arXiv:2503.17630cs.LGcs.SE2025-03被引 1

用隐空间插值生成逼真多样的测试样本,有效暴露深度模型缺陷。

Generating Realistic, Diverse, and Fault-Revealing Inputs with Latent Space Interpolation for Testing Deep Neural Networks

  • 在隐空间插值不同类样本,再通过量化器和解码器重建输入
  • 生成样本真实度高、多样性好,错误率最高达基线4倍
  • 适合用于模型可靠性测试与重训练提升精度

深度神经网络(DNN)被广泛应用于安全关键系统,亟需全面测试以确保可靠性。尽管已有多种方法生成对抗样本以揭示故障,但现有方法通常在输入空间中扰动样本并基于模型反馈迭代修改,导致测试样本不真实且故障揭示概率低。为此,我们提出一种黑盒测试输入生成方法ARGUS,可生成逼真、多样且能有效揭示故障的测试样本。ARGUS首先将样本压缩至连续隐空间,再通过与其他类别样本的隐空间插值进行扰动;随后利用向量量化器与解码器将扰动后的样本重构回输入空间。同时,在隐空间和输入空间均引入判别器,以保证生成样本的真实性。实验表明,相比当前最先进的黑盒与白盒测试方法,ARGUS生成的对抗样本在目标数据集上更真实、更具多样性,且能使所有原始样本被成功扰动,错误率最高达最优基线方法的4倍。此外,使用这些对抗样本进行模型重训练可进一步提升分类准确率。

原文摘要 · Abstract (English)

Deep Neural Networks (DNNs) have been widely employed across various domains, including safety-critical systems, necessitating comprehensive testing to ensure their reliability. Although numerous DNN model testing methods have been proposed to generate adversarial samples that are capable of revealing faults, existing methods typically perturb samples in the input space and then mutate these based on feedback from the DNN model. These methods often result in test samples that are not realistic and with low-probability reveal faults. To address these limitations, we propose a black-box DNN test input generation method, ARGUS, to generate realistic, diverse, and fault-revealing test inputs. ARGUS first compresses samples into a continuous latent space and then perturbs the original samples by interpolating these with samples of different classes. Subsequently, we employ a vector quantizer and decoder to reconstruct adversarial samples back into the input space. Additionally, we employ discriminators both in the latent space and in the input space to ensure the realism of the generated samples. Evaluation of ARGUS in comparison with state-of-the-art black-box testing and white-box testing methods, shows that ARGUS excels in generating realistic and diverse adversarial samples relative to the target dataset, and ARGUS successfully perturbs all original samples and achieves up to 4 times higher error rate than the best baseline method. Furthermore, using these adversarial samples for model retraining can improve model classification accuracy.

DNN测试对抗样本隐空间模型可靠性

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。