Variable Perturbation Effectiveness Problem

• Variable Perturbation Effectiveness Problem is defined by non-uniform utility of perturbations, where their impact varies with task structure, distribution affinity, and system geometry.
• It spans multiple domains—including neural ranking, XAI, optimization, control, and quantum systems—revealing trade-offs between clean performance and robustness against artifacts.
• Effectiveness depends on factors like finite-sample behavior, inverse moments, and structural invariance, guiding the design of perturbations that preserve essential task features.

Searching arXiv for the cited papers and closely related work on perturbation effectiveness across ranking, XAI, benchmarking, optimization, control, and statistical estimation. The Variable Perturbation Effectiveness Problem denotes a recurring research problem in which the utility of perturbations is not uniform across settings, samples, or parameter regimes. Across the cited literature, perturbations are used to test robustness, construct explanations, reduce benchmark contamination, stabilize inverse problems, characterize sensitivity of controlled systems, and accelerate parameter sweeps; yet the same works also show that perturbations can induce out-of-distribution artifacts, amplify boundary sensitivity, fail under unfavorable tail behavior, or become ineffective when the underlying geometry, spectrum, or control structure is mismatched. In this sense, perturbation effectiveness is variable because it depends on whether a perturbation preserves task structure, stays close to the relevant distribution or manifold, and interacts favorably with the optimization or dynamical system under study (Liu et al., 2023, Qiu et al., 2021, Qian et al., 2024, Cao, 2014, Kim et al., 2019, Luo et al., 2024, Alphonse et al., 2019, Göttlich et al., 2024, Melo et al., 31 Mar 2025, Bu et al., 29 May 2026, SanamSuraj et al., 2020).

1. Conceptual scope and problem forms

The problem appears in several technically distinct forms. In neural ranking, the central issue is the trade-off between clean effectiveness and adversarial robustness under word-substitution attacks. In perturbation-based XAI, the issue is that perturbed samples have different degrees of affinity to the original data distribution, so explanation quality varies with the in-distribution status of each perturbation. In benchmark design, variable perturbation is used to regenerate fresh test instances in order to reduce contamination. In stochastic approximation and bandits, effectiveness depends on perturbation tails, inverse moments, and finite-sample exploration behavior. In constrained optimization and control, perturbations are used to derive variational conditions or sensitivity estimates, but their effects can be either localized or global depending on stabilizability, detectability, or monotonicity assumptions. In open quantum systems and NPIV estimation, perturbative corrections can extend computational reach or restore suppressed spectral directions, but only in favorable regimes (Liu et al., 2023, Qiu et al., 2021, Qian et al., 2024, Cao, 2014, Kim et al., 2019, Luo et al., 2024, Alphonse et al., 2019, Göttlich et al., 2024, Melo et al., 31 Mar 2025, Bu et al., 29 May 2026).

A concise cross-domain taxonomy is therefore possible.

Setting	Perturbation object	Effectiveness criterion
Neural ranking	Word substitutions within $\mathbb{B}(\boldsymbol d,\epsilon)$	Clean ranking quality and adversarial robustness
Perturbation-based XAI	Masks, occlusions, corrupted inputs	Inlier-aware faithfulness and saliency reliability
Benchmarking	Variable substitution in test items	Contamination resistance and stability across seeds
SPSA / FTPL	Random perturbation distributions	MSE or regret under finite-sample and tail conditions
BSDE / QVI / PDE control	Terminal, forcing-term, or local data perturbations	Optimality conditions and stability/localization
Open quantum / NPIV	Perturbative expansions in operators or coefficients	Convergence radius, computational cost, prediction error

This taxonomy suggests that the phrase does not designate a single formal theorem, but a family of questions about when perturbations preserve structure and when they instead create artifacts or unstable corrections.

2. Error decomposition, invariance, and distributional affinity

A particularly explicit formalization is given for neural ranking models. In the ad-hoc retrieval setting with query $\boldsymbol q$ and candidate set $$\mathcal D=\{\boldsymbol d_1,\dots,\boldsymbol d_{N_d}\}$$, the perturbation model is the word substitution ranking attack, in which an adversary replaces at most $\epsilon\cdot M$ words in a target document with synonyms inside the neighborhood

$$\mathbb{B}(\boldsymbol{d}, \epsilon) :=\left\{ \boldsymbol{d}^{\prime}:\left\|\boldsymbol{d}^{\prime}-\boldsymbol{d}\right\|_0 /\|\boldsymbol{d}\| \leq \epsilon \right\}.$$

The key theoretical step is to decompose robust ranking error into natural ranking error and boundary ranking error, so that robust failure is attributed both to ordinary clean misranking and to examples that are correctly ranked but lie too close to the decision boundary. The paper then defines perturbation invariance of a ranking model and proves that the event of ranking change under admissible perturbation gives a differentiable upper bound on the boundary ranking error. On that basis it proposes perturbation-invariant adversarial training with objective

$$\mathcal{L} = \lambda \mathcal{L}_{\mathrm{nat}} + (1 - \lambda) \mathcal{L}_{\mathrm{adv}},$$

where $\mathcal L_{\mathrm{nat}}$ is a supervised pairwise ranking loss and $\mathcal L_{\mathrm{adv}}$ regularizes discrepancy between clean and attacked ranked lists using KL divergence, ListNet, or ListMLE. The reported interpretation is explicit: a larger $\lambda$ emphasizes clean effectiveness but weakens robustness, whereas a smaller $\lambda$ increases robustness but can hurt clean ranking. On MS MARCO passage ranking, PIAT$\boldsymbol q$0 on ConvKNRM achieves CleanMRR@10 of 0.2513, RobustMRR@10 of 0.2035, ASR of 48.3, and LSD of 11.5, outperforming adversarial training and data augmentation on both effectiveness and robustness; the paper further reports that DA and vanilla AT often increase robustness at the cost of clean effectiveness, while PIAT yields a better Pareto position (Liu et al., 2023).

An analogous decomposition appears in perturbation-based XAI, but the relevant distinction is not boundary proximity; it is in-distribution affinity. The central probabilistic identity is

$\boldsymbol q$1

and the claim is that conventional perturbation methods implicitly rely only on $\boldsymbol q$2 as if every perturbed sample were in-distribution. The proposed OoD Block instead estimates an Inlier Score $\boldsymbol q$3 as a proxy for $\boldsymbol q$4 and modifies explanation aggregation to

$\boldsymbol q$5

This mechanism is integrated into $\boldsymbol q$6, $\boldsymbol q$7, and $\boldsymbol q$8. The same paper argues that the standard Deletion faithfulness indicator is itself sensitive to OoD perturbations and therefore introduces Deletion$\boldsymbol q$9 by weighting model confidence with the inlier score. A degradation case is defined by Pearson correlation with the average mask exceeding 0.8, and the reported degradation occurrence rate is about $$\mathcal D=\{\boldsymbol d_1,\dots,\boldsymbol d_{N_d}\}$$0; in such cases the OoD-aware variants show especially strong gains in faithfulness and localization (Qiu et al., 2021).

Taken together, these formulations reject a common simplification: perturbations are not interchangeable probes. In both ranking and XAI, the decisive issue is whether perturbation-induced output changes reflect genuine task sensitivity or merely boundary artifacts and distributional drift.

3. Perturbation distributions, finite-sample optimality, and exploration

In stochastic approximation, perturbation effectiveness is explicitly regime-dependent. Simultaneous perturbation stochastic approximation conventionally uses Bernoulli $$\mathcal D=\{\boldsymbol d_1,\dots,\boldsymbol d_{N_d}\}$$1 perturbations, and the cited work affirms that this choice is asymptotically optimal. The same paper, however, studies one-iteration and small-sample SPSA and shows that asymptotic optimality does not guarantee finite-sample superiority. Under assumptions of independence, symmetry, bounded magnitude, and bounded inverse moments, it compares Bernoulli with the segmented uniform distribution, whose support is approximately

$$\mathcal D=\{\boldsymbol d_1,\dots,\boldsymbol d_{N_d}\}$$2

with mean $$\mathcal D=\{\boldsymbol d_1,\dots,\boldsymbol d_{N_d}\}$$3 and variance $$\mathcal D=\{\boldsymbol d_1,\dots,\boldsymbol d_{N_d}\}$$4. The one-iteration analysis derives conditions under which SU yields smaller MSE than Bernoulli; the practical interpretation is that favorable gain ratios, sufficiently small perturbation magnitude, a relatively flat loss, and an initial point not too far from the optimum increase the likelihood of SU outperforming Bernoulli. In the quadratic example with $$\mathcal D=\{\boldsymbol d_1,\dots,\boldsymbol d_{N_d}\}$$5, the theoretical condition evaluates to $$\mathcal D=\{\boldsymbol d_1,\dots,\boldsymbol d_{N_d}\}$$6, and simulation with $$\mathcal D=\{\boldsymbol d_1,\dots,\boldsymbol d_{N_d}\}$$7 replications reports MSE values of 0.1913 for Bernoulli and 0.1798 for SU at $$\mathcal D=\{\boldsymbol d_1,\dots,\boldsymbol d_{N_d}\}$$8, while at $$\mathcal D=\{\boldsymbol d_1,\dots,\boldsymbol d_{N_d}\}$$9 Bernoulli becomes superior with 0.0421 versus 0.1403. The broader conclusion is that higher-order inverse moments, not merely matched mean and variance, can determine finite-sample effectiveness (Cao, 2014).

The bandit literature reaches a related but distinct conclusion. In stochastic multi-armed bandits, Follow-The-Perturbed-Leader can be optimal or near-optimal when the perturbation distribution has the right tail and anti-concentration properties. For sub-Weibull perturbations with parameter $\epsilon\cdot M$0 and a matching lower-tail bound with parameter $\epsilon\cdot M$1, the paper gives instance-dependent and minimax-style regret bounds; for Gaussian perturbations with $\epsilon\cdot M$2, the stated bound is

$\epsilon\cdot M$3

Bounded-support perturbations can also be effective, but only when there is sufficient mass near the support extremes and when the perturbations are scaled strongly enough; the paper explicitly warns that without the extra $\epsilon\cdot M$4 scaling, bounded perturbations can incur linear regret. In adversarial bandits, by contrast, two barriers are established. First, when $\epsilon\cdot M$5, there is no stochastic perturbation whose induced choice probabilities exactly match those of Tsallis entropy regularization. Second, tighter block-maxima analysis of standard Gumbel-type perturbations cannot remove the extra $\epsilon\cdot M$6 factor in regret. On this basis the paper argues that, if an optimal FTPL perturbation exists in the adversarial setting, it is likely Fréchet-type (Kim et al., 2019).

These results jointly undermine another frequent misconception: neither “asymptotically optimal” nor “more random” implies universally effective perturbation. Effectiveness depends on finite-sample geometry, inverse moments, exploration mass, and the adversarial or stochastic character of the problem.

4. Dynamic variable substitution and benchmark contamination

In benchmark evaluation, variable perturbation is used not as a robustness attack but as a mechanism for regenerating test instances. VarBench proposes to extract variables from each test case, define a value range for each variable, and resample those values at evaluation time to create fresh instances. For GSM8K, the procedure asks an LLM to identify variables, produce a delexicalized question in which all numbers are replaced with placeholders, and define a Python function that computes the answer from those variables. A second prompt generates value ranges subject to the conditions that the range cannot be fixed, sampled values should preserve fluency and coherence, and integer ranges should have a maximum of 100. For ARC, CommonsenseQA, and TruthfulQA, answer choices are treated as variables because reliable variable extraction from the question stem itself was difficult. The paper measures relative performance drop by

$\epsilon\cdot M$7

For each variable-based evaluation it runs five times with random seeds 40–44 and averages the results (Qian et al., 2024).

The reported quantitative effects are largest on GSM8K. Examples include Mistral v0.3 7B dropping from 36.3 to 17.0, Zephyr 7B $\epsilon\cdot M$8 from 33.4 to 14.4, Llama 3 Instruct 8B from 75.8 to 39.4, Phi 3 Mini-4K Instruct from 78.0 to 42.0, GPT-4o from 81.6 to 62.1, and GPT-3.5 Turbo from 75.1 to 46.3. For ARC challenge, CommonsenseQA, and TruthfulQA, the declines are smaller, generally about 3–11\%, 3–9\%, and 0–7\% respectively, with a few slight improvements. The paper interprets this cautiously: either contamination is less severe in those tasks or the perturbations are less effective because the tasks are verbal and choice-based rather than arithmetic. The ablations are important. Paraphrasing, choice shuffling, and simple answer replacement do not consistently reproduce the observed drops, while stronger prompting leaves a substantial gap. At the same time, the paper is explicit that dynamic perturbation is not a complete cure: semantic contamination may remain, around 60\% of value ranges were modified during validation, 15\% of solution functions were corrected, and 7 GSM8K items had incorrect ground-truth answers (Qian et al., 2024).

This line of work reframes perturbation effectiveness as contamination resistance. A perturbation is effective to the extent that it preserves task structure while breaking exact-sequence reuse; it is ineffective when it only changes surface form or introduces uncontrolled artifacts.

5. Perturbation in constrained optimization, control, and dynamical systems

In robust optimization under quadratic BSDEs, the perturbation is applied at terminal time rather than along the full control path. The admissible terminal payoff set is

$\epsilon\cdot M$9

and the perturbation is defined by

$$\mathbb{B}(\boldsymbol{d}, \epsilon) :=\left\{ \boldsymbol{d}^{\prime}:\left\|\boldsymbol{d}^{\prime}-\boldsymbol{d}\right\|_0 /\|\boldsymbol{d}\| \leq \epsilon \right\}.$$0

The perturbative analysis proceeds through a linearized variational BSDE, with BMO martingale estimates ensuring that the perturbed and unperturbed solutions remain well controlled despite quadratic generator growth. From this, the paper derives a variational inequality and a projection-type optimality condition for the optimizer, and proves sufficiency under convexity of the generators and terminal cost. The same framework is then applied to partial hedging with ambiguity, fundraising under ambiguity, and randomized testing for a quadratic $$\mathbb{B}(\boldsymbol{d}, \epsilon) :=\left\{ \boldsymbol{d}^{\prime}:\left\|\boldsymbol{d}^{\prime}-\boldsymbol{d}\right\|_0 /\|\boldsymbol{d}\| \leq \epsilon \right\}.$$1-expectation (Luo et al., 2024).

For quasi-variational inequalities and optimal control, perturbations act on the forcing term and are analyzed through the minimal and maximal elements of the solution set. The QVI is

$$\mathbb{B}(\boldsymbol{d}, \epsilon) :=\left\{ \boldsymbol{d}^{\prime}:\left\|\boldsymbol{d}^{\prime}-\boldsymbol{d}\right\|_0 /\|\boldsymbol{d}\| \leq \epsilon \right\}.$$2

and the core stability question is how the extremal solutions $$\mathbb{B}(\boldsymbol{d}, \epsilon) :=\left\{ \boldsymbol{d}^{\prime}:\left\|\boldsymbol{d}^{\prime}-\boldsymbol{d}\right\|_0 /\|\boldsymbol{d}\| \leq \epsilon \right\}.$$3 and $$\mathbb{B}(\boldsymbol{d}, \epsilon) :=\left\{ \boldsymbol{d}^{\prime}:\left\|\boldsymbol{d}^{\prime}-\boldsymbol{d}\right\|_0 /\|\boldsymbol{d}\| \leq \epsilon \right\}.$$4 vary under perturbations of $$\mathbb{B}(\boldsymbol{d}, \epsilon) :=\left\{ \boldsymbol{d}^{\prime}:\left\|\boldsymbol{d}^{\prime}-\boldsymbol{d}\right\|_0 /\|\boldsymbol{d}\| \leq \epsilon \right\}.$$5. The cited work shows that decreasing and increasing perturbations require different assumptions on $$\mathbb{B}(\boldsymbol{d}, \epsilon) :=\left\{ \boldsymbol{d}^{\prime}:\left\|\boldsymbol{d}^{\prime}-\boldsymbol{d}\right\|_0 /\|\boldsymbol{d}\| \leq \epsilon \right\}.$$6, including distinct scaling relations and continuity hypotheses, but under these assumptions both extremal solutions are stable and the associated reduced optimal control problem is well-posed in the sense of existence of an optimal control (Alphonse et al., 2019).

A different localization phenomenon is proved for PDE-constrained linear-quadratic optimal control. There the perturbation is local in space, but the effect on the optimal state, control, and adjoint decays exponentially with distance provided stabilizability and detectability hold with constants uniform in domain size. The argument relies on a uniform bound on the inverse of the optimality operator together with an exponential spatial weight

$$\mathbb{B}(\boldsymbol{d}, \epsilon) :=\left\{ \boldsymbol{d}^{\prime}:\left\|\boldsymbol{d}^{\prime}-\boldsymbol{d}\right\|_0 /\|\boldsymbol{d}\| \leq \epsilon \right\}.$$7

and a Neumann-series argument for the weighted optimality system. The paper validates this for Helmholtz, Poisson, and advection-diffusion-reaction equations, and reports that even when the uncontrolled PDE may propagate perturbations globally, the optimal control structure localizes their influence (Göttlich et al., 2024).

In the restricted five-body problem with variable mass, the perturbation is a dynamical parameter rather than an infinitesimal analytic device. The fifth body obeys Jeans’ law

$$\mathbb{B}(\boldsymbol{d}, \epsilon) :=\left\{ \boldsymbol{d}^{\prime}:\left\|\boldsymbol{d}^{\prime}-\boldsymbol{d}\right\|_0 /\|\boldsymbol{d}\| \leq \epsilon \right\}.$$8

with the study specializing to $$\mathbb{B}(\boldsymbol{d}, \epsilon) :=\left\{ \boldsymbol{d}^{\prime}:\left\|\boldsymbol{d}^{\prime}-\boldsymbol{d}\right\|_0 /\|\boldsymbol{d}\| \leq \epsilon \right\}.$$9 and treating $$\mathcal{L} = \lambda \mathcal{L}_{\mathrm{nat}} + (1 - \lambda) \mathcal{L}_{\mathrm{adv}},$$0 as the perturbation parameter. The paper reports that the critical threshold between 9 and 15 coplanar equilibrium points shifts from $$\mathcal{L} = \lambda \mathcal{L}_{\mathrm{nat}} + (1 - \lambda) \mathcal{L}_{\mathrm{adv}},$$1 at $$\mathcal{L} = \lambda \mathcal{L}_{\mathrm{nat}} + (1 - \lambda) \mathcal{L}_{\mathrm{adv}},$$2 to 0.98510106 at $$\mathcal{L} = \lambda \mathcal{L}_{\mathrm{nat}} + (1 - \lambda) \mathcal{L}_{\mathrm{adv}},$$3, 0.97290121 at $$\mathcal{L} = \lambda \mathcal{L}_{\mathrm{nat}} + (1 - \lambda) \mathcal{L}_{\mathrm{adv}},$$4, and 0.95353029 at $$\mathcal{L} = \lambda \mathcal{L}_{\mathrm{nat}} + (1 - \lambda) \mathcal{L}_{\mathrm{adv}},$$5, so the parameter range producing 15 libration points expands with increasing $$\mathcal{L} = \lambda \mathcal{L}_{\mathrm{nat}} + (1 - \lambda) \mathcal{L}_{\mathrm{adv}},$$6. For $$\mathcal{L} = \lambda \mathcal{L}_{\mathrm{nat}} + (1 - \lambda) \mathcal{L}_{\mathrm{adv}},$$7, a symmetric pair of out-of-plane equilibria appears on the $$\mathcal{L} = \lambda \mathcal{L}_{\mathrm{nat}} + (1 - \lambda) \mathcal{L}_{\mathrm{adv}},$$8-axis and moves toward the central primary as $$\mathcal{L} = \lambda \mathcal{L}_{\mathrm{nat}} + (1 - \lambda) \mathcal{L}_{\mathrm{adv}},$$9 grows. The linear stability analysis, based on a sixth-degree characteristic polynomial, finds all libration points linearly unstable in the variable-mass case. The Newton–Raphson basin study uses a $\mathcal L_{\mathrm{nat}}$0 grid, maximum iteration count $\mathcal L_{\mathrm{nat}}$1, and tolerance $\mathcal L_{\mathrm{nat}}$2, and shows strong deformation of the basins as $\mathcal L_{\mathrm{nat}}$3 changes (SanamSuraj et al., 2020).

Across these settings, perturbation effectiveness is controlled by structural properties: BMO stability in quadratic BSDEs, monotonicity and Mosco convergence in QVIs, stabilizability and detectability in PDE control, and bifurcation-like parameter dependence in celestial mechanics.

6. Spectral mixing, convergence radii, and unresolved limits

In open quantum systems, perturbation effectiveness is tied to convergence radius and numerical linear algebra. For the Lindblad equation

$\mathcal L_{\mathrm{nat}}$4

standard perturbation theory expands around a reference parameter point but suffers from two bottlenecks: the pseudo-inverse is numerically costly, and the series has a limited radius of convergence, especially near dissipative phase transitions. Variational perturbation theory replaces the fixed coefficients $\mathcal L_{\mathrm{nat}}$5 with coefficients chosen variationally inside the span of perturbative directions, solving a least-squares problem in a reduced basis. A multipoint generalization combines information from several expansion points and is reported to cross boundaries between high- and low-photon phases. Two numerical implementations are developed: one based on a single LU decomposition of a modified Liouvillian, and one based on Krylov-space recycling with preconditioned iterative methods such as GMRES and BiCGSTAB. In the Kerr-resonator sweep, VPT requires seven times fewer reference points than standard PT, and multipoint VPT adds a further three-fold reduction in exact recomputations; in the dissipative cat-qubit parameter-estimation experiment, L-BFGS recovers unknown parameters in about 15 iterations, and the paper states that overall speedups can be as high as a factor of a hundred (Melo et al., 31 Mar 2025).

In NPIV estimation, perturbation effectiveness is again spectral. The baseline kernel ridge IV estimator solves

$\mathcal L_{\mathrm{nat}}$6

while the perturbative extension adds a cubic interaction

$\mathcal L_{\mathrm{nat}}$7

leading to first- and higher-order corrections in powers of $\mathcal L_{\mathrm{nat}}$8. The paper interprets the gain as spectral mixing: standard ridge suppresses low-eigenvalue directions, whereas the perturbative correction couples modes and can carry information from strong modes into weak ones. The reported high-dimensional regime is defined by $\mathcal L_{\mathrm{nat}}$9, and the strongest gains occur when $\mathcal L_{\mathrm{adv}}$0 is large. For the fractional Brownian kernel, the paper reports RMSE improvements from 0.382 to 0.124 at $\mathcal L_{\mathrm{adv}}$1, from 1.654 to 0.108 at $\mathcal L_{\mathrm{adv}}$2, from 3.766 to 0.028 at $\mathcal L_{\mathrm{adv}}$3, and from 11.52 to 0.136 at $\mathcal L_{\mathrm{adv}}$4, motivating the statement that first-order perturbative corrections can reduce prediction error by up to 99\% when $\mathcal L_{\mathrm{adv}}$5. The paper is equally explicit about the limits: RBF kernels show essentially no improvement, the coupling $\mathcal L_{\mathrm{adv}}$6 is sensitive, divergence may require renormalization or resurgence, and rigorous finite-sample guarantees comparable to classical kernel ridge theory are not provided (Bu et al., 29 May 2026).

A consistent picture emerges from these spectral and computational studies. Perturbation becomes effective when it enlarges the useful approximation space without violating the governing structure of the operator or inverse problem. This suggests a broad unifying principle: perturbations are most effective when they are structure-preserving but basis-enriching, and least effective when they merely add variance, remain trapped inside an unfavorable symmetry class, or fail to model the relevant boundary, manifold, or spectrum (Melo et al., 31 Mar 2025, Bu et al., 29 May 2026, Kim et al., 2019, Qian et al., 2024).

The resulting research landscape is therefore neither uniformly optimistic nor uniformly skeptical. Some works show that carefully designed perturbations can improve both clean and robust ranking, repair OoD-sensitive explanations, localize the effects of disturbances in optimal control, or dramatically reduce computational cost in steady-state tracking. Others show that asymptotically optimal perturbations may fail in small samples, that simple surface perturbations do not reliably expose contamination, that RBF symmetry can nullify perturbative gains in NPIV, and that minimax-optimal adversarial FTPL may be impossible without a yet-unsettled Fréchet-type construction. The Variable Perturbation Effectiveness Problem is thus best understood as a general question of perturbation design under structural constraints: which perturbations preserve the semantics, geometry, spectrum, or control logic that the method is supposed to probe, and which perturbations instead measure only artifacts of the perturbation process itself.