vulnerability to adversarial attacks is pretty well known now. I think it’s better to show improvement in robustness over improvements in accuracy now. 1% improvement under attack conditions is much more significant than 1% improvement in accuracy.

Edit: context.

Speaking from an academic point of view, for newly proposed algorithms.