| --- |
| license: mit |
| library_name: pytorch |
| tags: |
| - adversarial-robustness |
| - image-classification |
| - imagenet |
| - natural-jammers |
| datasets: |
| - imagenet-1k |
| --- |
| |
| # Natural Jammers: robust lenses |
|
|
| Robust models used in **Natural Jammers: When Non-Robust Features Become Antagonistic** |
| (**NeurIPS 2026, Spotlight**). Each robust model is paired with the standard torchvision model of the same |
| architecture to find the Jammed Set: clean ImageNet validation images that the standard model gets wrong and the |
| robust model gets right. |
|
|
| Paper: https://arxiv.org/abs/2610.34785 · Code: https://github.com/jiamingzhang94/natural-jammers · Project page: https://jiamingzhang.netlify.app/naturaljammers |
|
|
| The paper uses the 17 robust models below (Table 3). The ResNet and WideResNet models are the public MadryLab |
| checkpoints, hosted at [madrylab/robust-imagenet-models](https://huggingface.co/madrylab/robust-imagenet-models); |
| the two ViTs are hosted in this repository. The primary lens of the paper is ResNet-50, ℓ2, ε = 1. |
| Clean accuracy is that of the robust model; Jammed images are counted on the 50,000 ImageNet validation images. |
|
|
| | Robust model | Threat model | Clean accuracy | Jammed images | Weights | |
| | --- | --- | --- | --- | --- | |
| | ResNet-18 | ℓ2, ε = 0.5 | 65.5% | 2,639 (5.28%) | [`resnet18_l2_eps0.5.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet18_l2_eps0.5.ckpt) (MadryLab) | |
| | ResNet-18 | ℓ2, ε = 1 | 62.3% | 2,448 (4.90%) | [`resnet18_l2_eps1.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet18_l2_eps1.ckpt) (MadryLab) | |
| | ResNet-18 | ℓ2, ε = 3 | 53.1% | 1,924 (3.85%) | [`resnet18_l2_eps3.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet18_l2_eps3.ckpt) (MadryLab) | |
| | ResNet-18 | ℓ∞, ε = 1/255 | 63.5% | 2,502 (5.00%) | [`resnet18_linf_eps1.0.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet18_linf_eps1.0.ckpt) (MadryLab) | |
| | ResNet-18 | ℓ∞, ε = 4/255 | 52.5% | 1,867 (3.73%) | [`resnet18_linf_eps4.0.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet18_linf_eps4.0.ckpt) (MadryLab) | |
| | ResNet-50 | ℓ2, ε = 0.5 | 73.2% | 2,317 (4.63%) | [`resnet50_l2_eps0.5.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet50_l2_eps0.5.ckpt) (MadryLab) | |
| | ResNet-50 | ℓ2, ε = 1 | 70.4% | 2,140 (4.28%) | [`resnet50_l2_eps1.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet50_l2_eps1.ckpt) (MadryLab) | |
| | ResNet-50 | ℓ2, ε = 3 | 62.8% | 1,807 (3.61%) | [`resnet50_l2_eps3.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet50_l2_eps3.ckpt) (MadryLab) | |
| | ResNet-50 | ℓ∞, ε = 1/255 | 72.0% | 2,252 (4.50%) | [`resnet50_linf_eps1.0.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet50_linf_eps1.0.ckpt) (MadryLab) | |
| | ResNet-50 | ℓ∞, ε = 4/255 | 63.9% | 1,812 (3.62%) | [`resnet50_linf_eps4.0.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet50_linf_eps4.0.ckpt) (MadryLab) | |
| | WideResNet-50-2 | ℓ2, ε = 0.5 | 75.1% | 2,202 (4.40%) | [`wide_resnet50_2_l2_eps0.5.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/wide_resnet50_2_l2_eps0.5.ckpt) (MadryLab) | |
| | WideResNet-50-2 | ℓ2, ε = 1 | 73.4% | 2,167 (4.33%) | [`wide_resnet50_2_l2_eps1.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/wide_resnet50_2_l2_eps1.ckpt) (MadryLab) | |
| | WideResNet-50-2 | ℓ2, ε = 3 | 66.9% | 1,910 (3.82%) | [`wide_resnet50_2_l2_eps3.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/wide_resnet50_2_l2_eps3.ckpt) (MadryLab) | |
| | WideResNet-50-2 | ℓ∞, ε = 1/255 | 74.7% | 2,232 (4.46%) | [`wide_resnet50_2_linf_eps1.0.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/wide_resnet50_2_linf_eps1.0.ckpt) (MadryLab) | |
| | WideResNet-50-2 | ℓ∞, ε = 4/255 | 68.4% | 2,000 (4.00%) | [`wide_resnet50_2_linf_eps4.0.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/wide_resnet50_2_linf_eps4.0.ckpt) (MadryLab) | |
| | ViT-B/16 | ℓ∞, ε = 1/255 | 73.3% | 1,569 (3.14%) | `vit_b_16_linf_eps1.0.safetensors` (this repository) | |
| | ViT-B/32 | ℓ∞, ε = 1/255 | 66.5% | 1,828 (3.66%) | `vit_b_32_linf_eps1.0.safetensors` (this repository) | |
|
|
| `download_weights.py` in the code repository fetches any of them. The ViT files are plain torchvision |
| `state_dict`s in safetensors format: |
|
|
| ```python |
| import torchvision |
| from safetensors.torch import load_file |
| |
| model = torchvision.models.vit_b_32() |
| model.load_state_dict(load_file('vit_b_32_linf_eps1.0.safetensors')) |
| model.eval() # inputs: resize 256, center crop 224, [0, 1], ImageNet mean/std normalization |
| ``` |
|
|
| **Intended use.** Research on robustness. SHA-256 checksums of the ViT files are in `manifest.json`. |
|
|
| ```bibtex |
| @inproceedings{zhang2026natural, |
| title = {Natural Jammers: When Non-Robust Features Become Antagonistic}, |
| author = {Zhang, Jiaming and Zhang, Fuyao and Xie, Pengjun and Lim, Wei Yang Bryan}, |
| booktitle = {Advances in Neural Information Processing Systems}, |
| year = {2026} |
| } |
| ``` |
|
|
