From: Gaussian class-conditional simplex loss for accurate, adversarially robust deep classifier training
Method | MNIST ResNet-18 | FMNIST ResNet-18 | SVHN ResNet-18 | CIFAR-10 ResNet-18 | CIFAR-10 Shake-Shake-96 | CIFAR-100 Shake-Shake-112 |
---|---|---|---|---|---|---|
GCCS (regular training) | 18.50 ± 1.45 | 7.64 ± 5.42 | 5.37 ± 0.65 | 2.89 ± 1.01 | 9.21 ± 3.52 | 2.34 ± 0.87 |
GCCS (fine-tuning) | 18.11 ± 1.59 | 8.29 ± 5.69 | 7.33 ± 0.85 | 2.91 ± 1.22 | 9.57 ± 3.16 | 2.16 ± 0.51 |
No Defense (cross-entropy loss) | 3.12 ± 0.71 | 3.13 ± 1.24 | 1.94 ± 0.21 | 1.71 ± 0.31 | 2.71 ± 0.48 | 1.62 ± 0.26 |
Jacobian Reg. (regular training) [53] | 3.35 ± 1.01 | 3.64 ± 1.22 | 1.94 ± 0.21 | 2.03 ± 0.68 | - | - |
Jacobian Reg. (fine-tuning)[53] | 4.09 ± 0.81 | 3.71 ± 1.24 | 2.43 ± 0.26 | 2.35 ± 0.63 | - | - |
Input Gradient Reg. (regular training) [44] | 3.70 ± 0.92 | 2.71 ± 0.85 | 2.12 ± 0.24 | 1.57 ± 0.24 | 2.70 ± 0.55 | 1.63 ± 0.27 |
Input Gradient Reg. (fine-tuning) [44] | 3.65 ± 0.97 | 3.18 ± 1.03 | 2.11 ± 0.27 | 1.68 ± 0.31 | 2.97 ± 0.59 | 1.60 ± 0.25 |
Cross Lipschitz (regular training) [52] | 4.43 ± 1.07 | 4.44 ± 3.24 | 2.40 ± 0.29 | 1.91 ± 0.41 | - | - |
Cross Lipschitz (fine-tuning) [52] | 6.72 ± 2.23 | 4.42 ± 3.09 | 2.62 ± 0.28 | 1.85 ± 0.31 | - | - |