快速且灵活的语义分割鲁棒性证书
Fast and Flexible Robustness Certificates for Semantic Segmentation
AI总结：
本文提出了一种快速且灵活的可认证鲁棒语义分割网络，通过内置的Lipschitz约束实现高效训练和实时兼容的鲁棒性认证。
摘要：
深度神经网络对微小扰动易受攻击，这种扰动可能导致其预测发生剧烈变化，但输入在视觉上保持不变。对抗鲁棒深度学习文献试图通过对抗训练增强神经网络的鲁棒性，或通过随机平滑、形式方法或Lipschitz界来认证其决策。这些研究大多集中在分类任务上，目前针对语义分割的高效认证方法较少。在本文中，我们引入了一种新的可认证鲁棒语义分割网络，具有内置的Lipschitz约束，能够高效训练并在具有挑战性的数据集（如Cityscapes）上实现具有竞争力的像素准确率。此外，我们提供了一个新的框架，该框架可推广到语义分割任务的鲁棒性证书，展示了使用Lipschitz网络的灵活性和计算效率。我们的方法首次实现了与实时兼容的可认证鲁棒语义分割。此外，它允许在$\ell_2$攻击半径为$ε$的范围内计算最坏情况性能，涵盖广泛的表现度量。关键的是，我们基准测试了我们的认证过程的运行时间，发现我们的方法在NVIDIA A100 GPU上比随机平滑方法快约600倍。最后，我们评估了我们的最坏情况证书的紧密性，以进一步验证我们的方法的性能。
英文摘要：
Deep Neural Networks are vulnerable to small perturbations that can drastically alter their predictions for perceptually unchanged inputs. The literature on adversarially robust Deep Learning attempts to either enhance the robustness of neural networks (e.g, via adversarial training) or to certify their decisions up to a given robustness level (e.g, by using randomized smoothing, formal methods or Lipschitz bounds). These studies mostly focus on classification tasks and few efficient certification procedures currently exist for semantic segmentation. In this work, we introduce a new class of certifiably robust Semantic Segmentation networks with built-in Lipschitz constraints that are efficiently trainable and achieve competitive pixel accuracy on challenging datasets such as Cityscapes. Additionally, we provide a novel framework that generalizes robustness certificates for semantic segmentation tasks, where we showcase the flexibility and computational efficiency of using Lipschitz networks. Our approach unlocks real-time compatible certifiably robust semantic segmentation for the first time. Moreover, it allows the computation of worst-case performance under $\ell_2$ attacks of radius $ε$ across a wide range of performance measures. Crucially, we benchmark the runtime of our certification process and find our approach to be around 600 times faster than randomized smoothing methods at inference with comparable certificates on an NVIDIA A100 GPU. Finally, we evaluate the tightness of our worstcase certificates against state-of-the-art adversarial attacks to further validate the performance of our method.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
