On the tradeoff between robustness and geometric accuracy in adversarial training

Rachel Morris; Ryan Murray; Kerrek Stinson

cs.LGOct 16, 2026

On the tradeoff between robustness and geometric accuracy in adversarial training

Authors: Rachel Morris, Ryan Murray, Kerrek Stinson

Abstract

For non-parametric binary classification in the presence of an adversary, we prove an optimal quantitative estimate for adversarial classifiers controlling geometric accuracy, as measured by the Hausdorff distance to the Bayes classifier, in terms or their robustness, as encoded by the adversarial budget $\varepsilon$ . This rigorously shows that robust classifiers sacrifice at most $O(\sqrt{\varepsilon})$ or $O(\varepsilon)$ in accuracy, depending on the regularity of the underlying Bayes classifier. In contrast to prior work on the incompatibility of robustness and accuracy over low-complexity hypothesis classes, our work shows that high-complexity hypothesis classes allow for robust classifiers with precisely quantified accuracy. Our results apply for adversaries determined by any norm on Euclidean space and in both the infinite and finite data settings.

Figures & tables

Figure 1. The geometric barrier constructions for low (left) and high (right) regularity settings, as in Propositions 5.2 and 5.5 , respectively. In the low regularity setting, the barrier radius

r

is proportional to the distance

D

between

A_{0}

and

x^{*}\approx{\rm argmax}_{\partial A_{\varepsilon}}d(x,A_{0})

. By contrast, in the high regularity setting, we use normal coordinates to select a radius independent of

D=d(x_{0},A_{0})

Panel of Figure 2 — Figure 2. For the good radius, the fattened boundary is controlled by the volume of $G_{r_{\rm good}}=\mathcal{A}^{\varepsilon}\cap\mathbb{B}_{r_{\rm good}}$ , with $\mathcal{L}^{2}(G_{r_{\rm good}})\gtrsim\mathcal{L}^{2}(G_{r_{\rm good}}^{\eta}\setminus G_{r_{\rm good}}^{-\eta}).$ However, in the case of the bad radius $r_{\rm bad}$ , we see that a thin sliver of $G_{r_{\rm bad}}$ may generate a disproportionately large fattened boundary and break the previous estimate. However, these bad slivers appear only when large pieces of $\partial\mathcal{A}^{\varepsilon}$ align with $\partial\mathbb{B}_{r}$ , which fails for the majority of radii.

Adversarial Robustness

Adversarial robustness studies how well AI systems withstand deliberately crafted inputs, training-data corruption, and other attacks.

See all 463 papers

VanillaBench: The Hidden Accuracy Cost of Adversarial Robustness
Jul 14, 2026Niklas BunzelAdversarial Training Neural Network Robustness
Fraunhofer SIT / TU Darmstadt / ATHENE · Darmstadt, Germany
On the Existence of Consistent Adversarial Attacks in High-Dimensional Linear Classification
Jun 14, 2025Matteo Vilucchio, Lenka Zdeborová, Bruno LoureiroAdversarial Attacks Adversarial Robustness
Information Learning and Physics Laboratory, École Polytechnique Fédérale de Lausanne (EPFL) · Statistical Physics of Computation Laboratory, École Polytechnique Fédérale de Lausanne (EPFL) · Département d’Informatique, École Normale Supérieure - PSL & CNRS, France
Bagging Robustly Learns VC Classes with Linear Sample Complexity
Aug 13, 2026Omar MontasserAdversarial Robustness Classification
Yale University

Jul 14, 2026J/K move · Enter open · S save

VanillaBench: The Hidden Accuracy Cost of Adversarial Robustness

Niklas Bunzel

Fraunhofer SIT / TU Darmstadt / ATHENE · Darmstadt, Germany

Adversarial Training Neural Network Robustness Adversarial Robustness

Open paper AskPDF arXiv

Adversarial robustness research has produced hundreds of defended models over the past decade, yet the literature almost universally reports robustness results in isolation: standard (clean) accuracy and adversarial accuracy of the robust model are shown, but the gap to the corresponding vanilla model is rarely quantified. We introduce VanillaBench, a systematic benchmark that makes this gap explicit. For every adversarially-trained model catalogued by RobustBench across four threat models, we compute the accuracy difference against multiple vanilla references from Papers with Code, computed over both all entries and no-extra-data entries, the best vanilla model as of the robust model's publication year, and an architecture-matched baseline. Across all 186 robust models, the mean delta clean relative to the best vanilla model ranges from -7.7 to -29.5 percentage points, and even the single most robust model per track still trails its temporal vanilla counterpart by 4.0-21.0 points. The architecture-matched comparison, which isolates the effect of adversarial training from architectural differences, reveals a mean gap of -3.5 to -17.5 points. Restricting this architecture-matched comparison to models whose vanilla accuracy is known for the exact same architecture, rather than approximated from a related one, narrows the gap to -4.0 to -14.0 points. These results demonstrate that the robustness-accuracy trade-off is substantially larger than what is typically conveyed by individual papers. This information is critical for practitioners and decision-makers. When deploying models in real-world settings, the accuracy cost of robustness directly affects business outcomes, yet current publications do not provide the vanilla baseline needed to assess it. We argue that future robustness evaluations should report vanilla-referenced accuracy gaps as a standard component.

Abstract

Adversarial Robustness

Explore similar work

VanillaBench: The Hidden Accuracy Cost of Adversarial Robustness

On the Existence of Consistent Adversarial Attacks in High-Dimensional Linear Classification

Bagging Robustly Learns VC Classes with Linear Sample Complexity