Robustness Gap in Machine Learning

• Robustness gap is the discrepancy between a model's nominal performance and its stability when facing adversarial, corruptive, or distribution shifts.
• Researchers have demonstrated that improvements in data quality, optimizer bias, and regularization can bridge or expose gaps across various learning architectures.
• Evaluations contrasting empirical, certified, and latent-space metrics reveal that conventional accuracy measures may mask critical weaknesses in model robustness.

“Robustness gap” denotes a family of discrepancies between nominal performance and stability under perturbation, distribution shift, uncertainty, or alternative robustness criteria. In the cited literature, the term is instantiated in several precise ways: the drop from clean to corrupted or adversarial accuracy, the divergence between empirical and certified robustness, the discrepancy between high detection performance and poor latent-space separation, the interval between lower and upper bounds in global verification, and the error between ideal and noisy estimates of a target quantity (Yang et al., 2020, Gowal et al., 2021, Mashaido et al., 18 May 2026, Kabaha et al., 2024, Lee et al., 2024). Across these uses, the common object is not a single metric but a mismatch between what a model appears to achieve and what remains stable under worst-case or structured perturbation.

1. Formal definitions across research areas

In adversarial classification, one standard formalization compares clean accuracy with robust accuracy. For a classifier $f(x;\theta)$, perturbation set $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$, and data distribution $D$, the adversarial risk is

$R_{\rm adv}(\theta)=\E_{(x,y)\sim D}\Big[\max_{\delta\in\Delta_p(\varepsilon)}\mathbf1\{f(x+\delta;\theta)\neq y\}\Big],$

and robust accuracy is $$\mathrm{Acc}_{\rm robust}(\theta)=1-R_{\rm adv}(\theta)$$. One “robustness gap” is then

$$\Delta_{\rm gap}=\mathrm{Acc}_{\rm robust}^{\rm +ext\,data}-\mathrm{Acc}_{\rm robust}^{\rm orig.\,data}.$$

A related formulation uses clean accuracy $\mathrm{Acc}(g)$ and robust accuracy, termed astuteness, $\mathrm{Astuteness}_\varepsilon(g)$, with the colloquial gap $\mathrm{Acc}(g)-\mathrm{Astuteness}_\varepsilon(g)$ (Drenkow et al., 2021, Yang et al., 2020).

For non-adversarial corruptions, the gap is often defined as an accuracy drop under an altered distribution. Let $P$ be the clean distribution and $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$0 a counterfactually altered distribution emphasizing low-probability corruption events. Then

$$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$1

A more general corruption gap is

$$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$2

which reduces to the usual accuracy drop when $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$3 is the indicator of top-1 correctness (Drenkow et al., 2021, Sui et al., 24 Nov 2025).

In latent-space analyses, the gap is not defined by output accuracy but by geometric separation. Transformer prompt-injection defenses define a performance–robustness gap as the discrepancy between near-perfect classification performance $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$4 and a minimal clean–obfuscated embedding margin

$$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$5

with $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$6, indicating near-manifold overlap despite high classification scores (Mashaido et al., 18 May 2026).

Verification work defines a different robustness gap. If $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$7 is the minimal global-robustness bound and a verifier returns $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$8, then the robustness gap is

$$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$9

This gap measures uncertainty in the certificate rather than the model’s empirical degradation (Kabaha et al., 2024).

A plausible implication is that “robustness gap” has become a cross-domain term for a failure of nominal metrics, training objectives, or approximate certificates to faithfully represent worst-case or structured stability.

2. Accuracy, adversarial robustness, and whether the gap is inherent

Several papers treat the robustness gap as the apparent difference between standard accuracy and adversarial robustness. In a simple Gaussian model, standard classification and robust classification exhibit different sample complexity: if $D$0, the estimator $D$1 satisfies $D$2, but to get nontrivial $D$3-robustness one needs $D$4. With self-training, the same work shows that unlabeled data bridges this gap: with $D$5 labeled plus unlabeled samples, the self-trained classifier satisfies $D$6. On CIFAR-10, adding 500K unlabeled images raises robust accuracy from $D$7–$D$8 for standard TRADES to $D$9–$R_{\rm adv}(\theta)=\E_{(x,y)\sim D}\Big[\max_{\delta\in\Delta_p(\varepsilon)}\mathbf1\{f(x+\delta;\theta)\neq y\}\Big],$0 for robust self-training; on SVHN, unlabeled data recovers more than $R_{\rm adv}(\theta)=\E_{(x,y)\sim D}\Big[\max_{\delta\in\Delta_p(\varepsilon)}\mathbf1\{f(x+\delta;\theta)\neq y\}\Big],$1 of the full-label gain (Carmon et al., 2019).

A separate line argues that the observed tradeoff is not inherent on common image benchmarks. If the data distribution is $R_{\rm adv}(\theta)=\E_{(x,y)\sim D}\Big[\max_{\delta\in\Delta_p(\varepsilon)}\mathbf1\{f(x+\delta;\theta)\neq y\}\Big],$2-separated, then locally Lipschitz classifiers can achieve both zero clean risk and zero robust risk at radius $R_{\rm adv}(\theta)=\E_{(x,y)\sim D}\Big[\max_{\delta\in\Delta_p(\varepsilon)}\mathbf1\{f(x+\delta;\theta)\neq y\}\Big],$3. The multiclass construction

$R_{\rm adv}(\theta)=\E_{(x,y)\sim D}\Big[\max_{\delta\in\Delta_p(\varepsilon)}\mathbf1\{f(x+\delta;\theta)\neq y\}\Big],$4

has perfect astuteness under the stated assumptions. Empirically, the same work reports that datasets such as MNIST, CIFAR-10, SVHN, and Restricted ImageNet are well $R_{\rm adv}(\theta)=\E_{(x,y)\sim D}\Big[\max_{\delta\in\Delta_p(\varepsilon)}\mathbf1\{f(x+\delta;\theta)\neq y\}\Big],$5-separated at scales larger than the standard adversarial radius, and attributes the practical gap to two limitations of current methods: they either fail to impose local Lipschitzness or are insufficiently generalized (Yang et al., 2020).

By contrast, “Adversarial Robustness May Be at Odds With Simplicity” formalizes a setting in which a gap is induced by the hypothesis class. For the distribution $R_{\rm adv}(\theta)=\E_{(x,y)\sim D}\Big[\max_{\delta\in\Delta_p(\varepsilon)}\mathbf1\{f(x+\delta;\theta)\neq y\}\Big],$6, there exists a linear classifier with exponentially small standard loss and noisy loss, yet every linear classifier has $R_{\rm adv}(\theta)=\E_{(x,y)\sim D}\Big[\max_{\delta\in\Delta_p(\varepsilon)}\mathbf1\{f(x+\delta;\theta)\neq y\}\Big],$7, while a more complex nonlinear classifier achieves exponentially small adversarial loss. Within the restricted family $R_{\rm adv}(\theta)=\E_{(x,y)\sim D}\Big[\max_{\delta\in\Delta_p(\varepsilon)}\mathbf1\{f(x+\delta;\theta)\neq y\}\Big],$8, the paper proves

$R_{\rm adv}(\theta)=\E_{(x,y)\sim D}\Big[\max_{\delta\in\Delta_p(\varepsilon)}\mathbf1\{f(x+\delta;\theta)\neq y\}\Big],$9

This establishes a quantitative robustness–accuracy tradeoff inside a simple class even when a robust classifier exists outside it (Nakkiran, 2019).

Taken together, these results support two distinct interpretations. One is that the gap can be closed by better data and better inductive bias (Carmon et al., 2019, Yang et al., 2020). The other is that, for some tasks or model classes, robustness may require more complex classifiers than those sufficient for standard accuracy (Nakkiran, 2019).

3. Optimization bias, implicit regularization, and gap closing in linear models

One of the strongest gap-closing results is obtained for linear and linear-convolutional models. For a linear classifier $$\mathrm{Acc}_{\rm robust}(\theta)=1-R_{\rm adv}(\theta)$$0 under $$\mathrm{Acc}_{\rm robust}(\theta)=1-R_{\rm adv}(\theta)$$1-bounded perturbations,

$$\mathrm{Acc}_{\rm robust}(\theta)=1-R_{\rm adv}(\theta)$$2

The maximal $$\mathrm{Acc}_{\rm robust}(\theta)=1-R_{\rm adv}(\theta)$$3 for which the data remain separable is equivalent to a max-margin problem and to a minimum-dual-norm problem. In particular, for $$\mathrm{Acc}_{\rm robust}(\theta)=1-R_{\rm adv}(\theta)$$4-attacks the dual norm is $$\mathrm{Acc}_{\rm robust}(\theta)=1-R_{\rm adv}(\theta)$$5, so minimizing $$\mathrm{Acc}_{\rm robust}(\theta)=1-R_{\rm adv}(\theta)$$6 under margin-one constraints yields the maximally robust classifier (Faghri et al., 2021).

The same paper links this characterization to implicit bias. Steepest descent in norm $$\mathrm{Acc}_{\rm robust}(\theta)=1-R_{\rm adv}(\theta)$$7 converges in direction to the max-margin solution with respect to that norm, yielding the corollary:

• Gradient descent $$\mathrm{Acc}_{\rm robust}(\theta)=1-R_{\rm adv}(\theta)$$8 maximum $$\mathrm{Acc}_{\rm robust}(\theta)=1-R_{\rm adv}(\theta)$$9-margin $$\Delta_{\rm gap}=\mathrm{Acc}_{\rm robust}^{\rm +ext\,data}-\mathrm{Acc}_{\rm robust}^{\rm orig.\,data}.$$0 maximum robustness to $$\Delta_{\rm gap}=\mathrm{Acc}_{\rm robust}^{\rm +ext\,data}-\mathrm{Acc}_{\rm robust}^{\rm orig.\,data}.$$1-attacks.
• Sign-SGD $$\Delta_{\rm gap}=\mathrm{Acc}_{\rm robust}^{\rm +ext\,data}-\mathrm{Acc}_{\rm robust}^{\rm orig.\,data}.$$2 max $$\Delta_{\rm gap}=\mathrm{Acc}_{\rm robust}^{\rm +ext\,data}-\mathrm{Acc}_{\rm robust}^{\rm orig.\,data}.$$3-margin $$\Delta_{\rm gap}=\mathrm{Acc}_{\rm robust}^{\rm +ext\,data}-\mathrm{Acc}_{\rm robust}^{\rm orig.\,data}.$$4 max robustness to $$\Delta_{\rm gap}=\mathrm{Acc}_{\rm robust}^{\rm +ext\,data}-\mathrm{Acc}_{\rm robust}^{\rm orig.\,data}.$$5-attacks.
• Coordinate descent $$\Delta_{\rm gap}=\mathrm{Acc}_{\rm robust}^{\rm +ext\,data}-\mathrm{Acc}_{\rm robust}^{\rm orig.\,data}.$$6 max $$\Delta_{\rm gap}=\mathrm{Acc}_{\rm robust}^{\rm +ext\,data}-\mathrm{Acc}_{\rm robust}^{\rm orig.\,data}.$$7-margin $$\Delta_{\rm gap}=\mathrm{Acc}_{\rm robust}^{\rm +ext\,data}-\mathrm{Acc}_{\rm robust}^{\rm orig.\,data}.$$8 max robustness to $$\Delta_{\rm gap}=\mathrm{Acc}_{\rm robust}^{\rm +ext\,data}-\mathrm{Acc}_{\rm robust}^{\rm orig.\,data}.$$9-attacks.

A vanishingly small $\mathrm{Acc}(g)$0-regularizer,

$\mathrm{Acc}(g)$1

converges in direction to the same max-margin/min-norm solution. In this regime, perfect standard accuracy and a certain degree of robustness are achieved “for free” through the optimizer’s implicit bias (Faghri et al., 2021).

For linear convolutional models $\mathrm{Acc}(g)$2, gradient descent biases toward small $\mathrm{Acc}(g)$3-norm of the Fourier coefficients of the effective filter. With

$\mathrm{Acc}(g)$4

one obtains

$\mathrm{Acc}(g)$5

The implicit solution is therefore maximally robust against perturbations whose Fourier spectrum is bounded in $\mathrm{Acc}(g)$6. The same work implements a Fourier-$\mathrm{Acc}(g)$7 projected-gradient attack and finds that adversarially trained RobustBench CIFAR-10 models have $\mathrm{Acc}(g)$8 values very close to zero, revealing a spectral robustness gap not captured by standard $\mathrm{Acc}(g)$9 evaluation (Faghri et al., 2021).

This result is narrow in scope—it concerns linear and linear-convolutional models—but it is unusually explicit about how optimizer, architecture, regularizer, and attack geometry interact.

4. Geometric and representational robustness gaps

In transformer prompt-injection defense, the performance–robustness gap is explicitly geometric. The defense models are fine-tuned for 4-way classification over clean, prefix, suffix, and obfuscated prompts, and achieve classification accuracy $\mathrm{Astuteness}_\varepsilon(g)$0, $\mathrm{Astuteness}_\varepsilon(g)$1, and $\mathrm{Astuteness}_\varepsilon(g)$2 for DistilBERT, BERTBase, and BERTMedium. Yet the clean–obfuscated margin is $\mathrm{Astuteness}_\varepsilon(g)$3, and the obfuscated intra-class variance is $\mathrm{Astuteness}_\varepsilon(g)$4. Inter-class distances are $\mathrm{Astuteness}_\varepsilon(g)$5 for Clean–Suffix, $\mathrm{Astuteness}_\varepsilon(g)$6 for Clean–Prefix, and $\mathrm{Astuteness}_\varepsilon(g)$7 for Clean–Obfuscated. The same study terms the resulting phenomenon latent embedding collapse: obfuscated prompts intrude into the region of latent space occupied by clean prompts, with severe latent-space instability despite near-perfect detection metrics (Mashaido et al., 18 May 2026).

A key negative result is that model capacity does not close this gap. Across DistilBERT, BERTBase, and BERTMedium, $\mathrm{Astuteness}_\varepsilon(g)$8 remains approximately $\mathrm{Astuteness}_\varepsilon(g)$9, $\mathrm{Acc}(g)-\mathrm{Astuteness}_\varepsilon(g)$0 remains high, and PCA and t-SNE projections show obfuscated prompts leaking into the clean cluster. The paper’s recommendation is to complement performance metrics with geometry-based statistics such as $\mathrm{Acc}(g)-\mathrm{Astuteness}_\varepsilon(g)$1, intra-class variance, and inter-class distances, and to explore topology-aware descriptors and margin-based embedding losses (Mashaido et al., 18 May 2026).

A distinct but related notion arises in multimodal representation learning. “Is the Modality Gap a Bug or a Feature? A Robustness Perspective” defines a global gap vector $\mathrm{Acc}(g)-\mathrm{Astuteness}_\varepsilon(g)$2 between modality means and shows, under tight-cluster initialization and approximate double-stochasticity of the soft-assignment matrices, that minimizing the contrastive loss yields an orthogonal modality gap satisfying

$\mathrm{Acc}(g)-\mathrm{Astuteness}_\varepsilon(g)$3

Under this orthogonality condition, shifting one modality by $\mathrm{Acc}(g)-\mathrm{Astuteness}_\varepsilon(g)$4 does not change clean nearest-neighbor retrieval, but reducing the gap monotonically improves robustness to zero-mean isotropic embedding noise. The paper reports large robustness gains from this post-processing step without loss of clean accuracy on CIFAR-10, CIFAR-100, ImageNet-1k, A-OKVQA, and MS-COCO (Chowers et al., 30 Mar 2026).

These two literatures use “gap” differently—one as a discrepancy between performance and latent separation, the other as a geometric offset between modalities—but both locate robustness failure in representation geometry rather than in top-1 accuracy alone.

5. Corruption, certification, and verification gaps

For large vision-LLMs, corruption robustness is presented as a gap between apparent benchmark competence and degradation of the underlying prediction structure. Bench-C constructs a discriminative corruption benchmark by selecting samples with high prediction inconsistency under corruption and high semantic diversity. The benchmark retains $\mathrm{Acc}(g)-\mathrm{Astuteness}_\varepsilon(g)$5 samples, approximately $\mathrm{Acc}(g)-\mathrm{Astuteness}_\varepsilon(g)$6 of the initial pool, each with $\mathrm{Acc}(g)-\mathrm{Astuteness}_\varepsilon(g)$7 corruptions. To measure robustness beyond accuracy, the paper defines normalized entropy shift $\mathrm{Acc}(g)-\mathrm{Astuteness}_\varepsilon(g)$8, calibration shift $\mathrm{Acc}(g)-\mathrm{Astuteness}_\varepsilon(g)$9, and the Robustness Alignment Score

$P$0

with $P$1. Across thirteen LVLMs, clean-input accuracy ranges from $P$2 to $P$3, average $P$4 is negative for every model, and average RAS ranges from $P$5 to $P$6. The paper emphasizes that even subtle corruptions can yield slight accuracy gains while mean RAS remains below zero, a “visual quality paradox” indicating structural degradation beneath stable or improved top-1 accuracy (Sui et al., 24 Nov 2025).

In certified robustness, the gap is often the divergence between empirical adversarial robustness and formal certificates. “Towards Bridging the gap between Empirical and Certified Robustness against Adversarial Examples” notes that adversarial training yields strong empirical robustness but no certificates for large classifiers or higher-dimensional inputs, whereas randomized smoothing yields strong $P$7 certificates but poor empirical robustness. The paper proposes Certification through Adaptation, which adapts BatchNorm statistics of an adversarially trained model at inference time and then applies randomized smoothing, together with Auto-Noise for per-example noise selection. Using the same classifier, it reports average certified radius scores up to $P$8 on CIFAR-10 and $P$9 on ImageNet without affecting empirical robustness or benign accuracy (Gowal et al., 2021).

“Bridging the Theoretical Gap in Randomized Smoothing” studies a related theoretical-versus-empirical gap. It introduces Lipschitz-based certified radii $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$00 and $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$01, along with the Class-Partitioning Method for less conservative confidence intervals. On CIFAR-10 with LiResNet at $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$02, the paper reports at $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$03 that standard $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$04 certified accuracy is approximately $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$05, $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$06 certified accuracy is approximately $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$07, and empirical PGD-$$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$08 robust accuracy is approximately $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$09, cutting the gap by nearly half (Delattre et al., 3 Apr 2025).

Verification papers define yet another operational gap. VHAGaR seeks the minimal global-robustness bound $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$10 and returns lower and upper bounds $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$11 and $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$12, with robustness gap $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$13. With a three-hour timeout, VHAGaR attains an average gap of $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$14, whereas an existing global robustness verifier has a gap of $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$15; VHAGaR is also $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$16 faster, and leveraging dependencies and adversarial attacks makes it $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$17 faster (Kabaha et al., 2024).

A common misconception in these settings is that accuracy or even attack success alone suffices as a robustness evaluation. The cited work repeatedly rejects that view: logit structure, calibration, geometry, certification conservativeness, and verifier uncertainty all expose failure modes hidden by output-level performance (Sui et al., 24 Nov 2025, Gowal et al., 2021, Kabaha et al., 2024).

6. Distributional, stochastic, and systems-theoretic interpretations

Outside adversarial examples, robustness gaps appear in distribution shift and control. In partially identifiable distributional robustness, the issue is not attack generation but uncertainty about the shift model itself. Let

$$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$18

be the robust risk under structural parameter $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$19. When $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$20 is only set-identifiable from the training environments, the paper introduces the worst-case robust risk

$$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$21

which is always well-defined. In a linear additive-shift model, $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$22 contains the penalty $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$23, reflecting unseen directions. Existing methods such as anchor regression and OLS are provably suboptimal because they place no explicit penalty on unseen-direction shifts. On single-cell perturb-seq data, as soon as the fraction $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$24 of unseen-knockout cells is positive, anchor regression, DRIG, and OLS degrade sharply with shift strength $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$25, whereas the estimated minimax predictor degrades much slower; at $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$26 and maximal $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$27, anchor’s MSE can exceed the minimax predictor by up to $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$28–$$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$29 on average (Kostin et al., 4 Feb 2025).

In stochastic robust control, the gap metric itself becomes random. For nominal plant $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$30 and stochastic perturbed plant $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$31, the random gap is

$$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$32

Under Fréchet differentiability and Lipschitz assumptions, $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$33 is Lipschitz in the Gaussian parameter vector and therefore sub-Gaussian. This yields explicit tail bounds, expectation bounds, and high-probability robust-stability and $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$34-performance guarantees. Here the “gap” is not a performance drop but a metric distance between plants that quantifies uncertainty propagation into stability margins (Renganathan, 14 Jul 2025).

For linear time-varying systems, the time-varying gap metric

$$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$35

is linked to normalized coprime factor uncertainty. The maximal achievable stability margin satisfies

$$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$36

where $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$37 is a time-varying Hankel operator. When $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$38 is compact, its top singular value determines the margin exactly (Djouadi, 2012).

A still different use appears in quantum many-body simulation. In robust quantum gap estimation, the robustness gap is the error

$$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$39

The cited algorithm proves resilience to SPAM and depolarizing noise, then uses trial-state optimization and classical baseline correction to reduce gap estimate errors. In noisy simulation and on IBM Quantum hardware, the uncorrected relative gap error can exceed $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$40, whereas baseline correction reduces it below $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$41, and trial-state optimization yields $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$42 error in noiseless settings and $$\Delta_p(\varepsilon)=\{\delta\in\mathbb R^n:\|\delta\|_p\le\varepsilon\}$$43 on hardware (Lee et al., 2024).

These formulations suggest that the robustness gap is not confined to classification. It also measures the discrepancy between nominal and uncertain system behavior, or between ideal and noisy estimates, when perturbations are structured by a model rather than by an adversary.

7. Recurring patterns and unresolved questions

Several recurring patterns emerge. First, the gap is frequently caused by evaluation mismatch: clean accuracy, standard detection metrics, or coarse corruption benchmarks can fail to reveal fragility in geometry, calibration, or unseen directions (Mashaido et al., 18 May 2026, Sui et al., 24 Nov 2025, Kostin et al., 4 Feb 2025). Second, robustness is often tied to structure in the learning process itself: optimizer bias, regularization, data augmentation, unlabeled data, or architecture can either expose or close the gap (Faghri et al., 2021, Carmon et al., 2019, Yang et al., 2020). Third, simple scaling is often insufficient. Increasing transformer encoder depth and capacity does not eliminate latent embedding collapse, and multi-agent voting for mathematical question answering improves clean and noisy accuracy but leaves the adversarial robustness gap positive for all noise types and agent counts, with WikiTypo remaining the dominant bottleneck (Mashaido et al., 18 May 2026, Alavi et al., 10 Nov 2025).

The literature also contains a substantive controversy over whether robustness gaps are intrinsic. Some papers argue that there is no inherent tradeoff between accuracy and robustness on separated datasets and that the practical gap is due to under-smoothed or poorly generalized methods (Yang et al., 2020). Others prove that within restricted simple families, a quantitative tradeoff is unavoidable even when robust classifiers exist outside the family (Nakkiran, 2019). This suggests that the answer depends on which object is held fixed: the data distribution, the threat model, the hypothesis class, or the optimization procedure.

A plausible synthesis is that robustness gaps are best understood as model–evaluation mismatches. Depending on the setting, the mismatch can be between clean and adversarial risk, between performance and latent geometry, between empirical and certified guarantees, between observed and partially identified shifts, or between nominal and perturbed system models. The main research program across these papers is therefore not merely to improve robustness, but to specify the relevant notion of robustness precisely enough that the measured objective matches the failure mode one seeks to avoid.