On the Interaction of Compressibility and Adversarial Robustness

TL;DR

This paper investigates how different forms of neural network compressibility influence adversarial robustness, revealing a fundamental tension and providing a framework to understand and improve model security and efficiency.

Contribution

We develop a unified theoretical framework analyzing the impact of neuron-level and spectral compressibility on adversarial robustness, supported by empirical validation.

Findings

Compressibility induces sensitive directions exploitable by adversaries.

Vulnerabilities persist across different compression methods and training regimes.

Structured compression can lead to universal adversarial perturbations.

Abstract

Modern neural networks are expected to simultaneously satisfy a host of desirable properties: accurate fitting to training data, generalization to unseen inputs, parameter and computational efficiency, and robustness to adversarial perturbations. While compressibility and robustness have each been studied extensively, a unified understanding of their interaction still remains elusive. In this work, we develop a principled framework to analyze how different forms of compressibility - such as neuron-level sparsity and spectral compressibility - affect adversarial robustness. We show that these forms of compression can induce a small number of highly sensitive directions in the representation space, which adversaries can exploit to construct effective perturbations. Our analysis yields a simple yet instructive robustness bound, revealing how neuron and spectral compressibility impact $L_\infty$ and $L_2$ robustness via their effects on the learned representations. Crucially, the vulnerabilities we identify arise irrespective of how compression is achieved - whether via regularization, architectural bias, or implicit learning dynamics. Through empirical evaluations across synthetic and realistic tasks, we confirm our theoretical predictions, and further demonstrate that these vulnerabilities persist under adversarial training and transfer learning, and contribute to the emergence of universal adversarial perturbations. Our findings show a fundamental tension between structured compressibility and robustness, and suggest new pathways for designing models that are both efficient and secure.