jiamingzz/natural-jammers

Natural Jammers: robust lenses

Robust models used in Natural Jammers: When Non-Robust Features Become Antagonistic (NeurIPS 2026, Spotlight). Each robust model is paired with the standard torchvision model of the same architecture to find the Jammed Set: clean ImageNet validation images that the standard model gets wrong and the robust model gets right.

Code: https://github.com/jiamingzhang94/natural-jammers · Project page: https://jiamingzhang.netlify.app/naturaljammers

The paper uses the 17 robust models below (Table 3). The ResNet and WideResNet models are the public MadryLab checkpoints, hosted at madrylab/robust-imagenet-models; the two ViTs are hosted in this repository. The primary lens of the paper is ResNet-50, ℓ2, ε = 1. Clean accuracy is that of the robust model; Jammed images are counted on the 50,000 ImageNet validation images.

Robust model	Threat model	Clean accuracy	Jammed images	Weights
ResNet-18	ℓ2, ε = 0.5	65.5%	2,639 (5.28%)	resnet18_l2_eps0.5.ckpt (MadryLab)
ResNet-18	ℓ2, ε = 1	62.3%	2,448 (4.90%)	resnet18_l2_eps1.ckpt (MadryLab)
ResNet-18	ℓ2, ε = 3	53.1%	1,924 (3.85%)	resnet18_l2_eps3.ckpt (MadryLab)
ResNet-18	ℓ∞, ε = 1/255	63.5%	2,502 (5.00%)	resnet18_linf_eps1.0.ckpt (MadryLab)
ResNet-18	ℓ∞, ε = 4/255	52.5%	1,867 (3.73%)	resnet18_linf_eps4.0.ckpt (MadryLab)
ResNet-50	ℓ2, ε = 0.5	73.2%	2,317 (4.63%)	resnet50_l2_eps0.5.ckpt (MadryLab)
ResNet-50	ℓ2, ε = 1	70.4%	2,140 (4.28%)	resnet50_l2_eps1.ckpt (MadryLab)
ResNet-50	ℓ2, ε = 3	62.8%	1,807 (3.61%)	resnet50_l2_eps3.ckpt (MadryLab)
ResNet-50	ℓ∞, ε = 1/255	72.0%	2,252 (4.50%)	resnet50_linf_eps1.0.ckpt (MadryLab)
ResNet-50	ℓ∞, ε = 4/255	63.9%	1,812 (3.62%)	resnet50_linf_eps4.0.ckpt (MadryLab)
WideResNet-50-2	ℓ2, ε = 0.5	75.1%	2,202 (4.40%)	wide_resnet50_2_l2_eps0.5.ckpt (MadryLab)
WideResNet-50-2	ℓ2, ε = 1	73.4%	2,167 (4.33%)	wide_resnet50_2_l2_eps1.ckpt (MadryLab)
WideResNet-50-2	ℓ2, ε = 3	66.9%	1,910 (3.82%)	wide_resnet50_2_l2_eps3.ckpt (MadryLab)
WideResNet-50-2	ℓ∞, ε = 1/255	74.7%	2,232 (4.46%)	wide_resnet50_2_linf_eps1.0.ckpt (MadryLab)
WideResNet-50-2	ℓ∞, ε = 4/255	68.4%	2,000 (4.00%)	wide_resnet50_2_linf_eps4.0.ckpt (MadryLab)
ViT-B/16	ℓ∞, ε = 1/255	73.3%	1,569 (3.14%)	vit_b_16_linf_eps1.0.safetensors (this repository)
ViT-B/32	ℓ∞, ε = 1/255	66.5%	1,828 (3.66%)	vit_b_32_linf_eps1.0.safetensors (this repository)

download_weights.py in the code repository fetches any of them. The ViT files are plain torchvision state_dicts in safetensors format:

import torchvision
from safetensors.torch import load_file

model = torchvision.models.vit_b_32()
model.load_state_dict(load_file('vit_b_32_linf_eps1.0.safetensors'))
model.eval()  # inputs: resize 256, center crop 224, [0, 1], ImageNet mean/std normalization

Intended use. Research on robustness. SHA-256 checksums of the ViT files are in manifest.json.

@inproceedings{zhang2026natural,
  title     = {Natural Jammers: When Non-Robust Features Become Antagonistic},
  author    = {Zhang, Jiaming and Zhang, Fuyao and Xie, Pengjun and Lim, Wei Yang Bryan},
  booktitle = {Advances in Neural Information Processing Systems},
  year      = {2026}
}