3D computer vision models are commonly used in security-critical applications
such as autonomous driving and surgical robotics. Emerging concerns over the
robustness of these models against real-world deformations must be addressed
practically and reliably. In this work, we propose 3DeformRS, a method to
certify the robustness of point cloud Deep Neural Networks (DNNs) against
real-world deformations. We developed 3DeformRS by building upon recent work
that generalized Randomized Smoothing (RS) from pixel-intensity perturbations
to vector-field deformations. In particular, we specialized RS to certify DNNs
against parameterized deformations (e.g. rotation, twisting), while enjoying
practical computational costs. We leverage the virtues of 3DeformRS to conduct
a comprehensive empirical study on the certified robustness of four
representative point cloud DNNs on two datasets and against seven different
deformations. Compared to previous approaches for certifying point cloud DNNs,
3DeformRS is fast, scales well with point cloud size, and provides
comparable-to-better certificates. For instance, when certifying a plain
PointNet against a 3{\deg} z-rotation on 1024-point clouds, 3DeformRS grants a
certificate 3x larger and 20x faster than previous work.

本文提出 3DeformRS 方法，针对点云深度神经网络现实世界变形的鲁棒性问题，通过证明其对可参数化变形的鲁棒性进行认证，得出对四个点云深度神经网络在两个数据集和七种不同变形下的综合实验研究，证明 3DeformRS 相对以往方法更快、规模更大且提供有效证书。

3DeformRS：基于点云的空间变形认证

3DeformRS: Certifying Spatial Deformations on Point Clouds

Top-k predictions are used in many real-world applications such as machine
learning as a service, recommender systems, and web searches. $\ell_0$-norm
adversarial perturbation characterizes an attack that arbitrarily modifies some
features of an input such that a classifier makes an incorrect prediction for
the perturbed input. $\ell_0$-norm adversarial perturbation is easy to
interpret and can be implemented in the physical world. Therefore, certifying
robustness of top-$k$ predictions against $\ell_0$-norm adversarial
perturbation is important. However, existing studies either focused on
certifying $\ell_0$-norm robustness of top-$1$ predictions or $\ell_2$-norm
robustness of top-$k$ predictions. In this work, we aim to bridge the gap. Our
approach is based on randomized smoothing, which builds a provably robust
classifier from an arbitrary classifier via randomizing an input. Our major
theoretical contribution is an almost tight $\ell_0$-norm certified robustness
guarantee for top-$k$ predictions. We empirically evaluate our method on
CIFAR10 and ImageNet. For instance, our method can build a classifier that
achieves a certified top-3 accuracy of 69.2\% on ImageNet when an attacker can
arbitrarily perturb 5 pixels of a testing image.

本文介绍的方法，基于随机平滑技术，能够对 top-k 预测模型对 $\ell_0$-norm 对抗扰动具有几乎紧密的保证，并在 ImageNet 数据集上验证了该方法的有效性。

近乎紧致 L0 范数认证的 top-k 预测对抗扰动的稳健性

Almost Tight L0-norm Certified Robustness of Top-k Predictions against  Adversarial Perturbations

Finding minimum distortion of adversarial examples and thus certifying
robustness in neural network classifiers for given data points is known to be a
challenging problem. Nevertheless, recently it has been shown to be possible to
give a non-trivial certified lower bound of minimum adversarial distortion, and
some recent progress has been made towards this direction by exploiting the
piece-wise linear nature of ReLU activations. However, a generic robustness
certification for general activation functions still remains largely
unexplored. To address this issue, in this paper we introduce CROWN, a general
framework to certify robustness of neural networks with general activation
functions for given input data points. The novelty in our algorithm consists of
bounding a given activation function with linear and quadratic functions, hence
allowing it to tackle general activation functions including but not limited to
four popular choices: ReLU, tanh, sigmoid and arctan. In addition, we
facilitate the search for a tighter certified lower bound by adaptively
selecting appropriate surrogates for each neuron activation. Experimental
results show that CROWN on ReLU networks can notably improve the certified
lower bounds compared to the current state-of-the-art algorithm Fast-Lin, while
having comparable computational efficiency. Furthermore, CROWN also
demonstrates its effectiveness and flexibility on networks with general
activation functions, including tanh, sigmoid and arctan.

该论文介绍了一种名为 CROWN 的通用框架，可以证明具有一般激活函数的神经网络分类器对于给定的输入数据点是健壮的，通过绑定给定激活函数的线性和二次函数，从而可以处理包括但不限于 ReLU、tanh、sigmoid 和 arctan 在内的一般激活函数，同时在可比的计算效率下，在 ReLU 网络上 CROWN 可以显着提高认证下限，同时 CROWN 能够展示其对包括 tanh、sigmoid 和 arctan 在内的具有一般激活函数的网络的有效性和灵活性。