论文标题
可证明的防御几何变换
Provable Defense Against Geometric Transformations
论文作者
论文摘要
现实世界中出现的几何图像变换（例如缩放和旋转）已被证明很容易欺骗深度神经网络（DNNS）。因此，培训DNN对这些扰动有证实是鲁棒的，至关重要。但是，由于现有的验证符非常慢，因此没有先前的工作能够将针对几何转换的确定性认证鲁棒性纳入训练程序。为了应对这些挑战，我们提出了第一个可证明的辩护，用于确定性认证的几何鲁棒性。我们的框架利用了一种新颖的GPU优化验证仪，该验证者可以比现有几何鲁棒性验证者快60美元$ \ times $至42,600 $ \ times $ $ \ times $ \ times $ \ times的验证器，因此与现有作品不同，足以用于训练。在多个数据集中，我们的结果表明，通过我们的框架训练的网络始终达到最新的确定性认证的几何鲁棒性和清洁准确性。此外，我们首次验证神经网络的几何鲁棒性，用于具有挑战性的自动驾驶的现实世界中。
Geometric image transformations that arise in the real world, such as scaling and rotation, have been shown to easily deceive deep neural networks (DNNs). Hence, training DNNs to be certifiably robust to these perturbations is critical. However, no prior work has been able to incorporate the objective of deterministic certified robustness against geometric transformations into the training procedure, as existing verifiers are exceedingly slow. To address these challenges, we propose the first provable defense for deterministic certified geometric robustness. Our framework leverages a novel GPU-optimized verifier that can certify images between 60$\times$ to 42,600$\times$ faster than existing geometric robustness verifiers, and thus unlike existing works, is fast enough for use in training. Across multiple datasets, our results show that networks trained via our framework consistently achieve state-of-the-art deterministic certified geometric robustness and clean accuracy. Furthermore, for the first time, we verify the geometric robustness of a neural network for the challenging, real-world setting of autonomous driving.
