CGF initial seed selection method based on coverage rate analysis of anti-sensitive neurons

Abstract

The invention discloses a CGF initial test data selection method based on coverage rate analysis of anti-sensitive neurons. An adversarial sample is generated based on training data, and an absolute difference between an original sample and the adversarial sample in an activation state in a neural network is used to identify an adversarial sensitive neuron, and then a proportion of the test data set to activate the adversarial sensitive neuron is used as a coverage rate. Through the method, the ability of the intelligent software test suite to verify the robustness of the model can be effectively evaluated. According to the CGF initial seed selection method based on the adversarial neuron coverage rate, the initial seed scale can be greatly reduced under the condition that the adversarial neuron coverage rate is basically unchanged, and the CGF efficiency is effectively improved.

Description

Technical Field

[0001] The present invention relates to the technical field of software testing, in particular to a CGF initial seed selection method based on coverage analysis of adversarial sensitive neurons. Background Art

[0002] Intelligent software based on deep neural networks has gained increasing adoption and become a core component of many emerging industrial applications. However, intelligent software can also cause unintended behavior due to undetected defects, leading to serious consequences. Software testing is a crucial tool for ensuring software quality, and adequate testing of intelligent software relies on effective test cases. In traditional software testing, coverage-guided fuzzing (CGF) is a widely used defect detection technique. This testing method performs various random mutations on inputs to generate new test inputs, testing the software's performance under extreme conditions. CGF for traditional software includes steps such as seed selection and initialization, code coverage monitoring, input mutation, execution and feedback, filtering and optimization, and loop testing. Unlike traditional software programming paradigms, intelligent software is data-driven. Traditional software coverage metrics (such as statement coverage and branch coverage) and CGF processes cannot be directly applied to intelligent software systems.

[0003] To address the aforementioned problems faced by intelligent software testing, researchers have proposed the following coverage criteria:

[0004] 1) Neuron Coverage (NC). It is defined as the proportion of neurons activated in a neural network under a specific input set. The definition of activation usually depends on the activation function used. For example, for the ReLU (Rectified Linear Unit) activation function, a neuron will be activated only when the input value is greater than zero. The calculation method of neuron coverage is: first select the test data set, then perform forward reasoning, calculate the output value of the neurons in each layer of the neural network, and check whether the output value meets the activation condition (such as greater than 0), record the number of activated neurons, and compare it with the total number of neurons. The calculation formula of neuron coverage is:

[0005]

[0006] 2) k-multisection Neuron Coverage (KMNC). Assume that the activation value range of a neuron in the training dataset is [low n ,high n], divide this interval into k equal segments, and the segment to which the activation value generated by the test case on a certain neuron belongs is considered to be covered. The ratio of the number of segments covered by the test set on all neurons to the total number of segments is defined as KMNC. Its calculation formula is:

[0007]

[0008] Where T represents the test data set, k represents the number of preset segments, N represents the number of neurons, and φ(x,n) represents the activation value of neuron n under the action of test case x. Represents the segment interval with index i.

[0009] 3) Neuron Boundary Coverage (NBC). Neuron boundary coverage measures how many extreme case regions are covered (relative to the upper and lower boundary values) for a given test input set T. It is defined as the ratio of the number of extreme cases covered to the total number of extreme cases (2×|N|):

[0010]

[0011] The boundaries refer to the maximum and minimum activation values ​​generated by the training data set on the neurons.

[0012] 4) Strong Neuron Activation Coverage (SNAC). Strong neuron activation coverage measures how many extreme cases (relative to the upper boundary value) a given test input T covers. n ). It is defined as the ratio of the number of upper extreme cases covered to the total number of extreme cases (|N|):

[0013]

[0014] 5) Top-k Neuron Coverage (TKNC). Top-k neuron coverage measures how many neurons in each layer have ever been the most active k neurons. It is defined as the ratio of the total number of top-k neurons in each layer to the total number of neurons in the DNN:

[0015]

[0016] 6) Likelihood-based Surprise Coverage (LSC). LSC coverage relies on the concept of Likelihood-based Surprise Adequacy (LSA) and uses kernel density estimation to measure the similarities and differences between the test dataset and the training dataset. Its calculation formula is:

[0017]

[0018] 7) Distance-based Surprise Coverage (DSC). DSC coverage relies on the concept of distance-based surprise adequacy (DSA) and uses the Euclidean distance to measure the similarities and differences between the test dataset and the training dataset. Its calculation formula is:

[0019]

[0020] Among the aforementioned coverage criteria, NC, KMNC, NBC, SNAC, and TKNC all employ the analogy of neural networks to traditional programs, treating the activation of neurons as conditional statements within the program. LSC and DSC, on the other hand, focus on the degree of similarity between test data and training data. Neural networks are often sensitive to adversarial examples, and can even exhibit significant performance degradation under the influence of adversarial examples. Existing coverage criteria completely separate the relationship between test adequacy and model robustness, making them ineffective in assessing the test suite's ability to verify model robustness. Therefore, it is necessary to explore effective coverage criteria that can both assess test adequacy and provide guidance for model robustness testing.

[0021] In addition, the researchers also proposed a fuzz testing process for intelligent software by analogy with traditional software, which mainly includes the following steps:

[0022] 1) Batch Maintenance: Batch maintenance is the first step in intelligent software fuzz testing, responsible for managing and processing test data. Initial seeds are the initial test input data. This data is preprocessed and converted into a format suitable for subsequent testing and stored in a batch pool. The batch pool is a container for currently available test data, where all seed data awaits processing. Subsequently, batch selection selects a portion of test data from the pool for mutation. Furthermore, batch prioritization prioritizes test data based on coverage or other criteria, prioritizing critical data for improved testing efficiency and effectiveness.

[0023] 2) Mutation: This is responsible for generating new test data to enhance fuzz testing. First, seed sampling selects test data from the batch pool as mutation input. Next, power scheduling controls the frequency and intensity of mutation operations to ensure sufficient diversity and coverage of the generated data. Finally, a mutation rationality check verifies that the mutated test data meets requirements, ensuring that the generated test data is not invalid or loses practical significance.

[0024] 3) Deep Neural Network Feedback: Analyze and evaluate the performance of test data within the neural network. First, coverage analysis is performed to assess the network coverage of the generated test data. The results are fed back to the batch maintenance module to optimize the data priority within the batch pool. Subsequently, an Oracle mechanism is used to detect whether the mutated test data causes erroneous neural network behavior. Test data that causes errors is marked as failed tests, which are then used to further analyze and improve network performance.

[0025] This method uses all the test data as the initial seed or randomly selects a certain proportion of samples from the test data as the initial seed. It lacks a clear goal. In addition, the test data used by neural networks is usually very large, which will bring a heavy burden on computing resources and requires effective optimization. Summary of the Invention

[0026] The present invention provides a CGF initial seed selection method based on coverage analysis of adversarial sensitive neurons, aiming to solve the problems that the current intelligent software testing coverage criteria have unclear guiding significance and low correlation with model robustness.

[0027] In a first aspect, a method for selecting CGF initial test data based on coverage analysis of adversarial sensitive neurons is provided, comprising:

[0028] Identify adversarial-sensitive neurons in neural networks based on adversarial examples;

[0029] Create a candidate test data pool, which initially includes all test data;

[0030] Create a set C. Set C is initially empty and is used to store the final filtered test data.

[0031] Determine the set of adversarially sensitive neurons f c , set f c Initially, it is the union of the adversarial sensitive neurons activated by all test data, f c ={c1,…,c i ,…,c m}, c iis the adversarial sensitive neuron activated by at least one test data in the candidate test data pool, i=1~m, m is the total number of adversarial sensitive neurons activated by all test data;

[0032] The following steps are executed repeatedly until the iterative optimization stop condition is reached and the final set C is output:

[0033] In the pth iteration, the set f activated by each test data in the candidate test data pool is evaluated c The number of neurons in the candidate test data pool is activated by the set f c The test data p with the most neurons is added to the set C, and the test data p is removed from the candidate test data pool and removed from the set f. c Remove the adversarial sensitive neurons that have been activated by the test data p, and set p = p + 1 to proceed to the next iteration step.

[0034] In combination with the first aspect, in certain implementations of the first aspect, test data p is determined from the candidate test data pool based on the sorting of adversarial sensitive neuron coverage, and the adversarial sensitive neuron coverage of the test data p satisfies:

[0035]

[0036] It should be understood that in the p-th iteration step, the first one in descending order of the adversarial sensitive neuron coverage corresponds to the test data p.

[0037] In combination with the first aspect, in some implementations of the first aspect, if an activation value of a neuron exceeds a preset threshold τ, the neuron is covered.

[0038] In conjunction with the first aspect, in certain implementations of the first aspect, identifying adversarial-sensitive neurons of a neural network based on adversarial examples includes:

[0039] Based on the adversarial sample generation algorithm, an adversarial sample is generated that corresponds one-to-one with the original sample;

[0040] By comparing the changes in the activation values ​​of the target neuron between the original sample and the corresponding adversarial sample, it is determined whether the target neuron is an adversarially sensitive neuron.

[0041] In combination with the first aspect, in some implementations of the first aspect, there are multiple adversarial sample generation algorithms, and the number of adversarial samples generated by each adversarial sample generation algorithm is the same as the number of original samples.

[0042] In combination with the first aspect, in certain implementations of the first aspect, the adversarial sample generation algorithm includes at least one of the following: fast gradient sign method, basic iterative method, projected gradient descent method, deep pseudo-probability algorithm, and C&W attack algorithm.

[0043] In conjunction with the first aspect, in certain implementations of the first aspect, determining whether the target neuron is an adversarial-sensitive neuron includes:

[0044] Loop through the following steps until all original samples and all neurons are traversed: Calculate the change in activation value The original sample q is the jth neuron n in the i-th layer of the neural network i,j The activation value of For adversarial sample q, the jth neuron n in the i-th layer of the neural network i,j The activation value of

[0045] The following steps are performed repeatedly until all layers of the neural network are traversed: for the jth neuron n in the i-th layer i,j Sum all activation value changes to get the j-th neuron n in the i-th layer i,j Cumulative activation value change Arrange the cumulative changes in activation values ​​of all neurons in the i-th layer of the neural network in descending order. Suppose the number of neurons in the i-th layer of the neural network is n i , then let And select the first n i neurons as the adversarial sensitive neurons in the i-th layer, and β is the preset proportional coefficient.

[0046] In combination with the first aspect, in certain implementations of the first aspect, if the cumulative value of the activation value change of the target neuron exceeds a threshold, the target neuron is determined to be an adversarially sensitive neuron.

[0047] In conjunction with the first aspect, in certain implementations of the first aspect, the iterative optimization stopping condition includes:

[0048] The iteration terminates when the number of test data in set C reaches the limit, or when the coverage of adversarial sensitive neurons in set C reaches the preset coverage.

[0049] In conjunction with the first aspect, in certain implementations of the first aspect, the coverage of the adversarial sensitive neurons in the set C satisfies:

[0050]

[0051] The set of neurons activated by set C represents the union of the adversarial sensitive neurons activated by all test data in set C; the set of adversarial sensitive neurons is set f c The initial state of the set f c The initial state of is the union of the adversarial sensitive neurons activated by all test data.

[0052] Intelligent software is increasingly being used, and its performance requires effective testing. To assess test adequacy, researchers have proposed a variety of coverage criteria. However, these criteria are derived from traditional software test coverage categories or calculate the degree of similarity between the activation states of the test data and the training data within the model, failing to take into account the model's key attribute, robustness. In terms of coverage-guided use case generation, the initial seed is often too large, which often results in inefficient CGF processes. To address these issues, the present invention discloses a neural network coverage analysis method based on adversarial-sensitive neuron identification, referred to as adversarial-sensitive neuron coverage. This method generates adversarial samples based on training data and identifies adversarial-sensitive neurons using the absolute difference between the activation states of the original and adversarial samples within the neural network. The coverage is then calculated as the proportion of adversarial-sensitive neurons activated in the test dataset. This method effectively evaluates the ability of intelligent software test suites to verify model robustness. The present invention also discloses a CGF initial seed selection method based on adversarial-sensitive neuron coverage, which can significantly reduce the initial seed size while ensuring that the adversarial-sensitive neuron coverage remains essentially unchanged, effectively improving CGF efficiency.

[0053] The present invention can effectively measure the quality of the selected test suite by identifying neurons in the neural network that are sensitive to adversarial samples and counting the activation of these neurons in the test data set. This method combines the robustness of the model and can provide more targeted coverage indicators for the test suite, thereby improving the test suite's ability to verify the robustness of the model. Based on the coverage of adversarially sensitive neurons, the present invention also proposes a method for minimizing the selection of initial seeds for Coverage Guided Fuzzing (CGF) test cases, which can effectively solve the problems of large computational complexity and low efficiency of CGF for neural networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 A schematic diagram of a neural network coverage analysis method based on adversarial sensitive neuron identification provided in an embodiment of the present application.

[0055] Figure 2 This is a flow chart of a CGF initial seed selection algorithm based on the coverage of adversarial sensitive neurons provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] The present invention will be described in further detail below with reference to the accompanying drawings and specific embodiments.

[0057] The following combination Figure 1 , a neural network coverage analysis method based on adversarial sensitive neuron identification provided by an embodiment of the present invention is further described in detail.

[0058] Step 1.1, adversarial sample generation. For the neural network f under test, five typical adversarial sample generation algorithms are selected based on the training dataset T 1 (The training dataset used by the tested neural network) Generate adversarial sample set T 2 (ie using the training dataset T 1 For each algorithm, we generate the same number of adversarial samples as in the training dataset. The adversarial sample generation algorithm used in this step is as follows.

[0059] 1) Fast Gradient Sign Method (FGSM)

[0060] Calculation formula:

[0061]

[0062] Where x is the input sample, y is the true label, J(θ,x,y) is the loss function, θ is the model parameter, ∈ is the perturbation size, and x′ is the generated adversarial sample.

[0063] The algorithm flow is as follows: ① Use the model’s loss function to calculate the gradient of the input sample; ② Extract the sign of the gradient and multiply it by the perturbation size ∈; ③ Add the generated perturbation to the original input sample to obtain the adversarial sample x′.

[0064] 2) Basic Iterative Method (BIM)

[0065] Calculation formula:

[0066]

[0067] where x′ i is the adversarial sample generated by the i-th iteration, α is the step size of each iteration, Clip x,∈ Indicates clipping the result to within ∈ range from the original sample x.

[0068] The algorithm flow is as follows: ① First, initialize the adversarial sample x′0=x; ② For each round of iteration, perform the following operations: a) calculate the sign of the gradient of the current sample, b) multiply the gradient by the step size α and add it to the current sample, c) crop the new sample to the ∈ neighborhood of x; ③ Iterate until the preset number of rounds or the adversarial sample generation conditions are met.

[0069] 3) Projected Gradient Descent (PGD)

[0070] Calculation formula:

[0071]

[0072] PGD ​​adds random initialization on the basis of BIM, making adversarial samples more random and generalizable in the perturbation space.

[0073] The algorithm flow is as follows: ① First, the original input sample x is randomly initialized to obtain an initial point x′0; ② For each round of iteration, the following operations are performed: a) Calculate the sign of the gradient of the current sample, b) Multiply the gradient by the step size α and add it to the current sample, c) Crop the new sample to the ∈ neighborhood of x; ③ Iterate until the preset number of rounds or the adversarial sample generation conditions are met.

[0074] 4) DeepFool

[0075] DeepFool does not directly generate adversarial samples through a formula, but recursively linearizes the decision boundary of the classifier to gradually generate minimal perturbations.

[0076] The algorithm flow is as follows: ① Initialize the adversarial sample to the original input x′=x; ② In each iteration, calculate the minimum distance from the current sample to the decision boundary (assuming the classification boundary is linear); ③ Update the adversarial sample along the shortest path to the decision boundary, gradually pushing the sample into the misclassified area; ④ Iterate until the classifier misclassifies x′ or reaches the maximum number of iterations; ⑤ Obtain the final adversarial sample x′.

[0077] 5) C&W Attack (Carlini & Wagner Attack)

[0078] The goal of the C&W attack is to minimize the loss function of the following optimization problem:

[0079] min||δ|| p +c·f(x+δ)

[0080] where δ is the perturbation, c is the weight constant, f is the measure function of the classifier error, ||δ|| p It's L p The perturbation size of the norm.

[0081] The algorithm process is as follows: ① Initialize the adversarial perturbation δ to zero; ② Set the constant c and the maximum number of optimization iterations; ③ Use an optimization algorithm (such as Adam) to minimize ||δ|| p +c·f(x+δ);④After the optimization iteration, obtain the perturbation δ, calculate the adversarial sample x′=x+δ; return the adversarial sample x′.

[0082] By using the above five adversarial sample generation algorithms respectively, we get five adversarial sample sets: The number of samples in each adversarial sample set is the same as that in the training set T 1The same, their union is T 2 .

[0083] Step 1.2: Identify adversarially sensitive neurons. In a neural network, neurons whose activation values ​​change significantly when exposed to an adversarial sample are more strongly correlated with the characteristics of the adversarial sample. This step is used to identify neurons whose activation values ​​differ significantly when exposed to the adversarial sample and the original sample. These neurons are therefore considered adversarially sensitive.

[0084] Specifically, first consider the training set T 1 And the adversarial sample set generated using the FGSM algorithm Every time from T 1 and Take out a pair of “original sample-adversarial sample” from the neural network, form a Tensor, and input it into the neural network to perform forward reasoning. Let the number of neurons in the i-th layer of the neural network be n i,j , the absolute difference between the original sample and the adversarial sample on this neuron is

[0085] Each time a “original sample-adversarial sample” pair is used for inference, the absolute difference is accumulated based on the original value until T 1 and The samples in are taken. Similarly, using the training set T 1 and adversarial sample sets The sample pairs are formed respectively, and the cumulative absolute difference of neurons at all levels in the neural network is calculated through cyclic forward reasoning. Generated using BIM algorithms, Generated using the PGD algorithm, Generated using the DeepFool algorithm, Generated using the C&W attack algorithm.

[0086] Furthermore, the accumulated absolute differences of neurons in each layer of the neural network are arranged in descending order, and the number of adversarial sensitive neurons in the current layer is determined by multiplying the preset proportional coefficient β (0 < β < 1) by the total number of neurons. i The number of neurons included is n i , then the number of sensitive neurons in this layer is:

[0087]

[0088] For the neural network L i Layer, after the neurons are sorted in descending order by their accumulated absolute differences, the first n iThe neurons are the adversarial sensitive neurons of this layer. By performing this operation on all layers of the neural network, all the anti-sensitive neurons of the tested model can be obtained.

[0089] Step 1.3, test suite reasoning and coverage calculation. Use the test dataset T 3 Perform inference on the model under test and record the activation of all neurons. 3 Under the action of a single test sample, if the activation value of a neuron exceeds the preset threshold τ, the neuron is considered to be covered.

[0090] Specifically, record T 3 The neurons activated by all the test samples in the dataset are intersected with the adversarial-sensitive neurons, which are the covered adversarial-sensitive neurons. The formula for calculating the coverage of adversarial-sensitive neurons is:

[0091]

[0092] The following combination Figure 2 A CGF initial seed selection algorithm based on the coverage of adversarial sensitive neurons provided by an embodiment of the present invention is further described in detail.

[0093] Step 2.1, initialization and target setting. First, create an empty set C to store the seeds (test data) that are finally screened out. Preset a constant n that is smaller than the number of test data, n is the seed screening target value. Load all test data as the candidate seed pool. Record the adversarial sensitive neuron set f activated by the test data. c , f c is the union of the activated adversarial sensitive neurons of each seed in the candidate seed pool, f c ={c1,c2,…,c m}, c i An adversarial-sensitive neuron that is activated for at least one seed in the candidate seed pool.

[0094] Step 2.2: Evaluation of the coverage of candidate seeds. Use the seeds in the candidate seed pool, record the number of adversarial-sensitive neurons that these seeds can activate, and sort the samples in the candidate seed pool in descending order according to the number of adversarial-sensitive neurons that can be activated.

[0095] In specific implementation, the coverage calculation formula in step 1.3 above is used to calculate the adversarial sensitive neuron coverage corresponding to each seed in the candidate seed pool, and the samples in the candidate seed pool are sorted in descending order according to the adversarial sensitive neuron coverage.

[0096] Step 2.3, seed selection. Using a greedy strategy, select the seed with the largest current adversarial sensitive neuron coverage from the candidate seed pool, that is, the seed that activates the most adversarial sensitive neurons in step 2.2, and add it to the set C. The selected seeds in the candidate seed pool are deleted accordingly; from the coverage requirement f c The activated adversarial sensitive neurons of the selected seed are removed, and the coverage ability ranking of each seed in the new candidate seed pool is updated to ensure the efficiency and accuracy of subsequent selection.

[0097] That is, after executing step 2.3, the candidate seed pool, set C and the adversarial sensitive neuron set f c All are updated, and then return to step 2.2 to complete the evaluation of the coverage ability of the candidate seeds in the updated candidate seed pool.

[0098] Step 2.4, iterative optimization and stopping conditions. The above selection process is carried out in an iterative manner, and the algorithm dynamically adjusts the seed set C and coverage requirement f c The iteration terminates when the number of seeds reaches a limit or the coverage reaches a preset threshold. Through gradual optimization, the seed set is ensured to be both small and precise, while also having high coverage.

[0099] Step 2.5: Output the final seed set. After the algorithm is finished, the final seed set C is output.

[0100] The seed set C is the filtered test data set that is output. Through optimization, the seed set C can effectively trigger more adversarial-sensitive neurons in the neural network, providing high-quality test data with sufficient coverage and strong representativeness for subsequent testing phases, helping to identify potential problems or improve network robustness.

[0101] Although the present invention is disclosed above in terms of preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art may make possible changes and modifications without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention shall be based on the scope defined by the claims of the present invention.

Claims

1. A CGF initial test data selection method based on coverage analysis of adversarial sensitive neurons, characterized in that: include: Identify adversarial-sensitive neurons in neural networks based on adversarial examples; Create a candidate test data pool, which initially includes all test data; Create a set C. Set C is initially empty and is used to store the final filtered test data. Determine the set of adversarially sensitive neurons f c , set f c Initially, it is the union of the adversarial sensitive neurons activated by all test data, f c ={c1,…,c i ,…,c m }, c i is the adversarial sensitive neuron activated by at least one test data in the candidate test data pool, i=1~m, m is the total number of adversarial sensitive neurons activated by all test data; The following steps are executed repeatedly until the iterative optimization stop condition is reached and the final set C is output: In the pth iteration, the set f activated by each test data in the candidate test data pool is evaluated c The number of neurons in the candidate test data pool is activated by the set f c The test data p with the most neurons is added to the set C, and the test data p is removed from the candidate test data pool and removed from the set f. c Remove the adversarial sensitive neurons that have been activated by the test data p, and set p = p + 1 to proceed to the next iteration step.

2. The method according to claim 1, characterized in that According to the sorting of adversarial sensitive neuron coverage, the test data p is determined from the candidate test data pool. The adversarial sensitive neuron coverage of the test data p satisfies:

3. The method according to claim 2, characterized in that If the activation value of a neuron exceeds the preset threshold τ, the neuron is covered.

4. The method according to claim 1, wherein Based on adversarial examples, we identify adversarially sensitive neurons in neural networks, including: Based on the adversarial sample generation algorithm, an adversarial sample is generated that corresponds one-to-one with the original sample; By comparing the changes in the activation values ​​of the target neuron between the original sample and the corresponding adversarial sample, it is determined whether the target neuron is an adversarially sensitive neuron.

5. The method according to claim 4, characterized in that There are multiple adversarial sample generation algorithms, and the number of adversarial samples generated by each adversarial sample generation algorithm is the same as the number of original samples.

6. The method according to claim 4, characterized in that The adversarial sample generation algorithm includes at least one of the following: fast gradient sign method, basic iterative method, projected gradient descent method, deep pseudo-probability algorithm, and C&W attack algorithm.

7. The method according to claim 4, characterized in that Determine whether the target neuron is an opponent-sensitive neuron, including: The following steps are performed in a loop until all original samples and all neurons are traversed: Calculate the change in activation value Δ i,j,q , The original sample q is the jth neuron n in the i-th layer of the neural network i,j The activation value of For adversarial sample q, the jth neuron n in the i-th layer of the neural network i,j The activation value of The following steps are performed repeatedly until all layers of the neural network are traversed: for the jth neuron n in the i-th layer i,j Sum all activation value changes to get the j-th neuron n in the i-th layer i,j Cumulative activation value change Arrange the cumulative changes in activation values ​​of all neurons in the i-th layer of the neural network in descending order. Suppose the number of neurons in the i-th layer of the neural network is n i , then let n i =|β·n i |, and select the first n i neurons as the adversarial sensitive neurons in the i-th layer, and β is the preset proportional coefficient.

8. The method according to claim 4, characterized in that If the cumulative change in the activation value of the target neuron exceeds a threshold, the target neuron is determined to be an adversarially sensitive neuron.

9. The method according to claim 4, characterized in that Iterative optimization stopping conditions include: The iteration terminates when the number of test data in set C reaches the limit, or when the coverage of adversarial sensitive neurons in set C reaches the preset coverage.

10. The method according to claim 9, characterized in that The coverage of adversarial sensitive neurons in set C satisfies: The set of neurons activated by set C represents the union of the adversarial sensitive neurons activated by all test data in set C; the set of adversarial sensitive neurons is set f c The initial state of the set f c The initial state of is the union of the adversarial sensitive neurons activated by all test data.

Images