CROCO: Certified Robustness to Optical COrruptions

Optical systems degrade in the field through heat, mechanical decentering, and focus actuation, and recent work shows that the resulting aberrations can change the predictions of state-of-the-art image classification models. Empirical defenses reduce the risk but cannot provide guarantees. We present CROCO, the first certified robustness guarantee against physically parametrized lens aberrations. We describe each aberration by its Zernike coefficients, add Gaussian noise to these coefficients, and apply randomized smoothing. This yields an ${\ell }_2$ certificate in coefficient space that makes no assumption about how successive aberrations combine, so the modeled combination may be arbitrarily nonlinear. The certified radius converts into a guaranteed RMS wavefront tolerance and a range of lens sharpness (MTF), which are the quantities used to specify real lenses. The same method certifies classification, semantic segmentation, and the stability of explanations. On Imagenette, ImageNet100, and ImageNet1k, certification costs only a few points of accuracy and is nearly independent of the smoothing level. Certifying each Zernike mode separately shows that models are least robust to rotationally symmetric aberrations.