Verification of Neural Networks against Convolutional Perturbations via Parameterised Kernels

TL;DR

This paper presents a novel method for verifying neural network robustness against convolutional perturbations like blurring and sharpening by using parameterised kernels and input splitting, achieving tight bounds and safety certificates.

Contribution

It introduces a linear parameterisation of convolutional kernels for efficient verification of neural networks against specific perturbations, enabling the first robustness verification against camera shake.

Findings

Verified robustness on standard benchmarks where baseline methods failed

Achieved tight bounds and high effectiveness in verification

First to verify against convolutional perturbations like camera shake

Abstract

We develop a method for the efficient verification of neural networks against convolutional perturbations such as blurring or sharpening. To define input perturbations we use well-known camera shake, box blur and sharpen kernels. We demonstrate that these kernels can be linearly parameterised in a way that allows for a variation of the perturbation strength while preserving desired kernel properties. To facilitate their use in neural network verification, we develop an efficient way of convolving a given input with these parameterised kernels. The result of this convolution can be used to encode the perturbation in a verification setting by prepending a linear layer to a given network. This leads to tight bounds and a high effectiveness in the resulting verification step. We add further precision by employing input splitting as a branch and bound strategy. We demonstrate that we are able to verify robustness on a number of standard benchmarks where the baseline is unable to provide any safety certificates. To the best of our knowledge, this is the first solution for verifying robustness against specific convolutional perturbations such as camera shake.