**</sub> | <sub><sup>**Gowal2020Uncovering_70_16**</sup></sub> | <sub>*[Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples](https://arxiv.org/abs/2010.03593)*</sub> | <sub>85.29%</sub> | <sub>57.14%</sub> | <sub>WideResNet-70-16</sub> | <sub>arXiv, Oct 2020</sub> |
| <sub>**48**</sub> | <sub><sup>**Rade2021Helper_R18_ddpm**</sup></sub> | <sub>*[Helper-based Adversarial Training: Reducing Excessive Margin to Achieve a Better Accuracy vs. Robustness Trade-off](https://openreview.net/forum?id=BuD2LmNaU3a)*</sub> | <sub>86.86%</sub> | <sub>57.09%</sub> | <sub>PreActResNet-18</sub> | <sub>OpenReview, Jun 2021</sub> |
| <sub>**49**</sub> | <sub><sup>**Cui2023Decoupled_WRN-34-10**</sup></sub> | <sub>*[Decoupled Kullback-Leibler Divergence Loss](https://arxiv.org/abs/2305.13948)*</sub> | <sub>85.31%</sub> | <sub>57.09%</sub> | <sub>WideResNet-34-10</sub> | <sub>NeurIPS 2024</sub> |
| <sub>**50**</sub> | <sub><sup>**Chen2021LTD_WRN34_10**</sup></sub> | <sub>*[LTD: Low Temperature Distillation for Robust Adversarial Training](https://arxiv.org/abs/2111.02331)*</sub> | <sub>85.21%</sub> | <sub>56.94%</sub> | <sub>WideResNet-34-10</sub> | <sub>arXiv, Nov 2021</sub> |
| <sub>**51**</sub> | <sub><sup>**Gowal2020Uncovering_34_20**</sup></sub> | <sub>*[Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples](https://arxiv.org/abs/2010.03593)*</sub> | <sub>85.64%</sub> | <sub>56.82%</sub> | <sub>WideResNet-34-20</sub> | <sub>arXiv, Oct 2020</sub> |
| <sub>**52**</sub> | <sub><sup>**Rebuffi2021Fixing_R18_ddpm**</sup></sub> | <sub>*[Fixing Data Augmentation to Improve Adversarial Robustness](https://arxiv.org/abs/2103.01946)*</sub> | <sub>83.53%</sub> | <sub>56.66%</sub> | <sub>PreActResNet-18</sub> | <sub>arXiv, Mar 2021</sub> |
| <sub>**53**</sub> | <sub><sup>**Wang2020Improving**</sup></sub> | <sub>*[Improving Adversarial Robustness Requires Revisiting Misclassified Examples](https://openreview.net/forum?id=rklOg6EFwS)*</sub> | <sub>87.50%</sub> | <sub>56.29%</sub> | <sub>WideResNet-28-10</sub> | <sub>ICLR 2020</sub> |
| <sub>**54**</sub> | <sub><sup>**Jia2022LAS-AT_34_10**</sup></sub> | <sub>*[LAS-AT: Adversarial Training with Learnable Attack Strategy](https://arxiv.org/abs/2203.06616)*</sub> | <sub>84.98%</sub> | <sub>56.26%</sub> | <sub>WideResNet-34-10</sub> | <sub>arXiv, Mar 2022</sub> |
| <sub>**55**</sub> | <sub><sup>**Wu2020Adversarial**</sup></sub> | <sub>*[Adversarial Weight Perturbation Helps Robust Generalization](https://arxiv.org/abs/2004.05884)*</sub> | <sub>85.36%</sub> | <sub>56.17%</sub> | <sub>WideResNet-34-10</sub> | <sub>NeurIPS 2020</sub> |
| <sub>**56**</sub> | <sub><sup>**Debenedetti2022Light_XCiT-S12**</sup></sub> | <sub>*[A Light Recipe to Train Robust Vision Transformers](https://arxiv.org/abs/2209.07399)*</sub> | <sub>90.06%</sub> | <sub>56.14%</sub> | <sub>XCiT-S12</sub> | <sub>arXiv, Sep 2022</sub> |
| <sub>**57**</sub> | <sub><sup>**Sehwag2021Proxy_R18**</sup></sub> | <sub>*[Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?](https://arxiv.org/abs/2104.09425)*</sub> | <sub>84.59%</sub> | <sub>55.54%</sub> | <sub>ResNet-18</sub> | <sub>ICLR 2022</sub> |
| <sub>**58**</sub> | <sub><sup>**Hendrycks2019Using**</sup></sub> | <sub>*[Using Pre-Training Can Improve Model Robustness and Uncertainty](https://arxiv.org/abs/1901.09960)*</sub> | <sub>87.11%</sub> | <sub>54.92%</sub> | <sub>WideResNet-28-10</sub> | <sub>ICML 2019</sub> |
| <sub>**59**</sub> | <sub><sup>**Pang2020Boosting**</sup></sub> | <sub>*[Boosting Adversarial Training with Hypersphere Embedding](https://arxiv.org/abs/2002.08619)*</sub> | <sub>85.14%</sub> | <sub>53.74%</sub> | <sub>WideResNet-34-20</sub> | <sub>NeurIPS 2020</sub> |
| <sub>**60**</sub> | <sub><sup>**Cui2020Learnable_34_20**</sup></sub> | <sub>*[Learnable Boundary Guided Adversarial Training](https://arxiv.org/abs/2011.11164)*</sub> | <sub>88.70%</sub> | <sub>53.57%</sub> | <sub>WideResNet-34-20</sub> | <sub>ICCV 2021</sub> |
| <sub>**61**</sub> | <sub><sup>**Zhang2020Attacks**</sup></sub> | <sub>*[Attacks Which Do Not Kill Training Make Adversarial Learning Stronger](https://arxiv.org/abs/2002.11242)*</sub> | <sub>84.52%</sub> | <sub>53.51%</sub> | <sub>WideResNet-34-10</sub> | <sub>ICML 2020</sub> |
| <sub>**62**</sub> | <sub><sup>**Rice2020Overfitting**</sup></sub> | <sub>*[Overfitting in adversarially robust deep learning](https://arxiv.org/abs/2002.11569)*</sub> | <sub>85.34%</sub> | <sub>53.42%</sub> | <sub>WideResNet-34-20</sub> | <sub>ICML 2020</sub> |
| <sub>**63**</sub> | <sub><sup>**Huang2020Self**</sup></sub> | <sub>*[Self-Adaptive Training: beyond Empirical Risk Minimization](https://arxiv.org/abs/2002.10319)*</sub> | <sub>83.48%</sub> | <sub>53.34%</sub> | <sub>WideResNet-34-10</sub> | <sub>NeurIPS 2020</sub> |
| <sub>**64**</sub> | <sub><sup>**Zhang2019Theoretically**</sup></sub> | <sub>*[Theoretically Principled Trade-off between Robustness and Accuracy](https://arxiv.org/abs/1901.08573)*</sub> | <sub>84.92%</sub> | <sub>53.08%</sub> | <sub>WideResNet-34-10</sub> | <sub>ICML 2019</sub> |
| <sub>**65**</sub> | <sub><sup>**Cui2020Learnable_34_10**</sup></sub> | <sub>*[Learnable Boundary Guided Adversarial Training](https://arxiv.org/abs/2011.11164)*</sub> | <sub>88.22%</sub> | <sub>52.86%</sub> | <sub>WideResNet-34-10</sub> | <sub>ICCV 2021</sub> |
| <sub>**66**</sub> | <sub><sup>**Addepalli2022Efficient_RN18**</sup></sub> | <sub>*[Efficient and Effective Augmentation Strategy for Adversarial Training](https://arxiv.org/abs/2210.15318)*</sub> | <sub>85.71%</sub> | <sub>52.48%</sub> | <sub>ResNet-18</sub> | <sub>NeurIPS 2022</sub> |
| <sub>**67**</sub> | <sub><sup>**Chen2020Adversarial**</sup></sub> | <sub>*[Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuning](https://arxiv.org/abs/2003.12862)*</sub> | <sub>86.04%</sub> | <sub>51.56%</sub> | <sub>ResNet-50 <br/> (3x ensemble)</sub> | <sub>CVPR 2020</sub> |
| <sub>**68**</sub> | <sub><sup>**Chen2020Efficient**</sup></sub> | <sub>*[Efficient Robust Training via Backward Smoothing](https://arxiv.org/abs/2010.01278)*</sub> | <sub>85.32%</sub> | <sub>51.12%</sub> | <sub>WideResNet-34-10</sub> | <sub>arXiv, Oct 2020</sub> |
| <sub>**69**</sub> | <sub><sup>**Addepalli2021Towards_RN18**</sup></sub> | <sub>*[Scaling Adversarial Training to Large Perturbation Bounds](https://arxiv.org/abs/2210.09852)*</sub> | <sub>80.24%</sub> | <sub>51.06%</sub> | <sub>ResNet-18</sub> | <sub>ECCV 2022</sub> |
| <sub>**70**</sub> | <sub><sup>**Sitawarin2020Improving**</sup></sub> | <sub>*[Improving Adversarial Robustness Through Progressive Hardening](https://arxiv.org/abs/2003.09347)*</sub> | <sub>86.84%</sub> | <sub>50.72%</sub> | <sub>WideResNet-34-10</sub> | <sub>arXiv, Mar 2020</sub> |
| <sub>**71**</sub> | <sub><sup>**Engstrom2019Robustness**</sup></sub> | <sub>*[Robustness library](https://github.com/MadryLab/robustness)*</sub> | <sub>87.03%</sub> | <sub>49.25%</sub> | <sub>ResNet-50</sub> | <sub>GitHub,<br>Oct 2019</sub> |
| <sub>**72**</sub> | <sub><sup>**Zhang2019You**</sup></sub> | <sub>*[You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle](https://arxiv.org/abs/1905.00877)*</sub> | <sub>87.20%</sub> | <sub>44.83%</sub> | <sub>WideResNet-34-10</sub> | <sub>NeurIPS 2019</sub> |
| <sub>**73**</sub> | <sub><sup>**Andriushchenko2020Understanding**</sup></sub> | <sub>*[Understanding and Improving Fast Adversarial Training](https://arxiv.org/abs/2007.02617)*</sub> | <sub>79.84%</sub> | <sub>43.93%</sub> | <sub>PreActResNet-18</sub> | <sub>NeurIPS 2020</sub> |
| <sub>**74**</sub> | <sub><sup>**Wong2020Fast**</sup></sub> | <sub>*[Fast is better than free: Revisiting adversarial training](https://arxiv.org/abs/2001.03994)*</sub> | <sub>83.34%</sub> | <sub>43.21%</sub> | <sub>PreActResNet-18</sub> | <sub>ICLR 2020</sub> |
| <sub>**75**</sub> | <sub><sup>**Ding2020MMA**</sup></sub> | <sub>*[MMA Training: Direct Input Space Margin Maximization through Adversarial Training](https://openreview.net/forum?id=HkeryxBtPB)*</sub> | <sub>84.36%</sub> | <sub>41.44%</sub> | <sub>WideResNet-28-4</sub> | <sub>ICLR 2020</sub> |
| <sub>**76**</sub> | <sub><sup>**Standard**</sup></sub> | <sub>*[Standardly trained model](https://github.com/RobustBench/robustbench/)*</sub> | <sub>94.78%</sub> | <sub>0.00%</sub> | <sub>WideResNet-28-10</sub> | <sub>N/A</sub> |



#### L2, eps=0.5

|   <sub>#</sub>    | <sub>Model ID</sub>                                            | <sub>Paper</sub>                                                                                                                                                               | <sub>Clean accuracy</sub> | <sub>Robust accuracy</sub> |   <sub>Architecture</sub>   |        <sub>Venue</sub>         |
| :---------------: | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :-----------------------: | :------------------------: | :-------------------------: | :-----------------------------: |
| <sub>**1**</sub>  | <sub><sup>**Wang2023Better_WRN-70-16**</sup></sub> | <sub>*[Better Diffusion Models Further Improve Adversarial Training](https://arxiv.org/abs/2302.04638)*</sub> | <sub>95.54%</sub> | <sub>84.97%</sub> | <sub>WideResNet-70-16</sub> | <sub>arXiv, Feb 2023</sub> |
| <sub>**2**</sub> | <sub><sup>**Amini2024MeanSparse_S-WRN-70-16**</sup></sub> | <sub>*[MeanSparse: Post-Training Robustness Enhancement Through Mean-Centered Feature Sparsification](https://arxiv.org/abs/2406.05927)*</sub> | <sub>95.51%</sub> | <sub>84.33%</sub> | <sub>MeanSparse WideResNet-70-16</sub> | <sub>arXiv, Jun 2024</sub> |
| <sub>**3**</sub> | <sub><sup>**Wang2023Better_WRN-28-10**</sup></sub> | <sub>*[Better Diffusion Models Further Improve Adversarial Training](https://arxiv.org/abs/2302.04638)*</sub> | <sub>95.16%</sub> | <sub>83.68%</sub> | <sub>WideResNet-28-10</sub> | <sub>ICML 2023</sub> |
| <sub>**4**</sub> | <sub><sup>**Rebuffi2021Fixing_70_16_cutmi