Provable Defense Against Geometric Transformations
This addresses the critical need for certifiably robust DNNs against real-world geometric perturbations, with incremental improvements in speed and application to autonomous driving.
The paper tackles the problem of deep neural networks being vulnerable to geometric image transformations like scaling and rotation by proposing the first provable defense for deterministic certified geometric robustness, achieving state-of-the-art robustness and clean accuracy across multiple datasets and verifying robustness in autonomous driving.
Geometric image transformations that arise in the real world, such as scaling and rotation, have been shown to easily deceive deep neural networks (DNNs). Hence, training DNNs to be certifiably robust to these perturbations is critical. However, no prior work has been able to incorporate the objective of deterministic certified robustness against geometric transformations into the training procedure, as existing verifiers are exceedingly slow. To address these challenges, we propose the first provable defense for deterministic certified geometric robustness. Our framework leverages a novel GPU-optimized verifier that can certify images between 60$\times$ to 42,600$\times$ faster than existing geometric robustness verifiers, and thus unlike existing works, is fast enough for use in training. Across multiple datasets, our results show that networks trained via our framework consistently achieve state-of-the-art deterministic certified geometric robustness and clean accuracy. Furthermore, for the first time, we verify the geometric robustness of a neural network for the challenging, real-world setting of autonomous driving.