aiqbench analysis
The paper is a theoretical study of adversarial robustness, asking when extra compute gives attackers or defenders a durable edge. Its main results are a dichotomy for classification tasks under a quadratic compute gap, and a proof that defenses which spend computation at inference time can be provably stronger than fixed models. The result is formal and relies on strong cryptographic assumptions, so it offers conceptual evidence rather than a practical defense, but it is relevant to anyone thinking about jailbreak robustness and test-time compute.
Does More Compute Make Every Adversarial Attack Transferable?
arXiv:2504.20310v3 Announce Type: replace Abstract: Transferable attacks, or transferable jailbreaks, are a particularly strong version of adversarial examples that fool all defenders in a class. In this work, we study when more compute enables transferable attacks. We show that, when there is a quadratic gap in computational resources between attacker and defender, every learnable classification task admits either a transferable attack or an adversarial defense. For generative tasks, this dichotomy fails below a quadratic gap, i.e., more compute for the attacker does not lead to a transferable attack. We prove a stronger result that implies this failure: a defense that spends additional computation after it sees the input can be provably strictly stronger than every defense that publishes a fixed model. This result provides formal evidence that increasing inference-time compute can improve robustness, as empirically observed by Zaremba et al. (2025). We assume the existence of an array of cryptographic primitives: identity-based fully homomorphic encryption, publicly verifiable zero-knowledge succinct non-interactive arguments of knowledge, non-parallelizing languages, and incrementally verifiable computation.
Title:Does More Compute Make Every Adversarial Attack Transferable?
Abstract:Transferable attacks, or transferable jailbreaks, are a particularly strong version of adversarial examples that fool all defenders in a class. In this work, we study when more compute enables transferable attacks. We show that, when there is a quadratic gap in computational resources between attacker and defender, every learnable classification task admits either a transferable attack or an adversarial defense. For generative tasks, this dichotomy fails below a quadratic gap, i.e., more compute for the attacker does not lead to a transferable attack. We prove a stronger result that implies this failure: a defense that spends additional computation after it sees the input can be provably strictly stronger than every defense that publishes a fixed model. This result provides formal evidence that increasing inference-time compute can improve robustness, as empirically observed by Zaremba et al. (2025). We assume the existence of an array of cryptographic primitives: identity-based fully homomorphic encryption, publicly verifiable zero-knowledge succinct non-interactive arguments of knowledge, non-parallelizing languages, and incrementally verifiable computation.
Machine Learning (cs.LG); Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR)
arXiv:2504.20310 [cs.LG]
(or arXiv:2504.20310v3 [cs.LG] for this version)
https://doi.org/10.48550/arXiv.2504.20310 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 271 words
Related coverage
Rethinking the Transferable Adversarial Attacks and Robust Defense in Federated Learning
arXiv · Aug 27, 2026
Merge Now, Regret Later: The Hidden Cost of Model Merging Is Adversarial Transferability
arXiv · Aug 21, 2026
What Makes Adversarial Examples Transfer Across Deepfake Detectors?
arXiv · Sep 11, 2026
Visual-Invariance-Augmented Feature Optimal Alignment for Transferable Adversarial Attacks against Closed-Source MLLMs
arXiv · Oct 7, 2026