Before any robustness claim is made, the organisation defines the domain in which the neural network is meant to operate as a set of clearly defined attributes, so that the domain contains bounded objects; this is mandatory. The domain, once specified, should be enough for the system to perform the tasks intended for it, the training data should be representative of the data expected at inference, and each attribute should be given bounds inside the robustness specification. Attributes may be numerical (object shape, pixel intensity, signal amplitude) or non-numerical (words in a sentence, edges in a graph), and they are what allows a new instance of the domain to be generated from an existing one.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.