On the (Un-)Avoidability of Adversarial Examples

Adversarial vulnerability may sometimes be justified: The paper argues that not all label changes from small perturbations represent failures—some may be legitimate if the perturbed input genuinely belongs to a different category according to the underlying data distribution. This reframes the problem from "all adversarial examples are bad" to "some are unavoidable."

One-size-fits-all robustness standards are insufficient: The authors propose that adversarial robustness should be "locally adaptive" rather than uniform, meaning the acceptable level of robustness should vary depending on the specific input and its surrounding data distribution, rather than applying the same defense everywhere.

Current defenses may be solving the wrong problem: By focusing on worst-case adversarial losses, existing defense research may be over-correcting. The paper suggests a more nuanced approach that distinguishes between adversarial examples that represent genuine classification ambiguity versus those that are truly spurious.

Data augmentation can be theoretically grounded: The authors develop a data-augmentation framework based on their adaptive robustness definition and prove it maintains consistency for 1-nearest neighbor classification, suggesting principled approaches to building robustness exist beyond ad-hoc defensive techniques.

Implications for AI deployment: For practitioners deploying AI systems, this work suggests that perfect robustness to all perturbations may be neither achievable nor necessary—instead, systems should be evaluated based on whether their failures align with genuine uncertainty in the underlying problem.