Adversarial / Regimes
verifiedRobustness-Accuracy Tradeoff
Robust models are less accurate on clean data, and not because anyone has been careless. If some genuinely predictive features are also fragile, then refusing to use them costs accuracy — the trade is a property of the data rather than a limitation of current methods.
This reframes what a robustness number means. A model reported as 90% clean and 45% robust has not failed at 55% of its job; it has been asked to solve a harder problem on which 45% may be near the ceiling. It also explains why robust models often look more interpretable: the features that survive an adversary are the ones a person would have picked.
There are constructed distributions where the Bayes-optimal accurate classifier and the Bayes-optimal robust one differ, and no estimator achieves both — so the gap is not an optimisation failure. Empirically the frontier is smooth: each increment of ε bought costs clean accuracy at an increasing rate, which is why ε is chosen from a threat model rather than tuned.
Loss over 2000 training steps, starting near 7.2. It falls to about 1.94, with 93% of the total improvement arriving in the first half. A second line shows held-out, ending higher at about 2.14.
Loss on clean data against loss under attack. Drag the attack strength up to watch the two separate — that gap is not an optimisation failure, it is what the data costs once fragile features are refused.
Reviewed by opendroid · 2026-08-18
- arXiv:1805.12152 — Robustness May Be at Odds with Accuracy