The objective of neural network (NN) robustness certification is to determine
if a NN changes its predictions when mutations are made to its inputs. While
most certification research studies pixel-level or a few geometrical-level and
blurring operations over images, this paper proposes a novel framework, GCERT,
which certifies NN robustness under a precise and unified form of diverse
semantic-level image mutations. We formulate a comprehensive set of
semantic-level image mutations uniformly as certain directions in the latent
space of generative models. We identify two key properties, independence and
continuity, that convert the latent space into a precise and analysis-friendly
input space representation for certification. GCERT can be smoothly integrated
with de facto complete, incomplete, or quantitative certification frameworks.
With its precise input space representation, GCERT enables for the first time
complete NN robustness certification with moderate cost under diverse
semantic-level input mutations, such as weather-filter, style transfer, and
perceptual changes (e.g., opening/closing eyes). We show that GCERT enables
certifying NN robustness under various common and security-sensitive scenarios
like autonomous driving.

该论文提出了一种新的框架 GCERT，可根据语义层面的图像变异准确地验证神经网络的鲁棒性，并通过生成模型的潜在空间中的方向将全面的语义层面的图像变异一致地表示为整体，以获得精确的分析友好的输入空间表示，同时大大缩短了鲁棒性认证的时间成本。