SAR Metric Quantifies Vulnerability Monoculture Across Foundation Models
Exposing Vulnerability Monoculture Through Systemic Adversarial Robustness
Distillation, widely treated as a cost-free way to propagate capability, appears to propagate shared weaknesses at the pool level — a systemic risk individual robustness scores miss. Security teams and labs evaluating fleets of models can use SAR-style measurement to diversify their stacks. The finding is directly relevant to any ecosystem, including ASEAN deployments, that leans on a small set of distilled frontier models rather than independently trained ones.
A paper on arXiv introduces Systemic Adversarial Robustness (SAR), a measure of shared vulnerability across a pool of models based on the attack diversity needed to exploit it. SAR is formulated as a partial set-cover problem with provable approximation guarantees, enabling scalable algorithms to measure it empirically. Tests on vision and large language models show that pools distilled from DeepSeek-R1 and Claude Opus 4.6 have lower estimated systemic robustness than their parent pools. The authors frame vulnerability monoculture as a measurable target for adversarial evaluation of model populations.
Exposing Vulnerability Monoculture Through Systemic Adversarial Robustness
Beneath the apparent diversity of foundation models lies an increasingly homogeneous technical stack of common training pipelines, distillation methods, and data. These shared algorithmic choices can expose an otherwise distinct model ecosystem to concentrated risks leading to a vulnerability monoculture. Yet current practice in assessing adversarial robustness is restricted to individual robustness scores and attack transfer rates, leaving open the unexplored fundamental question: how many attacks suffice for catastrophic widespread compromise? In this paper, we investigate the empirical nature of shared vulnerabilities within a model pool and introduce Systemic Adversarial Robustness (SAR), a novel measure of shared vulnerability of a model pool through the attack diversity needed to exploit it. Specifically, SAR interpolates between single-attack transferability and independent per-model robustness: small values reveal a vulnerability monoculture, whereas large values indicate that failures are dispersed across models. We theoretically formulate SAR as a partial set-cover problem with provable approximation guarantees---enabling the development of scalable algorithms to empirically measure the systemic adversarial robustness. We empirically test the shared vulnerability of vision and large language models and characterize their shared collective vulnerability curve. Specifically, we demonstrate that model pools distilled from DeepSeek-R1 and Claude Opus 4.6 exhibit lower estimated systemic robustness than their corresponding parent pools, revealing a potential systemic cost of frontier-model distillation. Our framework seeks to establish vulnerability monoculture as a measurable target for a more wholistic adversarial evaluation of model populations.
