  Patch robustness certification ensures no patch within a given bound on a
sample can manipulate a deep learning model to predict a different label.
However, existing techniques cannot certify samples that cannot meet their
strict bars at the classifier or patch region levels. This paper proposes
MajorCert. MajorCert firstly finds all possible label sets manipulatable by the
same patch region on the same sample across the underlying classifiers, then
enumerates their combinations element-wise, and finally checks whether the
majority invariant of all these combinations is intact to certify samples.
