Their definition of robustness relies on a pre-specified choice of which set of perturbations to be "robust" to. They use the letter delta for this set in the p

Their definition of robustness relies on a pre-specified choice of which set of perturbations to be "robust" to. They use the letter delta for this set in the paper, IIRC. This is where the "human" bit comes in: to define robustness in the abstract you would have to establish which perturbations "should" change the categorisation and which ones "shouldn't", which they avoid attempting to do.