Efficient Certification of Spatial Robustness

Abstract

Recent work has exposed the vulnerability of computer vision models to spatial transformations. Due to the widespread usage of such models in safety-critical applications, it is crucial to quantify their robustness against spatial transformations. However, existing work only provides empirical quantification of spatial robustness via adversarial attacks, which lack provable guarantees. In this work, we propose novel convex relaxations, which enable us, for the first time, to provide a certificate of robustness against spatial transformations. Our convex relaxations are model-agnostic and can be leveraged by a wide range of neural network verifiers. Experiments on several network architectures and different datasets demonstrate the effectiveness and scalability of our method.

DeformRS: Certifying Input Deformations with Randomized Smoothing

“…Recently, several popular geometric transformations as well as other transformations, such as intensity contrast, were formulated as a piece-wise nonlinear layer (Mohapatra et al 2020), thus allowing for exact certification based on a tighter formulation of classical ℓ p certification solvers commonly used for additive perturbations. Moreover, recent work (Ruoss et al 2021) generated optimal intervals and certify them for general vector fields deformations. However, all previous methods either inherently suffer from scalability limitations, or that they cannot certify a composition of transformations jointly.…”

“…2019; Mohapatra et al 2020). Only recently has a certification approach been developed for the richer class of smooth vector fields (general displacement of pixels) (Ruoss et al 2021). However, all previous approaches require solving a mixed-integer or linear program, thus limiting their applicability to small DNNs on small datasets.…”

Auditing AI models for Verified Deployment under Semantic Specifications

“…These approaches have largely showed robustness and verification to norm bounded adversarial perturbations without trying to verify with respect to more semantically aligned properties of the input. Some papers [72][73][74] consider semantic perturbations like rotation, translation, occlusion, brightness change etc. directly in the pixel space, so the range of semantic variations that can be considered are more limited.…”