Robustness Radius: Concepts & Applications

• Robustness radius is a metric that quantifies the largest perturbation within which a system’s property—such as classification, feasibility, or stability—remains intact.
• It is computed via various methods like binary search in neural verification or Monte Carlo certification in randomized smoothing, reflecting a boundary to failure.
• Its applications span runtime validation in neural networks, stability analysis in dynamical systems, and robust optimization across uncertainties.

Searching arXiv for recent and foundational uses of “robustness radius” across verification, randomized smoothing, optimization, and related fields. arXiv search query: robustness radius randomized smoothing local robustness verification stability radius radius of robust feasibility Robustness radius is a family of quantitatively related notions that measure a margin to failure under perturbation. Across machine learning, optimization, control, statistics, and matching theory, it denotes either the largest perturbation set within which a desired property is guaranteed to persist, or equivalently the smallest perturbation that can destroy that property. In neural network verification, it is the largest input neighborhood on which the prediction is unchanged; in randomized smoothing, it is the certified perturbation norm for the smoothed classifier; in robust optimization, it is the largest uncertainty radius for which the robust feasible set remains nonempty; in dynamical systems, it appears as a stability or observability distance to the boundary of instability or unobservability; and in several recent applications it is recast as a runtime diagnostic, a sensitivity summary, or a geometric distance to an instability boundary (Liu et al., 2020, Goli et al., 2024, Katewa et al., 2018, Bianchin et al., 2016).

1. General formulation and conceptual variants

A common template is a perturbation family indexed by a scalar radius and a property of interest—classification invariance, feasibility, stability, observability, or non-blockingness—together with a threshold value at which that property first fails. In the local robustness setting for a classifier $f:\mathbb{R}^m\to C$, the robustness radius at input $x$ is defined as

$$R(f,x)=\max\left\{\eta \mid \forall y\in \mathbb{R}^m,\ \|y-x\|_p\le \eta \Rightarrow f(x)=f(y)\right\},$$

so it is exactly the largest perturbation size around $x$ within which the network’s prediction remains unchanged (Liu et al., 2020). In randomized smoothing, the corresponding certified radius is the largest perturbation norm for which the smoothed classifier’s prediction is guaranteed not to change; with Gaussian smoothing this takes the standard form $R=\sigma C(x)$ or, in the one-class lower-bound formulation, $R(x;\sigma)=\sigma\Phi^{-1}(p_A)$ (Goli et al., 2024, Park et al., 1 Jun 2026).

In robust optimization, the same logic is expressed at the level of feasible sets rather than predictions. For an uncertain system with robust feasible set $F_R^\alpha$, the radius of robust feasibility is

$$\rho=\sup\{\alpha\in\mathbb{R}_+ : F_R^\alpha\neq \emptyset\},$$

namely the largest uncertainty magnitude for which at least one robustly feasible solution still exists (Datta et al., 23 Oct 2025, 2007.07599). In sparse LTI stability analysis, the real sparse stability radius is the minimum Frobenius-norm perturbation that moves a stable system to the imaginary axis, while in network observability it is the minimum Frobenius-norm edge perturbation that makes a mode unobservable (Katewa et al., 2018, Bianchin et al., 2016).

These notions are mathematically parallel but not identical. Some are pointwise and local, some are global over a feasible set, and some are worst-case certified lower bounds rather than exact margins. A plausible implication is that “robustness radius” functions less as a single invariant than as a recurring design pattern: encode admissible perturbations, define the failure boundary, then measure the distance to that boundary.

Domain	Radius notion	Property preserved up to radius
Neural network verification	$R(f,x)$	Label invariance around one input
Randomized smoothing	Certified radius	Smoothed prediction constancy in $L_2$
Robust optimization	Radius of robust feasibility	Nonemptiness of robust feasible set
LTI systems	Stability radius	Stability under structured perturbations
Network sensing	Observability radius	Observability under edge perturbations
Matching markets	Robustness radius of a stable matching	Absence of blocking pairs

2. Local classification robustness and runtime validation

In neural network verification, the robustness radius is the local robustness quantity associated with the predicate

$x$0

with the paper on runtime input validation later specializing to $x$1 (Liu et al., 2020). The same work distinguishes the usual oracle-conditioned verification statement

$x$2

from the raw radius $x$3, which does not require the oracle and can therefore be computed even for misclassified natural inputs and adversarial examples. The paper explicitly notes that robustness radius is equivalent to the “minimal distortion” needed to make an adversarial example, while preferring the former terminology because it reflects the defensive viewpoint (Liu et al., 2020).

The central empirical observation is that correctly classified inputs have much larger robustness radii than natural misclassified inputs and adversarial examples. With $x$4 and $x$5, the reported pattern is

$x$6

This separation is especially pronounced for stronger attacks such as Carlini–Wagner and HopSkipJump, where the robustness radii are often close to zero. The paper further reports that the robustness radii of valid inputs often follow a normal distribution; under D’Agostino and Pearson’s normality test with the rule $x$7, 25 networks pass the normality test and 9 do not (Liu et al., 2020).

The paper’s practical contribution is to reinterpret robustness radius as a runtime signal for input validation. Radius estimation uses the verifier ERAN through an executable predicate $x$8, with binary search over $x$9. Complete verification returns true or false exactly; incomplete verification returns true or unknown conservatively, producing an under-approximation of the radius. On the small FNN-MNIST network, all nonzero approximate radii lie between 44% and 100% of exact radii, while each call to $$R(f,x)=\max\left\{\eta \mid \forall y\in \mathbb{R}^m,\ \|y-x\|_p\le \eta \Rightarrow f(x)=f(y)\right\},$$0 takes less than 1s in incomplete mode compared to 11s on average for complete verification (Liu et al., 2020).

Two deployment rules are then built on top of the radius. The first is threshold validation, accepting input $$R(f,x)=\max\left\{\eta \mid \forall y\in \mathbb{R}^m,\ \|y-x\|_p\le \eta \Rightarrow f(x)=f(y)\right\},$$1 iff $$R(f,x)=\max\left\{\eta \mid \forall y\in \mathbb{R}^m,\ \|y-x\|_p\le \eta \Rightarrow f(x)=f(y)\right\},$$2. On CNN-MNIST, threshold $$R(f,x)=\max\left\{\eta \mid \forall y\in \mathbb{R}^m,\ \|y-x\|_p\le \eta \Rightarrow f(x)=f(y)\right\},$$3 rejects $$R(f,x)=\max\left\{\eta \mid \forall y\in \mathbb{R}^m,\ \|y-x\|_p\le \eta \Rightarrow f(x)=f(y)\right\},$$4 of misclassified clean inputs, $$R(f,x)=\max\left\{\eta \mid \forall y\in \mathbb{R}^m,\ \|y-x\|_p\le \eta \Rightarrow f(x)=f(y)\right\},$$5 of FGSM adversarial examples with $$R(f,x)=\max\left\{\eta \mid \forall y\in \mathbb{R}^m,\ \|y-x\|_p\le \eta \Rightarrow f(x)=f(y)\right\},$$6, $$R(f,x)=\max\left\{\eta \mid \forall y\in \mathbb{R}^m,\ \|y-x\|_p\le \eta \Rightarrow f(x)=f(y)\right\},$$7 of FGSM adversarial examples with $$R(f,x)=\max\left\{\eta \mid \forall y\in \mathbb{R}^m,\ \|y-x\|_p\le \eta \Rightarrow f(x)=f(y)\right\},$$8, $$R(f,x)=\max\left\{\eta \mid \forall y\in \mathbb{R}^m,\ \|y-x\|_p\le \eta \Rightarrow f(x)=f(y)\right\},$$9 of CW adversarial examples, and $x$0 of HOP adversarial examples, while rejecting only $x$1 of valid inputs. The second is validation by distribution, which uses a sliding window and a heuristic test based on the newest radius and the drop in normality-test $x$2-value; on a sequence of 100 valid inputs, 1 misclassified input, and 400 adversarial examples, this method rejects all adversarial examples and the misclassified one, with only 3 valid inputs rejected when the inputs arrive in sequence (Liu et al., 2020).

3. Certified radii under randomized smoothing

Randomized smoothing recasts robustness radius as a certified property of a smoothed classifier. Given a base classifier $x$3 and Gaussian noise $x$4, the smoothed classifier is

$x$5

If $x$6 is the top class probability under noise and $x$7 the runner-up, one standard expression is

$x$8

and the corresponding guarantee is $x$9 for every $R=\sigma C(x)$0 with $R=\sigma C(x)$1 (Goli et al., 2024). A closely related formulation uses the top smoothed class probability $R=\sigma C(x)$2 directly and writes

$R=\sigma C(x)$3

or, with Monte Carlo certification, $R=\sigma C(x)$4 where $R=\sigma C(x)$5 is a one-sided Clopper–Pearson lower bound (Park et al., 1 Jun 2026).

Several papers modify how this certified radius is produced or improved. Pixel Partitioning-based Randomized Smoothing groups image pixels into partitions and averages within each partition. Its central claim is not a new certification formula but an increase in the confidence term through reduced effective noise variance: for a partition $R=\sigma C(x)$6, the effective standard deviation becomes $R=\sigma C(x)$7. For static partitions, the certificate is expressed after the averaging transform, while dynamic partitions introduce a factor $R=\sigma C(x)$8 under a Lipschitz-type partition stability condition (Goli et al., 2024). Empirically, PPRS increases certified accuracy relative to vanilla randomized smoothing across ImageNet, CIFAR-10, MNIST, and Fashion-MNIST; for example, on CIFAR-10 the table values are 35.1 for vanilla RS versus 51.9, 53.0, and 55.0 for SLIC-PPRS, QuickShift-PPRS, and Felzenszwalb-PPRS respectively (Goli et al., 2024).

Dual Randomized Smoothing addresses the curse of dimensionality by splitting the input into two lower-dimensional sub-images, smoothing them separately, and combining their evidence. The practical certificate is

$R=\sigma C(x)$9

and the paper’s central comparison is that standard randomized smoothing exhibits an upper bound that decreases at rate $R(x;\sigma)=\sigma\Phi^{-1}(p_A)$0, whereas DRS yields a superior upper bound decreasing like $R(x;\sigma)=\sigma\Phi^{-1}(p_A)$1 with $R(x;\sigma)=\sigma\Phi^{-1}(p_A)$2 (Xia et al., 2024). The work reports certified-accuracy improvements at $R(x;\sigma)=\sigma\Phi^{-1}(p_A)$3, including approximately $R(x;\sigma)=\sigma\Phi^{-1}(p_A)$4, $R(x;\sigma)=\sigma\Phi^{-1}(p_A)$5, and $R(x;\sigma)=\sigma\Phi^{-1}(p_A)$6 on CIFAR-10 for Gaussian augmentation, consistency regularization, and diffusion-denoising respectively (Xia et al., 2024).

A complementary line of work studies the computational cost of estimating the radius. One paper shows that reducing Monte Carlo samples by one or two orders of magnitude can still enable computation of a slightly smaller robustness radius, commonly about a $R(x;\sigma)=\sigma\Phi^{-1}(p_A)$7 radius reduction, with the same confidence; the approximate radius degradation follows a $R(x;\sigma)=\sigma\Phi^{-1}(p_A)$8 law (Seferis et al., 2024). Another replaces per-input Monte Carlo with a learned surrogate. RRISE trains a surrogate $R(x;\sigma)=\sigma\Phi^{-1}(p_A)$9 for the smoothed class distribution, applies a conformal offset $F_R^\alpha$0, and certifies

$F_R^\alpha$1

with the guarantee that $F_R^\alpha$2 with probability at least $F_R^\alpha$3. Whenever $F_R^\alpha$4, the surrogate’s predicted label matches the smoothed classifier and is constant on the $F_R^\alpha$5 ball of radius $F_R^\alpha$6 (Park et al., 1 Jun 2026). Across FashionMNIST, CIFAR-10, CIFAR-100, and Tiny ImageNet, the certified-accuracy gap to the Monte Carlo baseline is at most $F_R^\alpha$7 percentage points, while up to $F_R^\alpha$8 noisy base-model evaluations per query are replaced by a single surrogate forward pass (Park et al., 1 Jun 2026).

Theoretical limits remain central. For many i.i.d. smoothing distributions, the largest certifiable $F_R^\alpha$9 radius for $$\rho=\sup\{\alpha\in\mathbb{R}_+ : F_R^\alpha\neq \emptyset\},$$0 scales as

$$\rho=\sup\{\alpha\in\mathbb{R}_+ : F_R^\alpha\neq \emptyset\},$$1

and for $$\rho=\sup\{\alpha\in\mathbb{R}_+ : F_R^\alpha\neq \emptyset\},$$2 this dependence is no better than that of isotropic Gaussian smoothing, essentially putting a matching lower bound on the robustness radius. Uniform smoothing over $$\rho=\sup\{\alpha\in\mathbb{R}_+ : F_R^\alpha\neq \emptyset\},$$3 or $$\rho=\sup\{\alpha\in\mathbb{R}_+ : F_R^\alpha\neq \emptyset\},$$4 balls yields even worse upper bounds, namely $$\rho=\sup\{\alpha\in\mathbb{R}_+ : F_R^\alpha\neq \emptyset\},$$5 and $$\rho=\sup\{\alpha\in\mathbb{R}_+ : F_R^\alpha\neq \emptyset\},$$6 respectively (Kumar et al., 2020). This suggests that much of the current randomized-smoothing literature treats robustness radius not only as a certificate, but also as the object through which dimensionality and efficiency limits are expressed.

4. Relaxed and discrete robustness radii in neural and LLMs

The classical local radius can be relaxed by allowing bounded failure mass rather than demanding a perfectly safe ball. Under $$\rho=\sup\{\alpha\in\mathbb{R}_+ : F_R^\alpha\neq \emptyset\},$$7-weakened robustness, a classifier is $$\rho=\sup\{\alpha\in\mathbb{R}_+ : F_R^\alpha\neq \emptyset\},$$8-robust at $$\rho=\sup\{\alpha\in\mathbb{R}_+ : F_R^\alpha\neq \emptyset\},$$9 with radius $R(f,x)$0 if

$R(f,x)$1

so the proportion of adversarial examples in the ball is less than $R(f,x)$2. The $R(f,x)$3-robustness radius is then the maximum $R(f,x)$4 satisfying this condition (Huang et al., 2021). The paper presents this as a relaxation of conventional robustness, proves that the $R(f,x)$5-robustness decision problem is PP-complete, and gives a statistical hypothesis-testing algorithm with user-controllable type-I and type-II error bounds together with a binary search procedure for estimating the maximum $R(f,x)$6-robustness radius (Huang et al., 2021).

In NLP, robustness radius is often discrete rather than geometric in Euclidean space. One formulation studies word-level $R(f,x)$7-robustness: for input text $R(f,x)$8, perturbation space $R(f,x)$9, and radius $L_2$0,

$L_2$1

with robustness meaning that all texts in $L_2$2 preserve the gold label. Here the robustness radius is the largest number of word substitutions the model can tolerate while guaranteeing that no adversarial example exists (Yang et al., 2022). Exact computation is hard, so the paper estimates upper bounds by repurposed attacks and by a pseudo-dynamic programming method, and lower bounds by verification. It also complements the worst-case radius with a PAC-style robustness metric

$L_2$3

measuring the fraction of perturbations within radius $L_2$4 that preserve the correct label (Yang et al., 2022).

A related but geometrically different NLP formulation is the maximal safe radius in embedding space. For text embedding $L_2$5, perturbable index set $L_2$6, and

$L_2$7

the maximal safe radius is

$L_2$8

The paper interprets this as the minimum distance from the input to the decision boundary in embedding space, approximating it from above by Monte Carlo Tree Search with syntactic filtering and from below via linear relaxations adapted from CNN-Cert and POPQORN (Malfa et al., 2020).

These relaxed and discrete variants broaden the role of robustness radius. Rather than only delimiting a perfectly invariant neighborhood, they quantify safe mass, substitution budget, or distance to a decision boundary in a structured perturbation space. This suggests a shift from binary certification toward hybrid worst-case and average-case local analysis.

5. Feasibility, stability, and observability radii in optimization and networked systems

Outside classification, robustness radius often measures distance to loss of feasibility or dynamical well-posedness. For uncertain linear conic programs, the radius of robust feasibility is

$L_2$9

where $x$00 is the set of uncertainty radii for which the robust feasible set is nonempty (2007.07599). The paper provides computable lower and upper bounds using the distance from $x$01 to an epigraphical set $x$02, and shows that in important subclasses this distance is the optimal value of an SDP or SOCP. In the linear-programming case, the formula is exact: the radius equals $x$03 and can be computed through an associated SOCP (2007.07599).

Directional-sensor deployment under positional uncertainty imports this same idea into coverage control. For aerial directional sensors with robust feasible set $x$04, the radius of robust feasibility is again

$x$05

and the sensor-specific formulation uses worst-case displaced positions inside Euclidean balls and support/gauge-function expressions for an exact radius formula (Datta et al., 23 Oct 2025). The robustified deployment model adds the explicit constraint $x$06, creating a direct coverage–robustness tradeoff. Under nominal deployment, the reported orientation coverages are $x$07 for initial orientation, $x$08 for IDS orientation, and $x$09 for robustified orientation; under perturbed deployment, the corresponding values are $x$10, $x$11, and $x$12, showing the practical role of the radius constraint (Datta et al., 23 Oct 2025). A related DSN formulation likewise defines

$x$13

and integrates it with a Voronoi-based distributed greedy orientation rule (Datta et al., 22 Oct 2025).

In continuous-time LTI systems, the stability radius is the minimum Frobenius-norm perturbation $x$14 such that $x$15 under a sparsity mask $x$16: $x$17 This quantity is explicitly interpreted as a distance to instability (Rai et al., 2024). One line of work studies the exact sparse real $x$18-norm stability radius through equality-constrained optimization and derives the optimal perturbation relation

$x$19

where $x$20 and $x$21 are right and left eigenvectors of the optimally perturbed system (Katewa et al., 2018). Another derives closed-form approximations $x$22 and $x$23 from eigenvalue sensitivities and uses them for redesign, with the approximate linear formula

$x$24

under the simple-eigenvalue assumption (Rai et al., 2024).

Network observability uses a parallel construction. The observability radius of a network pair $x$25 is the smallest Frobenius-norm edge perturbation that creates an unobservable mode: $x$26 A large radius means the network is hard to break into an unobservable one, whereas a small radius means fragility (Bianchin et al., 2016). The paper analytically characterizes line and star networks under random edge weights, obtaining $x$27 for line networks and $x$28 for star networks, and concludes that line networks are inherently more robust than star networks (Bianchin et al., 2016).

These formulations share a precise “distance to ill-posedness” interpretation. The object that changes is the property being protected—feasibility, stability, observability, or coverage—but the scalar radius remains the threshold beyond which the robust counterpart ceases to exist.

6. Broader reinterpretations: econometrics, statistical estimation, and stable matchings

Recent work extends robustness radius into settings where perturbations act on estimands, data distributions, or preference parameters rather than on geometric inputs. In econometrics, the robustness radius is defined for a main estimate $x$29 and robustness-check estimates $x$30 as the smallest tolerance $x$31 such that one cannot reject

$x$32

Formally,

$x$33

equivalently the lower endpoint of a one-sided $x$34 confidence interval for $x$35 (Prallon, 22 Feb 2026). This reframes “robustness checks” as a test-inverted, uncertainty-adjusted radius around the main estimand, explicitly incorporating sampling uncertainty and correlation across regressions (Prallon, 22 Feb 2026).

In asymptotic statistics, the radius of statistical efficiency is the Wasserstein-2 distance from a data distribution to the set of ill-conditioned distributions for which the Fisher-information-like matrix becomes singular. The paper phrases this as “the size of the smallest perturbation to the data that renders the Fisher information matrix singular” and defines

$x$36

or, in the supervised covariate-shift version, $x$37 (Cutler et al., 2024). For generalized linear models, the exact formula is

$x$38

while for PCA the paper gives

$x$39

The paper emphasizes a reciprocal relationship between RSE and the intrinsic complexity or sensitivity of the problem instance, paralleling the classical Eckart–Young theorem (Cutler et al., 2024).

Stable matching under salience-vector perturbations offers a further geometric recasting. For a stable matching $x$40, admissible perturbations change at most $x$41 coordinates of each normalized salience vector and remain within $x$42-distance $x$43 after renormalization. The maximum robustness radius is

$x$44

meaning that no blocking pair can be created by any admissible perturbation of radius at most $x$45 (Ronen et al., 4 Feb 2026). The paper proves polynomial-time verification and exact computation of $x$46 for fixed $x$47 and $x$48, and shows that the salience profiles preserving stability factor as a product of low-dimensional polytopes in the simplex (Ronen et al., 4 Feb 2026).

A final nonparametric classification perspective rejects the fixed global robustness radius entirely. One paper argues that a single practitioner-chosen radius $x$49 is ill-suited to heterogeneous distributions and replaces it with per-point robustness regions $x$50 induced by the neighborhood preserving Bayes optimal classifier. This is not a scalar robustness radius in the usual sense; instead, the radius becomes local and geometry-dependent, with regions growing or shrinking according to class separation (Bhattacharjee et al., 2021). This suggests that many current uses of robustness radius can be read as special cases of a broader question: how far is a problem instance from its nearest admissible failure mode, and should that distance be global, local, or distribution-dependent?

7. Cross-cutting themes and limitations

Across these literatures, several themes recur. First, robustness radius is almost always a boundary quantity: the minimum perturbation that causes failure or the maximum perturbation that preserves a property. Second, exact computation is frequently difficult. Neural local robustness relies on complete or incomplete verification and binary search (Liu et al., 2020); randomized smoothing usually needs Monte Carlo lower confidence bounds or conservative surrogate calibration (Park et al., 1 Jun 2026, Seferis et al., 2024); $x$51-weakened robustness is PP-complete (Huang et al., 2021); word-substitution robustness involves $x$52-hard or $x$53-hard subproblems (Yang et al., 2022); exact maximal safe radius in NLP is NP-hard (Malfa et al., 2020); and matrix-completion RSE can be NP-hard to compute exactly (Cutler et al., 2024).

Third, robustness radius often trades off against other desiderata. In aerial sensor networks, larger $x$54 yields stronger guarantees but more conservative coverage (Datta et al., 23 Oct 2025). In randomized smoothing, larger $x$55 can increase the multiplicative factor in the certified radius while simultaneously reducing classification confidence under noise (Goli et al., 2024). In stable matchings, higher robustness thresholds may increase matching cost (Ronen et al., 4 Feb 2026). In runtime neural-network validation, raising the threshold rejects more invalid inputs but also raises the false alarm rate (Liu et al., 2020).

Fourth, many papers reinterpret the same radius operationally rather than purely diagnostically. Local neural robustness becomes a runtime filter (Liu et al., 2020); randomized-smoothing certificates become deployment-time surrogates (Park et al., 1 Jun 2026); stability radius becomes a redesign objective (Rai et al., 2024); and robustness-check dispersion becomes a scalar transparency measure in empirical work (Prallon, 22 Feb 2026). This suggests that robustness radius has evolved from a verification statistic into a decision variable in system design and deployment.

The main misconception these papers jointly resist is that robustness radius is a single universally defined metric. It is instead a family of domain-specific distances to failure, unified by a perturbation model and a preserved property but differentiated by norm choice, admissible perturbation structure, locality, and whether the quantity is exact, lower-bounded, or distributionally certified.