  Deep State Space Models (SSMs) have proven effective in numerous task
scenarios but face significant security challenges due to Adversarial
Perturbations (APs) in real-world deployments. Adversarial Training (AT) is a
mainstream approach to enhancing Adversarial Robustness (AR) and has been
validated on various traditional DNN architectures. However, its effectiveness
in improving the AR of SSMs remains unclear. While many enhancements in SSM
components, such as integrating Attention mechanisms and expanding to
data-dependent SSM parameterizations, have brought significant gains in
Standard Training (ST) settings, their potential benefits in AT remain
unexplored. To investigate this, we evaluate existing structural variants of
SSMs with AT to assess their AR performance. We observe that pure SSM
structures struggle to benefit from AT, whereas incorporating Attention yields
a markedly better trade-off between robustness and generalization for SSMs in
AT compared to other components. Nonetheless, the integration of Attention also
leads to Robust Overfitting (RO) issues. To understand these phenomena, we
empirically and theoretically analyze the output error of SSMs under AP. We
find that fixed-parameterized SSMs have output error bounds strictly related to
their parameters, limiting their AT benefits, while input-dependent SSMs may
face the problem of error explosion. Furthermore, we show that the Attention
component effectively scales the output error of SSMs during training, enabling
them to benefit more from AT, but at the cost of introducing RO due to its high
model complexity. Inspired by this, we propose a simple and effective Adaptive
Scaling (AdS) mechanism that brings AT performance close to
Attention-integrated SSMs without introducing the issue of RO.
