Exposing Vulnerability Monoculture Through Systemic Adversarial Robustness

Leo Elmecker-Plakolm; Lukasz Szpruch; Avishek Joey Bose; Matthew Wicker

cs.CROct 19, 2026

Exposing Vulnerability Monoculture Through Systemic Adversarial Robustness

Authors: Leo Elmecker-Plakolm, Lukasz Szpruch, Avishek Joey Bose, Matthew Wicker

Organizations: Imperial College London · The University of Edinburgh · The Alan Turing Institute · Mila - Québec AI Institute

Abstract

Beneath the apparent diversity of foundation models lies an increasingly homogeneous technical stack of common training pipelines, distillation methods, and data. These shared algorithmic choices can expose an otherwise distinct model ecosystem to concentrated risks leading to a vulnerability monoculture. Yet current practice in assessing adversarial robustness is restricted to individual robustness scores and attack transfer rates, leaving open the unexplored fundamental question: how many attacks suffice for catastrophic widespread compromise? In this paper, we investigate the empirical nature of shared vulnerabilities within a model pool and introduce Systemic Adversarial Robustness (SAR), a novel measure of shared vulnerability of a model pool through the attack diversity needed to exploit it. Specifically, SAR interpolates between single-attack transferability and independent per-model robustness: small values reveal a vulnerability monoculture, whereas large values indicate that failures are dispersed across models. We theoretically formulate SAR as a partial set-cover problem with provable approximation guarantees---enabling the development of scalable algorithms to empirically measure the systemic adversarial robustness. We empirically test the shared vulnerability of vision and large language models and characterize their shared collective vulnerability curve. Specifically, we demonstrate that model pools distilled from DeepSeek-R1 and Claude Opus 4.6 exhibit lower estimated systemic robustness than their corresponding parent pools, revealing a potential systemic cost of frontier-model distillation. Our framework seeks to establish vulnerability monoculture as a measurable target for a more wholistic adversarial evaluation of model populations.

Figures & tables

Figure 1: Left: A stylized visualization of how a decrease in Systemic Adversarial Robustness emerges through model distillation in large language models. Right Increasing the number of distillation fine-tuning steps reduces the number of unique attack vectors $\hat{k}$ needed to compromise a model pool due to the internalization of shared vulnerabilities, visualized as the overlap of vulnerable level sets.

Figure 2: Systemic Adversarial Robustness increases as a model pool becomes more diverse.

Figure 3: Systemic Adversarial Robustness vs Attack Success Rate under distillation. Left: The change in SAR and ASR as a function of fine-tuning steps. Right: Tracing the SAR distribution curves between the starting model pool and the fine-tuned model pool for

\operatorname{SAR}_{1-\delta}=0.85

at various steps during fine-tuning.

Panel of Figure 4 — Algorithm 1 Top-Down Greedy Estimate of $1-\delta$ Systemic Robustness

Figure 4: Distillation lowers systemic robustness under AmpleGCG + BEAST. Left: the distribution of singleton-completed $\hat{k}/M$ at varying risk tolerances $\delta$ for the medium-sized pool ( $M=6$ ), comparing the original pool, the pool after DeepSeek-R1 distillation, and the pool after subsequent Opus 4.6 distillation. Right: same as left but for the large-sized pool ( $M=8$ ). Lower values mean that fewer suffixes cover the pool. Dashed lines denote means.

Figure 5: Same as Figure 3 but for distillation of a pool of ten small LLMs on DeepSeek-R1 traces, under AmpleGCG + BEAST with thinking off.

Appendix figures & tables14 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 7 — Algorithm 2 Joint PGD attack $\mathcal{A}_{\mathcal{I}}(x)=\textsc{JointPGD}(x,\mathcal{I})$

Hyperparameter	Value
Steps $n_{\mathrm{it}}$	40
Step size $\eta$	$2.5\,\varepsilon/n_{\mathrm{it}}=\varepsilon/16$
Random restarts $n_{\mathrm{rs}}$	3

Appendix

Table 1: Hyperparameters of joint PGD on MNIST.

Panel of Figure 9 — Algorithm 3 Joint BEAST attack $\mathcal{A}_{\mathcal{I}}(x)=\textsc{JointBEAST}(x,\mathcal{I})$

Hyperparameter	Value
Beam width $B$	10
Seed length $L_{0}$	20 tokens
Suffix length $L$	30 tokens (as per canonical tokenizer)
Seed generator and canonical tokenizer	AmpleGCG-llama2-sourced-llama2-7b-chat
Temperature $T$	1
Query budget per call $Q$	15,000

Appendix

Table 2: Hyperparameters of joint BEAST.

Panel of Figure 11 — Algorithm 4 Joint GCG attack $\mathcal{A}_{\mathcal{I}}(x)=\textsc{JointGCG}(x,\mathcal{I})$

Hyperparameter	Value
Steps per call $n_{\mathrm{it}}$	20
Candidates per step $n_{\mathrm{cand}}$	64
Top- $n_{\mathrm{top}}$ substitutions	256
Samples	25 HarmBench behaviors
Judge	HarmBench-Llama-2-13b-cls

Appendix

Table 3: Hyperparameters of joint GCG.

Panel of Figure 13 — Algorithm 5 Joint AutoDAN attack $\mathcal{A}_{\mathcal{I}}(x)=\textsc{JointAutoDAN}(x,\mathcal{I})$

Hyperparameter	Value
Attacker model $g$	Qwen3.8-27B
Sampling temperature	0.8
Top- $p$	0.95
Maximum new tokens	768
Resampling attempts	3
Proposals per anchor $n_{\mathrm{p}}$	4

Appendix

Table 4: Hyperparameters of joint AutoDAN.

Pool	Architecture	Training data and regularisation	Varies across models
Low	MLPs, one hidden layer (256 units)	Shared training splits in fixed order, no augmentation or regularisation	Initialisation seed
Medium	MLPs, one hidden layer (256 units)	diverse resampling of training split, random affine augmentation, weight decay	Seed, training regime
High	6 two-layer CNNs, 6 three-layer CNNs, 4 one-hidden-layer MLPs, 4 diverse CNN variants	Same as Medium	Seed, training regime, architecture family

Appendix

Table 5: MNIST model pools. Each pool has 20 models, and each diversity level keeps what varies in the level below and adds one more factor. Every model is trained with early stopping and the best-validation weights are kept.

Figure 6: Distillation lowers systemic robustness under AdvLLM + BEAST. Left: the distribution of singleton-completed $\hat{k}/M$ at varying risk tolerances $\delta$ for the medium-sized pool ( $M=6$ ), comparing the original pool, the pool after DeepSeek-R1 distillation, and the pool after subsequent Opus 4.6 distillation. Right: same as left but for the large-sized pool ( $M=8$ ). Lower values mean that fewer suffixes cover the pool. Dashed lines denote means.

Figure 7: Model distillation from DeepSeek-R1 increases raw systemic risk under GCG. Left: the six parent–descendant lineages. Right: the distribution of singleton-completed $\hat{k}/6$ at each risk tolerance $\delta$ . Lower values mean that fewer suffixes cover the pool. Dashed lines denote medians.

Figure 8: Systemic risk of a Claude Opus 4.5 distilled lineage. Left: eight parent checkpoints and their Opus-attributed descendants. Right: singleton-completed systemic risk under AutoDAN-RR. The plotted worst-case sets were selected separately for the parents ( $25$ behaviors) and descendants ( $22$ behaviors).

Medium-sized model pool ( $M=6$ )
	$\delta=0$	$\delta=1/6$	$\delta=1/3$	$\delta=1/2$
Original pool	0.543	0.385	0.270	0.203
DeepSeek-R1	0.512 ( $-5.8\%$ )	0.363 ( $-5.6\%$ )	0.267 ( $-1.2\%$ )	0.202 ( $-0.8\%$ )
R1 $\rightarrow$ Opus 4.6	0.288 ( $-46.9\%$ )	0.208 ( $-45.9\%$ )	0.180 ( $-33.3\%$ )	0.168 ( $-17.2\%$ )
Large-sized model pool ( $M=8$ )
	$\delta=0$	$\delta=1/4$	$\delta=3/8$	$\delta=1/2$

Appendix

Table 6: Mean systemic robustness per input,

\hat{k}/M

, over the 100 HarmBench behaviours (AmpleGCG bank + BEAST, thinking off), with the relative change from the original pool in parentheses. Lower values mean the pool is easier to break jointly.

Pool	$M$	Params (B)	Post-training
Opus parents	8	4.0–31.2 (11.5)	8 instruction- or reasoning-tuned
Opus descendants	8	4.0–31.2 (11.5)	8 distilled from reasoning traces attributed to Claude Opus 4.5
DeepSeek-R1 parents	6	1.5–32.8 (8.1)	6 base, not safety-aligned
DeepSeek-R1 descendants	6	1.8–32.8 (8.1)	6 distilled from DeepSeek-R1

Appendix

Table 7: LLM pools. Parameters are the minimum–maximum over the pool, with the median in parentheses.

Adversarial Robustness

Adversarial robustness studies how well AI systems withstand deliberately crafted inputs, training-data corruption, and other attacks.

See all 481 papers

Risk Under Pressure: Compute-Aware Evaluation of Adversarial Robustness in Language Models
Jun 9, 2026Malikeh Ehghaghi, Boglárka Ecsedi, Marsha Chechik +1LLM Alignment Neural Network Robustness
University of Toronto · Vector Institute · Hugging Face
Evaluating and Improving the Robustness of Large Language Models to Input Sequence Variations
Oct 1, 2026Narek MaloyanLanguage Model Robustness Adversarial Attacks on LLMs
VanillaBench: The Hidden Accuracy Cost of Adversarial Robustness
Jul 14, 2026Niklas BunzelAdversarial Training Neural Network Robustness
Fraunhofer SIT / TU Darmstadt / ATHENE · Darmstadt, Germany

Jun 9, 2026J/K move · Enter open · S save

Risk Under Pressure: Compute-Aware Evaluation of Adversarial Robustness in Language Models

Malikeh Ehghaghi, Boglárka Ecsedi, Marsha Chechik, Colin Raffel

University of Toronto · Vector Institute · Hugging Face

LLM Alignment Neural Network Robustness Adversarial Robustness LLM Jailbreak Attacks Adversarial Robustness of Language Models LLM Safety Evaluation

Open paper AskPDF arXiv

Adversarial robustness evaluations of large language models (LLMs) typically report attack success rate (ASR) under fixed query budgets, implicitly treating all attacks as equally costly. In practice, the computational expense of different attack strategies can vary by orders of magnitude. Consequently, ASR at a fixed budget can obscure the true effort required to jailbreak a model, thereby making it hard to determine whether an attack's cost justifies its payoff to the attacker. We propose a compute-aware evaluation framework based on computational pressure, measured in cumulative floating-point operations (FLOPs), as a proxy for adversarial effort. We introduce risk-compute curves, which map compute budgets to attack risk, and derive two metrics that summarize the average pressure required for a given attack to succeed. Across ten models spanning three families and four different stages in language model training and alignment, evaluated with three attack strategies (gradient-based, iterative refinement, and template-based) on two jailbreak robustness benchmarks, we find: (1) alignment training has non-monotonic effects on compute-space robustness; (2) scaling model size reduces gradient-based attack effectiveness but has limited impact on cheaper template-based attacks; (3) gradient-based attacks optimized on a surrogate model can transfer to a separate target model, providing a way to reduce attacker costs; (4) compute cost varies by up to

{\approx}5{\times}

across harm categories within a single model; and (5) safety-aligned RL increases aggregate cost while leaving some categories disproportionately accessible. We release our framework to enable compute-aware risk assessment and evaluation.

Abstract

Adversarial Robustness

Explore similar work

Risk Under Pressure: Compute-Aware Evaluation of Adversarial Robustness in Language Models

Evaluating and Improving the Robustness of Large Language Models to Input Sequence Variations

VanillaBench: The Hidden Accuracy Cost of Adversarial Robustness