Title: Get RICH or Die Scaling: Profitably Trading Inference Compute for Robustness
Venue: NeurIPS 2025
Accepted: no
Keywords: VLMs

robustness

adversarial attacks

reasoning

scaling

efficiency
Abstract: Recent work shows that increasing inference-time compute through generation of long reasoning traces improves not just capability scores, but robustness to various text jailbreaks designed to control models or lower their guardrails. However, multimodal reasoning offers comparatively little defense against vision jailbreaks, which typically succeed by creating noise-like perturbations. When attacking a robust model, vision attacks are also capable of and often must resort to producing human-interpretable perturbations. Rather than operating in a model's blind-spot or out of its training distribution, such interpretable attacks construct familiar concepts connected to the attacker's goal. Inspired by the ability of robust models to force attacks into this space that appears more in-distribution for reasoning tasks, we posit the Robustness from Inference Compute Hypothesis (RICH): defending against attacks with inference compute (like reasoning) profits as those attacks become more in-distribution. To test this, we adversarially attack models of varying robustness with black-box-transfer and white-box attacks. RICH predicts a rich-get-richer dynamic: models that start with higher initial robustness gain more robustness benefits from increases in inference-time compute. Consistent with RICH, we find that robust models benefit more from increased compute, whereas non-robust models show little to no improvement. Our work suggests that inference-time compute can be an effective defense against adversarial attacks, provided the base model has some degree of robustness. In particular, layering disparate train-time and test-time defenses aids robustness not additively, but synergistically.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\n+1 to the deep cut 50 cent reference\n\nI am very intrigued by this paper. The Zaremba paper sparked my intense interest earlier in the year because inference time compute is a critical trend in AI right now as we hit the “data-wall”. The intense interest in reasoning time compute provokes a natural and important question; how does inference time compute interact with adversarial robustness? We have had ~1 impactful paper on this topic so far, which is the Zaremba paper.\n\nThis paper also helpful adds to this new literature by focusing on multi-modal models  with a new hypothesis, called the RICH hypothesis. I think this hypothesis synthesizes some vibes-based impressions/folklore from previous generations of adversarial robustness research into a relatively testable hypothesis that is quite interesting. OOD adv attack susceptibility not benefiting extended inference time models but robust models -> interpretable attacks that do benefit from extended inference time is an intriguing hypothesis.\n\nMy understanding of the main claim of this paper is that researchers need to improve inference time compute methods and base model robustness in parallel? I think it is possible to over-read Zaremba as “inference time compute gives you robustness for free”. In contrast, this paper says the two together are stronger because more robust models -> more interpretable perturbations -> more amenable to reasoning benefits.\n\nSTRENGTHS AND WEAKNESSES:\nVery intriguing paper, but confusing layout/organization. \n\nCritical Issue: No experimental details on o1 results from Figure 1 and apparently missing the claude results which are discussed in multiple sections, especially section 3.2. I am very open to revising my score to acceptance if the authors report the results they claim to have done. Where are the results discussed in lines 191 to 202?? Do they not exist? Did I somehow not find them? Please help. Maybe the authors confused sonnet and o1??\n\nThe main technical weakness of the first set of experiments in this  paper is the way they \ninstantiate “Inference-Time Compute”, which is by repeating the “correct” answer in the Textual input to the vision language model.  The authors remark on this issue at line 175.\n\nSection 3.2 is stronger because it uses more realistic inference time compute techniques like CoT. The main weakness of this section is the limited lack of reproducibility because Claude is closed weight and the extended-thinking mode may be quietly updated/modified by Anthropic. This is an acceptable and necessary tradeoff to test the authors hypothesis on a truly frontier model.\n\nMisc:\n\nWhen the authors introduce the Attack-Bard results for Chain of Thought and Augmented Reasoning, it is unclear to me where to actually find the results! Please make this more clear? Where are the results?\n\nFig 3: caption should be more clear about difference between high and low, add more info to make this caption more self contained.\n\nTable 1: Would be good to have this experiment duplicated for more attack images? Why is it so few examples.\n\nTable 2: The very minimal increase in robustness seems to weaken the rich hypothesis substantially. CoT is a much a much more “typical” or standard form of inference time compute.  Am I misunderstanding these results? Please clarify and if so edit this section to demonstrate that this is at best “neutral” evidence for the rich hypothesis. \n\nQ: They focus on gradient based perturbation style attacks. Do you have any theories on how this work may transfer to semantic adversarial attacks? e.g. “visual” prompt injections? \n\nQ: experiments with an open weights reasoning model where we can inspect reasoning traces could have been beneficial. Maybe these were not available at the time this research was conducted. This would provide strong evidence.\n\nQ: Again, where are the Sonnet results? Where are the experimental details for figure 2?\n\nNiggling Complaints.\n\nI don’t like how the methodology section goes into a lot of detail about each experiment and then delays actually showing/discussing the experimental results until the next section. I would radically shorten the methodology section to include only details that are used in each experiment. Then have the introduction/analysis of each experiment be contained.\n\nE.g Merge 3.1 and 4.1! This allows the reader to maintain an ongoing “context” of each experiment.\n\nQUESTIONS:\nmy questions are in the weaknesses section.\n\nLIMITATIONS:\nCritical Issue: No experimental details on o1 results from Figure 1 and apparently missing the claude results which are discussed in multiple sections, especially section 3.2. I am very open to revising my score to acceptance if the authors report the results they claim to have done. Where are the results discussed in lines 191 to 202? Do they not exist? Did I somehow not find them? Please help. Maybe the authors confused sonnet and o1?\n\nThis issue damages the credibility of the paper.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 1, "IMPACT": 4, "ORIGINALITY": 4, "DATE": "2025-06-27"}

comments: SUMMARY:
The authors discuss in their paper that robust multi-models get much better at defending against attacks when given more time to "think" during inference, while non-robust models don't improve much. This creates a "rich-get-richer" effect, where already-strong models benefit most from extra reasoning time.

STRENGTHS AND WEAKNESSES:
Strengths
 - Findings: Robust models at inference time become more robust.
 - The findings are related to the vision part, which has been the weak spot of multimodal, and therefore, I think that is an important contribution.
 - Improves defense with CoT.

Weaknesses
 - Experiments: it is not clear if there is a difference if the model has a different size.
 - Related work: Test-time adaptation (TTA) has never been discussed. This could be interesting.

QUESTIONS:
1. Ln:159: What makes PGD novel in this context?
2. Why TTA was not considered important for this paper?
3. Ln311: While the insights are interesting to me, it is somehow not explained in the paper how close this could be helpful for real-world defenses? (practability)

LIMITATIONS:
- Number of models in experiment could be larger.
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-06-30

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes the Robustness from Inference Compute Hypothesis (RICH), which suggests that increasing inference-time compute through long reasoning improves model robustness most effectively when attacks are forced into in-distribution regimes that the model can understand. The authors conduct experiments with vision-language models of varying robustness levels under both white-box and black-box attacks. They demonstrate that models with higher baseline robustness gain disproportionately more benefits from additional inference-time compute, while non-robust models see little improvement. The findings indicate that inference-time compute and train-time defenses work synergistically rather than additively.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n1. The paper addresses an important problem regarding the effectiveness of inference-time compute scaling as a defense mechanism against adversarial attacks.\n\n2. The methodology is comprehensive, testing the hypothesis through multiple experiments including both white-box and black-box attacks across different models.\n\n3. The paper provides clear evidence supporting their hypothesis through systematic experiments with varying levels of model robustness and inference compute.\n\n**Weaknesses**\n1. The theoretical foundation for why inference-time compute should work better with more robust models lacks depth. The paper mainly relies on empirical observations rather than providing a rigorous theoretical analysis.\n\n2. The paper proposes an explanatory hypothesis but does not develop specific improvement methods or new defense strategies based on this hypothesis. The findings remain largely theoretical without practical defensive solutions.\n\n3. The experimental design is relatively straightforward. The experiments primarily validate the hypothesis through increasing computation and comparing models with different robustness levels, without exploring more sophisticated experimental approaches.\n\n4. The experiments are limited to relatively small-scale models as acknowledged in the limitations section. This raises questions about whether the findings would hold true for larger, more sophisticated models.\n\n5. The paper lacks ablation studies to isolate the impact of different components of their approach, making it difficult to understand which aspects are most crucial for the observed improvements.\n\nQUESTIONS:\n1. How would the proposed hypothesis generalize to other types of attacks beyond vision attacks?\n\n2. What are the specific characteristics of \"in-distribution\" attacks that make them more amenable to reasoning-based defenses?\n\n3. How does the computational cost of increased inference-time compute compare to other robustness approaches?\n\n4. Could there be alternative explanations for why robust models benefit more from increased compute beyond the distribution shift hypothesis?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper investigates when and why increasing inference-time compute—such as adding longer prompts or Chain-of-Thought reasoning-can improve robustness against adversarial attacks. The authors introduce the RICH (Robustness-from-Inference-Compute Hypothesis), which posits that extra compute is only beneficial when the model has already been trained to be somewhat robust. Through white-box and black-box adversarial evaluations on three vision-language models of increasing robustness, they show that only the more robust models experience significant gains from inference-time scaling. The paper provides both a theoretical framing and empirical evidence that robustness and inference compute interact synergistically rather than additively, offering clear guidance for how to prioritize robustness efforts.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n- Clear, accessible writing: The prose is concise and logically structured, making technical sections easy to follow even on a first read.\n- Reader-friendly Q&A framing: Throughout the paper the authors pose explicit questions (e.g., “Does compute help all models equally?” around lines 231 and 253) and answer them immediately, which highlights the key take-aways and guides the reader through the experimental narrative.\n- Methodological rigor: Three vision-language models representing a spectrum of train-time robustness are evaluated under both a new white-box PGD attack and a black-box transfer set, with systematic variation of inference-time compute.\n- Original contribution: The work formalises the RICH hypothesis and introduces the first white-box attack specifically designed to probe inference-compute defences in multimodal settings.\n- Practical significance: Results show a “rich-get-richer” effect—robust models gain up to 5× more resistance when compute scales—offering concrete guidance to practitioners on when extra inference budget is worthwhile.\n\nWeaknesses\n- Limited scope of models and tasks: All experiments are confined to 7 B-class LLaVA derivatives and image-classification prompts; it remains unclear whether RICH generalises to larger frontier models or open-ended chat scenarios.\n- Compute overhead unreported in the main text: High-compute settings allow very long “thinking” traces yet provide no latency, throughput, or cost analysis, leaving real-world viability uncertain.\n- Small adversarial corpus: The black-box Attack-Bard set contains only 200 images, which may limit statistical power and diversity.\n- Reproducibility gaps: Critical implementation details (exact prompt templates, PGD step sizes, per-ε results) are pushed to appendices, making replication from the main paper alone difficult.\n- Incremental originality of idea: While applying inference-compute scaling to vision is novel, the core intuition—that extra compute can improve robustness—extends earlier text-only studies rather than introducing a fundamentally new mechanism.\n\nQUESTIONS:\n- All experiments use 7 B LLaVA derivatives on image-classification prompts. Does RICH hold for larger VLMs or open-ended chat?\n- Could the authors provide more precise measurements (e.g., FLOPs, runtime) for the various inference-compute regimes, to better compare across models and to real-world settings?\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 2, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-02"}