Capability and Robustness Cannot Both Be Free: An Information-Theoretic Bound for Vision-Language-Action Models
arXiv:2605.25889
Abstract
Vision-Language-Action (VLA) models reach high success rates on clean inputs but collapse under small adversarial perturbations: a PGD attack drops OpenVLA-7B's LIBERO success from to under . Whether this trade-off has a theoretical floor was open. We prove that it does. For any VLA policy, capability $I(\Astar;\Api)$ and robustness $I(\Api;\Atildepi)-I(\Api;δ)$ sum to at most $H(\Astar)+I(X;\Xtilde)$, the task entropy plus adversarial channel capacity. The proof reduces to two applications of the Data Processing Inequality. The pixel-level bound is loose by nats and serves as a ceiling guarantee; an encoder-specific corollary tightens it by over an order of magnitude, into a regime where realized capability already consumes -- of the budget. We validate Theorem~\ref{thm:main} with zero violations across cells: closed-form Gaussian-VLA, OpenVLA-7BLIBEROPGD ( suites $\eps$ seeds), Square-Attack, and multi-step (). A complementary measurability inequality $\Rob_{\text{disc}} \le \Cap_{\text{disc}}$ further holds across cross-architecture cells spanning OpenVLA, OpenVLA-OFT (continuous-), and SmolVLA (flow-matching). The same construction yields three label-free diagnostics: a pre-flight encoder ceiling, a defense-forensics probe that localizes input-side vs.\ language-model intervention, and a head-agnostic robustness ratio comparable across discrete-token, -regression, and flow-matching policies. Together these provide the cross-setting axis defense and architecture comparisons currently lack.