PhD Seminar • Programming Languages • The Defensive Tax: Price of Defenses That Never Defend

Defensive programming is standard practice, but in production many checks turn out to be unnecessary: checking for malformed input from trusted sources, verifying invariants that already hold, and handling errors that the platform never produces. Though well-intentioned, in actual deployments, where input is well-formed, internal contracts hold, and the platform is fixed, these defenses can never trigger and become pure overhead. We call this cost the defensive tax.

We study the defensive tax in 24 implementations of 8 serialization libraries across C++, Java, and Rust—systems that are among the most pervasive consumers of CPU cycles in datacenter software. We find that individual defenses can impose overhead exceeding 30% on specific code paths. At scale, this translates directly into wasted energy and carbon emissions.

This talk presents a taxonomy of defense taxes—input, contract, and platform—and walks through concrete examples, explaining how defensive branches degrade performance even when branch predictors learn they never trigger. More broadly, this work advocates for deployment-aware software. A decoder behind an internal RPC boundary does not need the same defenses as one facing the open internet, yet most libraries make no distinction and pay the full defensive tax regardless.