Renwei Deng

For ℓ0 perturbations that change only a few pixels, FocusBranch rewrites the “at most k perturbed pixels” constraint as a node made of a focus pixel set and a level, so verification can branch across levels. It builds super nodes through covering designs and concrete nodes through upper shadows, and picks a starting level from sampling estimates. Across 13 networks and 3,189 candidate instances it verified 2,799; in a 740-instance comparison it verified 641, against 375 for CoVerD+top-k-GP.

For ℓ0 perturbations that change only a few pixels, FocusBranch rewrites the “at most k perturbed pixels” constraint as a node made of a focus pixel set and a level, so verification can branch across levels. It builds super nodes through covering designs and concrete nodes through upper shadows, and picks a starting level from sampling estimates. Across 13 networks and 3,189 candidate instances it verified 2,799; in a 740-instance comparison it verified 641, against 375 for CoVerD+top-k-GP.