Abstract
Deep Neural Networks are vulnerable to small perturbations that can drastically alter their predictions for perceptually unchanged inputs. The literature on adversarially robust Deep Learning attempts to either enhance the robustness of neural networks (e.g, via adversarial training) or to certify their decisions up to a given robustness level (e.g, by using randomized smoothing, formal methods or Lipschitz bounds). These studies mostly focus on classification tasks and few efficient certification procedures currently exist for semantic segmentation. In this work, we introduce a new class of certifiably robust Semantic Segmentation networks with built-in Lipschitz constraints that are efficiently trainable and achieve competitive pixel accuracy on challenging datasets such as Cityscapes. Additionally, we provide a novel framework that generalizes robustness certificates for semantic segmentation tasks, where we showcase the flexibility and computational efficiency of using Lipschitz networks. Our approach unlocks real-time compatible certifiably robust semantic segmentation for the first time. Moreover, it allows the computation of worst-case performance under $\ell_2$ attacks of radius $\epsilon$ across a wide range of performance measures. Crucially, we benchmark the runtime of our certification process and find our approach to be around 600 times faster than randomized smoothing methods at inference with comparable certificates on an NVIDIA A100 GPU. Finally, we evaluate the tightness of our worstcase certificates against state-of-the-art adversarial attacks to further validate the performance of our method.
Abstract (translated)
深度神经网络容易受到细微扰动的影响，这些扰动虽然对输入图像的感知影响不大，但可能大幅改变其预测结果。对抗性鲁棒深度学习的研究领域致力于增强神经网络的鲁棒性（例如通过对抗训练）或认证其在特定鲁棒水平下的决策（例如使用随机平滑、形式方法或Lipschitz界）。这类研究主要集中在分类任务上，而对于语义分割任务的有效认证程序则很少见。在这项工作中，我们引入了一类新的可证式稳健的语义分割网络，这些网络内置了Lipschitz约束，并且可以高效地训练，在如Cityscapes等具有挑战性的数据集上达到了竞争性的像素精度。 此外，我们提供了一个新颖的框架，该框架将鲁棒性证书推广到了语义分割任务中，并展示了使用Lipschitz网络时的灵活性和计算效率。我们的方法首次实现了与实时兼容的可证式稳健的语义分割。它还允许在整个性能度量范围内对$\ell_2$攻击半径为$\epsilon$下的最坏情况性能进行计算。 至关重要的是，我们基准测试了认证过程的运行时间，并发现在NVIDIA A100 GPU上与随机平滑方法相比，我们的方法在推理时大约快600倍且证书相当。最后，我们将最差情况下的证书紧度与最先进的对抗性攻击进行了评估，进一步验证了该方法的有效性能。
URL
https://arxiv.org/abs/2512.06010
