The natural accuracies of ResNet18 and ResNet50 in CIFAR10

[louvinci]

I am new to the field of adversarial attacks. I noticed that the natural accuracies of ResNet18 and ResNet50 in CIFAR10 are 78.38% and 79.15% respectively, which are much lower than other pre-trained models. So, what is the reason for this? Is it because of adversarial training using PGD? I also found a lack of preprocessing operations, e.g., normalization operations, prior to training the models.