The robustness of deep neural networks is crucial for safety-critical deployments, yet existing evaluation methods are often attack-dependent and lack interpretability. We propose a principled, attack-agnostic robustness metric based on the spectral norm of the Fisher Information Matrix (FIM), which quantifies the worst-case sensitivity of the model's output distribution to input perturbations. Theoretically, we establish that the FIM equals the variance of the input Jacobian and derive closed-form spectral bounds for common architectures, including VGG, ResNet, DenseNet, and Transformer, providing the first theoretical robustness ranking. To enable scalable evaluation, we develop efficient algorithms, including power iteration and Hutchinson-based estimation, that support both white-box and black-box settings. Extensive experiments across multiple datasets, including CIFAR, ImageNet, and medical images, and across multiple architectures show a strong correlation between our metric and adversarial vulnerability. Our framework serves as an interpretable diagnostic tool that complements attack-based evaluations, offering insights into architectural sensitivity and guiding the design of more robust models.</p>\n","updatedAt":"2026-06-08T15:44:28.339Z","author":{"_id":"64911d8e0c18343a09439842","avatarUrl":"/avatars/7a04270e1c45b552689db8bc39105ba3.svg","fullname":"FranzChang","name":"pcczc15","type":"user","isPro":false,"isHf":false,"isHfAdmin":false,"isMod":false,"followerCount":1,"isUserFollowing":false}},"numEdits":0,"identifiedLanguage":{"language":"en","probability":0.9048064947128296},"editors":["pcczc15"],"editorAvatarUrls":["/avatars/7a04270e1c45b552689db8bc39105ba3.svg"],"reactions":[],"isReport":false}}],"primaryEmailConfirmed":false,"paper":{"id":"2606.04767","authors":[{"_id":"6a26e2f5da05d61ad5d10d9f","name":"Chong Zhang","hidden":false},{"_id":"6a26e2f5da05d61ad5d10da0","name":"Xiang Li","hidden":false},{"_id":"6a26e2f5da05d61ad5d10da1","name":"Jia Wang","hidden":false},{"_id":"6a26e2f5da05d61ad5d10da2","name":"Qiufeng Wang","hidden":false},{"_id":"6a26e2f5da05d61ad5d10da3","name":"Xiaobo Jin","hidden":false}],"publishedAt":"2026-06-03T00:00:00.000Z","submittedOnDailyAt":"2026-06-08T00:00:00.000Z","title":"Measuring Model Robustness via Fisher Information: Spectral Bounds, Theoretical Guarantees, and Practical Algorithms","submittedOnDailyBy":{"_id":"64911d8e0c18343a09439842","avatarUrl":"/avatars/7a04270e1c45b552689db8bc39105ba3.svg","isPro":false,"fullname":"FranzChang","user":"pcczc15","type":"user","name":"pcczc15"},"summary":"The robustness of deep neural networks is crucial for safety-critical deployments, yet existing evaluation methods are often attack-dependent and lack interpretability. We propose a principled, attack-agnostic robustness metric based on the spectral norm of the Fisher Information Matrix (FIM), which quantifies the worst-case sensitivity of the model's output distribution to input perturbations. Theoretically, we establish that the FIM equals the variance of the input Jacobian and derive closed-form spectral bounds for common architectures, including VGG, ResNet, DenseNet, and Transformer, providing the first theoretical robustness ranking. To enable scalable evaluation, we develop efficient algorithms, including power iteration and Hutchinson-based estimation, that support both white-box and black-box settings. Extensive experiments across multiple datasets, including CIFAR, ImageNet, and medical images, and across multiple architectures show a strong correlation between our metric and adversarial vulnerability. Our framework serves as an interpretable diagnostic tool that complements attack-based evaluations, offering insights into architectural sensitivity and guiding the design of more robust models. Code is available at: https://github.com/franz-chang/SRP/.","upvotes":1,"discussionId":"6a26e2f5da05d61ad5d10da4","githubRepo":"https://github.com/franz-chang/SRP","githubRepoAddedBy":"user","ai_summary":"A novel attack-agnostic robustness metric based on Fisher Information Matrix spectral norm is proposed, providing theoretical bounds and scalable evaluation methods for deep neural network robustness assessment.","ai_keywords":["Fisher Information Matrix","spectral norm","adversarial vulnerability","input Jacobian","power iteration","Hutchinson-based estimation","VGG","ResNet","DenseNet","Transformer"],"ai_summary_model":"Qwen/Qwen2.5-Coder-32B-Instruct","githubStars":1,"organization":{"_id":"650e52bc88cdfe73a84f59b5","name":"XJTLU-AI","fullname":"XJTLU Student AI Lab","avatar":"https://cdn-avatars.huggingface.co/v1/production/uploads/649b307f8302704b3c2b9ff0/6wILn5XTXuhNAxn_eZUBb.png"}},"canReadDatabase":false,"canManagePapers":false,"canSubmit":false,"hasHfLevelAccess":false,"upvoted":false,"upvoters":[{"_id":"64911d8e0c18343a09439842","avatarUrl":"/avatars/7a04270e1c45b552689db8bc39105ba3.svg","isPro":false,"fullname":"FranzChang","user":"pcczc15","type":"user"}],"acceptLanguages":["en"],"dailyPaperRank":0,"organization":{"_id":"650e52bc88cdfe73a84f59b5","name":"XJTLU-AI","fullname":"XJTLU Student AI Lab","avatar":"https://cdn-avatars.huggingface.co/v1/production/uploads/649b307f8302704b3c2b9ff0/6wILn5XTXuhNAxn_eZUBb.png"},"markdownContentUrl":"https://huggingface.co/buckets/huggingchat/papers-content/resolve/2606/2606.04767.md"}">
Measuring Model Robustness via Fisher Information: Spectral Bounds, Theoretical Guarantees, and Practical Algorithms
Abstract
A novel attack-agnostic robustness metric based on Fisher Information Matrix spectral norm is proposed, providing theoretical bounds and scalable evaluation methods for deep neural network robustness assessment.
The robustness of deep neural networks is crucial for safety-critical deployments, yet existing evaluation methods are often attack-dependent and lack interpretability. We propose a principled, attack-agnostic robustness metric based on the spectral norm of the Fisher Information Matrix (FIM), which quantifies the worst-case sensitivity of the model's output distribution to input perturbations. Theoretically, we establish that the FIM equals the variance of the input Jacobian and derive closed-form spectral bounds for common architectures, including VGG, ResNet, DenseNet, and Transformer, providing the first theoretical robustness ranking. To enable scalable evaluation, we develop efficient algorithms, including power iteration and Hutchinson-based estimation, that support both white-box and black-box settings. Extensive experiments across multiple datasets, including CIFAR, ImageNet, and medical images, and across multiple architectures show a strong correlation between our metric and adversarial vulnerability. Our framework serves as an interpretable diagnostic tool that complements attack-based evaluations, offering insights into architectural sensitivity and guiding the design of more robust models. Code is available at: https://github.com/franz-chang/SRP/.
Community
The robustness of deep neural networks is crucial for safety-critical deployments, yet existing evaluation methods are often attack-dependent and lack interpretability. We propose a principled, attack-agnostic robustness metric based on the spectral norm of the Fisher Information Matrix (FIM), which quantifies the worst-case sensitivity of the model's output distribution to input perturbations. Theoretically, we establish that the FIM equals the variance of the input Jacobian and derive closed-form spectral bounds for common architectures, including VGG, ResNet, DenseNet, and Transformer, providing the first theoretical robustness ranking. To enable scalable evaluation, we develop efficient algorithms, including power iteration and Hutchinson-based estimation, that support both white-box and black-box settings. Extensive experiments across multiple datasets, including CIFAR, ImageNet, and medical images, and across multiple architectures show a strong correlation between our metric and adversarial vulnerability. Our framework serves as an interpretable diagnostic tool that complements attack-based evaluations, offering insights into architectural sensitivity and guiding the design of more robust models.
Upload images, audio, and videos by dragging in the text input, pasting, or clicking here.
Tap or paste here to upload images
Cite arxiv.org/abs/2606.04767 in a model README.md to link it from this page.
Cite arxiv.org/abs/2606.04767 in a dataset README.md to link it from this page.
Cite arxiv.org/abs/2606.04767 in a Space README.md to link it from this page.
Discussion (0)
Sign in to join the discussion. Free account, 30 seconds — email code or GitHub.
Sign in →No comments yet. Sign in and be the first to say something.