AutoAttack

anchor

Parameter-free ensemble of adversarial attacks used as a standard robustness benchmark.

Findings

• IC-028SPADE, an abstaining classifier built on top of ResNet, ViT, and VGG models, detects out-of-distribution and adversarial samples with provable guarantees. [eval]
• IC-448CLIP ViT-L/14 achieves 0% accuracy under 2/255 and 4/255 L-infinity adversarial perturbations across all 15 evaluation datasets [eval]