A year after shipping a classifier adversarially trained at one L-infinity radius, what is that radius choice still worth?

## The question behind the question Somebody chose a radius before the model shipped. A year later the person who has to answer for the defence is usually not the engineer who tuned it, and the question they are asked is not "is the model robust" but "what is that decision still buying us". Answering it well means converting a training-time choice into a statement about **an adversary's cost today**. ## What was actually purchased Adversarial training bought a fitted neighbourhood: within a stated norm and radius, the model was trained on the hardest point the inner search could find, so points in that region stop flipping the answer cheaply. The purchase is real and it is measurable, and it has three properties worth stating plainly. **It is a price, not a barrier.** An attacker inside the region is not stopped; they are made to spend more — more search steps, more restarts, and typically a larger, more visible distortion to achieve the same targeted misread. Whether that price matters depends entirely on what one misread is worth to them. **The price collapses at the boundary.** Robust accuracy does not decay gently past the trained radius; it falls steeply. So the defence's value is concentrated on adversaries who, for their own reasons, want to stay imperceptible. **It was never charged outside the norm.** A sparse edit, a re-encode, a re-shot photograph or a substituted object were not in the region and were never priced. ## Reading the re-measurement A year on, the right artefact is a table, and its columns are the argument. Access assumption, norm, radius, steps, restarts, accuracy. The row at the trained radius is the claim that was made; every row below it is an attacker who declined to stay in the ball. If the shipped model's weights are public, the access column reads white-box by default and no part of the remaining number may be attributed to obscurity. Two readings are commonly wrong. A steep fall-off just outside the trained radius is **not** evidence that the training failed — it is the expected shape of what was bought. And an unchanged number from a year ago is not evidence that nothing has changed, if it was produced by re-running the same search at the same settings; the thing that moves over a year is the strength and cheapness of the search an attacker will run, so a re-measurement that does not increase steps and restarts has re-measured nothing. ## What you can honestly say - **What it still stops:** an adversary who edits the file they submit within the trained magnitude, evaluated with a search of at least the strength used in training. Give the current number with its columns. - **What it never stopped:** anyone whose move is outside the region — a few coordinates changed a lot, a capture-level change, or a genuinely different input. Those need their own measurement or their own answer. - **What decayed:** not the region, which is fixed, but the assumption that an attacker's search is expensive. Cheaper compute and better search make the same radius a smaller toll each year. - **What has not been established:** anything about the model as a whole. An empirical robust-accuracy figure bounds the attack that was run. It is not a guarantee, and it should never be repeated in a deck as one. ## The decision that follows The tempting move is to retrain at a larger radius. That is only right if the larger region describes an adversary you face, because widening it costs compute on every retrain and clean accuracy on every prediction — bills paid by all traffic, including the overwhelming majority that is not adversarial — while an attacker who re-photographs the listing pays none of it. The comparison worth putting in front of whoever owns the budget is: what does the same spend move the attacker's price by, here versus elsewhere in the pipeline, given what one successful misread is worth to them. On a marketplace listing, if a misread is worth a few dollars and the defence forces a fifty-step white-box search plus visible distortion, the economics are decisive and the radius earned its keep. If a misread is worth thousands, the same toll is a rounding error and the honest recommendation is that this control is not where the next unit of effort belongs. ## Saying it in a room Open with the reframe — it bought a cost, not immunity — then the current numbers with their columns, then the explicit list of moves that were never priced, then the recommendation with the bill attached. That sequence is what separates someone who owns a defence from someone who reports a percentage about it.