In tasks like node classification, image segmentation, and named-entity recognition we have a classifier that simultaneously outputs multiple predictions (a vector of labels) based on a single input, i.e. a single graph, image, or document respectively. Existing adversarial robustness certificates consider each prediction independently and are thus overly pessimistic for such tasks. They implicitly assume that an adversary can use different perturbed inputs to attack different predictions, ignoring the fact that we have a single shared input. We propose the first collective robustness certificate which computes the number of predictions that are simultaneously guaranteed to remain stable under perturbation, i.e. cannot be attacked. We focus on Graph Neural Networks and leverage their locality property - perturbations only affect the predictions in a close neighborhood - to fuse multiple single-node certificates into a drastically stronger collective certificate. For example, on the Citeseer dataset our collective certificate for node classification increases the average number of certifiable feature perturbations from $7$ to $351$.

翻译：在节点分类、图像分割和命名实体识别等任务中，我们有一个分类器，它基于单个输入（即单个图、图像或文档）同时输出多个预测（一个标签向量）。现有的对抗鲁棒性证书独立考虑每个预测，因此对此类任务过于悲观。它们隐含地假设攻击者可以使用不同的扰动输入来攻击不同的预测，忽略了我们有单一共享输入的事实。我们提出了首个集体鲁棒性证书，它计算在扰动下同时保证保持稳定（即无法被攻击）的预测数量。我们聚焦于图神经网络，并利用其局部性特性——扰动仅影响邻近区域的预测——将多个单节点证书融合成一个显著更强的集体证书。例如，在Citeseer数据集上，我们的节点分类集体证书将可认证的特征扰动平均数量从7个增加到351个。