PaperlayerView exact revision on arXiv

Source-linked AI summary

When Ambiguity Meets Atypicality: Dual-Perspective Test Input Prioritization for DNNs

Haoran Li, Shihai Wang, Bin Liu, Jialuo Chen, Wenjing Zhu, Yu Liu, Tengfei Shi, Shudi Guo

arXiv:2609.34703v1cs.SE

TL;DR

DNN test prioritization must find failure-inducing inputs despite costly labeling and the blind spots of relying on ambiguity or atypicality alone. DuFP combines both perspectives through class-conditional feature density estimation. Across its evaluations, it outperforms state-of-the-art approaches.

  • Problem

    Identifying misclassified test inputs is difficult when labeling is costly and ambiguity or distributional atypicality is considered in isolation.

    Source: §1 · p. 1

  • Method

    DuFP uses class-conditional feature density estimation to combine decision-ambiguity and distributional-atypicality scores for test input prioritization.

    Source: §1 · p. 2

  • Results

    DuFP achieved the best prioritization performance in 14 of 18 evaluation cases and the second-best in 4, with 4.6%–32.3% average APFD improvement over state-of-the-art techniques.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Across image and text datasets under clean, corrupted, and adversarial scenarios, DuFP is reported to prioritize fault-inducing inputs effectively and efficiently.

    Source: §1 · p. 2, §7 · p. 11

    DuFP targets closed-set classification and cannot be directly applied to regression or generative systems.

    Source: §6.3 · p. 11

Abstract

from arXiv · show

While Deep Neural Networks (DNNs) have achieved remarkable progress in cutting-edge domains, their inherent brittleness has become a growing concern. To ensure the reliability and safety of DNN-enabled software, DNN testing has emerged as an indispensable practice. Within this context, test input prioritization is essential for early fault detection and reducing labeling costs. However, it remains challenging to accurately identify failure-inducing inputs. Although decision ambiguity and distributional atypicality are two widely adopted perspectives for characterizing inter-class competition and intra-class typicality respectively, relying on either perspective in isolation inevitably introduces blind spots. In this paper, we propose DuFP (Dual perspective Feature space Prioritization), a KNN density-based test input prioritization approach for DNNs that jointly incorporates both inter-class and intra-class perspectives. The prioritization framework of DuFP is built upon class-conditional density estimation. Based on the estimation results, prediction correctness is characterized by an ambiguity score and an atypicality score, with the former reflecting decision ambiguity and the latter quantifying distributional atypicality. A hybrid uncertainty score is then constructed by integrating both scores to guide the final prioritization. We evaluate DuFP on prioritization and selection tasks across image and text datasets under clean, corrupted, and adversarial scenarios. Experimental results demonstrate that DuFP effectively and efficiently prioritizes fault-inducing inputs and outperforms state-of-the-art approaches.

1 Introduction

DNN testing must identify misclassified inputs early despite costly labeling and distribution shifts. DuFP combines decision ambiguity and distributional atypicality, and is reported to outperform state-of-the-art prioritization methods across its evaluations.

Motivation

  • Prioritization targets early identification of misclassified inputs when manual labeling is costly and test data may undergo distribution shifts.The introduction notes that labeling can require multiple annotators or domain-specific expertise.Source: §1 · p. 1
  • Using ambiguity alone can miss confidently predicted but atypical errors, while atypicality alone can miss errors driven by inter-class ambiguity.The paper argues that either single perspective leaves blind spots in identifying fault-inducing inputs.Source: §1 · p. 2

Approach

  • DuFP estimates class-conditional feature densities and integrates ambiguity and atypicality scores to prioritize test inputs.Ambiguity captures confusion with the strongest competing class; atypicality measures support from the predicted class’s training distribution.Source: §1 · p. 2

Evaluation

  • DuFP achieved the best prioritization performance in 14 of 18 evaluation cases and the second-best in 4, with 4.6%–32.3% average APFD improvement over state-of-the-art techniques.The evaluation covered six benchmarks across image and text datasets under clean, corrupted, and adversarial scenarios.Source: §1 · p. 2

Contributions

  • The authors release implementation code and related resources to support future research.Source: §1 · p. 2

2 Preliminary

The preliminaries define DNN classification and test input prioritization, then introduce KNN density estimation as a way to characterize local sample structure.

2.1 Deep Neural Network

  • A DNN maps inputs from X to outputs in Y, and classification predicts the label with the highest output probability.Source: §2.1 · p. 2

2.2 Test Input Prioritization

  • Test input prioritization orders test cases to maximize a scoring function that measures how effectively the sequence prioritizes fault-inducing inputs, commonly using APFD.Source: §2.2 · p. 3
  • Test input selection chooses a subset under a labeling budget, whereas prioritization orders the full set and can yield a selected subset by taking top-ranked inputs.Source: §2.2 · p. 3

2.3 KNN Density Estimation

  • KNN density estimation estimates local density from neighboring samples, adapting its neighborhood radius to dense or sparse regions without assuming a specific distribution form.Source: §2.3 · p. 3

3 Methodology

DuFP addresses the blind spots of ambiguity-only and atypicality-only prioritization by modeling class-conditional feature densities and combining both perspectives. It ranks inputs by hybrid uncertainty, using class-specific KNN estimates to characterize prediction ambiguity and atypicality.

3.1 Motivation

  • Joint ambiguity and atypicality can capture both near-boundary errors and confidently predicted inputs weakly supported by the training distribution.The two-moons example illustrates that each single perspective misses one of these patterns, whereas their hybrid assigns high uncertainty between and beyond the class distributions.Source: §3.1 · pp. 3–4

3.2 Overview

  • DuFP extracts training features, groups them by class, estimates class-conditional densities, derives two uncertainty scores, and ranks inputs using their hybrid.The method uses penultimate-layer activations, flattened and ℓ2-normalized, as feature representations.Source: §3.2 · p. 4, §3.3 · p. 4

3.3 Class-Conditional Density Estimation

  • To keep neighborhood scales comparable across imbalanced classes, DuFP sets each class’s neighbor count proportional to its size, making density reflect geometric proximity rather than class prevalence.The neighbor count is k_c = n_c · η, where η is the neighbor ratio; density uses the distance to the k_c-th class-specific neighbor.Source: §3.3 · p. 4

3.4 Uncertainty from Two Perspectives

  • Under the top-2 concentration assumption, ambiguity compares the predicted class with its strongest competitor, while atypicality measures reciprocal density within the predicted class.The assumption approximates misclassification probability using the strongest competing class; atypicality complements ambiguity when the predicted class dominates despite low class-conditional density.Source: §3.4 · pp. 4–5

3.5 Prioritization with Hybrid Uncertainty

  • DuFP log-transforms and independently min-max normalizes both scores over the test set, linearly interpolates them, and prioritizes inputs in descending hybrid uncertainty.The parameter λ controls the trade-off: larger values emphasize atypicality, while smaller values emphasize ambiguity.Source: §3.5 · pp. 5–6

4 Experiments Design

The experiments evaluate DuFP on image and text classification datasets under clean and distribution-shift conditions, comparing it with 23 prioritization techniques. They assess prioritization, selection, efficiency, and design contributions using fault-detection metrics across repeated runs.

4.1 Datasets and Models

  • Evaluation spans four image datasets and two text datasets, using VGG-16 and ResNet-20 for image tasks, DeiT for ImageNet-100, and fine-tuned BERT models for text tasks.Models were adopted from prior studies or public repositories without additional training.Source: §4.1 · p. 6

4.2 Candidate Set Construction

  • Candidate sets cover nominal test data, image and text corruptions, and adversarial inputs to represent ideal, natural-shift, and malicious-shift conditions.Image corruptions span noise, blur, weather, and digital distortions; text corruptions include autocomplete and autocorrection errors, word-level translations, and typos.Source: §4.2 · p. 6

4.3 Baselines

  • The comparison uses 23 techniques spanning coverage-based, surprise-based, uncertainty-based, and failure-mechanism-based methods.MCP and DATIS are included for selection; DATISr, which omits DATIS’s redundancy-removal stage, is included for prioritization.Source: §4.3 · pp. 6–7

4.4 Evaluation Metrics

  • APFD measures overall fault-detection effectiveness in an ordering, while TRC measures fault detection under a specified test budget.Higher values indicate earlier fault detection for APFD and more identified misclassified instances within the budget for TRC.Source: §4.4 · p. 7

4.5 Research Questions

  • The evaluation asks how well DuFP prioritizes and selects inputs, how efficient prioritization is, and how each design element contributes to effectiveness.Source: §4.5 · p. 7

4.6 Implementation

  • Experiments ran on an Ubuntu 20.04 server with an Intel Xeon Platinum 8458P CPU, RTX 4090 GPU, and 120 GB memory, with each setting repeated five times.The implementation used Python 3.8 and PyTorch 1.12.0.Source: §4.6 · p. 7

5 Results

DuFP achieves the strongest overall prioritization results, generally detects more faults under constrained selection budgets, and completes prioritization within five minutes on five of six datasets. Ablations favor combining ambiguity and atypicality, show limited sensitivity to α, and find KNN density estimation strongest among the tested alternatives.

5.1 RQ1: Prioritization

  • Across 18 prioritization settings, DuFP ranked first in 14 and second in 4, with average rank 1.2 versus 5.8 for the runner-up.The reported APFD gains also span coverage-, surprise-, uncertainty-, and mechanism-based baselines, and performance generalizes across image and text datasets and data scenarios.Source: §5.1 · pp. 7–8, Table 2 · p. 8
  • DuFP improves average APFD by at least 42.0% over coverage methods and 48.3% over surprise methods; gains are 4.6%–7.9% versus uncertainty methods and 7.2%–32.3% versus mechanism-based methods.Coverage-based methods perform weakest overall, while uncertainty-based methods generally outperform newer mechanism-based approaches in average ranking despite isolated strong results.Source: §5.1 · pp. 7–8

5.2 RQ2: Selection

  • Under the same selection budget, DuFP generally detects more faults; on DBPedia, DATIS surpasses it and DuFP achieves second-best performance.Figure 3 plots TRC against testing budget; DuFP remains higher than other curves in most cases.Source: §5.2 · pp. 8–9, Figure 3 · p. 9

5.3 RQ3: Efficiency

  • RTS, CertPri, and PRIMA often exceed 10 minutes because they compute training-set similarities, perturb inputs individually, or generate many mutants.Uncertainty-based methods are the most efficient overall, with DeepGini and Entropy taking 0.01–0.07 seconds.Source: §5.3 · p. 9
  • DuFP completes prioritization within five minutes on five of six datasets; DBPedia takes 19 minutes 5 seconds, and training-set feature extraction can be precomputed offline.Feature extraction and KNN search dominate cost; the offline training-set results can be reused across candidate sets.Source: §5.3 · pp. 9–10

5.4 RQ4: Ablation Study

  • Intermediate λ values typically yield the best APFD; λ=0 uses ambiguity alone and λ=1 atypicality alone, while the default λ=0.2 was selected by held-out validation.ImageNet-100 instead selected λ=0.01; the authors recommend reselecting λ for high-class-count, sparse-sample regimes or unexplored modalities.Source: §5.4.1 · p. 10, Figure 4 · p. 10
  • Across tested α values, APFD fluctuates within 2%; α=0.3 is the universal empirical default, and relatively small positive values tend to perform strongly.The authors introduce α to adapt the KNN neighborhood ratio across datasets of varying scales.Source: §5.4.1 · p. 10, Figure 5 · p. 10
  • The default KNN density estimator achieves the highest APFD across all tested settings, outperforming KDE, Single Gaussian, GMM, and von Mises-Fisher alternatives.The authors attribute this result to KNN's ability to capture feature-space neighborhood information.Source: §5.4.3 · p. 10

6 Discussion

The discussion explains how adaptive class-conditional density estimation handles class imbalance, describes validity threats and mitigations, and identifies limits in effectiveness, runtime, modalities, and task scope.

6.1 Class Imbalance Analysis

  • Figure 6 compares APFD across density-estimation methods; adaptive k removes explicit class-size dependence, though extremely scarce classes have higher variance.Density estimates reflect geometric proximity, while class prevalence affects DuFP through the prior term.Source: §6.1 · pp. 10–11, Figure 6 · p. 11

6.2 Threats to Validity

  • The evaluation addresses implementation and baseline fidelity threats through code verification and common settings, and covers six architectures, image and text data, and clean and shifted inputs.The authors identify the chosen models and datasets as the main external-validity threat.Source: §6.2 · p. 11

6.3 Limitations and Future Work

  • DuFP does not achieve the best result in every setting, and its runtime stays within 20 minutes but exceeds the under-one-second runtime typical of naïve uncertainty methods.The authors propose confidence-weighted density estimation and estimating density on a representative training subset as future directions.Source: §6.3 · p. 11
  • Evaluation covers image and text data, not other modalities, and DuFP targets closed-set classification rather than regression or generative systems.The paper says its feature-neighborhood ambiguity and atypicality idea may generalize beyond classification.Source: §6.3 · p. 11

7 Conclusion

DuFP uses class-wise density estimation to quantify decision ambiguity and distributional atypicality for test-input prioritization. Across image and text datasets in clean, corrupted, and adversarial settings, it outperforms state-of-the-art approaches with relatively low time overhead.

7 Conclusion

  • DuFP uses class-wise density estimation based on model information and training-data supervisory signals to quantify decision ambiguity and distributional atypicality.The resulting hybrid uncertainty is used to assess prediction correctness for test inputs.Source: §7 · p. 11
  • Evaluations cover image and text datasets under clean, corrupted, and adversarial settings.Source: §7 · p. 11
  • DuFP outperforms state-of-the-art approaches while maintaining relatively low time overhead.The authors conclude that it enhances DNN testing efficiency and contributes to the reliability of DNN-based systems.Source: §7 · p. 11

Related papers

Loading 2609.34703v1…