Get RICH or Die Scaling: Profitably Trading Inference Compute for Robustness

AI summary

Overview

• Research area: Adversarial robustness of vision-language models (VLMs), specifically whether scaling inference-time (test-time) compute can make models robust to adversarial and out-of-distribution (OOD) inputs.
• Technical level: Advanced. The paper assumes familiarity with adversarial attacks (PGD, white-box vs. black-box transfer), adversarial training, chain-of-thought (CoT) reasoning, VLMs, and RL-tuned reasoning models.
• Scope: The paper proposes and rigorously tests the Robustness from Inference Compute Hypothesis (RICH) — that inference-compute defenses become profitable as a model's training data better reflects the components of attacked data — across six VLMs, three attack settings, and multiple inference-scaling strategies.

What This Paper Is About

Prior work (Zaremba et al., 2025) found that scaling reasoning length correlates with robustness to text jailbreaks, but this benefit fades under stronger gradient-based attacks or attacks applied to image inputs. The authors ask when and why test-time compute actually buys robustness, and they hypothesize a "rich-get-richer" dynamic: models already robust at training time profit more from extra inference compute. Their goal is both to explain that dynamic (via the RICH) and to show that a cheap train-time intervention — robustifying a model's vision encoder — unlocks large test-time robustness gains even against white-box multimodal attacks.

Key Contributions

1. Proposes the RICH to explain inference compute's robustness effect, predicting a rich-get-richer dynamic in which test compute adds more robustness to models that are already robust.
2. Rigorously tests the RICH across models, inference compute scaling approaches, and attack types, consistently finding that inference compute adds more robustness as the base model is made more robust, and that other factors like model scale do not explain the results.
3. Shows the rate of return on trading inference compute for robustness can be improved simply by training or lightweight finetuning on attacked data — while introducing what the authors describe as the first adversarially robust RL-tuned reasoning VLM.
4. Demonstrates robustness benefits of inference-compute scaling in several novel contexts: open-source models, models with no RL finetuning, and models facing white-box vision attacks.

Main Findings

• Most robust model benefits most from test compute: Under a strong white-box vision attack with perturbation budget ε = 64/255, only the most robust model (Delta2-LLaVA-v1.5) benefited notably from scaled inference-time compute (K), while less robust models gained little (Figure 4, top left).
• Slope grows with base robustness: The curve of PGD steps versus K has a larger slope as base robustness increases — inference compute makes the attack harder faster when the model starts more robust, the "rich-get-richer" effect predicted by the RICH.
• Shrinking the attack budget helps weaker models: At ε = 16/255, inference-compute scaling gave notable robustness gains to less-robustified models like FARE-LLaVA-v1.5, and even models with no adversarial training benefited (Figure 4, bottom left). Delta2-LLaVA-v1.5 could not be successfully attacked at ε = 16/255.
• Specifications alone do not deter attacks: Adding an explicit security specification did not help the non-robust LLaVA-v1.5 under a strong white-box attack (ε = 16/255, step size 0.1, 300 PGD iterations); its attacker loss actually degraded with the spec (2.9 (0.8) at step 100, reported as attack success, robustness from spec "Negative"). FARE-LLaVA-v1.5 was neutral, and Delta2-LLaVA-v1.5 improved strongly (21.2 (0.0) at step 100 and 21.1 (0.0) at step 300 with the spec vs. 13.5 (0.0) and 12.4 (0.0) without).
• Attack budgets must match training budgets: FARE-LLaVA-v1.5 was finetuned at ε = 2/255 but had only 6.7 PGD steps to success at ε = 64/255; at ε = 16/255 it needed 18.8 steps (K=0), rising to 27.2 at K=5.
• CoT helps only robustified models on attacked data: On the Attack-Bard black-box transfer attacks, all models benefited from CoT on clean data, but only robustified models showed statistically significant benefits on adversarial data at the 0.01 level (McNemar's test). LLaVA-v1.5: clean 69.5 to 82.0 (Yes, 1.4e-4), adversarial 38.0 to 44.5 (No, 4.2e-2). FARE-LLaVA-v1.5: clean 61.5 to 71.0 (Yes, 9.4e-4), adversarial 56.0 to 65.5 (Yes, 4.6e-3). Delta2-LLaVA-v1.5: clean 62.0 to 72.5 (Yes, 4.0e-3), adversarial 62.0 to 73.0 (Yes, 4.5e-3).
• Large-scale VLMs do not rescue the effect: Llama-3.2-Vision-90B showed no significant CoT benefit on clean data (63.5 to 68.5, 1.9e-2) or adversarial data (27.0 to 27.5, 7.9e-1). Qwen-2.5-VL-72B benefited on clean data (57.0 to 67.5, 5.6e-4) but not on adversarial data (13.0 to 18.0, 1.3e-2).
• Robustification plus long reasoning unlocks gains: For InternVL 3.5 gpt-oss 20B, scaling reasoning to thousands of tokens per image via budget forcing produced significant robustness gains only if the VLM's ViT vision encoder was first robustified.
• Robustness changes attack character: Attacks on Delta2-LLaVA-v1.5 targeting the output "Cube" altered the object's shape from spherical to cuboid, whereas LLaVA-v1.5 was fooled by noise-like attacks preserving the object's shape. Adding a security specification made the attacker produce a more convincing cuboid shape.
• Instruction following appears to be the mechanism: In the example in Figure 1, the robust model's 2048-token reasoning notes the weevil's characteristic snout 28 times, while the base model mentions the snout 4 times, says it is absent, and answers incorrectly.

Methodology in Plain English

The authors start from the observation that test-time defenses rely on a "security specification" — an instruction telling the model to resist whatever an attacker injected. They argue such a spec is useless unless the model can actually follow instructions on data that has been pushed far away from its training distribution, and they formalize this as the RICH.

To test it, they line up three LLaVA-style VLMs with deliberately different amounts of adversarial training: LLaVA-v1.5 (none, average adversarial accuracy 1.0 at ε = 4/255), FARE-LLaVA-v1.5 (lightweight unsupervised adversarial finetuning of the image encoder, average 20.1), and Delta2-LLaVA-v1.5 (web-scale adversarial contrastive CLIP pretraining plus adversarial visual instruction tuning, average 61.5). If the RICH holds, robustness returns from test compute should rise with base robustness.

They run three protocol families. First, a white-box PGD attack on an image containing a visual prompt injection (ε = 16/255, step size 0.1, 300 iterations), with the model response pre-filled so that satisfying the spec would be trivially easy if the model simply assigned low probability to the attacker's target. Second, a shape-classification attack (step size 0.1, 100 iterations, ε = 64/255 and ε = 16/255) in which they scale inference compute naively by repeating the security specification K times, and also test three object aspects (color, shape, texture) across four images. Third, the Attack-Bard benchmark — 200 ImageNet-like images with black-box transfer attacks optimized for Bard and GPT-4V at ε = 16/255 — where they use CoT for the LLaVA-family and two large VLMs, and budget forcing for InternVL 3.5 gpt-oss 20B. For the InternVL experiments they robustify the vision encoder with the FARE procedure, training for up to 9,000 iterations on one 4xH100 node with a batch size of 24 (6 per GPU) and 2 PGD steps per iteration at a 2/255 attacker step size, with the clean loss weighted at 0.5; the model in Figure 1 was an early checkpoint at 4,500 iterations from the ε = 12 run. Because Attack-Bard has only 200 images, they run 30 evaluations and report means and standard errors.

Why This Matters

The paper reframes a puzzling negative result — reasoning does not rescue models from strong multimodal attacks, with o1-v still showing a 39% attack success rate on Attack-Bard even at maximum inference compute, versus 46% with no scaling — as a predictable consequence of what the model was trained on. It also supplies a practical recipe: lightweight adversarial finetuning of a vision encoder is enough to convert test compute into robustness.

• Autonomous driving: the paper cites prior work finding that VLMs performing autonomous driving crash more and complete routes less often when under attack, making robustness directly safety-relevant.
• Jailbreak-resistant assistants: security specifications combined with adversarial training could make specification enforcement meaningful on data designed to defeat it.
• Vision-language agents and content moderation: models that must follow instructions on images containing hostile injected text.
• Security-critical deployments where robustness matters more than clean-data performance: the authors suggest adversarial training is most relevant for models targeting security applications rather than universally.

Industry relevance: The findings apply to open-source models without RL finetuning, to a black-box transfer setting relevant to proprietary models where white-box access is unavailable, and they suggest a comparatively cheap train-time investment that pays off at inference. The authors note concurrent work showing inference compute can increase adversarial risk when reasoning chains are exposed or models act autonomously, and that their approach of scaling compute by extending the prompt rather than the model's generations avoids that inverse scaling law.

Future Directions

• Adversarially train or finetune frontier-scale models. The authors mostly tested smaller VLMs and say future work could validate the findings at the larger scales that see widespread deployment.
• Quantify the clean-data tradeoff. Adversarial training can harm performance on data that is not adversarially OOD, so the appropriate scope of robustification remains an open question.
• Extend the RICH to other compute-scaling and attack modalities. The paper tests CoT, naive specification repetition, and budget forcing, but the hypothesis may extend to other defense specifications and attack families.
• Address the inverse scaling law. Concurrent work identifies that scaling inference compute can increase adversarial risk when reasoning chains are exposed or models act autonomously; the paper only partially mitigates this by scaling the prompt rather than generation length.

Target Audience

Researchers and engineers working on adversarial robustness, trustworthy machine learning, and vision-language models will get the most from this paper, along with practitioners deploying reasoning models in security-sensitive settings. It is also relevant to readers tracking test-time compute scaling and to those interested in how train-time defenses and inference-time defenses interact. The writing assumes comfort with PGD attacks, perturbation budgets, transfer attacks, and chain-of-thought evaluation, so beginners will need background reading first.

Authors’ abstract

Test-time reasoning has raised benchmark performances and even shown promise in addressing the historically intractable problem of making models robust to adversarially out-of-distribution (OOD) data. Indeed, recent work used reasoning to aid satisfaction of model specifications designed to thwart attacks, finding a striking correlation between LLM reasoning effort and robustness to jailbreaks. However, this benefit fades when stronger (e.g. gradient-based or multimodal) attacks are used. This may be expected as models often can't follow instructions on the adversarially OOD data created by such attacks, and instruction following is needed to act in accordance with the attacker-thwarting spec. Thus, we hypothesize that the test-time robustness benefits of specs are unlocked by initial robustness sufficient to follow instructions on OOD data. Namely, we posit the Robustness from Inference Compute Hypothesis (RICH): inference-compute defenses profit as the model's training data better reflects the components of attacked data. Guided by the RICH, we test models of varying initial-robustness levels, finding inference-compute adds robustness even to white-box multimodal attacks, provided the model has sufficient initial robustness. Further evidencing a rich-get-richer dynamic, InternVL 3.5 gpt-oss 20B gains little robustness when its test compute is scaled, but such scaling adds significant robustness if we first robustify its vision encoder (creating the first adversarially robust reasoning VLM in the process). Robustifying models makes attacked components of data more in-distribution (ID), and the RICH suggests this fuels compositional generalization -- understanding OOD data via its ID components -- to following spec instructions on adversarial data. Consistently, we find test-time defenses both build and depend on train-time data and defenses.