Drug tolerance and adversarial machine learning training share an obvious surface resemblance: repeated exposure to a stimulus reduces a system’s sensitivity to it, and sometimes that reduced sensitivity carries over to a related but different stimulus the system was never directly trained against. In pharmacology this is cross-tolerance, a well-characterized, mechanistically understood phenomenon. In machine learning, the equivalent question, does robustness to one kind of adversarial attack transfer to a different kind, turns out to have a much messier, less settled answer. The comparison is worth making precisely because of where it breaks down, not despite it.
Scientific Foundation
Drug tolerance develops through several distinct mechanisms — pharmacokinetic tolerance, where the body simply metabolizes a drug more efficiently over time, and pharmacodynamic tolerance, where the target cells themselves become less responsive, typically through receptor downregulation or desensitization. Cross-tolerance is the specific case where tolerance built up to one drug produces reduced sensitivity to a different, pharmacologically related drug, and its mechanism is well identified: it happens because the two drugs converge on the same underlying receptor system. All opioid analgesics, regardless of their specific chemical structure, activate mu-opioid receptors, so chronic use of any one of them downregulates and desensitizes that shared receptor population, producing reduced sensitivity to every other drug that also targets it. Benzodiazepines and alcohol both enhance signaling through the GABA-A receptor complex, which is precisely why chronic alcohol use requires clinicians to calibrate benzodiazepine doses upward during withdrawal management — the neuroadaptive changes affect the shared receptor machinery itself, not any one specific drug molecule, so anything else acting through that same machinery inherits the adaptation. It’s worth being precise that this generalization isn’t always complete even within a clearly shared system — cross-tolerance to analgesia can develop incompletely enough that clinicians deliberately rotate between different opioids to partially work around it — and occasionally cross-tolerance appears between drugs with no obviously shared primary receptor target at all, such as certain amphetamine-like stimulants and caffeine, suggesting a secondary, less thoroughly characterized mechanism operating in some cases. But the dominant, best-understood cases all trace back to one clearly identified fact: the same molecular structure is being adapted in both instances.
Cross-Domain Connection
Adversarial training in machine learning works by deliberately exposing a model to inputs perturbed in a specific, structured way, small pixel-level changes to an image, for instance, engineered to fool the model, and continuing this exposure during training until the model learns to resist that particular kind of manipulation. The natural next question, given how many different families of adversarial perturbation exist, is whether robustness earned against one type transfers to a different one the model was never directly trained against.
What Remains Undemonstrated
Here’s where the comparison to cross-tolerance needs real correction. Unlike pharmacology’s relatively clean story, where a shared receptor target explains and predicts cross-drug generalization with real mechanistic precision, adversarial robustness generalization across attack types is documented to be considerably patchier, and in important cases, does not resemble a clean shared-mechanism story at all. Research has found that models adversarially trained against one type of perturbation, measured under one mathematical distance metric, often fail to generalize meaningful robustness to a different perturbation type measured under a different metric. More strikingly, when researchers trained models against multiple attack types simultaneously, hoping for broad robustness, the resulting models achieved only around 50 percent robust accuracy, worse than models trained against each attack type individually — the opposite of what a clean, shared-underlying-vulnerability account would predict. Some perturbation types do show genuine positive transfer to others, with certain attack families acting as broad catalysts for improved robustness across several different perturbation categories at once, while other perturbation types show documented negative transfer, where training a model to resist one specific kind of attack actively degrades its robustness against a different kind. Researchers studying this pattern describe it largely in empirical, catalogued terms, this attack type transfers well, that one doesn’t, rather than pointing to anything resembling the precise, identified shared molecular target that makes pharmacological cross-tolerance predictable in advance.
Why It Matters
The surface-level resemblance between the two phenomena is genuine and worth naming: both involve repeated exposure producing reduced sensitivity that sometimes, but not always, extends to a related but distinct case the system wasn’t directly trained against. What differs is how well each field can currently explain why that generalization happens when it does, and predict when it won’t. Pharmacology can point to a specific, verified shared receptor and say with real confidence that cross-tolerance should occur between any two drugs converging on it. Machine learning robustness research, working with a comparatively young and still-developing theoretical understanding of what adversarial vulnerability actually consists of at a structural level, is still largely cataloguing which attack types transfer and which don’t through empirical testing, without yet having identified an equivalent to pharmacology’s shared receptor — a single, well-characterized underlying vulnerability that would let researchers predict cross-attack generalization in advance rather than discovering it case by case.
Human Dimension
There’s a useful lesson in noticing that two phenomena can share the same basic shape, repeated exposure dulling a response, while standing on very different footing scientifically. Pharmacology earned its explanatory confidence the hard way, through decades of receptor biology mapping exactly which molecular structures are being adapted and why a related drug would inherit that adaptation. Adversarial machine learning is still in the earlier, more observational stage of that same journey — documenting real, sometimes surprising patterns of transfer and non-transfer, without yet having found its own version of the shared receptor that would make those patterns predictable rather than merely catalogued.
Sources:
1. Massive Bio — “Drug Tolerance” — https://massivebio.com/drug-tolerance-bio/
2. Wikipedia — “Cross-tolerance” — https://en.wikipedia.org/wiki/Cross_tolerance
3. ScienceDirect Topics — “Cross Tolerance — an overview” — https://www.sciencedirect.com/topics/immunology-and-microbiology/cross-tolerance
4. Osmosis — “Pharmacodynamics: Desensitization and tolerance” — https://www.osmosis.org/learn/Pharmacodynamics:_Desensitization_and_tolerance
5. Carolina Center for Recovery — “What Does It Mean to Have Cross Tolerance?” — https://carolinacenterforrecovery.com/addiction-blog/what-does-it-mean-to-have-cross-tolerance/
6. PMC (National Institutes of Health) — “Cellular Tolerance Induced by Chronic Opioids in the Central Nervous System” — https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9273719/
7. ACM Digital Library — “Adversarial training and robustness for multiple perturbations” (33rd Conference on Neural Information Processing Systems) — https://dl.acm.org/doi/10.5555/3454287.3454814
8. arXiv — “Calibrated Adversarial Sampling: Multi-Armed Bandit-Guided Generalization Against Unforeseen Attacks” — https://arxiv.org/pdf/2511.12265
9. arXiv — “Scaling Trends in Language Model Robustness” — https://arxiv.org/pdf/2407.18213
10. arXiv — “The Limitations of Adversarial Training and the Blind-Spot Attack” — https://arxiv.org/pdf/1901.04684
11. PMC (National Institutes of Health) — “Adversarial robustness assessment: Why in evaluation both L0 and L∞ attacks are necessary” — https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9009601/
Idea originated at artificialideas.org. Article researched and written by Claude Sonnet 5. Published at artificialideas.org.
Artificial Ideas 