A Majority Invariant Approach to Patch Robustness Certification for Deep Learning Models

TL;DR

This paper introduces MajorCert, a novel method for certifying the robustness of deep learning models against patch attacks by analyzing label set manipulations and majority invariance across classifiers.

Contribution

MajorCert is the first approach to certify samples by considering label set manipulations and majority invariance, overcoming limitations of existing strict certification methods.

Findings

Successfully certifies samples with complex patch manipulations

Outperforms existing robustness certification techniques

Provides a new perspective on patch robustness analysis

Abstract

Patch robustness certification ensures no patch within a given bound on a sample can manipulate a deep learning model to predict a different label. However, existing techniques cannot certify samples that cannot meet their strict bars at the classifier or patch region levels. This paper proposes MajorCert. MajorCert firstly finds all possible label sets manipulatable by the same patch region on the same sample across the underlying classifiers, then enumerates their combinations element-wise, and finally checks whether the majority invariant of all these combinations is intact to certify samples.