Source-linked AI summary
DLFuzz: Differential Fuzzing Testing of Deep Learning Systems
Jianmin Guo, Yu Jiang, Yue Zhao, Quan Chen, Jiaguang Sun
TL;DR
DL testing must address huge input spaces, rare behaviors, and robustness failures in safety-critical applications. DLFuzz differentially mutates inputs to jointly increase neuron coverage and prediction differences without manual labels or cross-referenced models. Compared with DeepXplore, it generated more adversarial inputs with smaller perturbations, higher average neuron coverage, and lower average time consumption.
Problem
DL systems used in safety-critical domains require robustness testing, but huge input spaces and imperceptible perturbations challenge manual test collection and behavior detection.
Method
DLFuzz iteratively applies minute perturbations while jointly optimizing neuron coverage and incorrect behaviors, using the original-versus-mutated prediction difference without manual labeling or cross-referenced models.
Results
Compared with DeepXplore, DLFuzz generated 338.59% more adversarial inputs with 89.82% smaller perturbations, averaged 2.86% higher neuron coverage, and used 20.11% less time.
Takeaways & Limitations
DLFuzz demonstrates that fuzzing-based DL testing can improve coverage and adversarial-input generation while avoiding reliance on multiple similar DL systems.
Takeaways & Limitations
The reported work focuses on image classification, with deployment to other DL tasks such as speech recognition left for future work.
Abstract
from arXiv · showhide
Deep learning (DL) systems are increasingly applied to safety-critical domains such as autonomous driving cars. It is of significant importance to ensure the reliability and robustness of DL systems. Existing testing methodologies always fail to include rare inputs in the testing dataset and exhibit low neuron coverage. In this paper, we propose DLFuzz, the frst differential fuzzing testing framework to guide DL systems exposing incorrect behaviors. DLFuzz keeps minutely mutating the input to maximize the neuron coverage and the prediction difference between the original input and the mutated input, without manual labeling effort or cross-referencing oracles from other DL systems with the same functionality. We present empirical evaluations on two well-known datasets to demonstrate its efficiency. Compared with DeepXplore, the state-of-the-art DL whitebox testing framework, DLFuzz does not require extra efforts to find similar functional DL systems for cross-referencing check, but could generate 338.59% more adversarial inputs with 89.82% smaller perturbations, averagely obtain 2.86% higher neuron coverage, and save 20.11% time consumption.
1 INTRODUCTION
DL testing is essential but difficult because enormous input spaces and imperceptible perturbations can expose incorrect classifications. DLFuzz addresses this challenge by iteratively mutating inputs to increase neuron coverage and prediction differences without manual labels or other models, outperforming DeepXplore in reported evaluations.
- Safety-critical deployments make testing DL robustness and reliability increasingly important.
- Manual test-data collection cannot cover the huge input space needed to trigger every feasible DL-system behavior.
- Imperceptible perturbations can make DL classifiers change their predicted class, creating incorrect behaviors that testing must detect.
- DLFuzz iteratively selects neurons and applies minute perturbations, retaining mutations that increase neuron coverage to expose incorrect behaviors.
- Compared with DeepXplore, DLFuzz generated 135% −584.62% more adversarial inputs with 79.56% −96.77% smaller perturbations and 1.10% −5.59% higher neuron coverage.
2 MOTIVATION
DLFuzz adapts fuzzing principles to DL testing by jointly optimizing neuron coverage and exceptional behaviors while maintaining promising seeds and varying mutation strategies.
- DL testing shares fuzzing’s goals of increasing coverage and eliciting exceptional behaviors.
- Optimization Goal: DLFuzz frames higher neuron coverage and more exceptional behaviors as a joint gradient-based optimization problem.
- Seed Maintenance: Mutated inputs that increase neuron coverage are retained in a seed list for subsequent fuzzing.
- Diversity in Mutation Strategies: Multiple neuron-selection strategies target neurons likely to cover more logic and trigger incorrect outputs.
3 DLFUZZ APPROACH
DLFuzz combines differential testing with neuron-coverage guidance: it mutates inputs through gradient-based optimization, retains useful seeds, and identifies incorrect behavior from inconsistent predictions.
- 3.1 Architecture: The implemented workflow targets image classification with CNNs, while the paper states that adapting it to speech recognition follows the same workflow.Algorithm 1 takes a DNN, alternative top-k labels, target-neuron count, selection strategies, a balancing hyperparameter, and iteration settings as inputs.
- 3.1 Architecture: A tiny perturbation produces a visibly indistinguishable input; differing class predictions between the original and mutated inputs identify an adversarial input without manual labels.Inputs with unchanged predictions continue through the mutation process.
- 3.2 Algorithm: DLFuzz’s mutation algorithm jointly maximizes neuron coverage and incorrect behaviors through a customized loss optimized by gradient ascent.The objective balances prediction changes toward alternative classes with activation of selected target neurons.
- 3.2 Algorithm: DLFuzz maintains a seed list of intermediate mutations that improve neuron coverage, then iteratively computes gradients and applies processed perturbations to each seed.Perturbation size is measured with l2 distance to keep the mutated input imperceptible.
- 3.2 Algorithm: Neuron selection uses customizable heuristics based on past coverage frequency, neuron weights, and proximity to activation thresholds.The framework supports selecting multiple neurons for each seed using one or more strategies.
4 EXPERIMENT
DLFuzz was evaluated on six CNNs across MNIST and ImageNet, where it improved neuron coverage, generated more adversarial inputs with smaller perturbations, and supported retraining gains. Its efficiency advantage had an exception on ResNet50, while future work targets other DL tasks.
- Experiment Setup: DLFuzz was evaluated on six CNNs using MNIST and ImageNet, with the same models and datasets as DeepXplore.The setup used three pretrained models per dataset and 20 randomly selected test images per CNN.
- Effectiveness: 1.10% to 5.59% higher neuron coverage was achieved by DLFuzz than DeepXplore across the tested CNNs.In the best setting, DLFuzz acquired 13.42% higher neuron coverage.
- Effectiveness: 338.59% more adversarial inputs were generated with 89.82% smaller perturbations, on average, than DeepXplore.DLFuzz also spent 20.11% less time generating each adversarial input, except on ResNet50, where neuron selection required more time for its 94056 neurons.
- Effectiveness: All tested neuron-selection strategies improved neuron coverage more than DeepXplore and performed similarly, with strategy 1 appearing slightly better.Figure 4 compares neuron coverage against the number of images tested for different strategies.
- Effectiveness: Retraining three MNIST CNNs with 114 adversarial images improved their accuracy by up to 1.8% within five epochs.The paper reports that more improvement is expected when more adversarial inputs are included.
- Discussion: DLFuzz generated 366 adversarial inputs whose identities were not found to change after mutation, with nearly identical images and imperceptible perturbations.The authors checked all generated inputs while maintaining a small l2 distance through a restricted threshold.
- Discussion: Future work will extend DLFuzz beyond image classification, adding task-specific mutation constraints and domain knowledge for speech recognition and other tasks.The paper identifies deployment on other popular DL tasks as a future direction.
5 CONCLUSION
DLFuzz combines fuzzing with differential testing to expose incorrect behaviors in DL systems and improve their robustness. Compared with DeepXplore, it achieved higher neuron coverage, more adversarial examples, smaller perturbations, and lower average time consumption, while also supporting accuracy improvements through retraining.
- Conclusion: DLFuzz combines fuzzing with DL testing to expose incorrect behaviors and improve testing performance without relying on multiple similar DL systems.The framework also supports retraining with generated adversarial examples to improve model accuracy.