Probabilistic Robustness Analysis in High Dimensional Space: Application to Semantic Segmentation Network

TL;DR

This work tackles the challenge of providing robust, probabilistic guarantees for high-dimensional semantic segmentation networks in safety-critical applications, where pixel-wise verification is traditionally intractable. It introduces an architecture-agnostic framework based on conformal inference augmented with a clipping-block surrogate, which projects network outputs onto a convex hull and optionally employs PCA/deflation to manage high dimensionality, yielding scalable probabilistic reach sets with the $<\epsilon,\ell,m>$ guarantees. The approach reduces conservatism compared with prior CI-based methods and sidesteps the need for surrogate training, enabling full-image perturbations and general $\ell_p$ perturbations while maintaining provable coverage. Empirical results on CamVid, OCTA-500, Lung Segmentation, and Cityscapes demonstrate reliable safety guarantees with substantially improved tightness and practical runtimes, and the authors provide an open-source repository to support reproducibility.

Abstract

Semantic segmentation networks (SSNs) are central to safety-critical applications such as medical imaging and autonomous driving, where robustness under uncertainty is essential. However, existing probabilistic verification methods often fail to scale with the complexity and dimensionality of modern segmentation tasks, producing guarantees that are overly conservative and of limited practical value. We propose a probabilistic verification framework that is architecture-agnostic and scalable to high-dimensional input-output spaces. Our approach employs conformal inference (CI), enhanced by a novel technique that we call the \textbf{clipping block}, to provide provable guarantees while mitigating the excessive conservatism of prior methods. Experiments on large-scale segmentation models across CamVid, OCTA-500, Lung Segmentation, and Cityscapes demonstrate that our framework delivers reliable safety guarantees while substantially reducing conservatism compared to state-of-the-art approaches on segmentation tasks. We also provide a public GitHub repository (https://github.com/Navidhashemicodes/SSN_Reach_CLP_Surrogate) for this approach, to support reproducibility.

Figures (8)

• Figure 1: Detection of the pixel status
• Figure 2: Illustrates the perturbation set $\mathbf{I}$ corresponding to an $r$-dimensional darkening adversary on image $x$. This set is made by independent perturbations on all $nc$ channels in $r'$ different pixels ($r=nc\times r'$), each with R,G, and B intensities greater than $150/255$. The lower bound $\mathbf{LB}$ represents the maximum darkening (channel intensities set to zero), while the upper bound $\mathbf{UB}$ corresponds to minimum darkening.
• Figure 3: Shows $\overline{\mathbf{RV}}$ versus perturbation level and perturbation dimension. In the top row, we perturbed the entire image with $\ell_2$ perturbation for CamVid and Lung Segmentation and $\ell_\infty$ for OCTA-500. In the bottom row, we consider darkening adversary with $e=5/255$ and we increase the dimension of perturbation. Robustness is averaged over 200 test images .
• Figure 4: The figure compares two reachable sets with the same $\langle \epsilon, \ell, m \rangle$ guarantees. $S_1$ is obtained using the naïve approach, while $S_3$ is produced by the surrogate-based technique, illustrating the accuracy of the latter.
• Figure 5: Shows the average run time versus perturbation level (top row) and perturbation dimension $r$ (bottom row). In the top row, the image is entirely perturbed within an $\ell_2$ ball for CamVid and Lung Segmentation and $\ell_\infty$ ball for OCTA-500. In the bottom row, we have darkening adversary where $e$ is fixed at $5/255$ across all experiments. The runtimes are averaged over 200 test images from datasets.

Theorems & Definitions (1)

• Example 1