Certifying Semantic Robustness of Deep Neural Networks

Since the discovery of adversarial examples, the local robustness of deep neural networks (DNNs) has received much attention. Moreover, researchers find that DNNs are also sensitive to semantic perturbations like fog, contrast and Gaussian noise. Due to the complexity of semantic perturbations, existing works only focus on local robustness towards some specific perturbations such as brightness and rotation. In this paper, we propose a statistics-based method to certify DNN’s local robustness towards general semantic perturbations. First, we give the formal definitions of semantic perturbations and local semantic robustness. Our definitions are general enough to cover almost all perturbations of concern. Then we develop a statistical certification algorithm. Our evaluations on CIFAR-10 and ImageNet show that compared with the state-of-the-art statistical certification algorithm, our method can provide the same theoretical guarantees using only 3.32%-6.55% of running time.