Research map / Adversarial robustness and security / Certified and empirical robustness

Verification of Neural Networks Against Convolutional Perturbations via Parameterised Kernels

AAAI 2025 · Adversarial robustness and security › Certified and empirical robustness · approach: Decision-boundary geometry of robustness · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes verifying neural networks against camera shake, box blur and sharpen convolutional perturbations by linearly parameterising kernels and prepending a linear layer computed via standard convolutions, then verifying with input splitting.

Problem

Verifying neural network robustness against semantically meaningful convolutional perturbations such as camera shake (motion blur), box blur and sharpening, for which existing general kernel-based verification yields loose bounds and high-dimensional perturbations that do not scale.

Approach

Linearly parameterise perturbation kernels (identity to target kernel via a scalar z in [0,1]), so that convolving a constant input with the kernel reduces to a few standard convolutions; the results form a prepended linear layer whose single input z is then verified with input splitting, giving a low-dimensional, tight perturbation encoding.

Key results

• On mnist_fc with kernel size 3 and strength 1.0, most box blur, sharpen and motion blur queries verify (e.g. 44/45 verified for box blur at strength 1.0 and sharpen 45/45 across strengths).
• The baseline general convolutional perturbation method verifies no properties on the evaluated networks even for kernel size 3 (ablation table shows 0 verified across benchmarks).
• Networks retain high verified robustness to sharpen perturbations (e.g. 40-45 of 45 at kernel size 9 on mnist_fc), while box blur and motion blur degrade significantly for large kernels and strengths.

Measured effects reported in the paper

Surprising findings

• Robustness to motion blur depends strongly on the blur angle, with 45° and 135° being more harmful than 0° and 90° at large kernel sizes.
• The baseline general method verified no properties even at kernel size 3, with bounds so loose that counterexamples were found in most cases.

Limitations

• Requires a separate verification run for each kernel type and size, unlike the general baseline.
• Only odd kernel sizes are evaluated; even kernel sizes lack a well-defined identity kernel.
• Restricted to specific parameterised kernels (camera shake, box blur, sharpen) rather than fully general perturbations.

Experimental setup

Datasets: MNIST CIFAR10

Benchmarks: mnist_fc (VNN-COMP) resnet18 (CIFAR10) oval21 (VNN-COMP) sri_resnet_a (VNN-COMP)

Metrics: verified count unsafe count timeout count runtime (s)

Baselines: convolutional perturbation verification baseline (general kernel-based method)

Builds on: Venus VNN-COMP benchmarks convolutional perturbation verification (Dimensionality-based baseline) input splitting

Closest papers by meaning

• Evaluating Robustness of Neural Networks with Mixed Integer Programming (ICLR 2019 · similarity 0.89)
• Towards General Robustness Verification of MaxPool-based Convolutional Neural Networks via Tightening Linear Approximation (CVPR 2024 · similarity 0.87)
• Contrasting Adversarial Perturbations: The Space of Harmless Perturbations (AAAI 2025 · similarity 0.87)
• Improving robustness to corruptions with multiplicative weight perturbations (NeurIPS 2024 · similarity 0.86)
• Provable Editing of Deep Neural Networks using Parametric Linear Relaxation (NeurIPS 2024 · similarity 0.86)
• VNN: Verification-Friendly Neural Networks with Hard Robustness Guarantees (ICML 2024 · similarity 0.86)