Deploying autonomous systems in safety-critical domains demands guaranteed robustness against physically plausible geometric perturbations rather than abstract pixel-wise noise. In vision-based navigation and autonomous landing, machine learning components require rigorous validation under dynamic operational conditions such as camera rotations and lighting shifts. Extending findings on the failure of first-order spatial attacks in classification, we show that standard gradient-based heuristics (e.g. APGD) similarly fail on for pose estimation, often performing worse than a simple random sampling baseline. To overcome these optimization bottlenecks, we reformulate pose estimation robustness within the framework of Global Lipschitzian Optimization (GLO). We argue that GLO offers a principled approach to robust validation, effectively localizing global optima with strong theoretical convergence guarantees. We evaluate this framework on a YOLOv8-Pose keypoint detector with a Perspective-n-Point (PnP) solver against rotation and contrast. In our evaluations, GLO successfully isolates critical failure modes where position deviations exceed safe operational limits, while rapidly pruning the search space by over 80%. To the best of our knowledge, this is the first study to extend geometric robustness validation to continuous keypoint regression and deep object detection, establishing a practical step toward certifying robust autonomous perception.
Figures & tables
Figure 1: Overview of the Vision-Based Landing (VBL) robustness validation framework. (A) Image: The input image, subjected to physically plausible geometric perturbations such as camera rotation. (B) Keypoints: The 2D runway corners extracted by the YOLOv8-Pose detector. (C) Position: The 3D aircraft pose estimated by the Perspective-n-Point (PnP) solver. The end-to-end pipeline is evaluated using Global Lipschitzian Optimization (GLO) to isolate critical failure modes.
Figure 2: Performance Comparison between Iterative PnP and BPnP. Relative 3D translation errors evaluated on 1,000 LARDv2 images using ground-truth keypoints and YOLOv8-Pose predictions.
Figure 3: Spatial Robustness Analysis. (a) Survival rate across increasing 1D roll rotation budgets ( ±2∘ to ±30∘ ). (b) Survival rate under compounding 2D rotation and contrast tolerances.
Figure 4: Runtime Attack Efficiency. Impact of strict computational time budgets ( 0.1 s to 5.0 s) on survival rate and median translation error under a fixed ±15∘ rotation bound.
Figure 5: Runtime Attack Efficiency under 2D Perturbations. Impact of computational time budgets (0.1s to 5.0s) on Survival rate and median translation error under fixed ±10.0∘ rotation and [0.7,1.4] contrast bounds.
Figure 6: Distance-Based Vulnerability Profile. The roll angle required to achieve a 90% failure rate across different approach distances (divided into quartiles). The red shaded region ( ≥45∘ ) denotes the experimental limit: attacks reaching this boundary fail to compromise the pipeline within physically plausible rotations, establishing a guaranteed robustness zone.
Figure 7: GeoRobust Convergence and Search Space Reduction. Top: count of active PO subspaces ( ∣POk∣ ). Bottom: remaining search area ( RA(k) ) enclosing worst-case transformations.
Safety-critical applications are required to perform as expected in normal operations. Image processing functions are often required to be insensitive to small geometric perturbations such as rotation, scaling, shearing or translation. This paper addresses the formal verification of neural networks against geometric perturbations on their image dataset. Our method Super-DeepG improves the reasoning used in linear relaxation techniques and Lipschitz optimization, and provides an implementation that leverages GPU hardware. By doing so, Super-DeepG achieves both precision and computational efficiency of robustness certification, to an extent that outperforms prior work. Super-DeepG is shared as an open-source tool on GitHub.
The adoption of vision neural networks in regulated industries requires formal robustness guarantees, especially in safety-critical domains such as healthcare, autonomous vehicles, and aerospace. However, current approaches are confined to incomplete statistical verification or robustness to ℓp-norm and affine transforms, which cover only a narrow subset of perturbations to the image formation process. In particular, robustness to camera motion remains an open problem despite being key to deploy many vision applications. We present a formal verification approach that targets robustness against 3D motion perturbations of the capturing camera. We first establish a closed-form mapping from camera pose to pixel values. By analyzing the continuity properties of the resulting homographies, we show that recent work on Lipschitz optimization and piecewise continuity can be extended to derive tight linear bounds on perturbed pixel values. Our approach applies to scenes with predominantly planar structure, such as ground planes in augmented reality, road markings and traffic signs in autonomous driving, or planar workspaces in robotic manipulation. This enables the first formal verification of projective geometry transforms, without complex simulation, surrogate networks, or explicit image-formation models. We validate our implementation and show up to 89% speedup and 7% tighter bounds over prior work. We then evaluate our method on the VNN-COMP benchmark and reveal systematic weaknesses to projective perturbations. Finally, we demonstrate a real-world case study on a safety-critical runway classifier, highlighting practical vulnerabilities to camera motion, and addressing a key challenge in the certification of learned models. Data and code are publicly available at https://github.com/jeangud/homography-verification .
Jean-Guillaume Durand, Panagiotis Kouvaros, Maxime Gariel +1
Vision-based navigation complements Global Navigation Satellite Systems, but certification demands integrity guarantees that account for faulty measurements. Previous work presented a probabilistic computer vision pipeline for runway-based pose estimation with fault detection inspired by Receiver Autonomous Integrity Monitoring. This work extends that framework by deriving protection levels, which provide probabilistic bounds on pose error that remain valid under undetected faults. We present an algorithm for computing protection levels for the nonlinear Perspective-n-Point problem applied to an aviation setting. The algorithm covers all six degrees of freedom of the aircraft pose (position and orientation) directly. We analyze the effect of measurement redundancy, pixel-level prediction uncertainty, and runway distance on the resulting protection levels. To make the results tangible, we demonstrate tradeoffs in the protection levels on an illustrative runway example.
Olivia Beyer Bruvik, Romeo Valentin, Marc R. Schlichting +2
Department of Aeronautics and Astronautics, Stanford University, Stanford, CA 94305 USA · A3 by Airbus LLC, Sunnyvale, CA 94086 USA