Are Safety Guarantees in Neural Networks Safe? How to Compute Trustworthy Robustness Certifications

2026-06-22

AI Summary

Existing neural network robustness certification methods struggle to provide reliable and efficient safety guarantees against adversarial examples. This work proposes an optimal certification framework based on the apothem metric, introducing this geometric measure for the first time into robustness analysis. We prove that volume-optimal certification is infeasible under the verifier paradigm and instead develop a dual certification mechanism that yields theoretical upper and lower bounds for class-wise instances. By integrating formal verification, interval analysis, and multidimensional geometric techniques, we implement ParallelepipedoNN—an efficient certification system. Experiments on MNIST and Fashion-MNIST demonstrate that our approach at least doubles the minimal certified radius, substantially enhancing the reliability of certified robustness bounds.

Abstract

A primary challenge in AI safety is the existence of adversarial examples -- slightly distorted inputs that cause a neural network (NN) to misclassify. To mitigate this problem, recent research focuses on the computation of robustness certifications, which, for a given input, determine the largest distortion the input may receive without breaking the network's prediction. Robustness certifications can be interpreted as an axis-aligned hyper-rectangle (multi-dimensional intervals). Most existing approaches focus on maximizing the certification's volume, but recent intractability results prohibit the computation of volume-optimal certifications in reasonable time. We introduce the apothem measure and show how to compute apothem-optimal certifications in a linear number of calls to a NN verifier (oracle) w.r.t. the input domain's diameter. Moreover, we prove that we cannot have a volume-optimal, oracle-based algorithm, even if we discard the oracle costs. Also, we introduce dual certifications -- an interval including all instances of a class -- thus providing apothem-minimum upper bounds to a robustness certification. Further, we present the ParallelepipedoNN system, which we evaluate on the standard MNIST and Fashion MNIST benchmarks. A preliminary comparison with existing work on the same datasets reveals at least two-fold improvement w.r.t. the minimum edge length.

Problem

• robustness certification
• adversarial examples
• neural network safety
• volume-optimal certification
• trustworthy AI

Innovation

• robustness certification
• apothem measure
• neural network verification
• adversarial robustness
• dual certifications