Does More Compute Make Every Adversarial Attack Transferable?

Transferable attacks, or transferable jailbreaks, are a particularly strong version of adversarial examples that fool all learners in a class. In this work, we study when more compute enables transferable attacks. We show that, when there is a quadratic gap in computational resources between the parties, then every learnable *classification* task admits either a transferable attack or an adversarial defense. On the other hand, we prove that there exist *generative* learning tasks for which neither a transferable attack nor an adversarial defense exists at a similar resource gap. These constructions provide formal evidence that increasing inference-time compute can improve robustness, as empirically observed by Zaremba et al. (2025). Our constructions assume the existence of an array of cryptographic primitives: identity-based fully homomorphic encryption (IB-FHE), publicly verifiable zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs), non-parallelizing languages (NPL), and incrementally verifiable computation (IVC).