adversarial robustness
It is one thing for a lock to keep out an honest passerby, and quite another for it to withstand a skilled burglar who studies it and attacks its weak point on purpose. Adversarial robustness is the second kind of strength for an AI model: how well it keeps behaving correctly when someone is deliberately crafting inputs to make it fail, rather than just facing ordinary, well-meaning use.
Concretely, a model is adversarially robust to the degree that an attacker — even one who can probe it and design tricky inputs — cannot easily push it into mistakes: misclassifying an adversarial example, falling for a jailbreak, or obeying a prompt injection. Researchers measure it by attacking the model as hard as they can and seeing how much performance survives. A common defense is adversarial training: deliberately generating attacks and training the model to handle them, which raises the bar but rarely closes the gap completely.
Robustness matters because real deployment includes adversaries — people who want a model to leak data, produce harmful content, or be fooled — and because safety claims rest on the model behaving well under pressure, not just on average. The honest state of the art is sobering: despite years of work, no general method makes capable models fully robust, and defenses are often broken by stronger later attacks. Reported robustness is always relative to the attacks tried, so 'robust' should be read as 'robust against these attacks', not 'unbreakable'.
After adversarial training, an image model that used to be fooled by faint pixel patterns now resists them — until researchers design a stronger attack tailored to the new model, and it fails again.
Robustness is measured against the attacks you tried; a stronger attacker can move the goalposts.
There is no known way to make a capable model fully adversarially robust; defenses raise the cost of attack rather than eliminate it. A robustness score is always relative to the attacks used to test it.