Robustness of neural networks to random noise perturbations of their inputs
arXiv:2606.31581v1 [cs.LG] 30 Jun 2026
Mark Levene and Martyn Harris School of Computing and Mathematical Sciences, Birkbeck, University of London Malet Street, London WC1E 7HX, U.K. [email protected],[email protected]
Abstract We investigate the problem of the robustness of a trained neural network to the perturbation of its input values. More specifically, we examine the interplay between the accuracy of the network, as measured by the mean squared error, and robustness. Accordingly, we present a robustness measure, which, with high probability, suggests an upper bound on the mean squared error of the network, with respect to an input data set, for a given perturbation of the input values of the network. The measure we propose is both simple and efficient to compute, treating the neural network as a black box. We provide experimental results on several real-world data sets showing the efficacy of the proposed method. We also introduce the concept of robustness curves, which allows us to further analyse robustness within and between data sets. Keywords: robustness of neural networks, perturbation of inputs, robustness curves, Gompertz function
1
Introduction
Data science along with machine learning (ML) [LH25], and especially neural networks (NN) [Agg18] have been in the forefront of the recent resurgence in artificial intelligence (AI) both in academia and in industry. The evaluation of an AI system is the measure of its success, that is, for NNs, determining the quality of the trained model. In particular, the accuracy of a NN is measured by the proportion of correct predictions it makes on the test data. In the following we will use the term accuracy as an umbrella for evaluation measures in ML [JS11] and, in particular, for NNs. For regression problems, on which we mainly focus in this work, measures such as mean squared error (MSE) and mean absolute error (MAE) are commonly used [LH25]; here we will concentrate on MSE. (For classification problems we use a variant of the MSE, called the multi-class Brier score (MBS) [SFMR23, Section 4.4], which is the counterpart of the MSE that can be used for classification problems see [HB21]; unless otherwise specified, in the following, MSE refers to both MSE and MBS.) Moreover, we also require that the predictions are stable under a wide range of conditions such as noise in the input, which may be caused by random or adversarial perturbations 1
of the input. This stability of an ML model such as an NN is called robustness [ARV09, SZS+ 14, MMS+ 18, BBB+ 25]. There are trade-offs between accuracy and robustness, where the increase of one may cause a decrease of the other; these trade-offs are reviewed in [LL25]. Here we concentrate on the robustness to input perturbations resulting from adding random Gaussian noise to the original input [RI99, ZJPD09]. We note that although we focus on NNs, the method we propose is valid for other ML algorithms, since, for the purpose of this paper, we treat a NN as a black box. Our notion of robustness of a NN is both intuitive, relatively simple, and can be computed in a straightforward manner. It hinges on adapting the MSE for perturbations with a fixed standard deviation, and then computing the robustness of the NN using a Monte Carlo method [Ros23] to obtain a confidence interval for the derived MSE. This contrasts with other research on robustness, such as [ARV09], which focuses on perturbation of network weights by modifying the model, and is limited to classification problems [SZS+ 14, MMS+ 18]. Apart from the standard evaluation on real-world data sets, with accuracy and MSE, we also introduce robustness curves, which visualise in a clear manner how increasing the perturbation of the input will degrade the MSE (see [ŠS21]). Then, in order to model robustness curves, we fit the curves to the Gompertz function [SW03, TT17], which is widely used for growth processes, saturation effects, and cumulative phenomena. This allows us to characterise the growth rate of the curves, identify a linear regime in which the MSE grows slowly, and to compare robustness across data sets. The rest of the paper is organised as follows. In Section 2 we present the methods used, including a brief review of the background on NNs needed herein, the method of perturbation by adding random Gaussian noise to the test data, and the evaluation of such perturbations. In Section 3 we formalise a measure of the robustness of a NN, assuming that the NN has already been trained and its inputs are perturbed with Gaussian noise. In Section 4 we describe experiments we carried out on real-world data sets to validate our approach, and in Section 5 we present a detailed evaluation of the experimental results, including the novel use of robustness curves to enhance the analysis and compare the performance of robustness within and between the employed data sets. Finally, in Section 6, we present our concluding remarks, and in Appendix A we provide additional figures and tables.
2
Methods
In Subsection 2.1 we briefly review NNs and introduce the notation adopted in this paper. In Subsection 2.2 we introduce perturbation of the inputs, and how the definition of the MSE can be adapted to deal with these perturbations.
2.1
Neural networks
To simplify the model under discussion, let us adopt a generic neural network with input and output layers and some hidden layers inbetween, such as the feedforward neural network (FNN) shown in Figure 1; the hidden layers may be viewed as the latent space of the network. In general, our methods may be deployed at various parts of the neural network architecture, although here will concentrate on the effect that perturbing an input will have on the predicted output of the network. Moreover, the methods we present are intended to be generic and, in principle apply to both regression or classification problems, however, since we are focusing 2
on input perturbation method we will assume, for the presentation of the method, that the network’s inputs are continuous.
Figure 1: A feedforward neural network with two hidden layers.
We assume that a neural network model, say NN, has been trained, and we have a test data set (or simply a data set) T containing a sample of n pairs (i.e. its cardinality is n, written as |T | = n). Each pair, (xi , yi ) in T is such that xi is a feature vector of fixed dimension (often called the input value), with |xi | ≥ 1 (called the width of the input value), and yi is also a feature vector of fixed dimension (often called the actual value) typically satisfying |yi | = 1. Thus the data set T induces a finite input set, x = {x1 , x2 , . . . , xn }, with corresponding target output values (or simply target values), y = {y1 , y2 , . . . , yn }. The set of predicted output values (or simply predicted values) resulting from running the neural network model NN on the input set x is given by ŷ = {ŷ1 , ŷ2 , . . . , ŷn }. We do not specify the train and test method of the neural network, which, for example, could be cross-validation [Agg18]; we evaluate the trained NN using mean squared error (MSE) and make use of the root mean squared error (RMSE) which has the same units as the target values [CWJ21, LH25]. (We note that there is also an argument for using the MAE, a measure known to be more robust to outliers [CD14], however we leave this choice for future work.) Now, given that the NN models the function computed by the neural network, we have ŷi = NN(xi ),
(1)
where xi is its input value and ŷi is the predicted output value.
2.2
Perturbing the inputs
For simplicity we will assume that, |xi | = 1, that is, each input value is a single feature, that the variance of xi is 1, and as stated in Subsection 2.1, xi is continuous. These assumptions will be relaxed in Section 4 when we experiment with real-world data sets that do not satisfy these assumptions. 3
We perturb the input with randomly generated Gaussian noise, noting that in our case the model is fixed and thus noise is injected into the input during testing rather than during training as in [RI99, ZJPD09], where the objective is to improve the performance of the neural network. Now, assume that ϵ is a normally distributed random variable, with mean 0 and variance σ 2 , i.e. from N (0, σ 2 ), and that σ is a small non-negative value; typically σ < 1 but ultimately its value will also depend on the data set. In the special case when σ = 0 we have the degenerate case of ϵ = 0. (For simplicity, we will use the symbol ϵ to denote both the random variable and its realised value, with the intended meaning being clear from context.) As stated in Subsection 2.1, we choose to make use of the MSE as our loss function. Thus, mean squared error (MSEϵ) of NN with respect to T and perturbation ϵ, is given by n
MSEϵ(NN) =
2 1 X yi − NN(xi + ϵ) , n
(2)
i=1
bearing in mind that for ϵ = 0 and we have the standard MSE (which we also refer to as the baseline MSE), where yi is the target output and NN(xi ) = yˆi is the predicted output as in (1).
3
A measure of robustness
We introduce a novel measure of robustness for NNs, called θ-robustness, and show how the MSE can be redefined to make use of this measure, leading to MSEθ. Now, a neural network NN is said to be θ-robust with significance α, 0 < α ≤ 1, for standard deviation σ, with ρ being a function of σ, α and NN, defined as ρ(σ, α, NN) = min such that P MSEϵ(NN) ≤ θ ≥ 1 − α, (3) θ
where θ ≥ 0 and ϵ is a random variable distributed as N (0, σ 2 ). To recap, given a trained neural network, NN, and σ, (3) gives us an upper bound on MSEϵ(NN), given in (2), at the α confidence level. It is important to note that smaller values of θ = ρ(σ, α, NN) correspond to higher levels of robustness. Pseudocode for computing an approximation of ρ(σ, α, NN) is given in Algorithm 1. (See [Ial19] detailing other nonparametric methods for estimating confidence intervals for quantiles.) We mention a similar definition of robustness in [ARV09], who are concerned with perturbations of the NN weights over a perturbation space, which can be sampled from a provided probability distribution function over the space. In particular, in their experiments, [ARV09] considered the uniform distribution for sampling the perturbation space. Moreover, the exact nature of the perturbation in the theoretical model is not specified in [ARV09]. In contrast, our model does not depend on the architecture of the NN as such as long as the NN is deterministic once trained. In our model we investigate the robustness of a fixed NN, defined with respect to perturbations of the inputs induced by N (0, σ 2 ), and investigate how the robustness changes with σ. We observe that MSEϵ can be viewed as a measure of robustness under perturbations, governed by σ. In addition, when σ1 ≤ σ2 , we expect ρ(σ1 , α, NN) ≤ ρ(σ2 , α, NN). Thus, in 4
Algorithm 1 Robustness-computation Input: σ, α, NN, m Output: θ 1: for j = 1 : m do % m = 1000 is reasonable 2: Generate n random values, ϵi , each distributed as N (0, σ 2 ) 3: θj = MSEϵ(NN) using the generated ϵi values 4: end for 5: Arrange the θj values in ascending order to obtain a sequence θ(1) , θ(2) . . . , θ(m) 6: ub = (1 − α)m % For convenience we may choose m such that (1 − α)m = (1 − α)m 7: θ = θ(ub) 8: return (θ)
general, we expect MSE0 (i.e. the baseline MSE) to give rise to a lower bound baseline for θ, although for small σ, MSEϵ may well fluctuate around MSE0 . We further note that it is obviously beneficial for MSE0 to be as small as possible without overfitting the training data, since if the model does not fit the data well, then measuring robustness does not make sense. (See [LL25] for a discussion on the tradeoff between accuracy measures, such as mean squared error, and robustness.) We can now define the mean squared error of the difference between the predicted output of the neural network on an input, xi , and its predicted output on a perturbed input, xi + ϵ, as, n 2 1 X MSEθ(NN) = NN(xi ) − NN(xi + ϵ) , (4) n i=1
where NN is θ-robust and ϵ is distributed as N (0, σ 2 ) with θ = ρ(σ, α, NN), noting that θ depends on σ, which in turn derives ϵ. We mention that there is a growing body of research looking into conditions that guarantee that the difference between NN(xi + ϵ) and NN(xi ) is bounded for small ϵ. In particular, this may be theoretically achieved by employing Lipschitz continuity for the function represented by the neural network; see [ZK25]. However, there are some limitations of this approach in terms of expressiveness and computation efficiency [HCC19]. Although we do not discount the potential benefits of the Lipschitz continuity approach, here we restrict ourselves to measuring robustness from an experimental data-driven perspective based on (3).
4
Experimental setup
In Subsection 4.1 we describe the test data sets used to assess our notion of robustness with respect to the neural networks trained on their respective training data sets, while in Subsection 4.2 we relax the assumptions presented in Subsection 2.2 regarding the perturbation of the data for different types of features. Our objective, is then, in Section 5, to determine how robust the neural network is, that is, determine the minimal θ according to (3), which allows the computation of MSEθ according to (4).
5
4.1
Data sets
In Table 1 we describe the chosen real-world data sets. In particular, we summarise key attributes of each data set, including the number and types of input features, noting that there is only one target feature. Data set Deaths from Cancer [OEC26a]
Task regression
n 31
Input type continuous (1): single temporal variable (calendar year).
Flu vaccination rates in 2020 [OEC26b]
regression
31
continuous (1): ordered temporal index.
Cleveland, Heart disease [Cle98]
classification
237
Wisconsin diagnostic, Breast Cancer [Wis95]
classification
569
MNIST [Kag19]
classification
70,000
continuous (6), ordinal (3), categorical/nominal (19): encoded clinical attributes from clinical measurements and diagnostic codes. continuous (30): geometric and textural features from cell nuclei images. continuous (784): flattened 28 × 28 grayscale pixel intensities scaled to [0, 1].
Target type continuous: Cancer mortality rate; deaths per 100,000 population. continuous: Flu vaccination uptake rate; percentage. Binary disease indicator.
Binary disease indicator.
categorical digit class {0, . . . , 9}.
Table 1: Summary of data sets used in the robustness experiments, including the types and number of input features, noting that there is only one target feature.
4.2
Perturbing real data
Here we relax the assumptions to the perturbation of attribute values as given in Subsection 2.2. In particular, we only perturb numeric features and do not alter categorical features [LH25], for example as is proposed in [PBVN24]. To make this decision more concrete, as an example, it does not make sense to perturb a categorical attribute such as gender, since changing this value will completely alter the meaning of the data item. Now, let the feature vector xi have m numeric features, m ≥ 1, and thus xi1 , xi2 , . . . , xim , are the m numeric features of xi , where the empirical standard deviation of xij is σij , with 1 ≤ j ≤ m. (For simplicity we assume that the numeric features of xi precede the categorical ones.) So, the perturbation ϵij that we apply to the jth numeric feature of xi , will be a normally distributed random variable with mean 0 and variance (σσij )2 , i.e. from N (0, (σσij )2 ), that 2. is, we scale N (0, σ 2 ) by σij
6
We observe that xi may have more than m features, and so any additional categorical features are not perturbed. So, ϵ in (2) is actually a vector of width |xi |, where m of the features are perturbed and the rest are not. Moreover, when the numeric value of the jth numeric feature is discrete rather than continuous, we round the perturbed value, that is, the corresponding ij component in xi becomes round(xij + ϵij ) rather than (xij + ϵij ). Whenever m > 1, we make use of a probability p, which is used to decide for each numeric data item of a feature, with probability p, whether to perturb its value or not; we call p the perturb or not probability. In our experiments p takes on four values 0.25, 0.5, 0.75 and 1, noting that when m = 1 we perturb all input data items, i.e. p = 1.
5
Evaluation
In Subsection 5.1 we describe and summarise the numeric results, while in Subsection 5.2 we describe and summarise robustness curves, which aid our understanding of how the robustness results change when the standard deviation σ used in perturbing the data values is increased.
5.1
Summary of numeric results
Prior to presenting the results we describe a variant of the MSE used for evaluating classification problems rather than regression ones. The metric we use for classification is called the multi-class Brier score (MBS) [SFMR23, Section 4.4], which is the counterpart of the MSE for classification problems; see [HB21]. For K > 1 classes, the MBSϵ of NN with respect to the data set T and perturbation ϵ, is defined as n K 2 1 XX MBSϵ = yik − pik , (5) 2n i=1 k=1
where NN(xi + ϵ) = (pi1 , pi2 , . . . , piK ) is the vector of the K predicted class probabilities, with xi and ϵ being |xi | vectors as explained in Section 4, and yi = (yi1 , yi2 , . . . , yiK ) being the one-hot encoding [LH25] K-vector for the i-th observation, where yik = 1 if class k is the target class, and 0 otherwise, for 1 ≤ k ≤ K. (From now on, for notational convenience, we will not distinguish between MBSϵ and MSEϵ and often refer to them both simply as MSEϵ; MBS0 , the baseline MBS, is referred to as the baseline MSE.) The interpretation of MBSϵ for input perturbation of ϵ, is thus the average squared Euclidean distance between the predicted probability vector and the one-hot encoding, rescaled so that a maximally wrong prediction scores 1; see [Hoe26]. In Table 2 we show for each data set in the experiments the FNN architecture used and how the data was split, including both the depth of each network and the number of neurons per hidden layer. We note that for the Deaths from Cancer and Flu vaccination rates data sets, we employ in-sample testing, which is due to their very small size of n = 31; see Table 1. We further note that the MNIST data set contains 70,000 images of which 60,000 are for
7
Data set Deaths from Cancer Flu vaccination rates Heart disease Breast Cancer MNIST
Input width
#HL
#Neurons
AF
#OU
AF
Train/Test
1
2
(64, 32)
ReLU
1
linear
In-sample
1
2
(64, 32)
tanh
1
linear
In-sample
28 30 784
2 2 3
(16, 8) (32, 16) (512, 128)
ReLU ReLU ReLU
2 2 10
sigmoid softmax softmax
75/25 75/25 98.36/1.64
256,
Table 2: Summary of neural network architectures used for each data set; #HL denotes the number of hidden layers, AF denotes the activation function, #OU denotes the number of output units, and Train/Test denotes the train and test split percentage. training and 10,000 for testing [BSI19]. However, for our experiments we only made use of a balanced subset 1,000 images, which we deemed sufficient to test our robustness model. We report in Table 3 the baseline performance in terms of MSE and RMSE for the FNNs deployed for the proof-of concept regression tasks, shown in Table 1. Furthermore, in Table 4 we report the baseline performance in terms of the standard metrics of Micro F1 and Macro F1 [LH25] (noting that Micro F1 is equal to accuracy [Opt24]), and MBS for the FNNs deployed for the classification tasks, shown in Table 1. As further validation for the MNIST data set, we also computed the baseline performance on the full 10,000 image data set, and, as such, the differences to those shown in the third row of Table 4 were not statistically significant. Data set
MSE
RMSE
MAE
Deaths from Cancer Flu vaccination rates
10.1927 12.8175
3.1926 3.5802
1.9622 2.44
Table 3: Baseline performance on the proof-of-concept regression data sets.
Data set
Micro F1
Macro F1
MBS
Heart disease Breast Cancer MNIST
0.8533 0.972 0.979
0.8532 0.9702 0.979
0.1059 0.0203 0.0137
Table 4: Baseline performance on the classification data sets. For comparison in Table 5, we report the performance, in terms of accuracy (recalling that accuracy is equal to Micro F1), from studies using the same classification data and FNN architectures. It can be seen that the baseline performance of our models is close enough to what has been reported in the literature. This is important, since robustness is not informative when the baseline performance is not adequate. Note that in Table 5 we only compare to the classification data sets from Table 1, since the two regression data sets are small data sets we use for proof-of-concept only. We now let θ = ρ(σ, α, NN) as computed by Algorithm 1, with α = 0.05 and NN being the 8
Data set Heart disease Breast Cancer MNIST
Approximate accuracy
Reference
0.8–0.86 0.86–0.97 0.96–0.99
[Asg24] [SKD18] [BSI19]
Table 5: Indicative performance ranges reported in the literature for comparable models. FNN used, as described in Table 2 for each data set. (The choice of α = 0.05 is pragmatic in terms of our experimentation, although we are aware that different data sets may, in principle, require different values of α, say 0.01.) In the experiments ρ(σ, α, NN), has been tested on a range of σ values starting from 0 and increased by increments of 0.01 until σ = 1; see [ZJPD09]. When m, the number of numeric features, is greater than 1, p, the perturbation probability, takes on the four values, 0.25, 0.5, 0.75 and 1, otherwise, when m = 1, then p = 1; see Subsection 4.2. In the subsection that follows we demonstrate how we can summarise the numerical results using the concept of robustness curves (see [ŠS21]). As an example of perturbed inputs from the MNIST test data, we show in Figure 2 how the digit class 7 is affected by increasing the perturbation. In the first column we have the unperturbed digit, while along the rest of the columns we have increasing values of σ: 0.1, 0.3, and 0.5, with p taking on the four values: 0.25, 0.5, 0.75 and 1 along the corresponding rows of the figure. As the value of these parameters increases, we observe how noise is gradually introduced to the sample.
Figure 2: An example from the MNIST test data of several perturbations of the digit class 7. (Note that when no perturbation occurs, we have p = 0 and σ = 0.)
9
5.2
Robustness curves
A robustness curve is a plot of ρ(σ, α, NN)/MSE0 (comprising the y-values of the plot) against σ (comprising the x-values of the plot). That is ρ(σ, α, NN) is normalised by the baseline MSE, MSE0 , where α and NN are understood from context as discussed towards the end of Subsection 5.1. Thus, the theoretical origin point of a robustness curve, that is (0, 1), corresponds to ρ(σ, α, NN)/MSE0 = 1; in practice, as noted in Section 3, for small σ, MSEϵ may fluctuate around MSE0 due to stochastic variation. When y > 1 the point (x, y) on the curve gives the multiple of MSE0 corresponding to ρ(σ, α, NN), with σ > 0. Therefore, the robustness curve is scale-free, which will be useful for comparing the robustness of different data sets. So, for example if y = ρ(σ, α, NN)/MSE0 = 2 then the robustness is twice the baseline MSE, MSE0 . For reference purposes, when using the RMSE √ as a measure matching the units of target values, the normalised robustness would be 2 times the √ baselines RMSE, where RMSE0 = MSE0 . Now, for each data set we fit the robustness curves to the Gompertz function [SW03, TT17], which is widely used for growth processes, saturation effects, and cumulative phenomena. We note that the Gompertz curve is sigmoidal (that is, S-shaped) but unlike the logistic curve, it is asymmetric [SW03]. We employ the standard form of he 4-parameter Gompertz function [TT17], given by (6) f (x) = d + (a − d) exp − exp −b(x − c) , where exp(·) is the exponential function, having the 4 parameters, • a is the upper asymptote (maximum value of y), • d is the lower asymptote (minimum value of y), • b is the growth-rate parameter controlling the steepness of the curve, and • c is the inflection point, i.e. the value of x where the growth rate is maximal (horizontal shift of the curve). For data sets with more than one numeric feature we have four robustness curves one for each value of p (the perturb or not probability) and when there is only one numeric feature we have only one robustness curve corresponding to p = 1. We measure the goodness-of-fit of the Gompertz curve with the R2 , the coefficient of determination, defined as, 2 Pn i=1 NN(xi ) − yi , (7) Pn 2 i=1 (ȳ − yi ) P where ȳ is the mean of the yi ’s, that is, ȳ = ni=1 yi /n. So, R2 is the MSE divided by the MST (mean total sum of squares, which is essentially the sample variance of y), where the MST is the denominator of (7) divided by n. Thus R2 measures the proportion of explained variance. On each robustness curve we indicate three significant data points: (1) The inflection point, defined above, which is the point of maximum growth. (2) The knee point, which is the maximum curvature point [SW03, OCB21] before inflection, observing that below the knee there is a linear regime. 10
(3) The half-maximum slope point, which is the intermediate threshold point between the knee and an inflection point, where the slope reaches half of its maximum. The qualitative properties of the Gompertz curve coincide with theoretical expectations for MSEϵ under increasing noise: (1) Flat initial regime: For small σ, perturbations lie within a locally linear region of the network. This corresponds to the early section of the Gompertz curve before the knee, where the MSE increases only slowly. The linear regime may be quantified by the first–order Taylor expansion of the Gompertz curve around the initial segment, where curvature is minimal. (2) Rapid degradation: As σ increases, increasing perturbations compounds the error. This matches the region of the Gompertz curve between the knee and the inflection point, where the slope is increasing. In this regime, the curvature of the Gompertz function grows rapidly, paralleling the nonlinear accumulation of prediction error. (3) Saturation: When predictions become effectively noise-dominated, further increases in σ cause only marginal changes in the prediction error. This corresponds to the region after the inflection point, where the Gompertz curve approaches its asymptote. Here the slope decreases toward zero, reflecting the model losing any meaningful predictive power. In Figures 3 − 7, appearing in Appendix A, we show the robustness curves for all the data sets. Correspondingly we show the fitted parameters for the curves in Tables 9, 10, 11, 12 and 13, also appearing in Appendix A. For all data sets the R2 is very high, indicating very good fits to the Gompertz curve. Recall that the y-values of the robustness curve are normalised robustness values for xvalues representing σ, with σ ≤ 1. In Table 6 we show the x and y-values, xknee and yknee , of the knee, and also x-values capped by y-values, where the y-value is either equal to 2 or to its value when it is less than 2 at x = 1, and denote these x and y-values by x2 and y2 , respectively. The (xknee , yknee )-values indicate the threshold of initial flat regime, where the growth rate of y-values is linear, while the (x2 , y2 )-values indicate a reasonable user-defined threshold capped by at most twice the baseline MSE. From Table 6 we can conclude that for ascertaining robustness, for the regression data sets (Deaths from Cancer and Flu vaccination rates) using the x2 -values is the sensible strategy, while for the classification data sets (Heart disease, Breast Cancer and MNIST) using the xknee values is more sensible. To introduce the concept of a robustness index, which allows us to compare Gompertz robustness curves independently of scale, we remove the vertical parameters a and d so that the shape of the curve depends only on b (the growth-rate) and c (the inflection point). This is achieved by normalisation as follows: fnorm (x) =
f (x) − d = exp − exp −b (x − c) , a−d
(8)
where f (x) is the Gompertz equation given in (6). The interpretation of b (growth-rate) and c (inflection point) is that a large growth-rate implies steeper growth, while a smaller one implies a slower growth, and a smaller inflection point implies earlier rise, while a larger one implies a later rise. 11
Data set
p
xknee
yknee
x2
y2
Deaths from Cancer Flu vaccination rates Heart disease Heart disease Heart disease Heart disease Breast Cancer Breast Cancer Breast Cancer Breast Cancer MNIST MNIST MNIST MNIST
1 1 0.25 0.5 0.75 1 0.25 0.5 0.75 1 0.25 0.5 0.75 1
0.4080 0.2604 0.1545 0.1607 0.1703 0.1607 0.0710 0.0346 0 0 0.3335 0.3042 0.2413 0.1872
17.6412 6.7941 1.0248 1.0904 1.1414 1.1807 1.0848 1.0556 0.9474 0.8801 1.4806 2.2519 2.6755 2.8039
0.0546 0.0727 1.0000 1.0000 1.0000 1.0000 0.6051 0.4332 0.3513 0.3030 0.4647 0.2818 0.2033 0.1527
2.0000 2.0000 1.3674 1.5996 1.7837 1.9360 2.0000 2.0000 2.0000 2.0000 2.0000 2.0000 2.0000 2.0000
Table 6: Thresholds on the x and y-values of the Gompertz curve, which assist in interpreting the robustness of a NN model. j i with growth-rate and inflection point parameters bi , ci For two curves fnorm and fnorm and bj , cj , respectively, define the raw crossing point
x∗ij =
bi ci − bj cj , bi − bj
bi ̸= bj ,
(9)
j i (x) = fnorm (x) when bi ̸= bj . which is the solution x∗ij to fnorm
To account for the relative growth rates of the curves, define the effective crossing fraction xeff as 1 − x∗ , if bi < bj , ij xeff = (10) x∗ , if bi > bj . ij
This ensures that the robustness correctly reflects the fraction of the interval over which j i fnorm (x) ≤ fnorm (x). The relative robustness index (or simply the robustness index) of curve i relative to curve j over the interval [0, 1], denoted by Rij , is then defined as Rij = max(0, min(1, xeff )).
(11)
j i Rij measures the fraction of the interval [0, 1] over which fnorm (x) ≤ fnorm (x) and captures all scenarios:
• Rij = 1: curve i is entirely below curve j (maximal robustness), • Rij = 0: curve i is entirely above curve j (no robustness), • 0 < Rij < 1: curve i crosses curve j, partial robustness over a subinterval of [0, 1].
12
In the special case when bi = bj , the curves differ only by a horizontal shift determined by the inflection points. In this case, since the Gompertz curve is strictly increasing, Rij is determined entirely by ci and cj , as follows: 1, if ci > cj , Rij = 0, if ci < cj , (12) 1, if ci = cj (by convention). We can then define overall robustness index, denoted by Gi , as Gi =
1 X Rij , κ−1
(13)
j̸=i
where κ is the total number of curves being analysed. This index is normalised to the unit interval [0, 1] and captures both full, over [0, 1], and partial robustness over a subinterval of [0, 1]. Gi = 1 indicates that curve i is more robust than all other curves over the full interval [0, 1], while 0 < Gi < 1 reflects the average robustness over only part of the domain. In Table 7 we present the robustness relationships between the curves for the five data sets and demonstrate this with the fitted data, and in Table 8 we present the overall robustness index for the data sets indicating which i is assigned to which data set. i
j
bi
ci
bj
cj
Rij
1 1 1 1 2 2 2 3 3 4 4 4 5 5 5 5
2 3 4 5 3 4 5 4 5 2 3 5 1 2 3 4
1.7122 1.7122 1.7122 1.7122 2.042 2.042 2.0420 2.8214 2.8214 1.2998 1.2998 1.2998 4.541 4.541 4.541 4.541
0.9701 0.9701 0.9701 0.9701 0.7317 0.7317 0.7317 0.5018 0.5018 0.7045 0.7045 0.7045 0.3991 0.3991 0.3991 0.3991
2.042 2.8214 1.2998 4.541 2.8214 1.2998 4.541 1.2998 4.541 2.0420 2.8214 4.5410 1.7122 2.0420 2.8214 1.2998
0.7317 0.5018 0.7045 0.3991 0.5018 0.7045 0.3991 0.7045 0.3991 0.7317 0.5018 0.3991 0.9701 0.7317 0.5018 0.7045
1 1 1 0.9471 1 0.78 0.873 0.329 0.7742 0.22 0.671 0.723 0.053 0.127 0.226 0.277
Table 7: Robustness relationships between normalized Gompertz curves using parameters with 4 decimal points precision. All pairs with Rij > 0 are included. Rows are ordered so that curve i is more robust (lies below) relative to curve j. The robustness index, Rij , j i measures the fraction of the interval [0, 1] over which fnorm (x) ≤ fnorm (x). 13
Data set
i
Gi
Deaths from Cancer Flu Vaccination Rates Heart Disease Breast Cancer MNIST
1 2 3 4 5
0.9866 0.6633 0.2758 0.4035 0.1708
Table 8: Overall robustness index Gi computed from the full Rij table. Gi measures the average fraction of the interval [0, 1] over which curve i is more robust (lies below) relative to the other curves. Higher Gi indicates greater robustness. A clear hierarchy of the curves’ robustness relative to each other emerges from Tables 7 and 8. It can be seen that Deaths from Cancer is the most robust, since the curves for the other data sets are completely above it, apart from MNIST curve which almost fully above it. Second, Flu vaccination rates, which is more robust than Heart Disease and to a large degree more robust than Breast Cancer and MNIST. Third, Heart disease is to a large degree more robust than MNIST but less robust than Breast Cancer, while Breast Cancer is to a large degree more robust than both Heart disease and MNIST. Finally, MNIST is the least robust relative to the other data sets. Then, where > means more robust than, the following hierarchy arises in the interval [0, 1] between the data sets, 1 > 2 > 4 > 3 > 5.
6
(14)
Concluding remarks
We have presented a method for quantifying the robustness of a trained neural network model when its inputs are perturbed with Gaussian noise. Given a trained neural network, NN and standard deviation σ, ρ(σ, α, NN), defined in (3), gives us the robustness of the NN, with Gauassian perturbation, N (0, σ 2 ), and significance level, α. The robustness, ρ(σ, α, NN), is then approximated with Algorithm 1. We have then described detailed experimentation using five real-world data sets trained with FNNs, showing how the robustness method we have presented can be put into practice. In Table 6 we showed that using a user-defined threshold of twice the baseline MSE for the regression data sets (Deaths from Cancer and Flu vaccination rates), while for the classification data sets (Heart disease, Breast Cancer and MNIST) setting the threshold at the knee point will assist in interpreting the robustness of the NN model. Furthermore, building on Tables 7 and 8 using robustness curves we were able to show in (14) the following hierarchy between the data sets, Death from Cancer > Flu vaccination rates > Breast Cancer > Heart disease > MNIST. It is important to validate the method presented herein on additional real-world data sets with a variety of machine learning models. Finally, an area of ongoing research is the extension of our notion of robustness to variational autoencoders (VAEs) [KW19], which are a type of generative neural network model, which include a probabilistic latent space.
14
A
Figures of the Gompertz curves and tables of fitted parameters for the data sets
Figure 3: Gompertz fit of the robustness curve for the Deaths from Cancer data set.
p
a
b
c
d
half slope
knee
R2
1
241.8389
1.7122
0.9701
6.137 × 1017
0.6676
0.4079
0.9993
Table 9: Gompertz fitted parameters for the robustness curve of the Deaths from Cancer data set. Parameters a, b, c, d correspond to the four-parameter Gompertz model.
p
a
b
c
d
half slope
knee
R2
1
93.1385
2.042
0.7317
1.183 × 1016
0.4781
0.2604
0.9988
Table 10: Gompertz fitted parameters for the robustness curve of the Flu vaccination rates data set. Parameters a, b, c, d correspond to the four-parameter Gompertz model.
p
a
b
c
d
half slope
knee
R2
0.25 0.5 0.75 1
1.5177 1.819 2.0159 2.1674
2.4418 2.4774 2.6829 2.8214
0.5486 0.5492 0.529 0.5018
0.986 1.0331 1.0726 1.1031
0.3366 0.3401 0.336 0.3183
0.1545 0.1607 0.1703 0.1607
0.9932 0.9939 0.9945 0.9938
Table 11: Gompertz fitted parameters for the robustness curves of the Heart disease data set. Parameters a, b, c, d correspond to the four-parameter Gompertz model.
15
Figure 4: Gompertz fit of the robustness curve for the Flu vaccination rates data set.
Figure 5: Gompertz fit of the robustness curve for the Heart disease data set. p
a
b
c
d
half slope
knee
R2
0.25 0.5 0.75 1
4.5475 6.7899 8.6648 10.1129
1.5474 1.4159 1.3171 1.2998
0.693 0.7143 0.714 0.7045
0.8123 0.6044 0.3401 0.1536
0.3584 0.3486 0.3209 0.3062
0.071 0.0345 0 0
0.9981 0.9986 0.999 0.9991
Table 12: Gompertz fitted parameters for the robustness curves of the Breast Cancer data set. Parameters a, b, c, d correspond to the four-parameter Gompertz model. 16
Figure 6: Gompertz fit for the robustness curves of the Breast Cancer data set.
Figure 7: Gompertz fit of the robustness curves for the MNIST data set. p
a
b
c
d
half slope
knee
R2
0.25 0.5 0.75 1
7.5501 17.6289 24.9933 31.3285
2.5148 3.8178 4.4781 4.5410
0.7162 0.5563 0.4562 0.3991
1.003 1.0419 0.9194 0.5594
0.5103 0.4206 0.3406 0.2851
0.3335 0.3042 0.2413 0.1872
0.9999 0.9999 0.9997 0.9991
Table 13: Gompertz fitted parameters for the robustness curves of the MNIST data set. Parameters a, b, c, d correspond to the four-parameter Gompertz model. 17
References [Agg18]
C.C. Aggarawal. Neural Networks and Deep Learning: A Textbook. Springer International Publishing, Cham, Switzerland, 2018.
[ARV09]
C. Alippi, M. Roveri, and G. Vanini. Robustness in neural networks. In M. Khosrow-Pour, editor, Encyclopedia of Information Science and Technology, pages 3314–3321. IGI Global, Hershey, PA, second edition, 2009.
[Asg24]
E. Asgarov. A comprehensive analysis of machine learning techniques for heart disease prediction. Open Access Library Journal, 11:1–17, 2024.
[BBB+ 25] A. Balendran, C. Beji, F. Bouvier, O. Khalifa, et al. A scoping review of robustness concepts for machine learning in healthcare. npj Digital Medicine, 8(Article number 38):9 pages, 2025. [BSI19]
A. Baldominos, Y. Saez, and P. Isasi. A survey of handwritten character recognition with MNIST and EMNIST. Applied Sciences, 9:Article 3169, 16 pages, 2019.
[CD14]
T. Chai and R.R. Draxler. Root mean square error (RMSE) or mean absolute error (MAE)? – Arguments against avoiding RMSE in the literature. Geoscientific Model Development, 7:1247–1250, 2014.
[Cle98]
Cleveland. Heart Disease. https://archive.ics.uci.edu/dataset/45/heart+ disease, 1998. UCI Machine Learning Repository.
[CWJ21] D. Chicco, M.J. Warrens, and G. Jurman. The coefficient of determination Rsquared is more informative than SMAPE, MAE, MAPE, MSE and RMSE in regression analysis evaluation. PeerJ Computer Science, 7:e623, 2021. [HB21]
L. Hui and M. Belkin. Evaluation of neural architectures trained with square loss vs cross-entropy in classification tasks. Machine Learning Archive, arXiv:2006.07322 [cs.LG], 2021.
[HCC19]
T. Huster, C.-Y.J. Chiang, and R. Chadha. Limitations of the Lipschitz constant as a defense against adversarial examples. In Proceedings of ECML PKDD 2018 Workshops, European Conference on Machine Learnin Principles and Practice of Knowledge Discovery in Databases (ECML PKDD), pages 16–29, Dublin, 2019.
[Hoe26]
L. Hoessly. On misconceptions about the Brier score in binary prediction models. Global Epidemiology, 11:Article 100242, 8 pages, 2026.
[Ial19]
C. Ialongo. Confidence interval for quantiles and percentiles. Biochemia Medica, 29:5–17, 2019.
[JS11]
N. Japkowicz and M. Shah. Evaluating learning algorithms: A classification perspective. Cambridge University Press, Cambridge, UK, 2011.
[Kag19]
Kaggle Community. MNIST Dataset: The MNIST database of handwritten digits. www.kaggle.com/datasets/hojjatk/mnist-dataset, 2019. Accessed via Kaggle; see original data set [LBB98]. 18
[KW19]
D.P. Kingma and M. Welling. An introduction to variational autoencoders. Foundations and Trends in Information Retrieval, 12:307–392, 2019.
[LBB98]
Y. LeCun, L. Bottou, and Y. Bengio. Gradient-based learning applied to document recognition. Proceeding of the IEEE, 86:2278–2324, 1998.
[LH25]
M. Levene and M. Harris. Just Enough Data Science and Machine Learning: Essential Tools and Techniques. Addison-Wesley, Hoboken, NJ, 2025.
[LL25]
J. Li and G. Li. Triangular trade-off between robustness, accuracy, and fairness in deep neural networks: A survey. ACM Computing Surveys, 57:Article 140, 40 pages, 2025.
[MMS+ 18] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, et al. Towards deep learning models resistant to adversarial attacks. In Proceedings of the 6th International Conference on Learning Representations (ICLR), Vancouver, 2018. 23 pages. [OCB21]
J.M. Osborne, W. Cook, and M.J. Bossé. Quantifying the curvature of curves: an intuitive introduction to differential geometry. PRIMUS, Problems, Resources, and Issues in Mathematics Undergraduate Studies, 31:133–152, 2021.
[OEC26a] OECD. Deaths from Cancer in the USA from 1990 to 2020. www.oecd.org/en/ data/indicators/deaths-from-cancer.html, 2026. [OEC26b] OECD. Influenza Vaccination Rates in 2020 for 31 countries. www.oecd.org/en/ data/indicators/influenza-vaccination-rates.html, 2026. [Opt24]
J. Optiz. A closer look at classification evaluation metrics and a critical reflection of common evaluation practice. Transactions of the Association for Computational Linguistics, 12:820–836, 2024.
[PBVN24] A. Prakash R, A. Bhattacharyya, J. Vaughan, and V.N. Nair. Assessing robustness of machine learning models using covariate perturbations. Machine Learning Archive, arXiv:1908.02729 [stat.ML], 2024. [RI99]
Y. Raviv and N. Intrator. Variance reduction via noise and bias constraints. In A.J.C. Sharkey, editor, Combining Artificial Neural Nets: Ensemble and Modular Multi-Net Systems, Perspectives in Neural Computing, chapter 7, pages 163–178. Springer-Verlag, London, 1999.
[Ros23]
S.M. Ross. Simulation. Academic Press, London, UK, sixth edition, 2023.
[SFMR23] L. Scrucca, C. Fraley, T.B. Murphy, and A.E. Raftery. Model-based clustering, classification, and density estimation using mclust in R. Chapman & Hall/CRC, Boca Raton, FL, 2023. [SKD18]
A. Sharma, S. Kulshrestha, and S.B. Daniel. Machine learning approaches for cancer detection. International Journal of Engineering and Manufacturing, 8:45– 55, 2018.
[ŠS21]
J. Šircelj and D. Skočaj. Accuracy-perturbation curves for evaluation of adversarial attack and defence methods. In Proceedings of 25th International Conference on Pattern Recognition (ICPR), pages 6290–6297, Milan, Italy, 2021. 19
[SW03]
G.A.F. Seber and C.J. Wild. Nonlinear Regression. Wiley Series in Probability and Statistics. John Wiley & Sons, Hoboken, NJ, 2003.
[SZS+ 14] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, et al. Intriguing properties of neural networks. Computer Vision and Pattern Recognition Archive, arXiv:1312.6199v4 [cs.CV], 2014. [TT17]
K.M.C. Tjørve and E. Tjørve. The use of Gompertz models in growth analyses, and new Gompertz-model approach: An addition to the unified-Richards family. PLoS ONE, 12(6):e0178691, 2017.
[Wis95]
Diagnostic Wisconsin. Breast Cancer. https://archive.ics.uci.edu/dataset/ 17/breast+cancer+wisconsin+diagnostic, 1995. UCI Machine Learning Repository.
[ZJPD09] R.M. Zur, Y. Jiang, L.L. Pesce, and K. Drukker. Noise injection for training artificial neural networks: A comparison with weight decay and early stopping. Medical Physics, 36:4810–4818, 2009. [ZK25]
M.-M. Zühlke and D. Kundenko. Adversarial robustness of neural networks from the perspective of Lipschitz calculus: A survey. ACM Computing Surveys, 57:Article 142, 41 pages, 2025.
20