一句话：提出 MajorCert，通过检查多数不变式来认证深度模型对补丁扰动的鲁棒性。
现有补丁鲁棒性认证要求样本在分类器层面或补丁区域层面满足严格条件，导致不少样本无法被认证。本文提出 MajorCert：首先针对同一样本、同一补丁区域，找出所有可能被操纵的标签集合；然后对这些集合逐元素枚举组合；最后检查这些组合的多数不变式是否保持完整，以完成认证。该方法放宽了现有技术对分类器或补丁区域级严格条件的依赖，从而有望认证更多样本。摘要未报告具体数据集、基线或实验结果。
Patch robustness certification ensures no patch within a given bound on a sample can manipulate a deep learning model to predict a different label. However, existing techniques cannot certify samples that cannot meet their strict bars at the classifier level or the patch region level. This paper proposes MajorCert. MajorCert firstly finds all possible label sets manipulatable by the same patch region on the same sample across the underlying classifiers, then enumerates their combinations element-wise, and finally checks whether the majority invariant of all these combinations is intact to certify samples.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2308-00452,
title = {A Majority Invariant Approach to Patch Robustness Certification for Deep Learning Models},
author = {Qilin Zhou and Zhengyuan Wei and Haipeng Wang and W.K. Chan},
booktitle = {ASE},
year = {2023},
doi = {10.1109/ase56229.2023.00137}
}