---
license: mit
library_name: pytorch
tags:
- adversarial-robustness
- image-classification
- imagenet
- natural-jammers
datasets:
- imagenet-1k
---

# Natural Jammers: robust lenses

Robust models used in **Natural Jammers: When Non-Robust Features Become Antagonistic**
(**NeurIPS 2026, Spotlight**). Each robust model is paired with the standard torchvision model of the same
architecture to find the Jammed Set: clean ImageNet validation images that the standard model gets wrong and the
robust model gets right.

Paper: https://arxiv.org/abs/2610.34785 · Code: https://github.com/jiamingzhang94/natural-jammers · Project page: https://jiamingzhang.netlify.app/naturaljammers

The paper uses the 17 robust models below (Table 3). The ResNet and WideResNet models are the public MadryLab
checkpoints, hosted at [madrylab/robust-imagenet-models](https://huggingface.co/madrylab/robust-imagenet-models);
the two ViTs are hosted in this repository. The primary lens of the paper is ResNet-50, ℓ2, ε = 1.
Clean accuracy is that of the robust model; Jammed images are counted on the 50,000 ImageNet validation images.

| Robust model | Threat model | Clean accuracy | Jammed images | Weights |
| --- | --- | --- | --- | --- |
| ResNet-18 | ℓ2, ε = 0.5 | 65.5% | 2,639 (5.28%) | [`resnet18_l2_eps0.5.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet18_l2_eps0.5.ckpt) (MadryLab) |
| ResNet-18 | ℓ2, ε = 1 | 62.3% | 2,448 (4.90%) | [`resnet18_l2_eps1.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet18_l2_eps1.ckpt) (MadryLab) |
| ResNet-18 | ℓ2, ε = 3 | 53.1% | 1,924 (3.85%) | [`resnet18_l2_eps3.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet18_l2_eps3.ckpt) (MadryLab) |
| ResNet-18 | ℓ∞, ε = 1/255 | 63.5% | 2,502 (5.00%) | [`resnet18_linf_eps1.0.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet18_linf_eps1.0.ckpt) (MadryLab) |
| ResNet-18 | ℓ∞, ε = 4/255 | 52.5% | 1,867 (3.73%) | [`resnet18_linf_eps4.0.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet18_linf_eps4.0.ckpt) (MadryLab) |
| ResNet-50 | ℓ2, ε = 0.5 | 73.2% | 2,317 (4.63%) | [`resnet50_l2_eps0.5.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet50_l2_eps0.5.ckpt) (MadryLab) |
| ResNet-50 | ℓ2, ε = 1 | 70.4% | 2,140 (4.28%) | [`resnet50_l2_eps1.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet50_l2_eps1.ckpt) (MadryLab) |
| ResNet-50 | ℓ2, ε = 3 | 62.8% | 1,807 (3.61%) | [`resnet50_l2_eps3.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet50_l2_eps3.ckpt) (MadryLab) |
| ResNet-50 | ℓ∞, ε = 1/255 | 72.0% | 2,252 (4.50%) | [`resnet50_linf_eps1.0.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet50_linf_eps1.0.ckpt) (MadryLab) |
| ResNet-50 | ℓ∞, ε = 4/255 | 63.9% | 1,812 (3.62%) | [`resnet50_linf_eps4.0.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/resnet50_linf_eps4.0.ckpt) (MadryLab) |
| WideResNet-50-2 | ℓ2, ε = 0.5 | 75.1% | 2,202 (4.40%) | [`wide_resnet50_2_l2_eps0.5.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/wide_resnet50_2_l2_eps0.5.ckpt) (MadryLab) |
| WideResNet-50-2 | ℓ2, ε = 1 | 73.4% | 2,167 (4.33%) | [`wide_resnet50_2_l2_eps1.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/wide_resnet50_2_l2_eps1.ckpt) (MadryLab) |
| WideResNet-50-2 | ℓ2, ε = 3 | 66.9% | 1,910 (3.82%) | [`wide_resnet50_2_l2_eps3.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/wide_resnet50_2_l2_eps3.ckpt) (MadryLab) |
| WideResNet-50-2 | ℓ∞, ε = 1/255 | 74.7% | 2,232 (4.46%) | [`wide_resnet50_2_linf_eps1.0.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/wide_resnet50_2_linf_eps1.0.ckpt) (MadryLab) |
| WideResNet-50-2 | ℓ∞, ε = 4/255 | 68.4% | 2,000 (4.00%) | [`wide_resnet50_2_linf_eps4.0.ckpt`](https://huggingface.co/madrylab/robust-imagenet-models/blob/main/wide_resnet50_2_linf_eps4.0.ckpt) (MadryLab) |
| ViT-B/16 | ℓ∞, ε = 1/255 | 73.3% | 1,569 (3.14%) | `vit_b_16_linf_eps1.0.safetensors` (this repository) |
| ViT-B/32 | ℓ∞, ε = 1/255 | 66.5% | 1,828 (3.66%) | `vit_b_32_linf_eps1.0.safetensors` (this repository) |

`download_weights.py` in the code repository fetches any of them. The ViT files are plain torchvision
`state_dict`s in safetensors format:

```python
import torchvision
from safetensors.torch import load_file

model = torchvision.models.vit_b_32()
model.load_state_dict(load_file('vit_b_32_linf_eps1.0.safetensors'))
model.eval()  # inputs: resize 256, center crop 224, [0, 1], ImageNet mean/std normalization
```

**Intended use.** Research on robustness. SHA-256 checksums of the ViT files are in `manifest.json`.

```bibtex
@inproceedings{zhang2026natural,
  title     = {Natural Jammers: When Non-Robust Features Become Antagonistic},
  author    = {Zhang, Jiaming and Zhang, Fuyao and Xie, Pengjun and Lim, Wei Yang Bryan},
  booktitle = {Advances in Neural Information Processing Systems},
  year      = {2026}
}
```