How Model Compression Reshapes Frequency-Specific Adversarial Robustness

Model compression is useful for deploying deep learning models when computation and memory are limited. However, preserving clean accuracy after compression does not necessarily mean that adversarial robustness is also preserved. We study how pruning and weight quantization affect standard and frequency-specific adversarial robustness across ResNet-18, MobileNetV2, and ResNet-50. We evaluate four pruning levels, three quantization levels, and three joint pruning–quantization settings and compressed model variants. Each variant is evaluated on all 10,000 test images using 10-step ℓ∞ PGD and DCT-constrained PGD across four non overlapping frequency bands at ε = 8/255. We find that the effect of compression depends strongly on architecture and compression severity. Eight-bit quantization generally preserves the behaviour of the dense models, while aggressive 4-bit quantization can greatly reduce robustness even when clean accuracy remains relatively high. Frequency-constrained attacks further show that the most vulnerable frequency range differs across architectures. These results show that clean accuracy alone is not sufficient for evaluating compressed models intended for reliable deployment.