\section{Related Work}

\textbf{Adversarial robustness.} Prior works have proposed methods to generate adversarial attacks \cite{carlini2017towards, goodfellow2014explaining, moosavi2016deepfool}, which find adversarial perturbations in a local region around a point. In contrast, this work investigates average-case robustness, which calculates the probability that a model’s prediction remains consistent in a local region around a point. Prior works have also proposed methods to certify model robustness \cite{cohen2019certified, carlini2022certified}, guaranteeing the lack of adversarial examples for a given $\epsilon$-ball under certain settings. Specifically, \citet{cohen2019certified} propose randomized smoothing, which involves computing class-wise average-case robustness, which is taken as the output probabilities of the randomized smoothed model. However, they estimate these probabilities via Monte Carlo sampling with $n=100,000$ samples, which is computationally expensive. Viewing average-case robustness from the lens of randomized smoothing, our estimators can also be seen as providing an analytical estimate of randomized smoothed models. However, in this work, we focus on their applications for model understanding and debugging as opposed to improving robustness.


\textbf{Probabilistic robustness.} Prior works have explored notions of probabilistic and average-case robustness.
% but they differ from our work in the generality of the problems considered. 
For instance, \citet{fazlyab2019probabilistic, kumar2020certifying, mangal2019robustness} focus on certifying robustness of real-valued outputs to input perturbations. In contrast, this work focuses on only those output changes that cause misclassification. Like our work, \citet{franceschi2018robustness} also considers misclassifications. However, \citet{franceschi2018robustness} aims to find the smallest neighborhood with no adversarial example, while we compute the probability of misclassification in a given neighborhood. \citet{robey2022probabilistically, rice2021robustness} also aim to compute average-case robustness. However, they do so by computing the average loss over the neighborhood, while we use the misclassification rate. Closest to our work is the work by \citet{weng2019proven} which aims to certify the binary misclassification rate (with respect to a specific class to misclassify to) using lower and upper linear bounds. In contrast, our work estimates the multi-class misclassification rate, as opposed to bounding the quantity in a binary setting. A crucial contribution of our work is its applicability to multi-class classification and the emphasis on estimating, rather than bounding, robustness. 


\textbf{Robustness to distributional shifts.} 
Prior works have explored the performance of models under various distributions shifts~\cite{taori2020measuring, ovadia2019can}. From the perspective of distribution shift, average-case robustness can be seen as a measure of model performance under Gaussian noise, a type of natural distribution shift. In addition, in contrast to works in distributional robustness which seek to build models that are robust to distributions shifts~\cite{thulasidasan2021effective, moayeri2022explicit}, this work focuses on measuring the vulnerability of existing models to Gaussian distribution shifts.
