Systematic Evaluation of Robustness in Fine-tuned Models

Angela John; Hamayoon Behmanush

cs.CVNov 1, 2026

Systematic Evaluation of Robustness in Fine-tuned Models

Authors: Angela John, Hamayoon Behmanush

Organizations: Saarland Informatics Campus, Saarland University

Abstract

Our study systematically evaluates the robustness of fine-tuned pre-trained models across different datasets and attack types, aiming to provide insights for researchers in selecting pre-trained models for image classification tasks while prioritizing robustness against potential attacks. Our work explores the influence of fine-tuning pre-trained models with different datasets and attack types on their robustness and overview of the appropriate pre-trained model for image classification based on factors such as computation resources, memory usage, and accuracy on clean data. We fine-tune the models with weights. Evaluate the models on data before any attack and after different attack cases. The study utilizes publicly available image datasets such as MNIST, CIFAR10, CIFAR100, and SVHN to assess the robustness of pre-trained models. The results indicate that the robustness of fine-tuned models varies across different data distributions and sample sizes, emphasizing the need for tailored selection based on specific task requirements. The findings also highlight the varying performance of ResNet50, DenseNet, and MobileNet in defending against attacks on different datasets. Overall, this research provides valuable insights into the robustness of fine-tuned pre-trained models and their suitability for real-world applications in image classification.

Figures & tables

Figure 3: Mobile-net with PGD attack for MNIST data Results

Pretrained Model	CIFAR10	CIFAR100	MNIST	SVHN
Dense-Net
Accuracy	88.37	66.05	99.66	93.88
Epoch with best Results	60	56	17	54
Mobile-net
Accuracy	86.20	61.09	99.49	93.42
Epoch with best Results	55	59	41	53

Table 1: Evaluation on Clean Model

Pretrained Model	CIFAR10	CIFAR100	MNIST	SVHN
Dense-Net
Minimum Adv Accuracy	17.24	4.79	24.68	26.82
Maximum Adv Accuracy	50.76	21.24	76.34	68.17
Mobile-net
Minimum Adv Accuracy	32.73	10.97	90.13	57.65
Maximum Adv Accuracy	43.09	17.79	92.25	69.49

Table 2: Random Uniform Gaussian Attack Case

Pretrained Model	CIFAR10	CIFAR100	MNIST	SVHN
Dense-Net
Minimum Adv Accuracy	17.74	4.79	33.24	26.82
Maximum Adv Accuracy	50.79	21.24	78.24	68.17
Mobile-net
Minimum Adv Accuracy	12.89	3.49	10.22	20.15
Maximum Adv Accuracy	36.81	17.82	96.06	67.94

Table 3: Fast Gradient Sign Method(FGSM)Attack Case

Pretrained Model	CIFAR10	CIFAR100	MNIST	SVHN
Dense-Net
Minimum Adv Accuracy	17.60	5.59	21.23	28.28
Maximum Adv Accuracy	48.71	21.70	69.23	67.82
Mobile-net
Minimum Adv Accuracy	14.35	4.10	69.62	22.80
Maximum Adv Accuracy	41.65	17.02	91.10	67.90

Table 4: Projected Gradient Descent attack(PGD) Attack Case

Adversarial Robustness

Adversarial robustness studies how well AI systems withstand deliberately crafted inputs, training-data corruption, and other attacks.

See all 487 papers

Large Pretraining Datasets Don't Guarantee Robustness after Fine-Tuning in Image Classification
Oct 28, 2024Jaedong Hwang, Brian Cheung, Zhang-Wei Hong +3Neural Network Robustness OOD Generalization
Massachusetts Institute of Technology
A Mechanistic Analysis of Adversarial Fine-tuning of Vision Transformers
May 28, 2026Hannah Gao, Isha Agarwal, Dylan Hadfield-Menell +1Adversarial Training Fine-Tuning
Massachusetts Institute of Technology · MIT Cambridge, MA
FACT: A Simple and Efficient Framework for Active Finetuning
Jun 1, 2026Wenshuai Xu, You Song, Yuzhuo Cui +3Active Learning Image Classification

Oct 28, 2024J/K move · Enter open · S save

Large Pretraining Datasets Don't Guarantee Robustness after Fine-Tuning in Image Classification

Jaedong Hwang, Brian Cheung, Zhang-Wei Hong, Akhilan Boopathy+2

Massachusetts Institute of Technology

Neural Network Robustness OOD Generalization Vision Foundation Model Adaptation Image Classification Catastrophic Forgetting Robust Classification

Open paper AskPDF arXiv

Large-scale pretrained models are widely leveraged as foundations for learning new specialized tasks via fine-tuning, with the goal of maintaining the general performance of the model while allowing it to gain new skills. A valuable goal for all such models is robustness: the ability to perform well on out-of-distribution (OOD) tasks. We assess whether fine-tuning preserves the overall robustness of the pretrained model in image classification, and observed that models pretrained on large datasets exhibited strong catastrophic forgetting and loss of OOD generalization. To systematically assess robustness preservation in fine-tuned models, we propose the Robustness Inheritance Benchmark (ImageNet-RIB). The benchmark, which can be applied to any pretrained model, consists of a set of related but distinct OOD (downstream) tasks and involves fine-tuning on one of the OOD tasks in the set then testing on the rest. We find that though continual learning methods help, fine-tuning reduces robustness across pretrained models. Surprisingly, models pretrained on the largest and most diverse datasets (e.g., LAION-2B) exhibit both larger robustness losses and lower absolute robustness after fine-tuning on small datasets, relative to models pretrained on smaller datasets. We observe this collapse in contrastively pretrained (CLIP) models and their fine-tuned variants, where it grows with pretraining scale; the supervised models we test do not exhibit it. These findings suggest that starting with the strongest foundation model is not necessarily the best approach for performance on specialist tasks. https://jd730.github.io/projects/ImageNet-RIB

Abstract

Adversarial Robustness

Explore similar work

Large Pretraining Datasets Don't Guarantee Robustness after Fine-Tuning in Image Classification

A Mechanistic Analysis of Adversarial Fine-tuning of Vision Transformers

FACT: A Simple and Efficient Framework for Active Finetuning