CIFAR

CIFAR-10 and CIFAR-100 are two labelled sets of small colour photographs, each of 60,000 images of $32 \times 32$ pixels, selected by hand from the 80 Million Tiny Images collection. Alex Krizhevsky described them in a University of Toronto report dated April 2009; the official page credits Krizhevsky, Vinod Nair and Geoffrey Hinton with creating them, and the name comes from the Canadian Institute for Advanced Research, which funded the work. CIFAR-10 has 10 classes of 6,000 images, CIFAR-100 100 classes of 600 images grouped into 20 superclasses, and both split 50,000 images for training and 10,000 for testing. Small enough that a network trains on them in minutes to hours, they became, in Barz and Denzler’s (2020) description, two of the most heavily benchmarked datasets in computer vision, the small-scale counterpart of ImageNet for image classification. Their source collection was withdrawn in 2020, and later studies found near-duplicates of test images in the training sets and built new test sets to measure how far published accuracy carries over.

Purpose

The report’s main subject was not a benchmark but unsupervised learning: training restricted Boltzmann machines and deep belief networks on millions of tiny images to learn features. Tiny Images had no reliable class labels, only the search term that had retrieved each image, which the report judges a very unreliable label. To test whether the learned features helped recognition, Krizhevsky had students label a subset, and released the result as CIFAR-10; CIFAR-100 had been completed only very recently, too late for the report’s experiments (Krizhevsky, 2009, §3.1). The CIFAR-100 classes do not overlap with CIFAR-10’s, so the report suggests them as negative examples for CIFAR-10.

Dataset Size

Version	Classes	Images per class	Training	Test	Image size	Source
CIFAR-10	10	6,000	50,000	10,000	$32 \times 32$ RGB	Report §3.1; official page
CIFAR-100	100 (20 superclasses)	600	50,000	10,000	$32 \times 32$ RGB	Report §3.1; official page

The report and the official page agree on these counts. The official page lists each archive (Python, MATLAB and binary versions) at 161–175 MB.

Classes

The ten CIFAR-10 classes are airplane, automobile, bird, cat, deer, dog, frog, horse, ship and truck. The official page calls them completely mutually exclusive: “automobile” includes sedans and SUVs, “truck” only big trucks, and neither includes pickup trucks, which are a CIFAR-100 class instead. Six of the ten classes are animals and four are vehicles; the report’s confusion matrix shows that its classifier seldom mistook an animal for a non-animal, apart from birds taken for planes, and often confused cats with dogs.

CIFAR-100 has 100 classes in 20 superclasses of five, and every image carries both a fine label (the class) and a coarse label (the superclass). The official page lists them as follows:

Superclass	Classes
aquatic mammals	beaver, dolphin, otter, seal, whale
fish	aquarium fish, flatfish, ray, shark, trout
flowers	orchids, poppies, roses, sunflowers, tulips
food containers	bottles, bowls, cans, cups, plates
fruit and vegetables	apples, mushrooms, oranges, pears, sweet peppers
household electrical devices	clock, computer keyboard, lamp, telephone, television
household furniture	bed, chair, couch, table, wardrobe
insects	bee, beetle, butterfly, caterpillar, cockroach
large carnivores	bear, leopard, lion, tiger, wolf
large man-made outdoor things	bridge, castle, house, road, skyscraper
large natural outdoor scenes	cloud, forest, mountain, plain, sea
large omnivores and herbivores	camel, cattle, chimpanzee, elephant, kangaroo
medium-sized mammals	fox, porcupine, possum, raccoon, skunk
non-insect invertebrates	crab, lobster, snail, spider, worm
people	baby, boy, girl, man, woman
reptiles	crocodile, dinosaur, lizard, snake, turtle
small mammals	hamster, mouse, rabbit, shrew, squirrel
trees	maple, oak, palm, pine, willow
vehicles 1	bicycle, bus, motorcycle, pickup truck, train
vehicles 2	lawn-mower, rocket, streetcar, tank, tractor

The idea, in the report’s words, is that classes within a superclass are similar and so harder to tell apart than classes from different superclasses. The grouping is semantic rather than taxonomic, as the page itself admits: mushrooms are filed under fruit and vegetables and bears under large carnivores. The report’s own class list (Appendix D) differs slightly from the page: its fish superclass has “ordinary fish (excluding trout and flatfish and salmon)” where the page has aquarium fish, and it names “cups, mugs, glasses” where the page has cups. The label names stored in the distributed files were not checked for this article.

Annotation Types

Each image has one class label (CIFAR-10) or one fine and one coarse label (CIFAR-100). There are no boxes, masks or attributes.

The labels came from filtering, not from free annotation. Every Tiny Images picture already carried the search term that found it, so each paid labeller took one class and went through all images retrieved by that class name and by its WordNet hyponyms; for “ship”, for example, also “cargo ship”, “ocean liner” and “frigate”. Labellers rejected images that did not belong to the class (Krizhevsky, 2009, §3.1). The main text summarizes the eight criteria of the instruction sheet (Appendix C of the report) in four, given here with the sheet’s details:

• The class name should be high on the list of likely answers to “What is in this picture?”
• The image should be photo-realistic: line drawings and cartoons were rejected, fairly photo-realistic drawings with internal texture accepted.
• The image should contain only one prominent instance of the object; images with several roughly equally prominent objects were rejected even if all belonged to the class.
• Partial occlusion and unusual viewpoints were acceptable if the object’s identity stayed clear, and cluttered or uniform backgrounds were no reason to reject.

The sheet adds that false positives are worse than false negatives, and that for ambiguous words such as “mouse” only the main meaning counts. Labellers were paid by the hour rather than per image, so that, as the report puts it, they had no incentive to rush, and the authors verified every submitted label themselves. Duplicates were then removed by comparing images with the L2 norm, using a threshold the report describes as liberal enough to catch re-saved JPEGs as well as perfect copies.

CIFAR-100 followed the same methodology according to the report, with one documented change: in Appendix D, labellers of classes with plural names were told not to reject images showing several instances. Barz and Denzler (2020, §4) found that CIFAR-100 also contains some line drawings and cartoons and some images with several instances of a class, and concluded that the original instructions seem to have been relaxed for it; they note that no separate CIFAR-100 instructions were published.

Splits

The training set received 5,000 randomly selected images of each CIFAR-10 class, and the remaining 1,000 per class form the test set (report §3.1; official page); for CIFAR-100 the official page gives 500 training and 100 test images per class. There is no official validation set.

The CIFAR-10 files divide the data into five training batches and one test batch of 10,000 images each. The test batch has exactly 1,000 randomly selected images of each class; the training batches hold the rest in random order, so an individual batch may contain more images of one class than another, but together they contain exactly 5,000 per class (official page). In the Python version each batch is a pickled dictionary whose data entry is a $10000 \times 3072$ array of 8-bit integers and whose labels entry lists the class indices. Each row holds the 1,024 red values of an image, then the 1,024 green and the 1,024 blue, each plane in row-major order. The binary version stores 3,073-byte records, one label byte followed by the 3,072 pixel bytes, and CIFAR-100’s binary records have two label bytes, coarse then fine. The page also provides, from Sivan Sabato, a file mapping each CIFAR-100 image to its index in Tiny Images, with 0 for images not from that collection.

The channel-planar layout is easy to get wrong when reading the raw arrays. The example below writes three synthetic images as CIFAR-100 binary records and reads them back.

import numpy as np

# Three synthetic 32x32 RGB images: a red disc, a green square, a blue bar.
y, x = np.mgrid[0:32, 0:32]
imgs = np.zeros((3, 32, 32, 3), np.uint8)               # image, height, width, channel
imgs[0][(y - 16) ** 2 + (x - 10) ** 2 < 36] = (220, 30, 30)
imgs[1][8:20, 18:30] = (30, 200, 60)
imgs[2][26:30, :] = (40, 60, 230)
coarse, fine = [5, 18, 0], [61, 8, 30]                  # arbitrary label values

# CIFAR-100 binary record: <coarse label><fine label><1024 red><1024 green><1024 blue>,
# each plane in row-major order (CIFAR-10 records have a single label byte).
planes = imgs.transpose(0, 3, 1, 2).reshape(3, 3072)    # channel-major rows
records = np.concatenate([np.array([coarse, fine], np.uint8).T, planes], axis=1)
blob = records.tobytes()
print("record length:", records.shape[1], "bytes; file of 3 images:", len(blob), "bytes")

# Reading it back.
rows = np.frombuffer(blob, np.uint8).reshape(-1, 3074)
c, f, pix = rows[:, 0], rows[:, 1], rows[:, 2:]
right = pix.reshape(-1, 3, 32, 32).transpose(0, 2, 3, 1)  # planes first, then to H x W x C
wrong = pix.reshape(-1, 32, 32, 3)                         # a common mistake
print("labels:", list(zip(c.tolist(), f.tolist())))
print("round trip exact:", np.array_equal(right, imgs))
print("pixel (16, 10) of image 0: right", right[0, 16, 10].tolist(), " wrong", wrong[0, 16, 10].tolist())
print("pixels that differ under the wrong reshape:", int((wrong != imgs).any(-1).sum()), "of", 3 * 32 * 32)

Output:

record length: 3074 bytes; file of 3 images: 9222 bytes
labels: [(5, 61), (18, 8), (0, 30)]
round trip exact: True
pixel (16, 10) of image 0: right [220, 30, 30]  wrong [0, 0, 0]
pixels that differ under the wrong reshape: 768 of 3072

Reshaping the 3,072 bytes as channels first and then moving the channel axis last recovers the images exactly. Reshaping directly to height × width × channel reads three consecutive red values as one pixel’s red, green and blue: the red disc’s centre comes out black, and a quarter of the pixels in these mostly black images change. On natural images nearly every pixel would.

Tasks

The task is single-label image classification: 10-way for CIFAR-10, and 100-way with the fine labels or 20-way with the coarse labels for CIFAR-100. Because the images are small and the training set fixed, CIFAR also serves as a test bed for training methods and for generative models (see Common Uses).

Evaluation

Unlike benchmarks run through an evaluation server, CIFAR has no hidden test set: the 10,000 test labels are distributed with the data, and results are reported as top-1 accuracy or error on the full test set. Several conventions that change the number are left to each paper and are worth checking when comparing results:

• Validation data. With no official validation split, the test set is easily used for model selection. Some papers hold out part of the training set instead: cuda-convnet’s documented procedure trained on batches 1–4, used batch 5 for early stopping and then retrained on all five (Methodology wiki page, 2011), and He et al. (2016) determined the length of their ResNet training on a 45,000/5,000 split of the training set. What repeated reuse of a public test set does, and does not, do to reported accuracy is discussed under benchmark overfitting and training, validation and test sets.
• Augmentation. Early results were reported both with and without augmentation, as the official page, cuda-convnet and Snoek et al. (2012) do. A widely used convention is the one stated in the ResNet paper: pad 4 pixels on each side, take a random $32 \times 32$ crop of the padded image or of its horizontal flip, and subtract the per-pixel mean (He et al., 2016, §4.2, which credits the deeply supervised nets of Lee et al.). cuda-convnet’s augmented runs instead trained on random $24 \times 24$ crops of the $32 \times 32$ images, so its networks saw smaller inputs. How these transformations work, with code, is in the data augmentation article.
• Test views. ResNet evaluated the single original image. cuda-convnet’s best results averaged predictions over 10 patches, the four corner and centre $24 \times 24$ crops and their mirror images, which its documentation says does better than the centre crop alone (TrainingNet wiki page, 2012).
• Runs. Differences between methods are often a fraction of a point, comparable to the variation between training runs. He et al. reported their 110-layer ResNet as the best of five runs, 6.43% error, with a mean of $6.61 \pm 0.16$%. Whether such a gap is meaningful is the subject of statistical significance in evaluation.
• Outside data. Networks pretrained on other datasets and fine-tuned on CIFAR, as in Dosovitskiy et al. (2021), are in a different setting from networks trained on the 50,000 images alone, and in our view the two should be compared separately.

License

As of October 2026, the official page states no license and no terms of use. It asks only that users cite the technical report. The images themselves were downloaded from web search engines for Tiny Images (Torralba et al., 2008), and nothing on the page addresses their copyright. The terms of use are therefore unclear, and this article does not guess at them.

Limitations and Bias

Origin in a withdrawn collection. Tiny Images was assembled by querying image search engines with every non-abstract noun in WordNet and storing each result at $32 \times 32$ pixels; Torralba, Fergus and Freeman (2008) report 79,302,017 images from 75,062 nouns. Birhane and Prabhu (2021, §2.3) showed that its label space included slurs and other offensive terms, with roughly 1,100 to 2,000 images in each of the nine such classes they plotted, and noted that Tiny Images “grandfathered” CIFAR-10 and CIFAR-100. On 29 June 2020 the creators withdrew Tiny Images, citing a preprint of that audit. Their statement apologizes, explains that the images are too small and too many for manual inspection to guarantee the removal of offensive ones, says the collection has been taken offline for good, and asks the community to stop using it and to delete existing copies. The statement does not mention CIFAR, and Birhane and Prabhu’s audit examined Tiny Images’ categories, not the CIFAR subsets; neither source reports offensive content in CIFAR itself. CIFAR’s own classes are everyday object and animal categories chosen by the authors, and every image was checked by people, the step Tiny Images lacked (our reading of the report). CIFAR-100’s “people” superclass (baby, boy, girl, man, woman) consists of web photographs taken from Tiny Images, which Birhane and Prabhu’s Table 1 lists among large datasets with zero consensual images; nothing in the report suggests that consent was sought for CIFAR. The sources disagree on Tiny Images’ size: the withdrawal statement gives 53,464 nouns, the TPAMI paper 75,062, and Krizhevsky’s report “79000 search terms”.

Duplicates between training and test sets. Barz and Denzler (2020) looked for near-duplicates of each test image in the training set by nearest-neighbour search in the feature space of a network trained on CIFAR, then judged the pairs by hand in order of increasing distance, stopping after 20 consecutive pairs judged different. They counted exact duplicates, near-duplicates (the same shot after different post-processing such as colour shifts, translation or scaling) and very similar images. In CIFAR-10, 286 test images had duplicates in the training set and 39 within the test set, 3.25% of the test set; in CIFAR-100, 891 and 104, or 10%. Most were near-duplicates. None of those found in CIFAR-10 was an exact duplicate, while CIFAR-100 had some, which suggests to them that the duplicate-removal step was skipped for CIFAR-100. On the test images with training duplicates their ResNet-110 made 0% and 2.9% errors, against 5.3% and 26.1% on the full test sets. Replacing the duplicates with new Tiny Images pictures gave the ciFAIR-10 and ciFAIR-100 test sets, on which the error of six architectures rose by 0.41 points on CIFAR-10 and 2.73 points on CIFAR-100 on average (their text; the mean of the gaps in their Table 2 is 0.42 and 2.74, as the train-validation-test split article notes). The ranking was unchanged on CIFAR-100, and only two models swapped places on CIFAR-10. Recht et al. (2018, §5.2), who counted as near-duplicates images of the same object in the same pose, allowing changes of zoom, colour scale, stretch and small shifts, judged about 800 CIFAR-10 test images (8%) to be near-duplicates of training images, and found that most classifiers were 99–100% accurate on them.

The example below repeats the search on synthetic data. A “training set” of 1,500 rendered scenes is cropped to $32 \times 32$; the 300-image “test set” contains 240 fresh scenes and 15 copies each of training images that were copied exactly, re-saved with noise, cropped 2–3 pixels differently from the same scene, or recoloured. Two feature spaces are compared: raw pixels under the L2 norm, as in the report’s duplicate filter, and a space that standardizes each colour channel and takes the best match over shifts of up to 3 pixels, standing in for the invariances Barz and Denzler’s network learned from augmentation. In each space the pairs are reviewed in order of distance with their stopping rule, using the known ground truth as the reviewer.

import numpy as np

def scene(rng, size=40):
    """A synthetic colour photograph: gradient background, one shape, sensor noise."""
    y, x = np.mgrid[0:size, 0:size] / size
    c0, c1 = rng.uniform(0, 255, (2, 3))
    img = c0 + (c1 - c0) * (x * rng.uniform(-1, 1) + y * rng.uniform(-1, 1))[..., None]
    cy, cx = rng.uniform(12, 28, 2)
    r = rng.uniform(5, 11)
    kind = rng.integers(3)
    if kind == 0:   mask = (y * size - cy) ** 2 + (x * size - cx) ** 2 < r ** 2      # disc
    elif kind == 1: mask = (abs(y * size - cy) < r) & (abs(x * size - cx) < r)       # square
    else:           mask = (y * size > cy - r) & (abs(x * size - cx) < (y * size - cy + r) / 2)  # triangle
    img[mask] = rng.uniform(0, 255, 3)
    return np.clip(img + rng.normal(0, 4, img.shape), 0, 255)

def crop(img, dy=0, dx=0):                       # a 32x32 window of the 40x40 scene
    return img[4 + dy:36 + dy, 4 + dx:36 + dx]

def make_split(seed, n_train=1500, n_fresh=240, n_each=15):
    rng = np.random.default_rng(seed)
    scenes = [scene(rng) for _ in range(n_train)]
    train = np.stack([np.round(crop(s)) for s in scenes])
    test, kind = [], []
    src = rng.choice(n_train, 4 * n_each, replace=False)   # training images to copy
    for i, j in enumerate(src):
        k = ["exact", "re-saved", "shifted", "recoloured"][i // n_each]
        if k == "exact":      t = train[j]
        elif k == "re-saved": t = train[j] + rng.normal(0, 3, train[j].shape)   # recompression noise
        elif k == "shifted":                                                       # another crop of the same shot
            dy, dx = rng.choice([-3, -2, 2, 3], 2)
            t = crop(scenes[j], dy, dx)
        else:                 t = train[j] * rng.uniform(0.7, 0.9, 3) + rng.uniform(10, 40, 3)  # colour/contrast edit
        test.append(np.clip(np.round(t), 0, 255)); kind.append(k)
    for _ in range(n_fresh):
        test.append(np.round(crop(scene(rng)))); kind.append("fresh")
    return train.astype(np.uint8), np.stack(test).astype(np.uint8), np.array(kind)

def nn_raw(train, test):
    """Nearest training image by root-mean-square pixel difference (the report's L2 test)."""
    a = train.reshape(len(train), -1).astype(float)
    b = test.reshape(len(test), -1).astype(float)
    d2 = (b ** 2).sum(1)[:, None] + (a ** 2).sum(1)[None] - 2 * b @ a.T
    return np.sqrt(np.maximum(d2, 0).min(1) / a.shape[1])

def nn_invariant(train, test, s=3):
    """Nearest training image after per-channel standardization, best over shifts up to s pixels."""
    def feat(x):                                  # zero mean, unit norm per channel and image
        x = x.astype(float) - x.mean(axis=(1, 2), keepdims=True)
        x /= np.linalg.norm(x, axis=(1, 2), keepdims=True) + 1e-9
        return x.reshape(len(x), -1) / np.sqrt(3)
    a = feat(train[:, s:32 - s, s:32 - s])
    best = np.full(len(test), -1.0)
    for dy in range(-s, s + 1):
        for dx in range(-s, s + 1):
            b = feat(test[:, s + dy:32 - s + dy, s + dx:32 - s + dx])
            best = np.maximum(best, (b @ a.T).max(1))   # cosine similarity
    return 1 - best                                       # cosine distance

def inspect(dist, is_dup, stop=20):
    """Barz & Denzler's protocol: review pairs by increasing distance and stop
    after `stop` consecutive pairs judged different (here the judge is the ground truth)."""
    found, run, n = np.zeros(len(dist), bool), 0, 0
    for i in np.argsort(dist):
        n += 1
        if is_dup[i]: found[i], run = True, 0
        else:         run += 1
        if run == stop: break
    return found, n

kinds = ["exact", "re-saved", "shifted", "recoloured"]
for seed in range(5):
    train, test, kind = make_split(seed)
    is_dup = kind != "fresh"
    line = [f"seed {seed}:"]
    for name, nn in [("raw L2", nn_raw), ("invariant", nn_invariant)]:
        found, n = inspect(nn(train, test), is_dup)
        counts = " ".join(f"{(found & (kind == k)).sum():2d}" for k in kinds)
        line.append(f"{name} found {counts} ({found.sum()}/60, {n} pairs viewed)")
    print("  ".join(line))
print("columns: exact, re-saved, shifted, recoloured (15 planted of each)")

train, test, kind = make_split(0)
for name, nn in [("raw L2 (grey levels)", nn_raw), ("invariant (cosine)", nn_invariant)]:
    d = nn(train, test)
    print(f"{name:>20}: " + ", ".join(f"{k} {np.median(d[kind == k]):.3f}" for k in kinds + ["fresh"]))

Output:

seed 0:  raw L2 found 15 15  8 15 (53/60, 85 pairs viewed)  invariant found 15 14 15 15 (59/60, 111 pairs viewed)
seed 1:  raw L2 found 15 15 10 15 (55/60, 99 pairs viewed)  invariant found 15 13 15 15 (58/60, 81 pairs viewed)
seed 2:  raw L2 found 15 15 11 15 (56/60, 111 pairs viewed)  invariant found 15 15 15 15 (60/60, 113 pairs viewed)
seed 3:  raw L2 found 15 15  5 15 (50/60, 93 pairs viewed)  invariant found 15 14 15 15 (59/60, 86 pairs viewed)
seed 4:  raw L2 found 15 15 13 15 (58/60, 153 pairs viewed)  invariant found 15 14 15 15 (59/60, 91 pairs viewed)
columns: exact, re-saved, shifted, recoloured (15 planted of each)
raw L2 (grey levels): exact 0.000, re-saved 2.913, shifted 28.839, recoloured 18.381, fresh 44.475
  invariant (cosine): exact 0.000, re-saved 0.009, shifted 0.000, recoloured 0.000, fresh 0.149

Raw-pixel distance finds every exact and re-saved copy, the kinds of duplicate the report’s liberal L2 threshold was meant to catch, but in the five runs it misses 2 to 10 of the 15 shifted crops: moving the content by 2–3 pixels changes most pixel values, and in seed 0 the median distance of a shifted copy (28.8 grey levels) lies far closer to that of an unrelated image (44.5) than to a re-saved copy’s (2.9). Recoloured copies survive in this example only because ranking is relative and the colour change is mild. The invariant space puts shifted and recoloured copies at a median distance of zero to three decimals, and finds 58 to 60 of the 60 duplicates. What it still misses are re-saved copies; in our own check, outside the code shown, each missed copy had a colour channel with little contrast, which standardization stretches together with its noise. That is the trade-off that made manual review necessary: the more invariant the space, the more unrelated look-alikes, such as two smooth gradients, also come close.

Label errors. Northcutt et al. (2021, Table 1) flagged likely label errors in the test sets algorithmically and had them checked on Mechanical Turk: 54 of 275 flagged CIFAR-10 test images (0.54% of the test set) and 585 of 2,235 flagged CIFAR-100 images (5.85%) were confirmed as errors. Their abstract adds that, with corrected labels, VGG-11 would outperform VGG-19 on CIFAR-10 if the share of originally mislabelled test images rose by only 5%.

Small, centred, single objects. At $32 \times 32$ pixels, much of the detail that distinguishes fine-grained CIFAR-100 classes such as maple and oak, or boy and girl, is gone. The labelling criteria selected images with one prominent, recognizable object, and Torralba et al. (2008) note that web images tend to show objects centred and fairly large. Accuracy on CIFAR therefore says little about cluttered scenes or small objects, and in our view methods tuned to $32 \times 32$ inputs, such as the small-input ResNets of He et al., do not transfer unchanged to full-resolution images.

Common Uses

• Prototyping architectures and training methods. The small size lets a full training run finish quickly, so architectures (the CIFAR ResNets of He et al.), optimizers (Adam), normalization layers and augmentation policies are often compared on CIFAR first.
• Transfer and pretraining. CIFAR-10 and CIFAR-100 are standard downstream targets for networks pretrained on larger data (see transfer learning).
• Generative models. Unconditional generation of CIFAR-10 images, scored with the Fréchet Inception Distance or the Inception Score, is a standard comparison (see image generation).
• Robustness and reliability. CIFAR-10.1, ciFAIR and CIFAR-10-C (below) measure generalization beyond the test set, and calibration studies report results on CIFAR-100.

Historical Milestones

Year	Result	Protocol	CIFAR-10 test error	Source
2009	Logistic regression on raw pixels / one-hidden-layer network initialized from RBM features learned on 2 million unlabelled tiny images	No augmentation	58.87% / 35.16% (41.13% / 64.84% correct)	Krizhevsky (2009), Figure 3.1
By 2012	cuda-convnet convolutional network	Without / with random translations and horizontal reflections	18% / 11%	cuda-convnet project page; official CIFAR page
2012	The cuda-convnet networks with nine hyperparameters retuned by Bayesian optimization	Without / with augmentation	14.98% / 9.5%	Snoek et al. (2012), §4.4
2015	110-layer ResNet, 1.7 million parameters	Pad-and-crop and flip augmentation, single view	6.43% (best of 5; mean 6.61%)	He et al. (2016), Table 6
2020	Vision Transformer ViT-H/14 pretrained on JFT-300M, fine-tuned at $384 \times 384$	Outside data; mean of 3 fine-tuning runs	0.50% (99.50% accuracy; 94.55% on CIFAR-100)	Dosovitskiy et al. (2021), Table 2

The 2009 result came from the report that introduced the dataset, whose question was whether features learned without labels help recognition: they raised accuracy by more than 20 points over raw pixels. cuda-convnet was Krizhevsky’s GPU implementation of convolutional networks; the AlexNet paper later pointed to it for the exact specification of its four-layer CIFAR-10 network (13% error without response normalization, 11% with). Its project page, which the official CIFAR page links for baselines, documented the training procedure step by step. Snoek et al. kept the expert’s networks and tuned only regularization, learning rate, number of epochs and response normalization, and gained more than 3 points, which in our reading shows early how much CIFAR numbers depend on tuning. The ResNet paper used CIFAR-10 to study depth rather than to set a record: its 1202-layer network trained to under 0.1% training error but scored 7.93% on the test set, worse than the 110-layer one, which the authors attribute to overfitting a small dataset. The Vision Transformer result belongs to a different setting: about 300 million outside images, fine-tuning at a resolution of 384 pixels, and pretraining data deduplicated against the CIFAR test sets following Kolesnikov et al. (Dosovitskiy et al., 2021, §4.1 and Appendix B.1.1).

Related Datasets

• 80 Million Tiny Images (Torralba et al., 2008): the source of all CIFAR images, withdrawn in June 2020 (see above).
• CIFAR-10.1 (Recht et al., 2018): a new test set of about 2,000 images drawn from Tiny Images with the same keyword distribution as CIFAR-10 and labelled following the original instructions. The 2018 preprint reported accuracy drops of 4% to 10% for a broad range of models, with few changes in their relative order; the follow-up study and its ImageNet counterpart are described in the article on ImageNetV2. Its data inherit the Tiny Images provenance.
• ciFAIR-10 and ciFAIR-100 (Barz & Denzler, 2020): the original training sets with duplicate-free test sets, described above.
• CIFAR-10-C (Hendrycks & Dietterich, 2019): the CIFAR-10 test images under the same algorithmically generated corruptions as ImageNet-C, 15 types of noise, blur, weather and digital distortion at five severities, released for evaluation and not for training. The paper also describes a CIFAR-10 version of its perturbation benchmark (CIFAR-10-P), and the authors’ repository distributes CIFAR-100-C as well (README, as of October 2026).
• MNIST: the earlier benchmark of grey-scale handwritten digits.
• ImageNet: the large-scale classification benchmark, with 1,000 classes of full-resolution web images.

Resources

• The CIFAR-10 and CIFAR-100 datasets: the official page, with downloads in Python, MATLAB and binary formats, MD5 checksums, the file layout and the CIFAR-100 to Tiny Images index file.
• Learning Multiple Layers of Features from Tiny Images: the 2009 report, whose Chapter 3 and Appendices C and D describe the collection.
• ciFAIR: the duplicate-free test sets, lists of the duplicates found, pretrained models and a leaderboard of results on CIFAR and ciFAIR.
• CIFAR-10.1 and CIFAR-10-C and CIFAR-100-C: the new and corrupted test sets.