Patch robustness certification is an emerging kind of defense technique
against adversarial patch attacks with provable guarantees. There are two
research lines: certified recovery and certified detection. They aim to label
malicious samples with provable guarantees correctly and issue warnings for
malicious samples predicted to non-benign labels with provable guarantees,
respectively. However, existing certified detection defenders suffer from
protecting labels subject to manipulation, and existing certified recovery
defenders cannot systematically warn samples about their labels. A certified
defense that simultaneously offers robust labels and systematic warning
protection against patch attacks is desirable. This paper proposes a novel
certified defense technique called CrossCert. CrossCert formulates a novel
approach by cross-checking two certified recovery defenders to provide
unwavering certification and detection certification. Unwavering certification
ensures that a certified sample, when subjected to a patched perturbation, will
always be returned with a benign label without triggering any warnings with a
provable guarantee. To our knowledge, CrossCert is the first certified
detection technique to offer this guarantee. Our experiments show that, with a
slightly lower performance than ViP and comparable performance with PatchCensor
in terms of detection certification, CrossCert certifies a significant
proportion of samples with the guarantee of unwavering certification.

该论文介绍了一种新型的认证防御技术 CrossCert，通过交叉检查两个认证恢复防御器，提供稳健的认证和检测认证，以确保一个经过认证的样本在受到修补扰动的情况下始终返回 benign 标签，并且不会触发任何警告，具有可证明的保证。