We know that we can measure a model’s robustness to perturbation by applying perturbation to training points and checking if the outputs are the same:

The lp ball around an image is said to be the adversarial ball, and a network is said to be E-robust around x if every point in the adversarial ball around x classifies the same. source, Part 3

But how is this done concretely?