# Towards Verifying Robustness of Neural Networks Against Semantic Perturbations

arXiv: https://arxiv.org/abs/1912.09533 · HTML: https://mlsanity.com/paper/1912.09533/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 19 Dec 2019.

## Built on by (most cited first, 3 of 3)

- [Guidance on the Assurance of Machine Learning in Autonomous Systems (AMLAS)](https://mlsanity.com/paper/2102.01564/) (2021)
- [Toward Certified Robustness Against Real-World Distribution Shifts](https://mlsanity.com/paper/2206.03669/) (2022)
- [General Lipschitz: Certified Robustness Against Resolvable Semantic Transformations via Transformation-Dependent Randomized Smoothing](https://mlsanity.com/paper/2309.16710/) (2023)

## Abstract (arXiv)

Verifying robustness of neural networks given a specified threat model is a fundamental yet challenging task. While current verification methods mainly focus on the ℓp-norm threat model of the input instances, robustness verification against semantic adversarial attacks inducing large ℓp-norm perturbations, such as color shifting and lighting adjustment, are beyond their capacity. To bridge this gap, we propose textitSemantify-NN, a model-agnostic and generic robustness verification approach against semantic perturbations for neural networks. By simply inserting our proposed textitsemantic perturbation layers (SP-layers) to the input layer of any given model, textitSemantify-NN is model-agnostic, and any ℓp-norm based verification tools can be used to verify the model robustness against semantic perturbations. We illustrate the principles of designing the SP-layers and provide examples including semantic perturbations to image classification in the space of hue, saturation, lightness, brightness, contrast and rotation, respectively. In addition, an efficient refinement technique is proposed to further significantly improve the semantic certificate. Experiments on various network architectures and different datasets demonstrate the superior verification performance of textitSemantify-NN over ℓp-norm-based verification frameworks that naively convert semantic perturbation to ℓp-norm. The results show that textitSemantify-NN can support robustness verification against a wide range of semantic perturbations. Code available https://github.com/JeetMo/Semantify-NN