Introduction
Fine-tuning pre-trained models has become the industry standard for adapting large-scale models to specific downstream tasks. However, this adaptation often comes with a hidden cost: a significant decline in adversarial robustness as accuracy improves. While it is well-known that training from scratch involves a tradeoff between accuracy and robustness—often attributed to the model's reliance on "non-robust" features—the specific dynamics of this tension during the fine-tuning process have remained less understood.
This research investigates whether the accuracy-robustness tradeoff persists during fine-tuning, how different Parameter-Efficient Fine-Tuning (PEFT) strategies like LoRA or BitFit influence this balance, and whether these findings extend to natural distribution shifts (out-of-distribution robustness).
Methodology
The study involved an extensive empirical evaluation of over 231 models and 4,100 robustness assessments. The researchers utilized a Vision Transformer (ViT-Base) pre-trained on ImageNet-21k as the base architecture.
Fine-Tuning Strategies
The authors compared seven distinct adaptation methods:
- Full Fine-Tuning (Full FT)
- Linear Probing (LP)
- PEFT Methods: LoRA, BitFit, Adapter, Compacter, and (IA)³.
These methods were categorized by their Information Location (e.g., Attention vs. Feed-Forward layers) and Mechanism (e.g., reparameterization vs. bias updates). Crucially, the evaluation was continuous, tracking accuracy and robustness at the granularity of individual backpropagation steps rather than just at convergence.
Datasets
To capture varying levels of task complexity, the study employed several benchmarks:
- Adversarial Robustness: CIFAR-10, CIFAR-100, Caltech-256, CUB-200, and Stanford Dogs.
- OOD Robustness: DomainNet (covering six domains like clipart, painting, and real images).
- Scalability: Places365 (1.8M samples).
The "Early Peak" Phenomenon
A central finding of this work is that adversarial robustness does not decline immediately. Instead, it follows a distinct trajectory: during the initial stages of fine-tuning (typically within the first few hundred steps or ~3 epochs), both accuracy and robustness improve as the model adapts its pre-trained features to the new task. However, robustness quickly reaches a peak and then begins a steady decay, even as accuracy continues to climb.
This decay suggests that as the model strives for higher accuracy, it begins to "overfit" to non-robust, task-specific features that are highly predictive but easily manipulated by adversarial perturbations.
Task Complexity and the Pareto Frontier
The tradeoff between accuracy and robustness is heavily influenced by the complexity of the downstream task. On simpler tasks like CIFAR-10, the "Pareto frontier"—the set of optimal balances between accuracy and robustness—is relatively flat, allowing for high accuracy with minimal robustness loss. In contrast, complex tasks like CUB-200 (fine-grained bird classification) exhibit a steep frontier, where gaining marginal accuracy requires sacrificing significant robustness.
The choice of PEFT strategy also plays a critical role. BitFit (updating only biases) proved highly effective for simple tasks. For complex tasks, Compacter (which targets information-heavy layers like attention) provided a superior balance, achieving a Pareto Area Under the Curve (AUC) significantly higher than full fine-tuning or linear probing.
Adversarial vs. OOD Robustness
Interestingly, the study found that adversarial robustness and out-of-distribution (OOD) robustness behave very differently. While adversarial robustness is fragile and trades off with accuracy, OOD robustness (the ability to generalize to different visual styles or domains) remains remarkably stable and generally improves alongside accuracy. This suggests that the degradation induced by fine-tuning is specific to adversarial vulnerabilities rather than a general loss of distributional robustness.
Conclusion and Future Work
This research highlights a critical challenge in deploying fine-tuned models: the inevitable erosion of adversarial robustness during the pursuit of peak accuracy. While PEFT methods like Compacter offer a better tradeoff on complex tasks, the "early peak" phenomenon suggests that stopping training early or using "robustness-aware" PEFT strategies may be necessary for security-critical applications. Future work should explore these dynamics in other architectures and integrate active adversarial defenses into the fine-tuning loop.