No Free Efficiency: Revisiting the Trade-off Between Training Efficiency and Model Vulnerability

Yiyong Liu; Jun Sakuma; Michael Backes; Rui Wen

cs.LGSep 27, 2026

No Free Efficiency: Revisiting the Trade-off Between Training Efficiency and Model Vulnerability

Authors: Yiyong Liu, Jun Sakuma, Michael Backes, Rui Wen

Organizations: CISPA Helmholtz Center for Information Security · Institute of Science Tokyo

Abstract

Training efficiency has become the central driver of recent progress in foundation models. To overcome the massive computational and data requirements of large-scale training, researchers increasingly adopt strategies such as selective data sampling, efficient pre-training, and simplified reinforcement learning pipelines. While these strategies drastically reduce overhead, they prompt a critical, yet neglected question: Is efficiency achieved at the expense of model robustness and security? To our knowledge, we present the first systematic cross-domain investigation of the efficiency-vulnerability trade-off. Across vision and language models, we show that efficiency-oriented training increases susceptibility to adversarial and privacy attacks. We characterize this vulnerability by analyzing the models' internal geometry and functional representations, demonstrating that the evaluated efficient variants consistently exhibit sharper loss geometry together with systematic changes in representational structure. We further extend our analysis to "zero RL training", finding that models trained using simplified RL recipes exhibit substantially greater susceptibility to catastrophic forgetting and more pronounced overconfidence than those trained through conventional alignment pipelines. Our findings suggest that training efficiency is rarely a "free lunch"; rather, the mechanisms that minimize computation can inadvertently compromise safety. We conclude by calling for a paradigm shift toward multi-objective training that jointly optimizes for performance, cost, and security.

Figures & tables

Table 1

Dataset	Paradigm	Acc	MIA			MS
Dataset	Paradigm	Acc	conf	entr	modi	1000	1000 (Pre-train)
CIFAR-10	Scratch	67.71 (99.91)	0.05%	0.04%	0.05%	62.60 (0.748)	65.22 (0.758)
CIFAR-10	Pre-train	67.88 (100.00)	0.21%	0.16%	0.21%	58.05 (0.669)	67.25 (0.785)
CIFAR-10 (swin)	Scratch	73.85 (100.00)	0.12%	0.12%	0.11%	42.41 (0.446)	57.70 (0.536)
CIFAR-10 (swin)	Pre-train	74.01 (100.00)	0.54%	0.54%	0.54%	39.01 (0.437)	60.06 (0.651)
TinyImageNet	Scratch	34.91 (99.98)	0.13%	0.07%	0.14%	24.65 (0.381)	27.53 (0.379)

Table 3: Accuracy (training accuracy in brackets), membership inference (MIA), and model stealing (MS) under pre-trained fine-tuning and scratch training. Higher MIA indicates greater privacy leakage. MS reports stolen-model accuracy with target–surrogate agreement in parentheses; higher values indicate more successful extraction.

Panel of Figure 2 — Figure 2: Model stealing under Shapley-based data selection. “Acc” denotes stolen-model test accuracy, “Agr” the fraction of test samples on which target and stolen models agree, and “Random” random query selection; higher Acc and Agr indicate more successful extraction. Query pools contain 1,000 distinct images (500 for PubFig83 owing to data limitations).

Dataset	Value	Sharpness	ECE	PCA PR	Paradigm	Sharpness	ECE	PCA PR
CIFAR-10	Low	0.0410	0.382	28.490	Scratch	0.0311	0.219	14.266
CIFAR-10	High	0.0591	0.430	10.793	Pre-train	0.1332	0.232	25.137
CIFAR-10 (swin)	Low	0.0170	0.410	13.907	Scratch	0.0010	0.060	9.897
CIFAR-10 (swin)	High	0.0189	0.436	10.896	Pre-train	0.0373	0.241	26.786
TinyImageNet	Low	0.0548	0.336	265.298	Scratch	0.0511	0.317	157.477
TinyImageNet	High	0.0600	0.384	74.960	Pre-train	0.1201	0.251	163.206

Table 4: Sharpness, Expected Calibration Error, and PCA Participation Ratio for vision models.

Panel of Figure 3 — Figure 3: Loss landscape for CIFAR-10.

Panel of Figure 4 — Figure 4: Log-scale member/non-member confidence distributions on TinyImageNet.

Panel of Figure 5 — Figure 5: Intra-CKA under Shapley-based data selection on CIFAR-10 and TinyImageNet.

Dataset		GSM8K	mawps	Minerva Math	MATH 500	Olympiad Bench	AIME24	AMC23	Avg.
Qwen2.5-Math-7B-Instruct	Before	95.38	98.60	31.62	77.20	33.93	3.33	52.50	56.08
Qwen2.5-Math-7B-Instruct	After	94.77	98.30	27.21	78.00	32.89	10.00	45.00	55.17
Qwen2.5-7B-SimpleRL-Zoo	Before	93.40	97.09	25.74	75.40	30.37	10.00	45.00	53.86
Qwen2.5-7B-SimpleRL-Zoo	After	81.58	84.99	18.75	68.80	29.33	6.67	42.50	47.52
Eurus-2-7B-PRIME	Before	89.69	96.22	25.37	70.60	32.00	6.67	55.00	53.65
Eurus-2-7B-PRIME	After	41.77	33.22	12.87	24.40	8.15	0.00	25.00	20.77

Table 6: Fine-tuning stability attack on IMDB dataset.

Panel of Figure 7 — Figure 7: Intra-CKA on GSM8K.

Model	Sharpness		ECE
Model	GSM8K	MATH 500	GSM8K	MATH 500
Instruct	0.0615	0.0398	0.0375	0.4006
SimpleRL	0.9120	0.5183	0.0899	0.4453
PRIME	0.5565	0.5032	0.1073	0.4492

Table 7: Sharpness and ECE for 7B math reasoning LLMs.

Appendix figures & tables21 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Value	Acc	MIA (conf)	MIA (entr)	MIA (modi)
CIFAR-10	Low	$48.07\pm 0.47$ ( $99.97\pm 0.06$ )	$0.12\%\pm 0.01\%$	$0.05\%\pm 0.01\%$	$0.11\%\pm 0.01\%$
CIFAR-10	High	$47.97\pm 0.58$ ( $99.97\pm 0.05$ )	$0.16\%\pm 0.02\%$	$0.09\%\pm 0.01\%$	$0.16\%\pm 0.01\%$
CIFAR-10 (swin)	Low	$37.01\pm 0.29$ ( $99.95\pm 0.08$ )	$0.08\%\pm 0.01\%$	$0.05\%\pm 0.01\%$	$0.09\%\pm 0.01\%$
CIFAR-10 (swin)	High	$36.94\pm 0.26$ ( $99.93\pm 0.07$ )	$0.29\%\pm 0.02\%$	$0.30\%\pm 0.02\%$	$0.30\%\pm 0.01\%$
TinyImageNet	Low	$36.09\pm 0.58$ ( $100.00\pm 0.00$ )	$0.08\%\pm 0.02\%$	$0.06\%\pm 0.01\%$	$0.10\%\pm 0.02\%$
TinyImageNet	High	$36.17\pm 0.46$ ( $100.00\pm 0.00$ )	$0.22\%\pm 0.01\%$	$0.35\%\pm 0.02\%$	$0.27\%\pm 0.02\%$

Appendix

Table 8: Accuracy (training accuracy in brackets) and TPR at 0.1% FPR of membership inference for data selection with Shapley values (mean

\pm

standard deviation over three seeds).

Dataset	Value	Robustness	Paradigm	Robustness
CIFAR-10	Low	$3.85\pm 0.21$	Scratch	$3.58\pm 0.58$
CIFAR-10	High	$1.33\pm 0.07$	Pre-train	$1.00\pm 0.05$
CIFAR-10 (swin)	Low	$0.70\pm 0.13$	Scratch	$3.22\pm 0.11$
CIFAR-10 (swin)	High	$0.18\pm 0.03$	Pre-train	$0.11\pm 0.03$
TinyImageNet	Low	$20.89\pm 2.00$	Scratch	$14.03\pm 1.70$
TinyImageNet	High	$10.46\pm 1.21$	Pre-train	$3.64\pm 0.13$

Appendix

Table 9: Adversarial robustness for vision models (mean

\pm

standard deviation over three seeds).

Dataset	Paradigm	Acc	MIA			MS
Dataset	Paradigm	Acc	conf	entr	modi	1000	1000 (Pre-train)
CIFAR-10	Scratch	$67.71\pm 0.36$ ( $99.91\pm 0.09$ )	$0.05\%\pm 0.03\%$	$0.04\%\pm 0.01\%$	$0.05\%\pm 0.02\%$	$62.60\pm 0.27$ ( $0.748\pm 0.005$ )	$65.22\pm 0.20$ ( $0.758\pm 0.004$ )
CIFAR-10	Pre-train	$67.88\pm 0.24$ ( $100.00\pm 0.00$ )	$0.21\%\pm 0.01\%$	$0.16\%\pm 0.01\%$	$0.21\%\pm 0.00\%$	$58.05\pm 0.16$ ( $0.669\pm 0.007$ )	$67.25\pm 0.14$ ( $0.785\pm 0.003$ )
CIFAR-10 (swin)	Scratch	$73.85\pm 0.35$ ( $100.00\pm 0.00$ )	$0.12\%\pm 0.01\%$	$0.12\%\pm 0.01\%$	$0.11\%\pm 0.01\%$	$42.41\pm 0.42$ ( $0.446\pm 0.006$ )	$57.70\pm 0.52$ ( $0.536\pm 0.009$ )
CIFAR-10 (swin)	Pre-train	$74.01\pm 0.14$ ( $100.00\pm 0.00$ )	$0.54\%\pm 0.02\%$	$0.54\%\pm 0.02\%$	$0.54\%\pm 0.02\%$	$39.01\pm 0.24$ ( $0.437\pm 0.010$ )	$60.06\pm 0.19$ ( $0.651\pm 0.006$ )
TinyImageNet	Scratch	$34.91\pm 0.75$ ( $99.98\pm 0.02$ )	$0.13\%\pm 0.01\%$	$0.07\%\pm 0.03\%$	$0.14\%\pm 0.03\%$	$24.65\pm 0.45$ ( $0.381\pm 0.004$ )	$27.53\pm 0.43$ ( $0.379\pm 0.008$ )

Appendix

Table 10: Accuracy (training accuracy in brackets), membership inference, and model stealing for pre-trained fine-tuning and training from scratch (mean

\pm

standard deviation over three seeds). Values in parentheses under MS denote agreement.

Dataset	Value	Sharpness	ECE	PCA PR	Paradigm	Sharpness	ECE	PCA PR
CIFAR-10	Low	$0.0410\pm 0.0146$	$0.382\pm 0.012$	$28.490\pm 7.284$	Scratch	$0.0311\pm 0.0116$	$0.219\pm 0.005$	$14.266\pm 0.160$
CIFAR-10	High	$0.0591\pm 0.0141$	$0.430\pm 0.014$	$10.793\pm 0.727$	Pre-train	$0.1332\pm 0.0088$	$0.232\pm 0.001$	$25.137\pm 0.962$
CIFAR-10 (swin)	Low	$0.0170\pm 0.0005$	$0.410\pm 0.009$	$13.907\pm 0.861$	Scratch	$0.0010\pm 0.0002$	$0.060\pm 0.004$	$9.897\pm 1.008$
CIFAR-10 (swin)	High	$0.0189\pm 0.0015$	$0.436\pm 0.008$	$10.896\pm 1.633$	Pre-train	$0.0373\pm 0.0056$	$0.241\pm 0.036$	$26.786\pm 0.668$
TinyImageNet	Low	$0.0548\pm 0.0025$	$0.336\pm 0.021$	$265.298\pm 13.393$	Scratch	$0.0511\pm 0.0017$	$0.317\pm 0.002$	$157.477\pm 0.655$
TinyImageNet	High	$0.0600\pm 0.0028$	$0.384\pm 0.019$	$74.960\pm 3.202$	Pre-train	$0.1201\pm 0.0033$	$0.251\pm 0.008$	$163.206\pm 1.082$

Appendix

Table 11: Sharpness, Expected Calibration Error (ECE), and PCA Participation Ratio (PCA PR) for vision models (mean

\pm

standard deviation over three seeds).

Dataset	Value	Acc	MIA (conf)	MIA (entr)	MIA (modi)
CIFAR-10	Full	$94.84\pm 0.32$ ( $100.00\pm 0.00$ )	$0.02\%\pm 0.00\%$	$0.01\%\pm 0.00\%$	$0.01\%\pm 0.00\%$
	High (20,000)	$88.54\pm 0.25$ ( $100.00\pm 0.00$ )	$0.07\%\pm 0.00\%$	$0.06\%\pm 0.00\%$	$0.07\%\pm 0.01\%$
	High (40,000)	$93.38\pm 0.27$ ( $100.00\pm 0.00$ )	$0.04\%\pm 0.01\%$	$0.02\%\pm 0.00\%$	$0.04\%\pm 0.00\%$
CIFAR-10 (swin)	Full	$79.40\pm 0.31$ ( $100.00\pm 0.00$ )	$0.05\%\pm 0.00\%$	$0.00\%\pm 0.00\%$	$0.05\%\pm 0.00\%$
	High (20,000)	$69.86\pm 0.29$ ( $100.00\pm 0.00$ )	$0.20\%\pm 0.01\%$	$0.28\%\pm 0.01\%$	$0.20\%\pm 0.01\%$
	High (40,000)	$77.91\pm 0.33$ ( $100.00\pm 0.00$ )	$0.18\%\pm 0.01\%$	$0.22\%\pm 0.00\%$	$0.18\%\pm 0.01\%$

Appendix

Table 12: Accuracy (training accuracy in brackets) and membership inference for Full-dataset training and High-Shapley subsets (mean

\pm

standard deviation over three seeds). MIA is reported as TPR at 0.1% FPR; higher values indicate greater privacy leakage.

Dataset	Value	Robustness	MS
CIFAR-10	Full	$18.60\pm 0.92$	$59.25\pm 0.23$ ( $0.599\pm 0.002$ )
	High (20,000)	$10.03\pm 0.88$	$67.05\pm 0.29$ ( $0.712\pm 0.003$ )
	High (40,000)	$17.60\pm 0.82$	$62.01\pm 0.26$ ( $0.634\pm 0.002$ )
CIFAR-10 (swin)	Full	$5.68\pm 0.22$	$41.20\pm 0.20$ ( $0.429\pm 0.003$ )
	High (20,000)	$2.57\pm 0.11$	$45.56\pm 0.21$ ( $0.499\pm 0.004$ )
	High (40,000)	$4.85\pm 0.19$	$43.10\pm 0.19$ ( $0.458\pm 0.003$ )

Appendix

Table 13: Adversarial robustness and model stealing using 1,000 distinct query images (500 for PubFig83) for Full-dataset training and High-Shapley subsets (mean

\pm

standard deviation over three seeds). Higher robustness is better. MS reports stolen-model accuracy, with agreement in parentheses; higher values indicate a more successful stealing attack.

Dataset	Value	Sharpness	ECE	PCA PR
CIFAR-10	Full	$0.0253\pm 0.0078$	$0.033\pm 0.003$	$10.544\pm 0.231$
	High (20,000)	$0.0313\pm 0.0081$	$0.076\pm 0.004$	$9.586\pm 0.292$
	High (40,000)	$0.0265\pm 0.0077$	$0.042\pm 0.003$	$9.841\pm 0.221$
CIFAR-10 (swin)	Full	$0.0128\pm 0.0004$	$0.160\pm 0.002$	$9.048\pm 0.201$
	High (20,000)	$0.0152\pm 0.0006$	$0.245\pm 0.003$	$8.424\pm 0.102$
	High (40,000)	$0.0142\pm 0.0003$	$0.185\pm 0.002$	$8.316\pm 0.162$

Appendix

Table 14: Sharpness, Expected Calibration Error (ECE), and PCA Participation Ratio (PCA PR) for Full-dataset training and High-Shapley subsets (mean

\pm

standard deviation over three seeds).

Dataset	Value	Before	After	Drop
CIFAR-10	Low	$48.07\pm 0.47$	$44.83\pm 0.38$	$3.24\pm 0.60$
CIFAR-10	High	$47.97\pm 0.58$	$34.12\pm 0.32$	$13.85\pm 0.66$
TinyImageNet	Low	$36.09\pm 0.58$	$34.54\pm 0.44$	$1.55\pm 0.73$
TinyImageNet	High	$36.17\pm 0.46$	$18.87\pm 0.61$	$17.30\pm 0.76$

Appendix

Table 15: Accuracy degradation under 50% unstructured weight pruning (mean

\pm

standard deviation over three seeds). “Drop” denotes the decrease from pre-pruning to post-pruning accuracy; higher values indicate greater pruning sensitivity.

Model	TPR at 0.1% FPR	AUC
Qwen2.5-Math-7B-Instruct	0.89%	0.823
Qwen2.5-7B-SimpleRL-Zoo	1.77%	0.857

Appendix

Table 16: Membership inference for the 7B models using the Min-

k

% probability attack with

k=15

. Higher TPR and AUC indicate greater membership leakage.

Model	State	GSM8K	MAWPS	Minerva	MATH 500	Olympiad	AIME24	AMC23	Avg.
Instruct	Before	95.38	98.60	31.62	77.20	33.93	3.33	52.50	56.08
Instruct	After	95.00	98.60	31.25	79.20	33.48	6.67	47.50	55.96
SimpleRL	Before	93.40	97.09	25.74	75.40	30.37	10.00	45.00	53.86
SimpleRL	After	90.30	97.29	26.10	71.20	30.96	6.67	40.00	51.78
PRIME	Before	89.69	96.22	25.37	70.60	32.00	6.67	55.00	53.65
PRIME	After	80.44	77.87	24.26	66.00	31.56	6.67	47.50	47.76

Appendix

Table 17: Mathematical-reasoning performance before and after 4-bit NF4 quantization. Higher values are better.

Model	Conf. MIA	Min- $k$ % MIA		Robustness		AutoDAN
Model	TPR	TPR	AUC	Base	Math	Steps	ASR
Instruct	0.59%	0.59%	0.802	99.50	97.00	1.32	98.08%
SimpleRL	0.88%	1.77%	0.833	99.50	93.70	0.23	100.00%

Appendix

Table 18: Membership inference, adversarial robustness, and AutoDAN jailbreak susceptibility for 32B models. Confidence-based MIA reports TPR at 1.0% FPR; Min-

k

% MIA (

k=15

) reports TPR at 0.1% FPR and AUC. Higher robustness accuracy is better; higher MIA TPR, AUC, and ASR and fewer AutoDAN steps indicate greater vulnerability.

Model	State	GSM8K	MAWPS	Minerva	MATH 500	Olympiad	AIME24	AMC23	Avg.
Instruct	Before	95.91	98.31	42.28	80.40	37.78	13.33	62.50	61.49
Instruct	After	95.07	98.31	37.87	77.60	36.30	10.00	52.50	58.24
SimpleRL	Before	95.91	98.31	31.99	77.60	39.70	10.00	52.50	58.00
SimpleRL	After	85.37	96.66	21.69	50.20	17.93	3.33	30.00	43.60

Appendix

Table 19: Fine-tuning stability of Qwen2.5 32B models under IMDB adaptation. “Before” and “After” report mathematical-reasoning benchmark accuracy before and after fine-tuning.

Panel of Figure 8 — Figure 8: Member and non-member confidence distributions on a logarithmic scale for CIFAR-10 with ResNet-18 under data selection and pre-training.

Panel of Figure 9 — Figure 9: Member and non-member confidence distributions on a logarithmic scale for CIFAR-10 with Swin under data selection and pre-training.

Panel of Figure 10 — Figure 10: Member and non-member confidence distributions on a logarithmic scale for PubFig83 under data selection and pre-training.

Panel of Figure 11 — Figure 11: Intra-CKA under Shapley-based data selection on CIFAR-10 (C-10) with Swin and PubFig83.

Panel of Figure 12 — Figure 12: Intra-CKA on 500 examples sampled from the MATH test set.

Dataset	Value	0	1	2	3	4
CIFAR-10	Low	0.512	0.509	0.561	0.677	0.781
CIFAR-10	High	0.489	0.421	0.498	0.526	0.587
TinyImageNet	Low	0.519	0.505	0.465	0.624	0.806
TinyImageNet	High	0.531	0.440	0.467	0.506	0.684

Appendix

Table 20: Fraction of zero ReLU activations under data selection. Lower values indicate that a larger proportion of units are active.

Panel of Figure 13 — Figure 13: Loss landscape for TinyImageNet.

Panel of Figure 14 — Figure 14: Loss landscape for PubFig83.

Dataset / architecture	Full	High	Low	Fine-tuning	Scratch
CIFAR-10 / ResNet-18	49,000	1,180	5,000	1,850	4,000
CIFAR-10 / Swin-Tiny	49,000	700	5,000	180	28,000
TinyImageNet / ResNet-18	99,000	12,000	50,000	4,700	20,000
PubFig83 / ResNet-18	6,970	1,950	4,000	2,800	3,680

Appendix

Table 21: Training-set sizes in the vision experiments.

Explore similar work

On the Efficiency-Safety Dilemma in Large Reasoning Models
Sep 20, 2026Yifei Yang, Zouying Cao, Xingrui Wang +4Large Reasoning Models Jailbreak Attacks
AGI Institute, School of Computer Science, Shanghai Jiao Tong University, Shanghai, China · Key Laboratory of Shanghai Education Commission for Intelligent Interaction and Cognitive Engineering, Shanghai Jiao Tong University · Ant Group +2
Risk Under Pressure: Compute-Aware Evaluation of Adversarial Robustness in Language Models
Jun 9, 2026Malikeh Ehghaghi, Boglárka Ecsedi, Marsha Chechik +1Large Language Model Evaluation Attack-Success Rate
University of Toronto · Vector Institute · Hugging Face
Test-Time Training Undermines Safety Guardrails
May 21, 2026Simone Antonelli, Sadegh Akhondzadeh, Aleksandar BojchevskiInference-Time Defense Test-Time Training
CISPA Helmholtz Center for Information Security · University of Cologne

Sep 20, 2026, cs.CLJ/K move · Enter open · S save

On the Efficiency-Safety Dilemma in Large Reasoning Models

Yifei Yang, Zouying Cao, Xingrui Wang, Xiao Zhou+3

AGI Institute, School of Computer Science, Shanghai Jiao Tong University, Shanghai, China · Key Laboratory of Shanghai Education Commission for Intelligent Interaction and Cognitive Engineering, Shanghai Jiao Tong University · Ant Group+2

Large Reasoning Models Jailbreak Attacks Efficiency

Open paper AskPDF arXiv

Large reasoning models (LRMs) incur high inference costs, often mitigated by efficiency techniques like quantization and pruning. However, the impact of these techniques on model adversarial robustness remains largely unexplored. This study provides the first comprehensive analysis of the interplay between efficiency, jailbreak vulnerability, and reasoning in LRMs. We find that while efficiency methods seemingly reduce the success rate of jailbreak attacks, this improvement is often superficial. It largely arises from degraded reasoning capabilities leading to "attempted but failed" malicious responses, rather than an increase in genuine alignment. Mechanistic analysis of representational drift confirms this, revealing a strict coupling between reasoning capability loss and the model's inability to maintain malicious semantic trajectories. Additionally, we identify quantization with pruning as the optimal strategy to balance efficiency and robustness. These findings clarify the distinction between true safety alignment and capability-induced failure, providing an empirical foundation for LRM deployment.

Abstract

Explore similar work

On the Efficiency-Safety Dilemma in Large Reasoning Models

Risk Under Pressure: Compute-Aware Evaluation of Adversarial Robustness in Language Models

Test-Time Training Undermines Safety Guardrails