Patch robustness certification ensures no patch within a given bound on a sample can manipulate a deep learning model to predict a different label. However, existing techniques cannot certify samples that cannot meet their strict bars at the classifier or patch region levels. This paper proposes MajorCert. MajorCert firstly finds all possible label sets manipulatable by the same patch region on the same sample across the underlying classifiers, then enumerates their combinations element-wise, and finally checks whether the majority invariant of all these combinations is intact to certify samples.

翻译：补丁鲁棒性认证确保在给定边界内的样本补丁无法操纵深度学习模型预测出不同标签。然而，现有技术无法认证那些在分类器或补丁区域层面无法满足其严格标准的样本。本文提出MajorCert。MajorCert首先找出所有可能被同一补丁区域在同一样本上跨底层分类器操纵的标签集合，然后按元素枚举这些集合的组合，最后检查所有这些组合的多数不变量是否保持完整，从而实现对样本的认证。