Efficient Certification of Spatial Robustness

Recent work has exposed the vulnerability of computer vision models to vector field attacks. Due widespread usage such in safety-critical applications, it is crucial quantify their robustness against spatial transformations. However, existing only provides empirical quantification deformations via adversarial attacks, which lack provable guarantees. In this work, we propose novel convex relaxations, enabling us, for first time, provide a certificate Our relaxations are model-agnostic and can be leveraged by wide range neural network verifiers. Experiments on various architectures different datasets demonstrate effectiveness scalability our method.