Beneath the apparent diversity of foundation models lies an increasingly homogeneous technical stack of common training pipelines, distillation methods, and data. These shared algorithmic choices can expose an otherwise distinct model ecosystem to concentrated risks leading to a vulnerability monoculture. Yet current practice in assessing adversarial robustness is restricted to individual robustness scores and attack transfer rates, leaving open the unexplored fundamental question: how many attacks suffice for catastrophic widespread compromise? In this paper, we investigate the empirical nature of shared vulnerabilities within a model pool and introduce Systemic Adversarial Robustness (SAR), a novel measure of shared vulnerability of a model pool through the attack diversity needed to exploit it. Specifically, SAR interpolates between single-attack transferability and independent per-model robustness: small values reveal a vulnerability monoculture, whereas large values indicate that failures are dispersed across models. We theoretically formulate SAR as a partial set-cover problem with provable approximation guarantees---enabling the development of scalable algorithms to empirically measure the systemic adversarial robustness. We empirically test the shared vulnerability of vision and large language models and characterize their shared collective vulnerability curve. Specifically, we demonstrate that model pools distilled from DeepSeek-R1 and Claude Opus 4.6 exhibit lower estimated systemic robustness than their corresponding parent pools, revealing a potential systemic cost of frontier-model distillation. Our framework seeks to establish vulnerability monoculture as a measurable target for a more wholistic adversarial evaluation of model populations.
Figures & tables
Figure 1: Left: A stylized visualization of how a decrease in Systemic Adversarial Robustness emerges through model distillation in large language models. Right Increasing the number of distillation fine-tuning steps reduces the number of unique attack vectors k^ needed to compromise a model pool due to the internalization of shared vulnerabilities, visualized as the overlap of vulnerable level sets.
Figure 2: Systemic Adversarial Robustness increases as a model pool becomes more diverse.
Figure 3: Systemic Adversarial Robustness vs Attack Success Rate under distillation. Left: The change in SAR and ASR as a function of fine-tuning steps. Right: Tracing the SAR distribution curves between the starting model pool and the fine-tuned model pool for SAR1−δ=0.85 at various steps during fine-tuning.
Algorithm 1 Top-Down Greedy Estimate of 1−δ Systemic Robustness
Figure 4: Distillation lowers systemic robustness under AmpleGCG + BEAST. Left: the distribution of singleton-completed k^/M at varying risk tolerances δ for the medium-sized pool ( M=6 ), comparing the original pool, the pool after DeepSeek-R1 distillation, and the pool after subsequent Opus 4.6 distillation. Right: same as left but for the large-sized pool ( M=8 ). Lower values mean that fewer suffixes cover the pool. Dashed lines denote means.
Figure 5: Same as Figure 3 but for distillation of a pool of ten small LLMs on DeepSeek-R1 traces, under AmpleGCG + BEAST with thinking off.
Table 5: MNIST model pools. Each pool has 20 models, and each diversity level keeps what varies in the level below and adds one more factor. Every model is trained with early stopping and the best-validation weights are kept.
Figure 6: Distillation lowers systemic robustness under AdvLLM + BEAST. Left: the distribution of singleton-completed k^/M at varying risk tolerances δ for the medium-sized pool ( M=6 ), comparing the original pool, the pool after DeepSeek-R1 distillation, and the pool after subsequent Opus 4.6 distillation. Right: same as left but for the large-sized pool ( M=8 ). Lower values mean that fewer suffixes cover the pool. Dashed lines denote means.
Figure 7: Model distillation from DeepSeek-R1 increases raw systemic risk under GCG. Left: the six parent–descendant lineages. Right: the distribution of singleton-completed k^/6 at each risk tolerance δ . Lower values mean that fewer suffixes cover the pool. Dashed lines denote medians.
Figure 8: Systemic risk of a Claude Opus 4.5 distilled lineage. Left: eight parent checkpoints and their Opus-attributed descendants. Right: singleton-completed systemic risk under AutoDAN-RR. The plotted worst-case sets were selected separately for the parents ( 25 behaviors) and descendants ( 22 behaviors).
Medium-sized model pool ( M=6 )
δ=0
δ=1/6
δ=1/3
δ=1/2
Original pool
0.543
0.385
0.270
0.203
DeepSeek-R1
0.512 ( −5.8% )
0.363 ( −5.6% )
0.267 ( −1.2% )
0.202 ( −0.8% )
R1 → Opus 4.6
0.288 ( −46.9% )
0.208 ( −45.9% )
0.180 ( −33.3% )
0.168 ( −17.2% )
Large-sized model pool ( M=8 )
δ=0
δ=1/4
δ=3/8
δ=1/2
Appendix
Table 6: Mean systemic robustness per input, k^/M , over the 100 HarmBench behaviours (AmpleGCG bank + BEAST, thinking off), with the relative change from the original pool in parentheses. Lower values mean the pool is easier to break jointly.
Pool
M
Params (B)
Post-training
Opus parents
8
4.0–31.2 (11.5)
8 instruction- or reasoning-tuned
Opus descendants
8
4.0–31.2 (11.5)
8 distilled from reasoning traces attributed to Claude Opus 4.5
DeepSeek-R1 parents
6
1.5–32.8 (8.1)
6 base, not safety-aligned
DeepSeek-R1 descendants
6
1.8–32.8 (8.1)
6 distilled from DeepSeek-R1
Appendix
Table 7: LLM pools. Parameters are the minimum–maximum over the pool, with the median in parentheses.
Adversarial robustness evaluations of large language models (LLMs) typically report attack success rate (ASR) under fixed query budgets, implicitly treating all attacks as equally costly. In practice, the computational expense of different attack strategies can vary by orders of magnitude. Consequently, ASR at a fixed budget can obscure the true effort required to jailbreak a model, thereby making it hard to determine whether an attack's cost justifies its payoff to the attacker. We propose a compute-aware evaluation framework based on computational pressure, measured in cumulative floating-point operations (FLOPs), as a proxy for adversarial effort. We introduce risk-compute curves, which map compute budgets to attack risk, and derive two metrics that summarize the average pressure required for a given attack to succeed. Across ten models spanning three families and four different stages in language model training and alignment, evaluated with three attack strategies (gradient-based, iterative refinement, and template-based) on two jailbreak robustness benchmarks, we find: (1) alignment training has non-monotonic effects on compute-space robustness; (2) scaling model size reduces gradient-based attack effectiveness but has limited impact on cheaper template-based attacks; (3) gradient-based attacks optimized on a surrogate model can transfer to a separate target model, providing a way to reduce attacker costs; (4) compute cost varies by up to ≈5× across harm categories within a single model; and (5) safety-aligned RL increases aggregate cost while leaving some categories disproportionately accessible. We release our framework to enable compute-aware risk assessment and evaluation.
Large language models (LLMs) in production systems face prompt injections, trojans (backdoors), and manipulation of automatic quality metrics. This thesis develops models, methods, and algorithms for evaluating and improving LLM robustness to adversarial input sequence variations. We propose R_stab(f), a generative robustness metric based on the Jensen-Shannon divergence between per-step output distributions under small input perturbations. For localized attacks we prove V(h) <= 1 - R_class(h), where R_class(h) is the probability that a decision operator h keeps its decision under small perturbations. For non-localized attacks we propose a calibrated empirical model. For LLM-as-a-Judge systems we develop ASA, an adaptive evolutionary black-box attack that reaches an attack success rate (ASR) of up to 73.8%, with transfer between open models up to 62.6%. On Trojan Detection Challenge 2023 data (Pythia-1.4B), surrogate triggers reach REASR ~0.99 while recall of the true triggers is ~0.17 against a baseline of ~0.14. On SaTML CTF 2024 we systematize four classes of bypasses of multi-layer defenses, which reduce the ASR from 90% to 15-25%. Committees of 5-7 heterogeneous models reduce the ASR for Gemma-3-4B by 47-55 percentage points, to 19.3% with 7 models. For agentic systems based on the Model Context Protocol (MCP), we propose AttestMCP, which attests tool calls with HMAC-protected packets at under 0.1 ms per call, and the Commit Boundary isolation pattern. On the MCPBench benchmark of 847 scenarios they reduce the average ASR from 53.7% to 12.4%. The methods are implemented in the JudgeGuard and TrojanArmor software suites and the MCPSec module.
Adversarial robustness research has produced hundreds of defended models over the past decade, yet the literature almost universally reports robustness results in isolation: standard (clean) accuracy and adversarial accuracy of the robust model are shown, but the gap to the corresponding vanilla model is rarely quantified. We introduce VanillaBench, a systematic benchmark that makes this gap explicit. For every adversarially-trained model catalogued by RobustBench across four threat models, we compute the accuracy difference against multiple vanilla references from Papers with Code, computed over both all entries and no-extra-data entries, the best vanilla model as of the robust model's publication year, and an architecture-matched baseline. Across all 186 robust models, the mean delta clean relative to the best vanilla model ranges from -7.7 to -29.5 percentage points, and even the single most robust model per track still trails its temporal vanilla counterpart by 4.0-21.0 points. The architecture-matched comparison, which isolates the effect of adversarial training from architectural differences, reveals a mean gap of -3.5 to -17.5 points. Restricting this architecture-matched comparison to models whose vanilla accuracy is known for the exact same architecture, rather than approximated from a related one, narrows the gap to -4.0 to -14.0 points. These results demonstrate that the robustness-accuracy trade-off is substantially larger than what is typically conveyed by individual papers. This information is critical for practitioners and decision-makers. When deploying models in real-world settings, the accuracy cost of robustness directly affects business outcomes, yet current publications do not provide the vanilla baseline needed to assess it. We argue that future robustness evaluations should report vanilla-referenced accuracy gaps as a standard component.
Niklas Bunzel
Fraunhofer SIT / TU Darmstadt / ATHENE · Darmstadt, Germany