INTACT: Sound Worst-Case Topological Certificates for Segmentation Score Maps

INTACT (INference-Time Adversarial Certificates for Topology) computes sound, worst-case topological certificates for thresholded segmentation score maps: statements that hold on every mask reachable within a given perturbation budget, not on average and not by sampling. Topology-aware training (the clDice and Betti-matching lineage) improves such properties on average but guarantees nothing about any particular output; INTACT takes the complementary, inference-time view and certifies a given map.

Given a frozen score map p and an ℓ_∞ budget ε, the ±ε band splits the image into a certainly-foreground core, a certainly-background core, and a POSSIBLE band the adversary controls. The reachable binary masks are then exactly a lattice interval (Proposition 1, with the background test non-strict so the characterisation is exact, not merely up to ties), and over that interval a finite conjunction of monotone predicates is settled by checking just its two extremes — both individually necessary, and not replaceable by any fixed budget of random masks (Lemma 1).

Instantiating the principle yields five certified quantities: certainly- foreground coverage; certified connected components; certified enclosed regions; a strict certified-connectivity fraction; and certified 1-cycles — holes whose wall is certainly foreground and whose interior is certainly background, so no in-budget perturbation can fill or breach them. Each is stated with its worst-case adversary and its scope caveat. The certificate operates on perturbations of the score map; it is not an end-to-end input-space certificate (composition with input-space methods is stated as an interface, not claimed as a result).

Results. A worst-case-exhaustive soundness harness — verified to ring on planted unsound certificates — reports 0 violations in 16,675,936 checks on 30 real mosaic crops through a frozen zero-shot segmentation model, and 0 violations in 10,578,388 checks across two retinal-vessel datasets (DRIVE and CHASE_DB1, model-free Frangi maps), including a deliberately degenerate regime (Dice 0.30) where the certificate had every excuse to break. At ε = 0.10, 94% of predicted grout length is certainly-foreground while the strict certified-connected fraction is 0.766; the two are reported separately throughout, because coverage is not connectivity.

Method as reported. The paper reports two of its own pre-registered claims being refuted and corrected, each recorded as an addendum that preserves the original claim verbatim with the construction that breaks it: an unsound β₁ cycle certificate (H₁ is not monotone under foreground growth), and a registered equivalence between two cycle computations that in fact holds only when each cavity contains a single background component. Both were found the same way — a registered claim checked against a case its own regression suite did not cover.

Reproducibility. The frozen score maps and every committed result file ship with the code, so the entire real-track certification reproduces with no checkpoint and no GPU; certification is CPU-only. Every numeral in the paper is traced to its source by a gate (check_numbers), the markdown and typeset masters are checked to agree in both directions (check_sync, check_content), and the pre-registration record ships so the registrations and their order can be read directly.

Methodology disclosure. The experimental campaign was executed by an agentic AI system under human adjudication, with pre-registration (registry before code, claims locked before prose) and adversarial self-verification; the two corrections above were found by that process. Section 10 documents it.