Research map / Adversarial robustness and security / Attacks on text and graphs
Understanding Zero-shot Adversarial Robustness for Large-Scale Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add text-guided contrastive adversarial training (TeCoA) instead of standard cross-entropy adversarial training | finetuning (FT) · ImageNet + 15 zero-shot datasets, PGD-100 eps=1/255 | average robust accuracy: 10.62 -> 38.18 | Helped |
| add text-guided contrastive adversarial training (TeCoA) instead of standard adversarial training | visual prompt tuning (VPT) · ImageNet + 15 zero-shot datasets, PGD-100 eps=1/255 | average robust accuracy: 31.84 -> 32.00 | Mixed |
| use one-hot contrastive loss (CoAdv.) instead of text-guided contrastive loss (ablation) | finetuning · ImageNet + 15 zero-shot datasets, PGD-100 eps=1/255 | average robust accuracy: 38.18 -> 7.83 | Hurt |
| use image-only contrastive adversarial training (ImgCoAdv.) (ablation) | finetuning and VPT · ImageNet + 15 zero-shot datasets, PGD-100 eps=1/255 | average robust accuracy: FT 4.65 and VPT 5.51, versus CLIP 6.57 | Hurt |
| visual prompt tuning with standard adversarial training instead of plain CE (ablation) | VPT · ImageNet + 15 zero-shot datasets, PGD-100 eps=1/255 | average robust accuracy: 7.79 -> 31.84 | Helped |
| standard adversarial training with cross-entropy loss instead of plain CE (ablation) | finetuning · ImageNet + 15 zero-shot datasets, PGD-100 eps=1/255 | average robust accuracy: FT (CE) 14.98 -> FT (Adv.) 10.62 on average; ImageNet 9.13 -> 45.12 | Mixed |
| remove ground-truth labels and use CLIP pseudo text labels for TeCoA (ablation) | VPT and FT · ImageNet + 15 zero-shot datasets, PGD-100 eps=1/255 | average robust accuracy: VPT 32.00 -> 32.40; FT 38.18 -> 36.63 | No clear effect |
| use TeCoA with finetuning instead of VPT under AutoAttack | finetuning vs VPT · AutoAttack eps=1/255 average | average robust accuracy: 29.90 -> 37.02 | Helped |
| add TeCoA training to CLIP (finetuning) evaluated under stronger AutoAttack | finetuning · AutoAttack eps=4/255 average | average robust accuracy: 0.06 -> 9.04 | Helped |
| finetuning with TeCoA lowers clean accuracy relative to CLIP on average | finetuning · 16 datasets clean accuracy | average clean accuracy: 64.56 -> 55.97 | Hurt |
Closest papers by meaning
- On the Zero-shot Adversarial Robustness of Vision-Language Models: A Truly Zero-shot and Training-free Approach (CVPR 2025 · similarity 0.93)
- Text-Guided Attention is All You Need for Zero-Shot Robustness in Vision-Language Models (NeurIPS 2024 · similarity 0.93)
- Pre-trained Model Guided Fine-Tuning for Zero-Shot Adversarial Robustness (CVPR 2024 · similarity 0.91)
- CLIP is Strong Enough to Fight Back: Test-time Counterattacks towards Zero-shot Adversarial Robustness of CLIP (CVPR 2025 · similarity 0.91)
- Improving Zero-Shot Adversarial Robustness in Vision-Language Models by Closed-form Alignment of Adversarial Path Simplices (ICML 2025 · similarity 0.91)
- One Prompt Word is Enough to Boost Adversarial Robustness for Pre-trained Vision-Language Models (CVPR 2024 · similarity 0.91)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.