🤖 machine learning

Capability and Robustness Cannot Both Be Free: An Information-Theoretic Bound for Vision-Language-Action Models

This paper establishes a theoretical information-theoretic bound proving that Vision-Language-Action models face an inherent trade-off where the sum of capability and robustness cannot exceed a fixed budget determined by task entropy and adversarial channel capacity, thereby demonstrating that significant improvements in one dimension inevitably come at the expense of the other.

Original authors: Jianwei Tai

Published 2026-05-26

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Jianwei Tai

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are teaching a robot to do a complex task, like making a sandwich or assembling a toy. You want the robot to be capable (it does the job perfectly when the room is clean and quiet) and robust (it keeps doing the job perfectly even if someone sneaks in and slightly messes up the lighting or adds a tiny, invisible sticker to the table).

For a long time, researchers hoped they could make robots that were both super capable and super robust, perhaps just by training them "smarter."

This paper says: No, you can't have both for free. There is a hard, mathematical limit on how good a robot can be at both things at the same time.

Here is the breakdown using simple analogies:

1. The "Budget" Analogy

Think of the robot's ability to handle the world as a fixed budget of "information money."

Capability is how well the robot understands the real instructions (the "Oracle").
Robustness is how well the robot ignores the fake or messy instructions (the "Attack").

The paper proves that the sum of your Capability and your Robustness cannot exceed a specific Total Budget. This budget is determined by two things:

How complex the task is (The "Task Entropy"): If the task is "pick up a red block," the budget is small. If the task is "build a house of cards," the budget is huge.
How much noise the attacker can add (The "Channel Capacity"): If the attacker can only add a tiny speck of dust, the budget is small. If they can smear the whole image, the budget is huge.

The Catch: You cannot spend this budget on both Capability and Robustness simultaneously without running out. If you spend more money on being robust against attacks, you must spend less on being capable in normal conditions, and vice versa.

2. The "No Free Lunch" Discovery

The authors looked at a popular robot brain called OpenVLA.

The Problem: When the robot sees a clean image, it succeeds 95% of the time. But if a hacker adds a tiny, invisible pattern (an "adversarial perturbation"), the robot's success rate crashes to under 5%.
The Old Hope: Maybe if we train it differently, it can be 95% good on clean images and 95% good on attacked images.
The Reality: The math proves this is impossible. There is a "theoretical floor." You can't just train your way out of this trade-off; the laws of information theory say you have to choose.

3. Why the "Budget" Was So Big (and then Small)

Initially, the authors calculated the budget using the entire image (millions of pixels).

The Loose Bound: They found a budget of about 5,000 units. The robot was only using about 7.5 units for its actual job. This made it look like there was plenty of room to improve both sides. It was like saying, "You have a $5,000 allowance, but you only spend $7.50 on lunch, so you must have $4,992.50 left to spend on Robustness!"

But that was misleading.
The robot doesn't look at every single pixel. It looks at a "summary" of the image (like a compressed photo) before making a decision.

The Tight Bound: When the authors looked at the budget specifically for the part of the image the robot actually uses, the budget shrank from 5,000 down to 31 units.
The Shock: Now, the robot is already spending 24% of its entire budget just on being capable. That leaves very little room (only ~23 units) to improve Robustness without hurting Capability.

4. The "Leakage" Problem

The paper also introduces a clever way to measure "Robustness" that prevents cheating.
Imagine a robot that, instead of ignoring the attack, simply copies the attack into its action.

Attack: "Move left."
Robot Action: "Move left."
Result: The robot looks "robust" because it didn't change its mind, but it's actually just blindly following the hacker.

The paper's math subtracts out this "cheating" behavior. It ensures that true Robustness means the robot is ignoring the noise, not just copying it.

5. What This Means for the Future

The authors don't say we should give up. Instead, they offer a new ruler for scientists to use.

Instead of just saying, "Our new defense makes the robot 10% better," they suggest scientists should say:

"Our new defense uses up 60% of the remaining 'Robustness Budget' available for this specific robot architecture."

This helps everyone compare different robots fairly. It tells us that for current robots, we are hitting a wall. To get better, we can't just tweak the training; we might need to change the robot's "brain" (its architecture) or accept that it will be slightly less perfect on clean days to be safer on messy days.

In short: You can't have a robot that is perfect at its job and perfectly immune to tricks. There is a hard math limit, and for today's robots, we are already spending a big chunk of that limit just to do the job at all.

Technical Summary: Capability and Robustness Cannot Both Be Free

Problem Statement

Vision-Language-Action (VLA) models, which map multimodal observations (images and language) directly to robot actions, have achieved high success rates on clean inputs but exhibit catastrophic fragility under adversarial perturbations. Empirical studies show that imperceptible perturbations (e.g., a $16/255$ PGD attack) can drop task success rates from $>95\%$ to $<5\%$ . While empirical defenses exist, they typically involve a trade-off: recovering robustness often incurs a cost in clean accuracy.

The central open question addressed by this work is whether this trade-off has a theoretical floor. Specifically, can a smarter training procedure simultaneously achieve high capability (clean accuracy) and high robustness without limit, or is there a fundamental information-theoretic constraint preventing both from being maximized simultaneously?

Methodology

The authors formulate a theoretical framework based on information theory to bound the joint performance of VLA policies.

1. Theoretical Framework

The paper defines a VLA policy $\pi$ that maps an observation $X$ to an action $A_\pi$ . Let $A^\star$ be the oracle (expert) action and $\tilde{X} = X + \delta$ be the perturbed observation. The authors define two key metrics:

Capability ($Cap$): The mutual information between the policy's action and the oracle action, $I(A^\star; A_\pi)$ .
Robustness ($Rob$): The mutual information preserved under attack, adjusted for "leakage," defined as $I(A_\pi; \tilde{A}_\pi) - I(A_\pi; \delta)$ . The subtraction of $I(A_\pi; \delta)$ prevents degenerate policies from achieving high scores by simply copying the perturbation $\delta$ into the action.

The core contribution is Theorem 1, which states that for any VLA policy with discrete (or discretized) actions:
$Cap(\pi) + Rob(\pi) \leq H(A^\star) + I(X; \tilde{X})$
Where:

$H(A^\star)$ is the entropy of the oracle action (task complexity).
$I(X; \tilde{X})$ is the mutual information between the clean and perturbed observation (attack channel capacity).

The proof relies on two applications of the Data Processing Inequality (DPI) and the non-negativity of mutual information. The bound is policy-independent, meaning the "budget" for capability and robustness is determined solely by the task and the attack, not by the model architecture.

2. Tightening the Bound

The authors acknowledge that the pixel-level bound is loose for current models because the image dimension ( $D \approx 49,152$ ) vastly exceeds the action space dimension ($7$-D). To address this, they propose Corollary 4 (Encoder-Specific Bound):
$Cap(\pi) + Rob(\pi) \leq H(A^\star) + I(\phi(X); \phi(\tilde{X}))$
Here, $\phi$ represents a frozen encoder (e.g., DINOv2+SigLIP in OpenVLA). This restricts the channel capacity to the policy-relevant subspace, significantly tightening the theoretical budget.

3. Validation Strategy

The paper validates the bound through two distinct approaches:

Synthetic Validation (Gaussian-VLA): A closed-form proxy where all quantities ( $H, I$ ) can be computed analytically or estimated with high precision. This includes 252 experimental cells varying dimensions and noise levels.
Real-Model Validation: Evaluation on OpenVLA-7B across four LIBERO suites (Spatial, Object, Goal, LIBERO-10) under Projected Gradient Descent (PGD) attacks. The authors use MINE (Mutual Information Neural Estimation) and discretized histogram estimators to measure the terms.

Key Results

1. Theoretical Verification

Zero Violations: The bound holds in 252/252 synthetic Gaussian-VLA cells and 48/48 real OpenVLA-7B experimental cells.
Slack Behavior: The "slack" ( $S = \text{Budget} - (Cap + Rob)$ ) is non-negative in all cases. As the attack budget $\epsilon$ increases, the channel capacity $I(X; \tilde{X})$ decreases, causing the total budget to shrink, which aligns with theoretical predictions.

2. Magnitude of the Bound

Pixel-Level Bound: On OpenVLA, the pixel-level budget is approximately 5,000 nats (dominated by image channel capacity), while the measured $Cap + Rob$ is negligible ( $<1$ nat). This results in a slack of $\sim 10^3$ nats, indicating the pixel-level bound is a loose ceiling.
Encoder-Specific Bound: By restricting the channel to the encoder subspace, the budget drops to $\sim 31$ nats ( $H(A^\star) \approx 26$ nats + $I(\phi(X); \phi(\tilde{X})) \approx 4.6$ nats).
Constraint Reality: Under the encoder-specific bound, the discretized capability ( $Cap_{disc} \approx 7.5$ nats) already consumes $\sim 24\%$ of the total budget. This suggests that for current architectures, the trade-off is not just theoretical but practically constraining; there is limited room to improve robustness without sacrificing capability.

3. Estimator Robustness

The authors demonstrate that the bound holds even when using biased estimators (MINE, InfoNCE, KSG). Because MINE tends to underestimate mutual information (a lower bound), it underestimates the Left-Hand Side (LHS) of the inequality, making the bound easier to satisfy. Thus, the zero-violation result is robust against estimator bias.

Significance and Claims

The paper claims the following contributions and significance:

First Impossibility Result for Action Policies: Unlike prior work (e.g., Tsipras et al., 2019) which focused on binary classifiers, this is the first information-theoretic bound specifically for action-generating policies. It proves that capability and robustness cannot both be free; they compete for a fixed budget determined by task entropy and attack channel capacity.
A New Metric for Defense Evaluation: The authors propose Encoder-Specific Slack ( $S_{enc}$ ) as a normalized metric for comparing defense papers. Instead of reporting absolute robustness numbers that do not transfer across settings, future work can report the fraction of the encoder budget consumed. This allows for a standardized assessment of how close a policy is to the theoretical limit.
Diagnostic Value for Architecture: The bound reveals that the "looseness" in current models is structural. The gap between the pixel-level budget and the encoder-level budget highlights that current policies do not fully exploit the information available in the encoder representation.
Safety Implications: The work reframes adversarial fragility from an accuracy problem to a safety problem. Since each prediction is a physical action, the theoretical floor implies that there is a hard limit to how robust a VLA can be made without compromising its ability to perform the task, necessitating a shift in how safety-critical systems are designed and evaluated.

The paper concludes that while the bound is non-constructive (it does not provide a recipe to build a policy that saturates the bound), it establishes a fundamental limit that no amount of architectural tuning can bypass. The "slack" represents the gap between current capabilities and the theoretical maximum, which is now quantifiable.