DeepXplore

Abstract

Deep learning (DL) systems are increasingly deployed in safety-and security-critical domains including self-driving cars and malware detection, where the correctness and predictability of a system's behavior for corner case inputs are of great importance. Existing DL testing depends heavily on manually labeled data and therefore often fails to expose erroneous behaviors for rare inputs.We design, implement, and evaluate DeepXplore, the first whitebox framework for systematically testing real-world DL systems. First, we introduce neuron coverage for systematically measuring the parts of a DL system exercised by test inputs. Next, we leverage multiple DL systems with similar functionality as cross-referencing oracles to avoid manual checking. Finally, we demonstrate how finding inputs for DL systems that both trigger many differential behaviors and achieve high neuron coverage can be represented as a joint optimization problem and solved efficiently using gradientbased search techniques.DeepXplore efficiently finds thousands of incorrect corner case behaviors (e.g., self-driving cars crashing into guard rails and malware masquerading as benign software) in stateof-the-art DL models with thousands of neurons trained on five popular datasets including ImageNet and Udacity selfdriving challenge data. For all tested DL models, on average, DeepXplore generated one test input demonstrating incorrect behavior within one second while running only on a commodity laptop. We further show that the test inputs generated by DeepXplore can also be used to retrain the corresponding DL model to improve the model's accuracy by up to 3%.

Boosting operational DNN testing efficiency through conditioning

“…20 40 Experiments 7 and 8 tested the ideal situation where the operational test set is untouched. Experiments 9-12 used mutated operational data simulating unideal physical environment conditions, with the two methods used by DeepXplore [40]: occlusion by small rectangles simulating an attacker blocking some parts of 6 https://udacity.com/self-driving-car a camera (Experiments 9 and 10) and lighting effects for simulating different intensities of lights (Experiments 11 and 12). Figure 5 illustrates the mutations.…”

“…Deep Learning has gained great success in tasks that are intuitive to human but hard to describe formally, such as image classification or speech recognition [15,24]. As a result, Deep Neural Networks (DNNs) are increasingly adopted as integral parts of widely used software systems, including those in safety-critical application scenarios such as medical diagnosis [37] and self-driven cars [40]. Effective and efficient testing methods for DNNs are thus needed to ensure their service quality in operation environments.…”

“…Recent efforts on DNN testing [30,32,38,40,44,45,47] have aimed at generating artificial adversarial examples, which resembles the debug testing [13] of human written programs that aims at finding error-inducing inputs. However, the fundamental difference between DNN models and human written programs challenges the basic concepts and wisdoms for debug testing.…”

Adaptive metamorphic testing with contextual bandits

“…Return updated bandit for future test cycle learning systems based on software testing techniques, such as differential, multi-implementation [33] or mutation testing [34]. Because testing machine learning systems, due to their stochastic nature, is affected by the oracle problem [3], there has been work to especially apply MT for this purpose.…”

Towards Quality Assurance of Software Product Lines with Adversarial Configurations

“…Adversarial ML can be seen as set of security assesement and reinforcement techniques helping to better understand flaws and weaknesses of ML algorithms. Typical scenarios in which adversarial learning is used are: network traffic monitoring, spam filtering, malware detection [1,[6][7][8][9][10] and more recently autonomous cars and object recognition [25,26,36,44,45,49,61]. In such works, authors suppose that a system uses ML in order to perform a classification task (e.g., differentiate emails as spams and non-spams) and some malicious people try to fool such classification system.…”