Verification of Neural Networks against Convolutional Perturbations via Parameterised Kernels
Benedikt Brückner, Alessio Lomuscio
TL;DR
This work addresses robustness verification of neural networks against semantically meaningful convolutional perturbations, such as camera shake, blur, and sharpening. It introduces linearly parameterised kernels that interpolate between the identity and a target perturbation via a single strength variable $z \in [0,1]$, and shows that convolution with such kernels can be computed efficiently by convolving the input with a small set of fixed coefficient matrices and a bias, thanks to linearity: ${\bm{I}} * {\bm{K}} = \sum_{i=1}^m ({\bm{I}} * {\bm{A}}_i) z_i + {\bm{I}} * {\bm{B}}$. These kernels are then integrated into neural network verifiers by prepending a linear layer that computes $\tilde{\bm{A}} z + \tilde{\bm{B}}$, enabling tight bounds and enabling branch-and-bound with low-dimensional perturbations. The authors demonstrate empirical scalability to large networks (e.g., ResNet18) and show improved verification performance across multiple benchmarks compared to baseline high-dimensional perturbation methods, with notable robustness for sharpening and angle-dependent motion blur. The approach is easy to implement within standard ML libraries and supports extending to additional perturbations through further parameterisations, offering a practical path toward semantically grounded robustness certification in real-world systems.
Abstract
We develop a method for the efficient verification of neural networks against convolutional perturbations such as blurring or sharpening. To define input perturbations we use well-known camera shake, box blur and sharpen kernels. We demonstrate that these kernels can be linearly parameterised in a way that allows for a variation of the perturbation strength while preserving desired kernel properties. To facilitate their use in neural network verification, we develop an efficient way of convolving a given input with these parameterised kernels. The result of this convolution can be used to encode the perturbation in a verification setting by prepending a linear layer to a given network. This leads to tight bounds and a high effectiveness in the resulting verification step. We add further precision by employing input splitting as a branch and bound strategy. We demonstrate that we are able to verify robustness on a number of standard benchmarks where the baseline is unable to provide any safety certificates. To the best of our knowledge, this is the first solution for verifying robustness against specific convolutional perturbations such as camera shake.