# Capability and Robustness Cannot Both Be Free: An Information-Theoretic Bound for Vision-Language-Action Models

arXiv: https://arxiv.org/abs/2605.25889 · HTML: https://mlsanity.com/paper/2605.25889/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in Safety and adversarial attacks, one of 13 directions in Vision-language-action models.
- Builds on 23 of its 32 references that are in the map.
- First posted on arXiv 25 May 2026.

## Placed in

- Vision-language-action models / [Safety and adversarial attacks](https://mlsanity.com/vla/safety-and-adversarial-attacks/)
- Diffusion models / [Diffusion and flow policies for robotics](https://mlsanity.com/diffusion/diffusion-and-flow-policies-for-robotics/)

## Builds on (most cited first, 23 of 23)

- [DINOv2: Learning Robust Visual Features without Supervision](https://mlsanity.com/paper/2304.07193/) (2023)
- [Representation Learning with Contrastive Predictive Coding](https://mlsanity.com/paper/1807.03748/) (2018)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Sigmoid Loss for Language Image Pre-Training](https://mlsanity.com/paper/2303.15343/) (2023)
- [π0: A Vision-Language-Action Flow Model for General Robot Control](https://mlsanity.com/paper/2410.24164/) (2024)
- [Theoretically Principled Trade-off between Robustness and Accuracy](https://mlsanity.com/paper/1901.08573/) (2019)
- [LIBERO: Benchmarking Knowledge Transfer for Lifelong Robot Learning](https://mlsanity.com/paper/2306.03310/) (2023)
- [Robustness May Be at Odds with Accuracy](https://mlsanity.com/paper/1805.12152/) (2018)
- [Deep Learning and the Information Bottleneck Principle](https://mlsanity.com/paper/1503.02406/) (2015)
- [MINE: Mutual Information Neural Estimation](https://mlsanity.com/paper/1801.04062/) (2018)
- [On Variational Bounds of Mutual Information](https://mlsanity.com/paper/1905.06922/) (2019)
- [SmolVLA: A Vision-Language-Action Model for Affordable and Efficient Robotics](https://mlsanity.com/paper/2506.01844/) (2025)
- [Visual Adversarial Examples Jailbreak Aligned Large Language Models](https://mlsanity.com/paper/2306.13213/) (2023)
- [Information-theoretic analysis of generalization capability of learning algorithms](https://mlsanity.com/paper/1705.07809/) (2017)
- [Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients](https://mlsanity.com/paper/1711.09404/) (2017)
- [A study of the effect of JPG compression on adversarial images](https://mlsanity.com/paper/1608.00853/) (2016)
- [Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Robotics](https://mlsanity.com/paper/2411.13587/) (2024)
- [Eva-VLA: Evaluating Vision-Language-Action Models' Robustness Under Real-World Physical Variations](https://mlsanity.com/paper/2509.18953/) (2025)
- [Adversarial Training and Provable Robustness: A Tale of Two Objectives](https://mlsanity.com/paper/2008.06081/) (2020)
- [StableVLA: Towards Robust Vision-Language-Action Models without Extra Data](https://mlsanity.com/paper/2605.18287/) (2026)
- [Information-Theoretic Constraints for Continual Vision-Language-Action Alignment](https://mlsanity.com/paper/2603.13335/) (2026)
- [The Compression Gap: Why Discrete Tokenization Limits Vision-Language-Action Model Scaling](https://mlsanity.com/paper/2604.03191/) (2026)
- [Explainable Adversarial-Robust Vision-Language-Action Model for Robotic Manipulation](https://mlsanity.com/paper/2512.11865/) (2025)

## Built on by (most cited first, 1 of 1)

- [Outcome-Conditioned End-Effector Geometry Across Vision-Language-Action Policies](https://mlsanity.com/paper/2609.21659/) (2026)

## Abstract (arXiv)

Vision-Language-Action (VLA) models reach high success rates on clean inputs but collapse under small adversarial perturbations: a 16/255 PGD attack drops OpenVLA-7B's LIBERO success from 95% to under 5%. Whether this trade-off has a theoretical floor was open. We prove that it does. For any VLA policy, capability I(Astar;Api) and robustness I(Api;Atildepi)-I(Api;δ) sum to at most H(Astar)+I(X;Xtilde), the task entropy plus adversarial channel capacity. The proof reduces to two applications of the Data Processing Inequality. The pixel-level bound is loose by ~ 103 nats and serves as a ceiling guarantee; an encoder-specific corollary tightens it by over an order of magnitude, into a regime where realized capability already consumes 5--9% of the budget. We validate Theorem~refthm:main with zero violations across 308 cells: 252 closed-form Gaussian-VLA, 48 OpenVLA-7B+LIBERO+PGD (4 suites × 4 eps × 3 seeds), 4 Square-Attack, and 4 multi-step (T=10). A complementary measurability inequality Robdisc ≤ Capdisc further holds across 144 cross-architecture cells spanning OpenVLA, OpenVLA-OFT (continuous-L1), and SmolVLA (flow-matching). The same construction yields three label-free diagnostics: a pre-flight encoder ceiling, a defense-forensics probe that localizes input-side vs. language-model intervention, and a head-agnostic robustness ratio comparable across discrete-token, L1-regression, and flow-matching policies. Together these provide the cross-setting axis defense and architecture comparisons currently lack.