Search papers, labs, and topics across Lattice.
This paper introduces a novel verification framework, Spatio-Temporal Bound Propagation (STBP), for assessing the robustness of 3D CNNs in video and volumetric applications by modeling adversarial perturbations as structured spatio-temporal constraints. By leveraging realistic assumptions about adversarial strength, STBP achieves tighter bounds and stronger robustness guarantees compared to traditional methods, while also improving computational efficiency. The framework is validated across several critical domains, demonstrating a 1.7x increase in certified robust accuracy under the same perturbation budgets, thus enhancing safety in AI systems deployed in high-stakes environments.
Tighter robustness guarantees and 1.7x higher certified accuracy for 3D CNNs in safety-critical applications could redefine verification standards in AI.
With AI increasingly deployed in safety-critical systems, providing formal robustness guarantees for the underlying models is essential. Existing verification methods either rely on overly conservative approximations or incur prohibitive computational costs. For example, the use of lp-norm perturbations in video settings encodes the belief that the adversary can inject noise in every video frame. In practice, adversarial perturbations exhibit structured spatial and temporal correlations, constrained to lower-dimensional, semantically meaningful subspaces. In this work, we study robustness verification of 3D CNNs processing video and volumetric inputs, targeting applications in action recognition (UCF-101), autonomous driving (Udacity), and medical imaging (MedMNIST) exploiting realistic assumptions on adversarial strength by modelling them as spatio-temporal constraints - where the attacker can modify either a subset of frames or patches within a set of consecutive frames. We demonstrate that modelling realistic constraints enables tighter approximations. We introduce Spatio-Temporal Bound Propagation (STBP), a verification framework that computes an exact closed-form characterization of the first convolutional layer and propagates certified bounds through subsequent layers using scalable approximations. Computing the exact closed form provides the tightest bounds for the first convolutional layer. Thus, we utilise approximation methods in the remainder of the network. To spur further progress in this field, we propose ST-Bench, a verification benchmark for autonomous driving and activity recognition, to systematically evaluate verifiable robustness. Compared to existing verification-based approaches, STBP provides stronger robustness guarantees with significantly improved scalability, achieving 1.7x higher certified robust accuracy under identical perturbation budgets.
