Adversarial trade-offs

Lens adapted to this topic: What the evidence supports about the trade-off

The dominant research account is that adversarial robustness and ordinary accuracy can be competing objectives, especially when the threat model makes predictive features vulnerable. Theory identifies conditions producing a trade-off, and experiments observe it across models and applications. However, mainstream work also treats the trade-off as conditional rather than an unavoidable law: architecture, data, perturbation strength, and methods such as robust self-training can change the outcome.

• Theoretical analyses identify settings in which improving robustness necessarily or predictably reduces standard accuracy, including linear regression and classification models.
• Robust classifiers may learn representations different from standard classifiers; the robust representations can align more closely with salient, human-perceived features despite lower standard accuracy.
• The trade-off varies with training-data quantity and quality, model size, adversary strength, perturbation structure, and overparameterization.
• TRADES and related methods explicitly optimize a balance between natural and robust error rather than treating either objective as sufficient on its own.
• Evidence from robot-learning tasks suggests that gains in adversarial robustness can produce a net loss in holistic task performance in some real-world applications.

Lens adapted to this topic: Why the trade-off may be avoidable or overstated

A serious dissenting view argues that broad claims of an inherent trade-off overgeneralize from particular threat models, datasets, hypothesis classes, and training procedures. Results showing robust self-training or other methods improving both metrics suggest that standard accuracy need not always be sacrificed. A further critical position questions whether adversarial-ML evaluations—particularly for large language models—define meaningful threats and measure progress rigorously enough to support strong conclusions.

• A standard-accuracy penalty can occur even when an optimal predictor has zero standard and robust error, but robust self-training is shown theoretically and empirically to improve robustness without sacrificing standard error in some settings.
• Architecture choice can alter the accuracy–robustness curve; adversarial training acts as a form of regularization in some overparameterized linear models, so the trade-off is not solely a property of robustness itself.
• Distributionally adversarial results emphasize that observed trade-offs depend on the adversary’s allowed distribution changes and on the details of the learning problem.
• A critical position on adversarial ML for large language models argues that the field’s problems are less clearly defined, harder to solve, and more difficult to evaluate than earlier toy settings.
• Some evaluations and commentaries challenge whether particular claims about perceptual misalignment and adversarial examples follow from the assumptions or measurements used.