做AI安全验证的团队终于有了兼顾精度和效率的方案——STBP用混合策略解决了传统方法要么太松要么太慢的困境，做视频/3D视觉鲁棒性验证的开发者可以直接参考。
随着AI在安全关键系统中的部署，形式化鲁棒性保证变得至关重要。现有验证方法要么过于保守，要么计算成本高昂。本文提出STBP（时空边界传播）框架，针对处理视频和体积输入的3D CNN，通过建模真实的时空约束（如攻击者只能修改连续帧中的子集或补丁）来获得更紧的近似。STBP对第一卷积层计算精确闭式解，后续层使用可扩展近似，在UCF-101、Udacity和MedMNIST等基准上实现了1.7倍更高的认证鲁棒准确率。同时，作者发布了ST-Bench基准，用于系统评估自动驾驶和活动识别中的可验证鲁棒性。
Hybrid Robustness Verification for Spatio-Temporal Neural Networks
With AI increasingly deployed in safety-critical systems, providing formal robustness guarantees for the underlying models is essential. Existing verification methods either rely on overly conservative approximations or incur prohibitive computational costs. For example, the use of lp-norm perturbations in video settings encodes the belief that the adversary can inject noise in every video frame. In practice, adversarial perturbations exhibit structured spatial and temporal correlations, constrained to lower-dimensional, semantically meaningful subspaces. In this work, we study robustness verification of 3D CNNs processing video and volumetric inputs, targeting applications in action recognition (UCF-101), autonomous driving (Udacity), and medical imaging (MedMNIST) exploiting realistic assumptions on adversarial strength by modelling them as spatio-temporal constraints - where the attacker can modify either a subset of frames or patches within a set of consecutive frames. We demonstrate that modelling realistic constraints enables tighter approximations. We introduce Spatio-Temporal Bound Propagation (STBP), a verification framework that computes an exact closed-form characterization of the first convolutional layer and propagates certified bounds through subsequent layers using scalable approximations. Computing the exact closed form provides the tightest bounds for the first convolutional layer. Thus, we utilise approximation methods in the remainder of the network. To spur further progress in this field, we propose ST-Bench, a verification benchmark for autonomous driving and activity recognition, to systematically evaluate verifiable robustness. Compared to existing verification-based approaches, STBP provides stronger robustness guarantees with significantly improved scalability, achieving 1.7x higher certified robust accuracy under identical perturbation budgets.