🤖 AI Summary
This work addresses the vulnerability of vision models to convolutional perturbations—such as motion blur—at inference time, which poses significant security risks. The paper introduces the first provably robust certified training method against such perturbations by efficiently encoding convolutional distortions and integrating them into a formal verification framework, thereby overcoming the theoretical limitations of conventional empirical data augmentation strategies. On CIFAR-10, the proposed approach achieves over 80% robust accuracy against realistic levels of motion blur while maintaining standard accuracy comparable to baseline models. To the best of our knowledge, this is the first method to enable provably robust training against convolutional perturbations.
📝 Abstract
Vision models have been found to be susceptible to perturbations such as motion blur induced at runtime by a shaking camera. This impedes their deployment in critical applications since phenomena such as slightly blurred vision might lead to failures, for example an object detector missing objects. While methods such as data augmentation or Adversarial Training can improve empirical robustness, they lack formal safety guarantees, making it difficult to identify and mitigate hidden vulnerabilities. We introduce a novel Certified Training approach that leverages an efficient encoding of convolutional perturbations to train provably robust models. Our method significantly outperforms Adversarial Training, achieving, for example, over 80% robust accuracy against motion blur of reasonable intensity on CIFAR10 while maintaining comparable standard accuracy.