Diversity seed mutation method for fuzz testing of deep learning systems

Abstract

The present invention belongs to the technical field of fuzzy testing, and discloses a diversity seed mutation method for fuzzy testing of a deep learning system, including: continuously selecting seeds to be tested from a seed queue, and selecting the position of neurons to be activated, and inputting these two types of information into a diversity seed generative adversarial network, which extracts and fuses the features of seeds of each category at different levels, and generates mutation seeds through adversarial loss and boundary loss function constraint generators; extracting the boundary information of seeds before and after mutation using the Sobel operator, and screening the mutation seeds by calculating the structural similarity of the boundary information of the two; and inputting the screened mutation seeds into the target deep learning model for testing. The seed mutation method of the present invention not only effectively enhances the diversity of seeds, but also significantly improves the robustness of deep learning models.

Description

Technical Field

[0001] The present invention belongs to the technical field of fuzzy testing and relates to a diversity seed mutation method for fuzzy testing of a deep learning system. Background Art

[0002] In recent years, deep learning has been widely used in many fields such as industrial robots, autonomous driving and smart homes. However, the popularity of this technology has also brought unprecedented challenges. The decision-making ability of deep learning depends on the ability to process large amounts of data, but if these deep learning models are not fully and rigorously tested before deployment, their decisions may result in significant economic losses and even threaten human life. For example, in 2018, an accident occurred in Arizona where an Uber self-driving car failed to recognize a pedestrian, killing the pedestrian. In 2023, at an agricultural product logistics center in Seoul, due to a malfunction of the robot sensor, the robot mistakenly identified a worker as a box, lifted it and dropped it onto the conveyor belt, causing his unfortunate death. These serious incidents reveal the potential vulnerabilities or defects in deep learning. In order to ensure its safety in practical applications, it is urgent to explore the potential vulnerabilities or defects of deep learning models.

[0003] Fuzz testing is a general vulnerability mining method that has achieved remarkable results in the field of traditional software vulnerability mining. In recent years, this method has been widely used in deep learning model vulnerability mining. Fuzz testing of deep learning models detects hidden vulnerabilities in deep learning models by mutating the seeds to be tested and inputting the mutated seeds into the deep learning model. By mining these vulnerabilities, researchers and developers can optimize the model to improve the robustness and security of the model. Deep learning fuzz testing can be divided into four steps: seed queue construction, seed selection, coverage analysis, and seed mutation. Seed queue construction is to randomly select a small amount of data from the original data set and add it to the seed queue in sequence or randomly; seed selection is to select a seed from the seed queue in sequence or randomly in each round of testing as the seed to be tested for that round of testing; seed mutation is to take the seed to be tested as input and perform corresponding mutation processing on it according to the pre-defined mutation strategy to obtain the mutated seed; coverage analysis is to input the mutated seed into the deep learning model and calculate its coverage. Among them, seed mutation is the core of fuzz testing, because the mutated seed as the test input directly affects the vulnerability mining efficiency of fuzz testing. Currently, most researchers achieve seed mutation by adding small perturbations to seeds, and some researchers use generative adversarial networks to generate seeds similar to the original seeds. Although the above two methods can ensure the consistency of the categories before and after seed mutation, they limit the diversity of seeds and affect the efficiency of vulnerability mining in deep learning models. Summary of the invention

[0004] The purpose of the present invention is to provide a deep learning system fuzzy testing diversity seed mutation method, which solves the problem of low neuron coverage caused by insufficient seed diversity in existing fuzzy testing methods.

[0005] The technical solution adopted by the present invention is a deep learning system fuzzy test diversity seed mutation method, which is specifically implemented according to the following steps:

[0006] Step 1: Continuously select the seeds to be tested from the seed queue and select the positions of the neurons to be activated. These two pieces of information are input into the diversity seed generative adversarial network. The network extracts the features of different levels of seeds of each category and fuses them. At the same time, the generator is constrained by the adversarial loss and boundary loss functions to generate mutation seeds.

[0007] Step 2: Use the Sobel operator to extract the boundary information of the seeds before and after the mutation, and screen the mutant seeds by calculating the structural similarity of the boundary information of the two;

[0008] In step 3, the screened mutant seeds are input into the target deep learning model for testing, the seeds that improve neuron coverage are added to the seed queue for subsequent testing, and the neuron list is updated, and the seeds that cause target model classification errors are retained in the adversarial test case set.

[0009] The beneficial effects of the present invention are:

[0010] (1) The method of the present invention proposes a diversity seed generative adversarial network, which guides the generation of diverse and high-coverage seeds by designing a neuron position information extractor and coverage loss;

[0011] (2) The method of the present invention designs a boundary loss and adversarial loss function to optimize the generation process of the diversity seed generative adversarial network. While generating diverse seeds, it can appropriately retain the characteristics of the original seeds and ensure that the category labels of the seeds can remain consistent before and after mutation.

[0012] (3) Experiments were conducted on the CIFAR-10 and ImageNet datasets. The results showed that the neuron coverage of the seed mutation method of the present invention was improved by 2.05% and 1.03% respectively compared with the optimal comparison method, and the number of adversarial test cases was increased by 45% and 16% respectively. This method not only effectively enhanced the diversity of seeds, but also significantly improved the robustness of the deep learning model. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 It is the overall framework diagram of the method of the present invention;

[0014] Figure 2It is a framework diagram of the diversity seed generative adversarial network in the method of the present invention;

[0015] Figure 3 is an example diagram of screening mutant seeds in the method of the present invention;

[0016] Figure 4 This is a loss change diagram when training based on the CIFAR-10 dataset and taking the VGG-19 model as an example in an embodiment of the present invention;

[0017] Figure 5 This is a loss change diagram when training based on the ImageNet dataset and taking the VGG-19 model as an example in an embodiment of the present invention;

[0018] Figure 6 is a diagram showing the influence of different modules on neuron coverage in an embodiment of the present invention;

[0019] Figure 7 1 is a comparison diagram of the effects of generating seeds on the CIFAR-10 dataset using four different methods in the embodiments of the present invention;

[0020] Figure 8 1 is a comparison diagram of the effects of generating seeds on the ImageNet dataset using four different methods in the embodiments of the present invention;

[0021] Fig. 9 is the neuron coverage rate of different thresholds on the CIFAR-10 dataset in an embodiment of the present invention;

[0022] Fig.10 is the neuron coverage of different thresholds on the ImageNet dataset in an embodiment of the present invention;

[0023] Fig.11 This is a graph showing changes in neuron coverage in the early stage of fuzzy testing on the CIFAR-10 dataset in an embodiment of the present invention;

[0024] Fig.12 This is a graph showing changes in neuron coverage in the early stage of fuzzy testing on the ImageNet dataset in an embodiment of the present invention;

[0025] Fig.13 is a comparison chart of the number of model errors revealed by four different methods in an embodiment of the present invention;

[0026] Fig.14 is an effect diagram of adversarial test cases of different methods in the embodiments of the present invention;

[0027] FIG15 is a graph showing the change in model retraining accuracy on the CIFAR-10 dataset in an embodiment of the present invention, wherein FIGS. ad respectively use VGG-16, VGG-19, MobileNet, and DenseNet as experimental models;

[0028] FIG16 is a graph showing the change in model retraining accuracy on the ImageNet dataset in an embodiment of the present invention, wherein FIGS. ad respectively select VGG-16, VGG-19, MobileNet, and DenseNet as experimental models. DETAILED DESCRIPTION

[0029] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0030] The diversity seed mutation method for fuzzy testing of deep learning system of the present invention is a coverage-guided seed mutation method. The core of the method is to use the diversity seed generative adversarial network (DSGAN) designed by the present invention to perform seed mutation. Its overall architecture is as follows: Figure 1 As shown, the specific implementation steps are as follows:

[0031] Step 1: Continuously select seeds to be tested from the seed queue and select the positions of neurons to be activated. These two types of information are input into the diversity seed generative adversarial network, which extracts features of different levels of seeds of each category and fuses them. At the same time, the generator is constrained by the designed adversarial loss and boundary loss function to generate mutation seeds.

[0032] The framework of the diversity seed generative adversarial network DSGAN of the present invention is as follows Figure 2 As shown, its specific structure is:

[0033] The key to generating diverse seeds is to mutate the seeds without changing the original seed category labels. To achieve this goal, the present invention designs a diverse seed generative adversarial network DSGAN, including a generator, a discriminator, a style encoder, a mapping network and a neuron location information extractor. The network adds a neuron location information extractor (NLE) based on the StarGAN v2 model architecture, and optimizes the generation process of diverse seeds through the designed adversarial loss and boundary loss.

[0034] The goal of DSGAN is to learn mapping functions between different domains and enable the generated seeds to activate specific neurons. The model generates multiple style vectors through a style encoder or mapping network, and then inputs these vectors into the generator. The generator has two inputs, namely the style vector generated by the style encoder or mapping network and the original seed carrying the neuron position information. By combining these two inputs, the generator is able to create seeds with a specific style and enable the generated seeds to activate specific neuron positions. The discriminator is used to evaluate the authenticity of the generated seeds and whether they conform to the target style.

[0035] The DSGAN generator uses 7 downsampling layers and 7 upsampling layers to perform feature extraction and style transfer on seeds, and retains the detailed information of seeds through residuals. In the downsampling layer, each layer adopts a fully convolutional network structure, including convolutional layers, normalization, and activation processing. Each downsampling layer consists of 3 convolutional layers, including two 3×3 convolutions and one 1×1 convolution. The padding and step size are set to 1, and the activation layer uses the LeakyReLU function. In the upsampling layer, each layer contains two convolutional layers, two linear layers, as well as normalization and activation processing. The convolution kernel size is 3×3, and the padding and step size are set to 1. The discriminator uses a fully convolutional module. First, there is a convolutional layer with a convolution kernel size of 3×3, and the step size and padding are set to 1; then, the discriminator contains The first layer is a sampling module that is the same as the upsampling layer in the generator; followed by two convolutional layers with kernel sizes of 4×4 and 1×1 respectively, and all activation layers use the LeakyReLU function. n The calculation method of is shown in formula (1):

[0036] (1)

[0037] in, image_size is the seed size (256×256 or 32×32).

[0038] The network structure of the style encoder is similar to that of the discriminator, except that the convolution kernel size of the last two layers of the style encoder is 4×4 and the stride is 1. The mapping network adopts a full linear layer structure, including 3 linear layers, and then determines the number of feature extraction layer modules according to the number of data set categories. Each feature extraction layer module contains 4 linear layers, and the activation layer uses the ReLU function.

[0039] The two inputs of the generator are style vectors and the original seed with neuron position information , where the style vector By mapping network or style encoder Provides seeds with location information Provided by the neuron position information extractor. Mapping network Using a 64-dimensional random vector z And target areas y , generate style vector ,in Representation Mapping Network Targeted fields y Output of the mapping network By the feature vector and Field Random sampling can generate a variety of style vectors. Style encoder Based on the given seed And its field , extract the style vector ,here Representation Style Encoder Targeted fields y The output of the generator Responsible for inputting seeds Convert to output torrents that reflect a specific style , discriminator Includes multiple output branches, each branch Used to determine the seed Is it the field? .

[0040] The neuron position information extractor embeds the extracted neuron information into the seed and combines it with the coverage loss constraint to enable the seed generated by the generator to activate the target neuron, thereby improving the neuron coverage of the generated seed, as shown in formula (2):

[0041] (2)

[0042] in, represents the seed that carries the neuron position information, Indicates that we first select an unactivated neuron in the target neural network. , and encode its position in a unique hot encoding. The input dimension is the number of neurons in the target model DNN, and the output dimension is a 64-dimensional vector. Subsequently, the encoded vector is expanded and then passed through 5 convolution modules to obtain the neuron position feature map. Finally, the position information is embedded into the original seed Get .

[0043] The loss function of the DSGAN network is designed as:

[0044] For deep learning fuzz testing, it is necessary to clearly generate the category labels of the seeds. In most fuzz testing studies, in order to ensure label consistency, the size of the perturbation is usually limited to minimize the difference between the original seed and the mutated seed. However, this limitation also weakens the diversity of the seeds in visual effects. In order to improve the diversity of the mutated seeds, the method of the present invention does not limit the size of the perturbation at the pixel level. Therefore, to ensure that the generated diverse seeds are suitable for fuzz testing, the present invention designs boundary loss and adversarial loss to ensure that the labels before and after the seed mutation are consistent, and designs coverage loss to improve the neuron coverage of the generated seeds. The DSGAN loss function is designed as follows:

[0045] Boundary loss: In order to constrain the edge features before and after the mutation, so that the category labels of the seeds before and after the mutation are consistent, the boundary loss is defined as shown in formula (3):

[0046] (3)

[0047] in, Representation Generator By mapping the network Generated style vector and seeds that carry information about the neuron's location Generate mutation seeds. Represents the Sobel operator used to extract edge features, for the original seed Constraining the edge features of the mutant seeds can further ensure the consistency of seed categories before and after mutation and improve the effectiveness of the mutant seeds.

[0048] Adversarial loss: In order to make the seed have the ability to induce errors in the deep learning model, the adversarial loss is defined as shown in formula (4):

[0049] (4)

[0050] The random vector Respectively with the original category label and the target category label Input Mapping Network , generate style vector and , generator Seed and , As input, learn to generate target category seeds While appropriately retaining the original seed characteristics. Express expectations, represents the output of the discriminator corresponding to domain y, and are hyperparameters and are set to 0.8 and 0.2 respectively.

[0051] Coverage loss: To ensure that After the module processing, the mutated seeds have a higher neuron coverage. The method of the present invention is The coverage loss is designed as shown in formula (5):

[0052] (5)

[0053] in, is the target deep learning model, represents the neurons to be activated, is the threshold of neuron activation, Represents the neuron position in the deep learning model as We hope that the output value will get closer and closer to the threshold , thereby achieving the purpose of activating neurons.

[0054] In the method of the present invention, the original style reconstruction loss, style diversity loss and cycle consistency loss of the StarGAN v2 model are specifically:

[0055] Style reconstruction loss: In order to ensure that the generator uses the generated style vector when generating seeds, the present invention adopts style reconstruction loss, as shown in formula (6):

[0056] (6)

[0057] Among them, the style encoder Target category Extracting the style vector of the seed . Representation Generator By using the style vector Seeds Perform style conversion. Through training, the style encoder can The style vector of the corresponding seed is extracted, so that the generator can generate a mutated seed with the style according to the style vector.

[0058] Style diversity loss: In order to further enable the generator to generate diverse seeds based on different style vectors of the same category, style diversity loss is adopted, as shown in formula (7):

[0059] (7)

[0060] in, and They are composed of two random vectors and Input to the mapping network The two generated by Different style vectors of , and Indicates that the generator uses the original seed with position information Respectively and The generated variant seeds. To maximize the value of this objective function, we can explore more space, discover more meaningful style features, and generate diverse seeds. During the training process, in order to more effectively guide the model to learn richer style features, the weight of this objective function is increased.

[0061] Cycle consistency loss: In order to further retain some features of the original seed and ensure the consistency of category information before and after seed mutation, cycle consistency loss is used, as shown in formula (8):

[0062] (8)

[0063] in, The style encoder For target label y and original seeds The extracted style vector is to pass the random vector Input Mapping Network And according to category The generated style vector. Represents the generator based on the original seed and Generate mutation seeds, and then use mutation seeds and Restoring the original seed, by minimizing the consistency loss, encourages the generator to generate seeds that can properly preserve the characteristics of the original seed.

[0064] The overall objective function of the present invention is shown in formula (9):

[0065] (9)

[0066] When training the model, the present invention sets and is 1, and Set to 2, the generator , Discriminator , and style encoder The learning rate is set to , mapping network The learning rate is set to , Adam is used as the optimizer, the batch size is set to 8, and the model training iterations are 100,000 times.

[0067] Step 2: Use the Sobel operator to extract the boundary information of the seeds before and after mutation, and screen the mutant seeds by calculating the structural similarity of the boundary information of the two, so as to avoid the phenomenon of unclear category of seeds after multiple mutations and improve the effectiveness of seeds.

[0068] Boundary screening: During the iterative mutation of seeds, some seeds with unclear categories may be generated. Therefore, a boundary screening module is designed for the mutation algorithm of the present invention. Since the mutation process of the present invention mainly involves large-scale changes to the color information of the original seeds, it is not possible to directly use indicators such as SSIM (Structure Similarity Index Measure, SSIM) or L2 for screening. However, the seeds generated by the diversity seed generative adversarial network of the present invention retain the boundary information of the original seeds, so the screening of the present invention mainly focuses on the similarity of the boundary information. In order to ensure the effectiveness of the generated seeds, the Sobel operator is used to extract the original seeds. and mutant seeds The boundary information of m and , then calculate m and In order to ensure the consistency of the category information before and after the seed mutation, the present invention selects the mutant seeds with SSIM values ​​greater than 0.7 for subsequent testing; otherwise, the original seeds need to be retested. x Mutation is performed. SSIM is shown in formula (10):

[0069] (10)

[0070] in, yes m The average value of yes The average value of yes m The variance of yes The variance of , is a constant used to maintain stability. is the dynamic range of pixel values, , , the range of structural similarity is -1 to 1, and when two seeds are the same, the SSIM value is 1.

[0071] Depend on Figure 3As shown, the left side presents the original seeds and their generated boundary information, while the right side shows the diverse seeds generated by the diversity seed generative adversarial network of the present invention. It can be seen that the present invention adopts a screening algorithm to successfully discard those seeds with unclear categories.

[0072] Step 3: Input the selected mutant seeds into the target deep learning model for testing. The seeds that improve neuron coverage are added to the seed queue for subsequent testing, and the neuron list is updated. The seeds that cause the target model to misclassify are retained in the adversarial test case set.

[0073] After the screening, the test analysis phase begins. This phase includes two parts of testing: one is to check whether the mutant seed can cause errors in the deep learning model, and the other is to evaluate the neuron coverage of the mutant seed. The present invention inputs the screened mutant seeds and the original seeds into the deep learning model and compares their classification results. If the classification results of the two are different, it means that the mutant seed has caused an error in the deep learning model and is stored in the adversarial test case set. Calculate the neuron coverage of the deep neural network after the mutant seed is input. If the coverage is improved, it indicates that the seed may help to further improve the neuron coverage. The mutant seed is added to the seed queue for subsequent fuzzy testing.

[0074] Embodiment 1:

[0075] 1. Comparison methods and indicators

[0076] In order to verify the effectiveness of the method of the present invention, it is compared with the existing fuzz testing methods CAGFuzz, DLFuzz and DeepSensor from the following aspects:

[0077] (1) Comparison of neuron coverage;

[0078] (2) Comparison of the number and time of discovering potential errors in the target model;

[0079] (3) Add the discovered errors to the training set, retrain the target model, and compare the accuracy of the target model after retraining.

[0080] Neuron coverage (NC): used to measure the adequacy of deep learning model testing. It is defined as the ratio of activated neurons to the total number of neurons. This ratio can be used as a metric to evaluate the testing efficiency of the test set for deep learning models.

[0081] Number of adversarial test cases (AdvNum): The total number of seeds generated by fuzz testing that can cause the target model to misidentify errors.

[0082] Average time to generate adversarial test cases (AvgTime): represents the average time required to generate adversarial test cases under a fixed number of tests and the same input conditions. It is calculated by dividing the total recorded test time by the total number of adversarial test cases generated.

[0083] Accuracy (Acc): Indicates the performance of the deep learning model after retraining using adversarial test cases. If the accuracy is improved, it indicates that the robustness of the deep learning model has been enhanced.

[0084] Embodiment 2:

[0085] On the basis of Example 1, implement:

[0086] 2. Dataset

[0087] The experimental environment of this embodiment is Ubuntu 22.04 system, the programming language is Python, and the PyTorch 2.0 deep learning framework is used for experiments. The NVIDIA GeForce RTX 4090 graphics card is used in the hardware configuration, and all experiments are carried out in the GPU environment.

[0088] In this embodiment, two commonly used and different types of data sets are selected for experimental verification of the method of the present invention, namely CIFAR-10 and ImageNet, and four deep learning models for classification tasks are used for testing. The detailed parameter information of the models is shown in Table 1.

[0089] Table 1 Datasets and models

[0090]

[0091] CIFAR-10 is a general small image classification dataset, each of which is an image data with a dimension of 32×32×3. There are 10 categories in this dataset, with a total of 60,000 images, including 50,000 training sets and 10,000 test sets.

[0092] The ImageNet dataset is a large image dataset, each of which is an image of dimension 224×224×3. This dataset contains a total of 1,000 categories, with more than one million images in the training set and more than 50,000 images in the test set.

[0093] This example randomly selects 4 categories from ImageNet, randomly selects 200 data from each category, and a total of 800 data are used as test data. For the CIFAR-10 dataset, 500 test data are randomly selected from each category, and a total of 5,000 data are accumulated.

[0094] (III) Experimental results

[0095] (1) Model training

[0096] In order to ensure the correctness and effectiveness of the experimental results, this embodiment selects four commonly used deep learning models for each data set, namely VGG-16, VGG-19, MobileNet and DenseNet-121. When training a deep learning model, since the target model has a deep number of layers, the setting of the learning rate is very critical. If the learning rate is too high, the weight of the model will increase rapidly, which will have a negative impact on the training of the entire model. Therefore, the learning rate is set to 0.0005. For the CIFAR-10 data set, the training rounds of the deep learning model are set to 100 times.

[0097] For model training of the ImageNet dataset, this embodiment uses the weights provided by the Keras framework. Since this embodiment randomly selects four categories from ImageNet, a layer of global average pooling and a linear layer are added at the end of each model. The model with one thousand categories is used for four categories, and finally trained again for 20 rounds.

[0098] Figure 4 , Figure 5 The loss change diagrams based on the CIFAR-10 dataset and the ImageNet dataset are shown respectively, taking the VGG-19 model as an example for training. Because Adam can dynamically update the learning rate to make the model converge quickly, this embodiment uses the Adam optimizer to train the model. From the figure, it can be seen that as the number of training rounds increases, the training loss and verification loss of the model gradually decrease, and finally tend to be stable, thereby ensuring that the fuzzy test is performed when the model is not overfitted.

[0099] Embodiment 3:

[0100] On the basis of Example 2, carry out:

[0101] (2) Ablation experiment

[0102] In order to evaluate the effects of the neuron position information extractor, adversarial loss, boundary loss and screening module designed in the present invention, this embodiment uses the VGG-16 model as an example to conduct an ablation experiment on the ImageNet dataset. The experimental results are as follows: Figure 6 shown.

[0103] Figure 6In the figure, no_sim represents the neuron coverage curve without the screening module, and StarGanV2+no_sim represents the curve without the optimized generation process and the screening module. It can be seen that as the number of test seeds increases, the neuron coverage continues to increase. Because the method of the present invention adds adversarial loss and boundary loss to the diversity seed adversarial generative network, constrains and optimizes its generation process, and uses boundary information for screening, which improves the effectiveness of generating seeds, it can be observed that the method of the present invention has a higher neuron coverage as the number of seeds increases.

[0104] Embodiment 4:

[0105] On the basis of Example 3, carry out:

[0106] (3) Neuron coverage

[0107] The method of the present invention is compared with three different types of testing methods: gradient-based fuzz testing method DLFuzz, search-based fuzz testing method DeepSensor, and fuzz testing method using generative adversarial network CAGFuzz. The test data is input into different methods to generate seeds, which are used to test the neuron coverage of the target model.

[0108] Figure 7 and Figure 8 The effects of generating seeds using four different methods on CIFAR-10 and ImageNet datasets are shown. It can be observed that the seeds generated by CAGFuzz, DLFuzz and DeepSensor have relatively small changes. The seeds generated by the diversity seed generative adversarial network of the present invention change the shallow features of the original seeds through the features of other categories without changing the category information, so that the generated seeds have significant changes. In this way, seeds that can guide the deep learning model to produce incorrect recognition can be generated. Figure 8 Taking the first picture of the method of the present invention as an example, the feature distribution in the upper right corner of the seed conforms to the characteristics of the bird category, so when the deep learning model identifies the seed, an incorrect recognition result may occur.

[0109] Table 2 shows the neuron coverage of four different methods on two datasets.

[0110] Table 2 Comparison of neuron coverage of the proposed method and CAGFuzz, DLFuzz, and DeepSensor

[0111]

[0112] As shown in Table 2, when the neuron threshold is set to 0.75, the neuron coverage of the method of the present invention is better than that of the comparison method in both CIFAR-10 and ImageNet datasets. The main reason why the method of the present invention can improve the neuron coverage is that: first, the method of the present invention adds the location information of the neurons, so that when the original seeds pass through the diversity seed generative adversarial network, seeds with high coverage can be generated; then, the generated seeds are subjected to coverage analysis, and seeds with increased neuron coverage of the deep learning model are preferentially added to the seed queue for subsequent fuzzy testing, and the neuron coverage of the target model can be further improved by reusing these seeds.

[0113] This example conducts a series of experiments to verify the effectiveness of the method of the present invention. By testing at different neuron thresholds and adjusting the neuron threshold every 0.1, the testing capabilities of different methods are more comprehensively reflected. Fig. 9 and Fig.10 As shown in the figure, in the CIFAR-10 dataset and ImageNet dataset, the average neuron coverage of the method of the present invention is 1.54% and 0.95% higher than that of the comparison method at different neuron thresholds. At the same neuron threshold, the neuron coverage of the method of the present invention is better than that of the comparison method.

[0114] This embodiment adopts a local perspective to evaluate the method of the present invention. Taking the VGG-19 model as an example, this embodiment compares the coverage of the early stage of fuzzy testing on the CIFAR-10 and ImageNet datasets. Fig.11 and Fig.12 As shown, with the increase of the number of input seeds, the method of the present invention can achieve higher neuron coverage in the early stage of fuzz testing.

[0115] In summary, the diversity seed generative adversarial network of the present invention can efficiently generate seeds, and use the original seeds with the position information of unactivated neurons as mutation inputs to generate diverse seeds, which can effectively improve the neuron coverage of the deep learning model.

[0116] Embodiment 5:

[0117] On the basis of Example 4, carry out:

[0118] 4. Adversarial Test Cases

[0119] The seeds to be tested selected by the method of the present invention are all correctly classified by the deep learning model. These seeds to be tested are input into the diversity seed generative adversarial network, and the generated mutant seeds are input into the deep learning model. If the deep learning model classification error is caused, this type of seed is called an adversarial test case, which can find potential errors in the deep learning model. In this embodiment, the same number of seeds are input into the method of the present invention and three comparative methods, and the number of adversarial test cases that can be finally generated is recorded. Among them, the test seeds of CIFAR-10 are 5000, and the test seeds of ImageNet are 800. Table 3 shows the number of adversarial test cases generated by different methods.

[0120] Table 3 Comparison of the number of adversarial test cases generated by the proposed method and CAGFuzz, DLFuzz, and DeepSensor

[0121]

[0122] As can be seen from Table 3, the method of the present invention has a strong ability to detect deep learning errors, and has good results on the two datasets of CIFAR-10 and ImageNet and four deep learning models. On the two datasets of CIFAR-10 and ImageNet, the method of the present invention found an average of 1975 and 50 more potential errors of deep learning models than the comparison method. The reason why the method of the present invention performs better in error detection is that the variation of the comparison method limits the disturbance size to a range that is invisible to the human eye, and when the method of the present invention mutates the original seed, it not only retains its edge features, but also introduces features of other categories, one of the most significant changes of which is the change in the color of the original seed.

[0123] This embodiment uses a local perspective to evaluate the method of the present invention. Taking the VGG-16 model as an example, experiments are conducted on the CIFAR-10 dataset. The experimental results are as follows: Fig.13 As shown in the figure, from a local perspective, in the early stage of fuzz testing, as the input data increases, the method of the present invention can find more potential errors in the deep learning model. For example, the adversarial testing of different methods Fig.14 shown.

[0124] Table 4 Comparison of the time taken by the proposed method, CAGFuzz, DLFuzz and DeepSensor to generate adversarial test cases

[0125]

[0126] As can be seen from Table 4, the average error discovery time of DLFuzz and DeepSensor is relatively long. This is because the perturbation acquisition of these two methods is based on the calculation of model gradients, and due to the complexity of deep learning models, calculating gradients will result in a large time overhead. In contrast, the mutation module of CAGFuzz uses CycleGAN to generate seeds, which consumes relatively little time. However, this method calculates the cosine similarity of the original seeds and the mutant seeds when screening effective seeds, which brings a large time overhead in the screening stage. The method of the present invention uses a diversity seed generative adversarial network to generate seeds in the mutation module, and uses convolution operations in the screening algorithm, which greatly reduces the time overhead, so that the method of the present invention can find potential errors in deep learning models faster when testing the same model and using the same correctly classified test data.

[0127] Embodiment 6:

[0128] On the basis of Example 5, carry out:

[0129] (V) Heavy training

[0130] In this embodiment, adversarial test cases are added to the training set, and the target deep learning model is retrained using the new training set to evaluate whether the accuracy of the deep learning model can be improved. CIFAR-10 and ImageNet data sets are selected as experimental data sets, and four deep learning models, VGG-16, VGG-19, MobileNet and DenseNet, are selected as experimental models. For the CIFAR-10 data set, 200 adversarial test cases are added to the training set, and for the ImageNet data set, 40 adversarial test cases are added. In this embodiment, these four models are retrained for 5 rounds. After the model is retrained, the original test set is used to verify whether the accuracy of the retrained model is improved, and the experimental results are shown in Figures 15 and 16.

[0131] Since adversarial test cases are added to the training set, some retrained models may experience a decrease in accuracy in the initial stage. However, as the number of training rounds increases, the final accuracy of the method of the present invention exceeds that of other methods. Experiments have shown that the method of the present invention can effectively improve the accuracy of the model. By adding the same number of adversarial examples to the training set and retraining the target model as a new data set, the method of the present invention can more effectively improve the accuracy of the model than the comparative method. The accuracy of the optimal model has increased from the original 94.23% to 97.27%, an increase of 3.04%.

Claims

1. A diversity seed mutation method for fuzz testing of deep learning systems, characterized in that: Follow the steps below to implement it: Step 1, continuously selecting seeds to be tested from the seed queue, and selecting the positions of neurons to be activated, and inputting these two pieces of information into a diversity seed generative adversarial network, which extracts and fuses the features of different levels of seeds of each category, and generates variant seeds through adversarial loss and boundary loss function constraints generator; wherein the seed queue is an image queue; Step 2: Use the Sobel operator to extract the boundary information of the seeds before and after the mutation, and screen the mutant seeds by calculating the structural similarity of the boundary information of the two; Step 3: Input the selected mutant seeds into the target deep learning model for testing, add the seeds that improve neuron coverage to the seed queue for subsequent testing, update the neuron list, and keep the seeds that cause the target model to misclassify in the adversarial test case set; In step 1, the diversity seed generative adversarial network adds a neuron position information extractor on the basis of the StarGAN v2 model architecture, specifically including a generator, a discriminator, a style encoder, a mapping network and a neuron position information extractor, and retains the style reconstruction loss, style diversity loss and cycle consistency loss of the StarGAN v2 model; wherein the style encoder and the mapping network are used to generate multiple style vectors; the neuron position information extractor is used to generate original seeds carrying neuron position information; the generator is used to generate seeds, which has two inputs, namely, a style vector generated by a style encoder or a mapping network and an original seed carrying neuron position information; the discriminator is used to evaluate the authenticity of the generated seeds and whether the generated seeds conform to the target style; The boundary loss is the original seed Constrain the edge features of the mutated seeds to ensure the consistency of the seed categories before and after mutation. Its definition is as follows: in, For the original seed, Representation Generator By mapping the network Generated style vector and seeds that carry information about neuron locations Generate mutation seeds. Represents the Sobel operator used to extract edge features; The adversarial loss is defined as follows: The random vector Respectively with the original category label and target category label Input Mapping Network , generate style vector and , generator Seed and , As input, learn to generate target category seeds while appropriately preserving the original seed characteristics; Express expectations, Indicates that the discriminator judges the image Is it The original category label y of the style represented, and are hyperparameters and are set to 0.8 and 0.2 respectively.

2. The deep learning system fuzzy testing diversity seed mutation method according to claim 1 is characterized in that: The neuron position information extractor extracts neuron position information, embeds the extracted information into seeds, and combines the coverage loss constraint to enable the seeds generated by the generator to activate the target neurons, as shown in the following formula: in, represents the seed that carries the neuron position information, Indicates that we first select an unactivated neuron in the target neural network. , and encode its position in a unique hot encoding. The input dimension is the number of neurons in the target model DNN, and the output dimension is a 64-dimensional vector. Subsequently, the encoded vector is expanded and then passed through 5 convolution modules to obtain the neuron position feature map. Finally, the position information is embedded into the original seed Get .

3. The deep learning system fuzzy testing diversity seed mutation method according to claim 2 is characterized in that: The coverage loss is shown as follows: in, Representation Generator By mapping the network Generated style vector and seeds that carry information about neuron locations Generate mutation seeds. is the target deep learning model, represents the neurons to be activated, is the threshold of neuron activation, Represents the neuron position in the deep learning model as The output value of , thereby achieving the purpose of activating neurons.

4. The deep learning system fuzzy testing diversity seed mutation method according to claim 1, characterized in that: The style reconstruction loss, style diversity loss and cycle consistency loss in the diversity seed generative adversarial network are specifically: The style reconstruction loss is as follows: Among them, the style encoder For the original category label Extracting the style vector of the seed , Representation Generator By using the style vector Seeds Perform style transfer, Represents expectations; through training, the style encoder can be Extract the style vector of the corresponding seed, so that the generator can generate a variant seed with the style according to the style vector; The style diversity loss is expressed as follows: in, and They are composed of two random vectors and and target category label Input to the mapping network The two different style vectors generated in , and Indicates that the generator uses the original seed with position information Respectively and The generated mutation seeds, express expectations; The cycle consistency loss is expressed as follows: in, Express expectations, The style encoder For the original category label y and original seeds The extracted style vector is to pass the random vector Input Mapping Network And according to the target category label The generated style vector, Represents the generator based on the original seed and Generate mutation seeds, and then use mutation seeds and Restoring the original seed, by minimizing the consistency loss, encourages the generator to generate seeds that can properly preserve the characteristics of the original seed.

5. The deep learning system fuzzy testing diversity seed mutation method according to claim 1, characterized in that: In step 2, the Sobel operator is used to extract the original seed and mutant seeds The boundary information of m and , then calculate m and The structural similarity SSIM between them is used to select the variant seeds with SSIM values ​​greater than 0.7 for subsequent testing; otherwise, the original seeds need to be re-tested. x After mutation, SSIM is as follows: in, yes m The average value of yes The average value of yes m The variance of yes The variance of , is a constant used to maintain stability. is the dynamic range of pixel values, , , the range of structural similarity is -1 to 1, and when two seeds are the same, the SSIM value is 1.

Images