Certified Training for Convolutional Perturbations

Neural networks are notoriously brittle when faced with real-world input perturbations, such as motion blur caused by camera movement. While adversarial training can improve empirical robustness, it lacks formal safety guarantees. This paper addresses the gap in existing literature by developing a method to train neural networks that are provably robust to convolutional perturbations, ensuring they remain reliable in safety-critical applications.

The authors propose a novel certified training pipeline that treats convolutional perturbations as a low-dimensional parameterization. By representing these perturbations as a linear combination of an identity kernel and a perturbation kernel, the method allows for the efficient encoding of blur effects. The core of the training strategy involves using Symbolic Interval Propagation (SSIP) and a hybrid RSIP-SSIP approach to compute tight bounds on the network's output. These bounds are incorporated into the loss function, forcing the network to maintain consistent, correct classifications across the entire range of potential perturbation strengths.

The proposed certified training framework demonstrates superior performance compared to traditional adversarial training. On the CIFAR10 dataset, the models achieved over 80% robust accuracy against motion blur of reasonable intensity, while simultaneously maintaining standard accuracy levels comparable to non-robust models. The authors show that by exploiting the low dimensionality of convolutional perturbations, they can avoid the over-regularization typically associated with certified training, resulting in a better balance between safety and performance.