PerturbEmbedding: Embedding Perturbation Framework

• PerturbEmbedding is a perturbation-based framework that injects controlled noise directly into embedding layers to enhance model robustness and interpretability.
• It unifies various strategies by representing node, edge, and weight perturbations as additive modifications in the hidden representation space.
• Empirical results demonstrate that embedding perturbations can improve clean accuracy and resist adversarial attacks with minimal computational overhead.

Searching arXiv for papers on "PerturbEmbedding" and closely related embedding-perturbation methods to ground the article in the current literature. PerturbEmbedding is a perturbation-based embedding framework in which perturbations are injected directly into learned representations rather than being confined to raw inputs or model parameters. In the literature provided here, the term is used most explicitly for Graph Neural Networks (GNNs), where hidden embeddings $H^{(k)}$ at each layer are perturbed and training is cast as a unified min–max problem over random and adversarial perturbations (Yang et al., 30 Aug 2025). Related uses of embedding perturbation appear in work on topological descriptors, latent-variable models, Transformer interpretability, generative alignment, and geometric-topological stability, but these instantiate different mathematical objects and objectives. Taken together, these works present PerturbEmbedding less as a single universal algorithm than as a family of methods in which perturbations of embedding-level representations are used to improve robustness, generalization, identifiability, interpretability, or alignment (Yang et al., 30 Aug 2025, Som et al., 2018, Andrés-Terré et al., 2019, Conti et al., 22 Jun 2025, Hu et al., 15 May 2026, George et al., 24 Jun 2025).

1. Terminological scope and core definition

The most direct formulation of PerturbEmbedding appears in "Unifying Adversarial Perturbation for Graph Neural Networks" (Yang et al., 30 Aug 2025). There, a GNN with parameters $\theta$ computes hidden embeddings

$$H^{(0)}=X,\qquad H^{(k)}=f^{(k)}_\theta(H^{(k-1)},A)$$

for $k=1\ldots K$, followed by predictions $\hat y=f_\theta(H^{(K)})$. PerturbEmbedding introduces a perturbation $\Delta^{(k)}$ at every hidden layer and forms the perturbed embedding

$\bar H^{(k)}=H^{(k)}+\Delta^{(k)}.$

This places the perturbation directly in representation space rather than exclusively in node features, adjacency, or weights (Yang et al., 30 Aug 2025).

The same source defines two constraint classes. Random perturbations satisfy

$$\Delta^{(k)}\in S_{\mathrm{rand}}^{(k)}\coloneqq\{\Delta:\|\Delta\|_p\le \epsilon_k\},$$

while adversarial perturbations satisfy

$$\Delta^{(k)}\in S_{\mathrm{adv}}^{(k)}\coloneqq \arg\max_{\|\Delta\|_p\le \epsilon_k}L(f_\theta(H^{(k)}+\Delta),y).$$

Training is then written as the bilevel objective

$$\min_\theta\max_{\Delta^{(1)}\in S^{(1)},\ldots,\Delta^{(K)}\in S^{(K)}}\sum_{k=1}^K L(f_\theta(H^{(k)}+\Delta^{(k)}),y),$$

with $\theta$0 chosen as random, adversarial, or a mixture/alternation of the two (Yang et al., 30 Aug 2025).

A broader reading of the term is supported by several adjacent papers. "Perturbation Robust Representations of Topological Persistence Diagrams" converts multiple perturbed persistence diagrams into a Grassmann point, and explicitly concludes that the construction realizes a “PerturbEmbedding” that is both vector-valued and provably stable (Som et al., 2018). "Perturbation theory approach to study the latent space degeneracy of Variational Autoencoders" also uses the label “PerturbEmbedding” for a perturbation-theoretic modification of latent embeddings (Andrés-Terré et al., 2019). This suggests that the phrase denotes a methodological pattern—embedding-space perturbation as a design primitive—rather than only the GNN framework.

2. Unification of perturbation strategies in Graph Neural Networks

A central claim of the GNN formulation is that previously separate perturbation schemes can be rewritten as perturbations of hidden embeddings (Yang et al., 30 Aug 2025). The paper identifies three common strategies:

Strategy	Original object	Hidden-embedding view
PerturbNode	$\theta$1	$\theta$2 added to some $\theta$3
PerturbEdge	$\theta$4	$\theta$5 added to some $\theta$6
PerturbWeight	$\theta$7	$\theta$8 added to some $\theta$9

The equivalences are given algebraically in the first GCN layer. Edge perturbation $$H^{(0)}=X,\qquad H^{(k)}=f^{(k)}_\theta(H^{(k-1)},A)$$0 yields

$$H^{(0)}=X,\qquad H^{(k)}=f^{(k)}_\theta(H^{(k-1)},A)$$1

Node perturbation $$H^{(0)}=X,\qquad H^{(k)}=f^{(k)}_\theta(H^{(k-1)},A)$$2 similarly yields $$H^{(0)}=X,\qquad H^{(k)}=f^{(k)}_\theta(H^{(k-1)},A)$$3, and weight perturbation $$H^{(0)}=X,\qquad H^{(k)}=f^{(k)}_\theta(H^{(k-1)},A)$$4 induces $$H^{(0)}=X,\qquad H^{(k)}=f^{(k)}_\theta(H^{(k-1)},A)$$5 (Yang et al., 30 Aug 2025). Under this view, perturbations of features, structure, and parameters are all representable as embedding perturbations.

This unification matters because prior adversarial or regularizing schemes had typically been specialized to particular GNN families or datasets (Yang et al., 30 Aug 2025). By injecting $$H^{(0)}=X,\qquad H^{(k)}=f^{(k)}_\theta(H^{(k-1)},A)$$6 literally at every layer, PerturbEmbedding provides a common representation-space interface for perturbation. A plausible implication is that the framework is best understood as an abstraction layer over perturbation mechanisms rather than merely another attack-defense heuristic.

The paper also gives a unified perspective on perturbation form: random and adversarial perturbations are treated as instances of the same embedding-space operator, differing only in how $$H^{(0)}=X,\qquad H^{(k)}=f^{(k)}_\theta(H^{(k-1)},A)$$7 is selected (Yang et al., 30 Aug 2025). This collapses a distinction that is often architectural in prior work into a choice of optimization regime.

3. Training procedures, optimization regimes, and theoretical intuition

The GNN framework supports random training, adversarial training, and hybrid or alternated training. In random training, each mini-batch samples $$H^{(0)}=X,\qquad H^{(k)}=f^{(k)}_\theta(H^{(k-1)},A)$$8 or uses Gaussian noise clipped to the ball, and then descends $$H^{(0)}=X,\qquad H^{(k)}=f^{(k)}_\theta(H^{(k-1)},A)$$9 to minimize $k=1\ldots K$0 (Yang et al., 30 Aug 2025). In adversarial training, the inner maximization is approximated by one- or a few-step PGD on each $k=1\ldots K$1, followed by descent on $k=1\ldots K$2. The framework also allows a learned generator $k=1\ldots K$3 in place of PGD, with $k=1\ldots K$4 updated to make $k=1\ldots K$5 more maximizing (Yang et al., 30 Aug 2025).

The paper’s pseudocode emphasizes layerwise forward computation of $k=1\ldots K$6, initialization of $k=1\ldots K$7, repeated projected sign updates

$k=1\ldots K$8

and a perturbed forward pass with $k=1\ldots K$9 before updating $\hat y=f_\theta(H^{(K)})$0 (Yang et al., 30 Aug 2025). In practice, the same source notes that one often perturbs only a single layer, such as $\hat y=f_\theta(H^{(K)})$1, or uses a shared $\hat y=f_\theta(H^{(K)})$2 across layers.

The theoretical discussion is deliberately informal rather than a full proof. Injecting random perturbations $\hat y=f_\theta(H^{(K)})$3 is said to smooth the model’s loss landscape in the neighborhood of each hidden representation, which by classic generalization-smoothness trade-offs shrinks the generalization gap (Yang et al., 30 Aug 2025). Adversarial training explicitly minimizes worst-case loss in $\hat y=f_\theta(H^{(K)})$4. The framework further argues for compositional smoothing across layers: a small change in $\hat y=f_\theta(H^{(K)})$5 or $\hat y=f_\theta(H^{(K)})$6 can be compensated for in any layer’s representation (Yang et al., 30 Aug 2025). The paper adapts a standard Lipschitz-style bound: $\hat y=f_\theta(H^{(K)})$7

These arguments place PerturbEmbedding in a line of work where robustness is induced by local neighborhood control in latent space rather than by combinatorial defense rules. Related papers in other domains use an analogous logic. The persistence-diagram construction of Perturbed Topological Signatures samples many perturbed diagrams, maps them to smoothed density surfaces, and summarizes the family through the principal left singular subspace $\hat y=f_\theta(H^{(K)})$8 (Som et al., 2018). That work gives the stability sketch

$\hat y=f_\theta(H^{(K)})$9

which plays a role analogous to the embedding-space smoothness intuition in the GNN setting (Som et al., 2018).

4. Empirical behavior in the GNN literature

The GNN PerturbEmbedding paper evaluates the framework on homophilous datasets—Cora, Citeseer, PubMed—and heterophilous datasets—Penn94, Chameleon, Squirrel, Film—using GCN, GAT, and LINKX backbones (Yang et al., 30 Aug 2025). The task is semi-supervised node classification, with standard 60/20/20 splits for homophily and 48/32/20 per class for heterophily, and accuracy averaged over 5 seeds (Yang et al., 30 Aug 2025). Perturbation budgets are typically set to $\Delta^{(k)}$0 in $\Delta^{(k)}$1, with budgets tuned by grid-search on the validation split (Yang et al., 30 Aug 2025).

The reported findings are concrete. PerturbEmbedding is described as giving the best or tied-best performance on all 7 datasets in the Table 1 excerpt (Yang et al., 30 Aug 2025). Against GraphAT, ADV_Train, FLAG, and TW-AWP, it improves clean accuracy by up to $\Delta^{(k)}$2 on heterophilous benchmarks and by $\Delta^{(k)}$3–$\Delta^{(k)}$4 on citation graphs (Yang et al., 30 Aug 2025). Under additional random edge noise of up to $\Delta^{(k)}$5, PerturbEmbedding retains $\Delta^{(k)}$6 of its clean accuracy, whereas vanilla GCN and GAT drop by $\Delta^{(k)}$7–$\Delta^{(k)}$8 points (Yang et al., 30 Aug 2025). Under white-box attacks—Meta-Attack and PGD at $\Delta^{(k)}$9 perturbation rate—the method loses $\bar H^{(k)}=H^{(k)}+\Delta^{(k)}.$0 accuracy versus $\bar H^{(k)}=H^{(k)}+\Delta^{(k)}.$1 for all baselines (Yang et al., 30 Aug 2025).

The ablations are equally characteristic. Perturbing every hidden layer outperforms perturbing only the first layer by $\bar H^{(k)}=H^{(k)}+\Delta^{(k)}.$2 (Yang et al., 30 Aug 2025). Pure random noise achieves nearly the same gains as full PGD adversarial training, but at approximately one quarter of the cost (Yang et al., 30 Aug 2025). Runtime is reported as $\bar H^{(k)}=H^{(k)}+\Delta^{(k)}.$3 versus $\bar H^{(k)}=H^{(k)}+\Delta^{(k)}.$4 per epoch on Cora, or only about $\bar H^{(k)}=H^{(k)}+\Delta^{(k)}.$5 overhead relative to plain GCN, while FLAG or PGD-based methods are $\bar H^{(k)}=H^{(k)}+\Delta^{(k)}.$6–$\bar H^{(k)}=H^{(k)}+\Delta^{(k)}.$7 slower (Yang et al., 30 Aug 2025).

These observations help delimit a common misconception. PerturbEmbedding is not presented as requiring strong inner maximization at every layer to be effective. On the contrary, the paper reports that non-targeted random perturbations can nearly match adversarial PGD-based training at substantially lower cost (Yang et al., 30 Aug 2025). This suggests that, within this framework, robustness benefits are not reducible to adversarial hardness alone; neighborhood smoothing in representation space is itself a major contributor.

5. Related perturbation-at-embedding paradigms beyond GNNs

Several papers in the supplied corpus instantiate closely related ideas without sharing the exact same task setting.

In topological data analysis, "Perturbation Robust Representations of Topological Persistence Diagrams" builds $\bar H^{(k)}=H^{(k)}+\Delta^{(k)}.$8 noisy versions $\bar H^{(k)}=H^{(k)}+\Delta^{(k)}.$9 of a persistence diagram, converts each to a kernel-density surface

$$\Delta^{(k)}\in S_{\mathrm{rand}}^{(k)}\coloneqq\{\Delta:\|\Delta\|_p\le \epsilon_k\},$$0

vectorizes these surfaces, stacks them into a matrix $$\Delta^{(k)}\in S_{\mathrm{rand}}^{(k)}\coloneqq\{\Delta:\|\Delta\|_p\le \epsilon_k\},$$1, computes the SVD, and uses the span of the top $$\Delta^{(k)}\in S_{\mathrm{rand}}^{(k)}\coloneqq\{\Delta:\|\Delta\|_p\le \epsilon_k\},$$2 left singular vectors as a Grassmann representation $$\Delta^{(k)}\in S_{\mathrm{rand}}^{(k)}\coloneqq\{\Delta:\|\Delta\|_p\le \epsilon_k\},$$3 (Som et al., 2018). The paper concludes that this realizes a “PerturbEmbedding” that is both vector-valued and provably stable, and explicitly frames it as suitable for SVMs, nearest neighbors, clustering, and deep-fusion layers (Som et al., 2018). Here perturbation is used to marginalize topological jitter and to produce an ML-compatible fixed-structure representation.

In variational autoencoders, "Perturbation theory approach to study the latent space degeneracy of Variational Autoencoders" treats each latent Gaussian

$$\Delta^{(k)}\in S_{\mathrm{rand}}^{(k)}\coloneqq\{\Delta:\|\Delta\|_p\le \epsilon_k\},$$4

as an eigen-wavefunction of a Hamiltonian

$$\Delta^{(k)}\in S_{\mathrm{rand}}^{(k)}\coloneqq\{\Delta:\|\Delta\|_p\le \epsilon_k\},$$5

adds a perturbation-augmented energy term to the ELBO, and defines

$$\Delta^{(k)}\in S_{\mathrm{rand}}^{(k)}\coloneqq\{\Delta:\|\Delta\|_p\le \epsilon_k\},$$6

(Andrés-Terré et al., 2019). The stated purpose is to break latent-space degeneracy by lifting symmetries in the energy spectrum. Synthetic experiments report ARI values of approximately $$\Delta^{(k)}\in S_{\mathrm{rand}}^{(k)}\coloneqq\{\Delta:\|\Delta\|_p\le \epsilon_k\},$$7 versus $$\Delta^{(k)}\in S_{\mathrm{rand}}^{(k)}\coloneqq\{\Delta:\|\Delta\|_p\le \epsilon_k\},$$8 for $$\Delta^{(k)}\in S_{\mathrm{rand}}^{(k)}\coloneqq\{\Delta:\|\Delta\|_p\le \epsilon_k\},$$9, and $$\Delta^{(k)}\in S_{\mathrm{adv}}^{(k)}\coloneqq \arg\max_{\|\Delta\|_p\le \epsilon_k}L(f_\theta(H^{(k)}+\Delta),y).$$0 versus $$\Delta^{(k)}\in S_{\mathrm{adv}}^{(k)}\coloneqq \arg\max_{\|\Delta\|_p\le \epsilon_k}L(f_\theta(H^{(k)}+\Delta),y).$$1 for $$\Delta^{(k)}\in S_{\mathrm{adv}}^{(k)}\coloneqq \arg\max_{\|\Delta\|_p\le \epsilon_k}L(f_\theta(H^{(k)}+\Delta),y).$$2, together with a $$\Delta^{(k)}\in S_{\mathrm{adv}}^{(k)}\coloneqq \arg\max_{\|\Delta\|_p\le \epsilon_k}L(f_\theta(H^{(k)}+\Delta),y).$$3 shrinkage in run-to-run variance of pairwise distances (Andrés-Terré et al., 2019). This is not the same algorithm as the GNN method, but it clearly belongs to the same broader category of perturbation-designed embedding control.

In Transformer interpretability, "Probing the Embedding Space of Transformers via Minimal Token Perturbations" defines a minimal token perturbation at sequence position $$\Delta^{(k)}\in S_{\mathrm{adv}}^{(k)}\coloneqq \arg\max_{\|\Delta\|_p\le \epsilon_k}L(f_\theta(H^{(k)}+\Delta),y).$$4 by selecting the nearest vocabulary token in cosine similarity,

$$\Delta^{(k)}\in S_{\mathrm{adv}}^{(k)}\coloneqq \arg\max_{\|\Delta\|_p\le \epsilon_k}L(f_\theta(H^{(k)}+\Delta),y).$$5

and studies the resulting embedding shift $$\Delta^{(k)}\in S_{\mathrm{adv}}^{(k)}\coloneqq \arg\max_{\|\Delta\|_p\le \epsilon_k}L(f_\theta(H^{(k)}+\Delta),y).$$6 and its layerwise propagation (Conti et al., 22 Jun 2025). Rare tokens are found to induce larger shifts, and a layer-wise propagation curve rises steadily from layer $$\Delta^{(k)}\in S_{\mathrm{adv}}^{(k)}\coloneqq \arg\max_{\|\Delta\|_p\le \epsilon_k}L(f_\theta(H^{(k)}+\Delta),y).$$7 through $$\Delta^{(k)}\in S_{\mathrm{adv}}^{(k)}\coloneqq \arg\max_{\|\Delta\|_p\le \epsilon_k}L(f_\theta(H^{(k)}+\Delta),y).$$8, dips at $$\Delta^{(k)}\in S_{\mathrm{adv}}^{(k)}\coloneqq \arg\max_{\|\Delta\|_p\le \epsilon_k}L(f_\theta(H^{(k)}+\Delta),y).$$9, and exhibits growing variance in deeper layers (Conti et al., 22 Jun 2025). This is an analysis framework rather than a training method, but it exemplifies perturbation in embedding space as an instrument for structural probing.

In generative-model alignment, "Embedding-perturbed Exploration Preference Optimization" perturbs text-conditioning embeddings $$\min_\theta\max_{\Delta^{(1)}\in S^{(1)},\ldots,\Delta^{(K)}\in S^{(K)}}\sum_{k=1}^K L(f_\theta(H^{(k)}+\Delta^{(k)}),y),$$0 by learnable tensors $$\min_\theta\max_{\Delta^{(1)}\in S^{(1)},\ldots,\Delta^{(K)}\in S^{(K)}}\sum_{k=1}^K L(f_\theta(H^{(k)}+\Delta^{(k)}),y),$$1, produces perturbed sequences $$\min_\theta\max_{\Delta^{(1)}\in S^{(1)},\ldots,\Delta^{(K)}\in S^{(K)}}\sum_{k=1}^K L(f_\theta(H^{(k)}+\Delta^{(k)}),y),$$2, and optimizes a diversity-plus-anchor objective

$$\min_\theta\max_{\Delta^{(1)}\in S^{(1)},\ldots,\Delta^{(K)}\in S^{(K)}}\sum_{k=1}^K L(f_\theta(H^{(k)}+\Delta^{(k)}),y),$$3

before using those perturbations inside a GRPO-style RL loop (Hu et al., 15 May 2026). The aim is to prevent the collapse of intra-group reward variance and thereby avoid vanishing discriminative signal and reward hacking (Hu et al., 15 May 2026). This again differs from the GNN context but reinforces the broader association between embedding perturbation and variance preservation.

6. Stability, interpretability, and conceptual significance

Across these works, perturbation at the embedding level plays several distinct but related roles.

First, it functions as a robustness mechanism. In the GNN setting, small perturbations around $$\min_\theta\max_{\Delta^{(1)}\in S^{(1)},\ldots,\Delta^{(K)}\in S^{(K)}}\sum_{k=1}^K L(f_\theta(H^{(k)}+\Delta^{(k)}),y),$$4 are used to smooth or harden the model locally, improving both clean generalization and resistance to feature and structure attacks (Yang et al., 30 Aug 2025). In the persistence-diagram setting, perturbing diagrams and aggregating their induced density surfaces yields a Grassmann representation whose distance is controlled by the Wasserstein distance between original diagrams (Som et al., 2018). In the ECT literature, while the term PerturbEmbedding is not used as a named algorithm, the paper on perturbed embeddings of simplicial complexes establishes Lipschitz-type bounds for ECT and SELECT under vertex-wise perturbations of embeddings: $$\min_\theta\max_{\Delta^{(1)}\in S^{(1)},\ldots,\Delta^{(K)}\in S^{(K)}}\sum_{k=1}^K L(f_\theta(H^{(k)}+\Delta^{(k)}),y),$$5 and

$$\min_\theta\max_{\Delta^{(1)}\in S^{(1)},\ldots,\Delta^{(K)}\in S^{(K)}}\sum_{k=1}^K L(f_\theta(H^{(k)}+\Delta^{(k)}),y),$$6

(George et al., 24 Jun 2025). This suggests a common emphasis on perturbation-stability at the representation level.

Second, perturbation acts as a symmetry-breaking device. In the VAE formulation, the added potential $$\min_\theta\max_{\Delta^{(1)}\in S^{(1)},\ldots,\Delta^{(K)}\in S^{(K)}}\sum_{k=1}^K L(f_\theta(H^{(k)}+\Delta^{(k)}),y),$$7 is specifically intended to lift latent-space degeneracy arising from ELBO invariances under orthogonal transformations (Andrés-Terré et al., 2019). The energy spectrum becomes an ordering device for latent directions.

Third, perturbation can be used as a probe of information flow. The Transformer study measures how minimal token substitutions change hidden states across layers and uses identifiability via cosine retrieval from hidden states to show that deeper layers are increasingly intermixed (Conti et al., 22 Jun 2025). The conclusion that early layers are more reliable proxies for model explanations rests on embedding perturbation as an interpretive methodology (Conti et al., 22 Jun 2025).

A plausible implication is that PerturbEmbedding is most usefully understood not as a single field-specific term but as a recurrent research strategy: deliberately perturb the representational object of interest, then exploit the induced geometry, invariance, or variance for a downstream purpose.

7. Limitations, distinctions, and future directions

Several distinctions are necessary to avoid conflation. The GNN framework PerturbEmbedding operates on hidden embeddings $$\min_\theta\max_{\Delta^{(1)}\in S^{(1)},\ldots,\Delta^{(K)}\in S^{(K)}}\sum_{k=1}^K L(f_\theta(H^{(k)}+\Delta^{(k)}),y),$$8 inside a supervised node-classification pipeline and explicitly unifies node, edge, and weight perturbations (Yang et al., 30 Aug 2025). The PTS construction for persistence diagrams uses perturbation to produce a stable Grassmann descriptor, but it does not involve bilevel adversarial training of a neural encoder (Som et al., 2018). The VAE method uses perturbation theory and a Hamiltonian formalism to resolve latent degeneracy, which is conceptually related but mathematically different (Andrés-Terré et al., 2019). The Transformer and flow-model papers use embedding perturbation primarily for interpretability and RL-based alignment, respectively, again with distinct objectives (Conti et al., 22 Jun 2025, Hu et al., 15 May 2026).

Another limitation is that some of the theoretical claims are only sketched. The GNN paper explicitly states that it does not present a full formal proof for its robustness and generalization intuitions (Yang et al., 30 Aug 2025). By contrast, the stability of the topological and ECT-based constructions is stated in theorem form with explicit bounds (Som et al., 2018, George et al., 24 Jun 2025). This asymmetry suggests that the theoretical maturity of embedding-perturbation methods is domain-dependent.

Future directions are already hinted at within the cited works. For PTS, the paper proposes learning the kernel bandwidth $$\min_\theta\max_{\Delta^{(1)}\in S^{(1)},\ldots,\Delta^{(K)}\in S^{(K)}}\sum_{k=1}^K L(f_\theta(H^{(k)}+\Delta^{(k)}),y),$$9 or subspace size $\theta$00 end-to-end and extending the method to other TDA summaries (Som et al., 2018). For GNNs, the framework’s support for mixtures of random and adversarial perturbations across layers suggests further exploration of layerwise allocation, budget sharing, and generator-based inner maximization (Yang et al., 30 Aug 2025). For generative alignment, embedding perturbations optimized once and then frozen raise the possibility of structured semantic exploration with minimal backbone modification (Hu et al., 15 May 2026). For interpretability, minimal token perturbations suggest systematic layerwise probes of how lexical rarity and token substitutability propagate through deep sequence models (Conti et al., 22 Jun 2025).

In this sense, PerturbEmbedding names a convergence point of several research threads. Whether instantiated as hidden-state regularization in GNNs, perturbation-robust subspace encoding of persistence diagrams, perturbative energy shaping of VAE latents, or controlled embedding-level diversification in generative alignment, the underlying principle is the same: perturb the representation itself, and use the resulting structure to control robustness, variability, or meaning (Yang et al., 30 Aug 2025, Som et al., 2018, Andrés-Terré et al., 2019, Hu et al., 15 May 2026).