基于双重扰动的神经网络鲁棒性验证
Verifying Neural Network Robustness with Dual Perturbations
对做视觉鲁棒性评测的人，这篇提供了把连续空间扭曲（卷积扰动）与逐像素噪声联合建模的验证框架，可直接用来检验分类网络在真实复合损坏下是否真的鲁棒，避免单一扰动验证带来的虚假安全感。
原文依据 dual perturbations that capture both convolutional distortions and independent pixel-level variations
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论安全攸关的深度学习系统必须对真实世界中同时包含空间相关畸变与独立噪声的损坏保持鲁棒。当前的深度神经网络验证方法将这些扰动分开处理，要么检验独立的逐像素扰动，要么检验使用预定义模式的受限卷积变换。这一空白使得在两类扰动同时出现的真实条件下评估鲁棒性成为不可能。为解决这些局限，我们提出 VeriDou 框架，引入：(i) 通用卷积扰动，使验证能够覆盖连续的空间畸变空间；(ii) 双重扰动，同时刻画卷积畸变与独立的像素级变化。我们在 14340 个实例构成的多样化基准上进行的评估表明，VeriDou 的双重扰动方法在那些被现有方法宣称高度鲁棒的网络中发现了显著更多的对抗样本。这表明 VeriDou 能够探索更广泛的不安全区域，从而增强对鲁棒性的形式化评估。VeriDou 已在 https://github.com/dynaroars/VeriDou 公开。
英文原文摘要 1185 字符
Safety-critical deep learning systems must be robust against real-world corruptions combining spatially correlated distortions and independent noise.Current deep neural network verification methods handle these perturbations separately, either checking independent pixel-wise perturbations or restricted convolutional transformations using predefined patterns.This gap prevents assessing robustness under realistic conditions where both perturbation types occur simultaneously.To address these limitations, we propose VeriDou, a framework that introduces:(i) universal convolutional perturbations that enable verification across continuous spatial distortion spaces, and(ii) dual perturbations that capture both convolutional distortions and independent pixel-level variations.Our evaluation on a set of diverse benchmarks with 14340 instances shows VeriDou's dual perturbations approach found substantially more adversarial examples on networks that existing methods claimed to be highly robust.This shows that VeriDou is able to explore a broader range of unsafe regions and thus enhances formal assessment of robustness. VeriDou is available at https://github.com/dynaroars/VeriDou.