Software testing device and software testing method

Abstract

To verify validity of a prediction model created by machine learning with appropriate precision and efficiency.SOLUTION: A software testing device 100 includes: a storage 201 for holding a prediction model; and an arithmetic unit 202 that receives input of a presupposition condition, a restriction condition, and an approximate threshold, converts a prediction model to a logical expression, analyzes an approximate range on the basis of the approximate threshold for the logical expression and simplifies the logical expression, combines the simplified logical expression with negation of the presupposition condition and restriction condition and generates an inspection expression, searches for a value for satisfying the inspection expression as a counterexample, inputs the counterexample into the prediction model when it exists and evaluates inspection precision, and outputs the result.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a software testing device and a software testing method. [Background technology]

[0002] There is artificial intelligence software that incorporates trained models. This artificial intelligence software uses trained models that are mechanically created from training data, so it can achieve advanced functions that humans cannot create. On the other hand, there is a possibility that processing that is unexpected for humans is being performed. As a result, for example, a machine learning program verification device (see Patent Document 1) capable of comprehensively evaluating the validity of a predictive model has been proposed as a conventional technology for verifying such trained models.

[0003] This apparatus includes a storage device for storing a program created by machine learning, which inputs explanatory variable values ​​and outputs the value of an objective variable in accordance with a prediction algorithm using an ensemble tree composed of a plurality of decision trees; and a calculation device for executing the following processes: a process of creating a decision tree logical formula for the program by logically connecting path logical formulas indicating decision tree paths in the decision tree; a process of creating a combined logical formula for the decision tree logical formula by logically connecting a verification property logical formula indicating a verification property to be verified for the program and an objective variable calculation logical formula that defines the relationship between the decision tree output value for each decision tree and the value of the objective variable; a process of inputting the combined logical formula into a predetermined satisfiability determiner to obtain a satisfiability determination result of the combined logical formula, and a process of determining whether the program satisfies the verification property based on the satisfiability determination result, if the result of the determination indicates satisfiability, a process of obtaining a violating input value, which is the value of the explanatory variable that violates the verification property, and a violating output value, which is the value of the objective variable in the case of the violating input value, from a satisfying solution indicated by the satisfiability determiner. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2020-135171 A Summary of the Invention [Problem to be solved by the invention]

[0005] According to the conventional technology, it is possible to verify the validity of a predictive model (trained model, hereafter referred to as a predictive model). On the other hand, the length of the converted logical formula increases exponentially with the number of decision trees in the predictive model. Therefore, depending on the predictive model, the amount of calculation required for determining satisfiability may increase explosively, and it may be practically difficult to perform verification with appropriate accuracy. Therefore, an object of the present invention is to provide a technology that enables verification of the validity of a predictive model created by machine learning with appropriate accuracy and efficiency. [Means for solving the problem]

[0006] The software testing device of the present invention that solves the above-mentioned problems includes a storage device that holds a predictive model generated by machine learning to be tested, a process of accepting an input of a precondition that determines a range of a test input value, a process of accepting an input of a constraint condition of an inference output value of the predictive model for the input value, a process of accepting an input of an approximation threshold value, a process of acquiring the predictive model from the storage device and converting it into a logical formula, a process of analyzing an approximation range for the logical formula based on the approximation threshold value to simplify the logical formula, and a process of converting the simplified logical formula into the precondition and the constraint. and a calculation device that executes a process of generating a check equation by combining with the negation of a reduction condition, a process of searching for a value that satisfies the check equation as a counterexample, a process of inputting the counterexample into the prediction model if one exists, and a process of outputting the result of the evaluation. Furthermore, the software testing method of the present invention is characterized in that an information processing device performs the following processes: storing a predictive model generated by machine learning to be tested in a storage device, and accepting input of prerequisites that determine a range of test input values, accepting input of constraint conditions for the inference output value of the predictive model for the input value, accepting input of an approximation threshold, retrieving the predictive model from the storage device and converting it into a logical formula, analyzing an approximation range for the logical formula based on the approximation threshold and simplifying the logical formula, combining the simplified logical formula with the negation of the prerequisites and the constraint conditions to generate a check formula, searching for a value that satisfies the check formula as a counterexample, inputting the counterexample into the predictive model if one exists to evaluate the check accuracy, and outputting the results of the evaluation. Effect of the Invention

[0007] According to the present invention, it is possible to verify the validity of a predictive model created by machine learning with appropriate accuracy and efficiency. [Brief description of the drawings]

[0008] [Figure 1] FIG. 2 is a diagram illustrating an example of a functional configuration of a software testing device according to the present embodiment. [Diagram 2] FIG. 2 is a diagram illustrating an example of a hardware configuration of the software testing device according to the present embodiment. [Diagram 3] FIG. 2 is a diagram illustrating an example of a main flow of a software testing method according to the present embodiment. [Figure 4] FIG. 2 is a diagram illustrating an example of a decision tree set model in the first embodiment. [Diagram 5] FIG. 11 is a diagram illustrating an example of a prerequisite, a constraint, and an approximation threshold in the first embodiment. [Figure 6] FIG. 11 is a diagram illustrating an example of a flow of a logical expression generation process in the present embodiment. [Figure 7A] FIG. 11 is a diagram illustrating an example of a process for generating a logical formula in the first embodiment. [Figure 7B] FIG. 11 is a diagram illustrating an example of a process for generating a logical formula in the first embodiment. [Figure 7C] FIG. 11 is a diagram illustrating an example of a process for generating a logical formula in the first embodiment. [Figure 8] FIG. 11 is a diagram illustrating an example of a flow of logical expression approximation processing in the present embodiment. [Figure 9] FIG. 11 is a diagram illustrating an example of an analysis process of an approximation range in the first embodiment. [Figure 10] FIG. 11 is a diagram illustrating an example of a flow of a process for generating a satisfiability test expression in this embodiment. [Figure 11] FIG. 13 is a diagram illustrating an example of a sufficiency test formula in the first embodiment. [Figure 12] FIG. 11 is a diagram illustrating an example of a flow of a sufficiency determination process in the present embodiment. [Figure 13] FIG. 11 is a diagram showing an example of counterexample data in the first embodiment. [Figure 14] FIG. 11 is a diagram illustrating an example of a flow of counterexample data creation processing in this embodiment. [Figure 15A] FIG. 11 is a diagram showing an example of true / false judgment of a counterexample in the first embodiment. [Figure 15B] FIG. 11 is a diagram showing an example of true / false judgment of a counterexample in the first embodiment. [Figure 16A] FIG. 13 is a diagram showing an example of output of a test result in the first embodiment. [Figure 16B] FIG. 13 is a diagram showing an example of output of a test result in the first embodiment. [Figure 16C] FIG. 13 is a diagram showing an example of output of a test result in the first embodiment. [Figure 17] FIG. 2 is a diagram illustrating an example of a functional configuration of a software testing device according to the present embodiment. [Figure 18] FIG. 2 is a diagram illustrating an example of a flow of a software testing method according to the present embodiment. [Figure 19] FIG. 13 is a diagram illustrating an example of a logical expression in which a path is deleted in the first embodiment. [Figure 20] FIG. 11 is a diagram illustrating an example of a decision tree in which a path is deleted in the first embodiment. [Figure 21] FIG. 4 is a diagram illustrating an example of a logical expression of a prediction model in the first embodiment. [Figure 22]FIG. 11 is a diagram illustrating an example of a satisfiability test formula in which logical expressions of paths are aligned in the first embodiment. [Figure 23A] FIG. 13 is a diagram illustrating an example of preconditions when a test is performed by giving different approximation thresholds for each test input value range in the first embodiment. [Figure 23B] FIG. 13 is a diagram showing an example of constraint conditions when testing is performed by giving different approximation thresholds for each test input value range in the first embodiment. [Figure 23C] FIG. 13 is a diagram illustrating an example in which a test is performed by providing different approximation thresholds for each test input value range in the first embodiment. [Figure 23D] FIG. 13 is a diagram illustrating an example in which a test is performed by providing different approximation thresholds for each test input value range in the first embodiment. [Figure 24] FIG. 11 is a diagram illustrating an example of a K-layer neural network in the second embodiment. [Diagram 25] FIG. 11 is a diagram illustrating an example of a flow of a logical expression generation process in the present embodiment. [Figure 26] FIG. 11 is a diagram illustrating an example of a neural network, connection weights, biases, input variables, output variables, activation functions, preconditions, constraint conditions, and approximation thresholds in the second embodiment. [Figure 27] FIG. 11 is a diagram illustrating an example of a process for generating a logical formula in the second embodiment. [Figure 28] FIG. 11 is a diagram illustrating an example of a flow of logical expression approximation processing in the present embodiment. [Figure 29] FIG. 11 is a diagram illustrating an example of an analysis process of an approximation range in the second embodiment. [Diagram 30] FIG. 11 is a diagram illustrating an example of a sufficiency test formula in the second embodiment. [Diagram 31] FIG. 13 is a diagram showing an example of counterexample data in the second embodiment. [Diagram 32] FIG. 13 is a diagram showing an example of true / false judgment of a counterexample in the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] <Functional configuration> Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram showing an example of a functional configuration of a software testing device 100 according to this embodiment. The software testing device 100 shown in FIG. 1 is a computer that can verify the validity of a predictive model created by machine learning with appropriate accuracy and efficiency. As a specific application of the software testing device 100, for example, verification of a predictive model used for improving productivity in a factory or optimizing vehicle allocation can be envisioned.

[0010] As shown in FIG. 1, the software testing device 100 of this embodiment has a prediction model holding unit 101, a logical formula generation unit 102, an approximation range analysis unit 103, a check formula generation unit 104, a sufficiency determination unit 105, a check accuracy evaluation unit 106, a test result output unit 107, an approximation threshold input unit 108, a prerequisite input unit 109, and a constraint condition input unit 110.

[0011] Among these, the prediction model holding unit 101 stores a trained prediction model to be tested. The prediction model holding unit 101 is implemented in a storage device, which will be described later.

[0012] The logical expression generating unit 102 generates a logical expression that expresses the function of the prediction model. The logical expression generating unit 102 is implemented by a calculation device, which will be described later, executing a program.

[0013] The approximation threshold value for testing the prediction model is input to the approximation range analysis unit 103. The approximation range analysis unit 103 is implemented by causing the above-mentioned arithmetic device to execute a program.

[0014] Moreover, the check expression generation unit 104 generates a check expression by combining a logical expression in which a subexpression to be approximated is replaced with an approximate value with the negation of a precondition and a constraint. This check expression generation unit 104 is implemented by the above-mentioned arithmetic device executing a program.

[0015] The sufficiency determination unit 105 determines whether or not there is input / output data that satisfies the check formula. The sufficiency determination unit 105 is implemented by the above-mentioned arithmetic device executing a program. can be.

[0016] Furthermore, when there is no input / output data that satisfies the verification formula, the verification accuracy evaluation unit 106 judges that the prediction model does not violate the constraint conditions or that the verification accuracy is insufficient. When there is input / output data that satisfies the verification formula, the input data is given to the prediction model to obtain output data, and if the constraint conditions are violated, it is judged to be a counterexample, and if not, it is judged to be a false counterexample. This verification accuracy evaluation unit 106 is implemented by the above-mentioned arithmetic device executing a program.

[0017] Moreover, the test result output unit 107 outputs to an appropriate output device the evaluation results by the above-mentioned test accuracy evaluation unit 106. This test result output unit 107 is implemented by the above-mentioned arithmetic device executing a program.

[0018] The approximation threshold input unit 108 receives an input of an approximation threshold when testing a prediction model. The approximation threshold input unit 108 is implemented by causing the above-mentioned arithmetic device to execute a program.

[0019] Furthermore, the precondition input unit 109 accepts input of a precondition that specifies a range of input data to be tested for the prediction model. This precondition input unit 109 is implemented by the above-mentioned arithmetic device executing a program.

[0020] The constraint condition input unit 110 receives input of constraint conditions that specify conditions that the inference output data of the prediction model should satisfy. The constraint condition input unit 110 is implemented by the above-mentioned arithmetic device executing a program. <Hardware configuration> The hardware configuration of the software testing device 100 of this embodiment is as shown in FIG.

[0021] That is, the software test apparatus 100 includes a storage device 201 , a calculation device 202 , a memory 203 , an input device 204 , an output device 205 , and a communication device 206 .

[0022] Of these, the storage device 201 is configured with an appropriate non-volatile storage element such as an SSD (Solid State Drive) or a hard disk drive.

[0023] The arithmetic unit 202 is a CPU that reads out a program 2012 stored in the storage unit 201 into a memory 203 and executes the program, thereby controlling the device itself and carrying out various types of judgment, calculation and control processing.

[0024] The memory 203 is composed of a volatile storage element such as a RAM (Random Access Memory).

[0025] The input device 204 is assumed to be a device such as a keyboard, mouse, or microphone that accepts key input or voice input from the user.

[0026] The output device 205 is assumed to be a device such as a display that displays data processed by the arithmetic unit 202 .

[0027] The communication device 206 is assumed to be a network interface card or the like that is connected to an appropriate network and handles communication processing with other devices (e.g., a user terminal that distributes a prediction model, an appropriate server device, etc.).

[0028] If the device 100 is a stand-alone machine, it is preferable that it further comprises an input device for accepting key input or voice input from the user, and an output device such as a display for displaying processed data.

[0029] Moreover, in addition to a program 2012 for implementing functions required for the software testing device 100 of this embodiment, at least the prediction model holding unit 101 and the SMT solver program 2013 already described are stored in the storage unit 101. Note that the SMT solver program 2013 is used when the satisfiability determining unit 105 searches for variable values ​​(counterexamples) that satisfy the check formula. <Flow example: Main flow> The actual procedure of the software testing method according to this embodiment will be described below with reference to the drawings. The various operations corresponding to the software testing method described below are realized by a program that is read into a memory or the like and executed by the software testing device 100. This program is composed of codes for performing the various operations described below.

[0030] 3 is a diagram showing an example of a main flow of the software testing method according to the present embodiment. In this case, the software testing device 100 acquires a prediction model to be tested from an external device via, for example, the input device 204 or the communication device 206, and stores it in the prediction model holding unit 101 (S301).

[0031] Here, as an example of a prediction model, a decision tree ensemble model is shown in Fig. 4. As shown in Fig. 4, the decision tree ensemble model has a structure in which a path is formed from a root node (the circle node at the top of the figure) which is the starting point, through edges (arrowed line segments in the figure) to each node (the circle node in the figure), branching to a leaf node (the triangle node in the figure) which is the terminal end. Each leaf node is associated with a weight, and the output variable (final decision value) is determined by, for example, adding up the weight values ​​of the leaf nodes selected in each decision tree.

[0032] In addition, the software testing device 100 acquires information on the prerequisites, constraint conditions, and approximation thresholds via the prerequisite input unit 109, constraint condition input unit 110, and approximation threshold input unit 108 (S302), and stores it in an appropriate storage means such as the memory 203.

[0033] An example of a precondition is a logical expression including an input variable, an example of a constraint is a logical expression including an output variable, and an example of an approximation threshold is the difference between the maximum and minimum weights of the decision tree to be approximated.

[0034] 5 shows an example of a screen including input interfaces 1301 to 1303 for the information on the preconditions, constraint conditions, and approximation thresholds. The preconditions input unit 109 outputs the screen to the output device 205, and acquires the values ​​input by operating the input device 204 into the preconditions field 1301, constraint conditions field 1302, and approximation threshold field 1303 of the screen.

[0035] Next, the logical expression generating unit 102 of the software test device 100 extracts the prediction model from the prediction model holding unit 101 and converts it into a logical expression (S303). The details of the process flow for converting it into a logical expression will be described later with reference to FIGS.

[0036] In addition, the approximation range analysis unit 103 of the software testing device 100 determines the approximation target in the logical formula obtained in S303 based on the approximation threshold value obtained in S302 described above, and approximates it with constants (e.g., the maximum and minimum weighting values ​​in the logical formula including the determined approximation target) (S30 4) The details of the processing flow for this approximation will be described later with reference to Figures 8 and 9.

[0037] Next, the check equation generation unit 104 of the software test device 100 creates a sufficiency check equation from the logical equation approximated in S304, the above-mentioned prerequisites, and the negation of the above-mentioned constraints (S305). The details of the process flow for creating this sufficiency check equation will be described later with reference to Figs.

[0038] Furthermore, the sufficiency determination unit 105 of the software test apparatus 100 determines the sufficiency of the sufficiency test formula (S306). The details of the process flow relating to this sufficiency determination will be described later with reference to FIGS.

[0039] If the above-mentioned judgment result shows that the constraints are not satisfied (S307: NO), the test result output section 107 of the software test equipment 100 outputs from the output device 205 or the communication device 206 that the above-mentioned constraints are satisfied (S310), and the processing ends.

[0040] On the other hand, if the result of the above-mentioned determination is that the condition is satisfied (S307: YES), the sufficiency determination unit 105 of the software test equipment 100 creates counterexample data (S308).

[0041] Next, the testing accuracy evaluation unit 106 of the software test device 100 inputs the counterexample data created in S308 to the prediction model (S309). The details of the processing flow in the testing accuracy evaluation unit 106 will be described later with reference to FIG.

[0042] If, as a result of the above input, the output result of the predictive model satisfies the constraint condition, i.e., the input counterexample is a false counterexample (S310: YES), the test result output unit 107 of the software testing equipment 100 outputs from the output device 205 (output 1802 in FIG. 15B) that the inspection accuracy is insufficient (S311), and ends the processing.

[0043] On the other hand, if the result of the above input is that the output result of the predictive model does not satisfy the constraint conditions, i.e., the input counterexample is a true counterexample (S310: NO), the test result output unit 107 of the software testing equipment 100 outputs the counterexample data from the output device 205 (output 1801 in Figure 15A) S312) and terminates the processing. <Flow example: Creating a logical expression> Next, details of the process (S303) in the logical expression generating unit 102 will be described based on the flow in Fig. 6. In this case, the logical expression generating unit 102 sets the initial value of the logical expression of the prediction model to null (S801).

[0044] Next, the logical expression generating unit 102 sets the initial value of the logical expression of the decision tree to null (S802).

[0045] Furthermore, the logical expression generating unit 102 decomposes the decision tree to be processed into paths from the root node to the leaves (S803). This decomposition process is performed by appropriately adopting existing technology.

[0046] Next, the logical expression generating unit 102 sets the initial value of the logical expression of the path to null (S804).

[0047] Furthermore, the logical expression generating unit 102 generates a logical expression for the path by combining the decision conditions included in the route with logical products (S805).

[0048] Next, the logical expression generating unit 102 combines the output variable name=weight of the decision tree with the logical expression of the path by logical AND (S806). Note that an example of the logical expression obtained in the above-mentioned S805 and S806 is shown in FIG. 7A.

[0049] Furthermore, the logical expression generating unit 102 combines the logical expressions of the paths with the logical expression of the decision tree by a logical sum (S807). Note that an example of the logical expression obtained in S807 is shown in FIG.

[0050] Next, the logical expression generating unit 102 acquires one unprocessed path from among the paths decomposed in S803 (S808), and determines whether or not the path is the last unprocessed path in the decision tree (S809).

[0051] As a result of the above-mentioned determination, if an unprocessed path still remains, that is, if it is not the last path (S809: No), the logical expression generating unit 102 returns the process to S804.

[0052] On the other hand, if the result of the above determination is that there are no unprocessed paths remaining, that is, if this is the last path (S809: Yes), the logical expression generation unit 102 combines the logical expression of the decision tree with the logical expression of the prediction model by a logical AND (S810).

[0053] Furthermore, the logical expression generating unit 102 acquires an unprocessed decision tree from the decision tree set model as the next decision tree to be processed (S811), and determines whether it is the last unprocessed decision tree in the decision tree set model (S812).

[0054] As a result of the above determination, if there is still an unprocessed decision tree remaining, that is, if this is not the last decision tree (S812: No), the logical expression generating unit 102 returns the process to S802.

[0055] On the other hand, if the result of the above judgment shows that there are no unprocessed decision trees remaining, i.e., this is the last decision tree (S812: Yes), the logical expression generation unit 102 combines the output variable names of the decision trees with "+" and generates an expression for the sum of the output variables of the decision trees (S813).

[0056] Next, the logical expression generating unit 102 generates a logical expression for the prediction model by combining the logical expression for the prediction model with the logical expression for the sum of the output variables of the decision tree (S814). An example of the logical expression generated through the above-mentioned S810, S813, and S814 is shown in FIG. 7C.

[0057] Furthermore, logical expression generation section 102 outputs the logical expression obtained in S814 to approximation range analysis section 103 (S815), and ends the process. <Flow example: Logical expression approximation processing> Next, a detailed description will be given of the process (S304) in the approximation range analysis unit 103. Fig. 8 is a diagram showing an example of the flow of logical expression approximation processing in this embodiment.

[0058] In this case, the approximation range analysis unit 103 decomposes the logical formula of the prediction model into logical formulas of a decision tree (S901).

[0059] Next, the approximation range analysis unit 103 obtains the maximum and minimum values ​​of the weights in the logical formula of the decision tree (S902; maximum and minimum values ​​1502 in FIG. 9).

[0060] The approximation range analysis unit 103 also compares the difference between the maximum and minimum weight values ​​with the approximation threshold (S903). That is, the logical formula of the decision tree (logical formula 1501 in FIG. 9) in which the difference between the maximum and minimum weight values ​​is equal to or less than the approximation threshold is extracted.

[0061] If the result of the above comparison is that the value is equal to or less than the threshold (S904: Yes), the approximation range analysis unit 103 replaces the logical formula of the decision tree with "output variable ≧ minimum value ∧ output variable ≦ maximum value" (S905). An example of the logical formula 1503 obtained by this replacement is shown in FIG.

[0062] On the other hand, if the result of the above comparison shows that the value is not equal to or less than the threshold (S904: No), The similar range analysis unit 103 obtains the logical formula of the next decision tree (S906), and determines whether there are any other unprocessed decision trees (S907).

[0063] As a result of the above-mentioned determination, if it is found that an unprocessed decision tree exists (S907: Yes), the approximate range analysis unit 103 returns the process to S902.

[0064] On the other hand, if the above-mentioned judgment reveals that there are no unprocessed decision trees (S907: No), the approximation range analysis unit 103 outputs the logical formula of the prediction model for which approximation processing has been completed up to this point to the check formula generation unit 104 (S908), and terminates the processing. <Flow example: Generating a satisfiability test expression> Next, a detailed flow of the check equation generation (S305) in the check equation generating unit 104 will be described. Fig. 10 is a diagram showing an example of the flow of generating a satisfiability check equation in this embodiment.

[0065] In this case, the check equation generation unit 104 generates a check equation by combining the logical equation of the prediction model and the precondition with a logical AND (S401).

[0066] Furthermore, the check-formula generating unit 104 combines the negation of the constraint condition with the satisfiability check formula by logical AND (S402). A logical formula 1601 obtained by this combination is shown in FIG.

[0067] Next, the check equation generating unit 104 outputs the sufficiency check equation obtained in S402 to the sufficiency determining unit 105 (S403), and the process ends. <Flow example: Sufficiency determination> Next, a detailed flow of the sufficiency determination process (S306) in the sufficiency determination unit 105 will be described. Fig. 12 is a diagram showing an example of the flow of the sufficiency determination process in this embodiment.

[0068] In this case, the sufficiency determination unit 105 inputs the sufficiency test formula into the SMT solver program 2013 and starts it (S501), and searches for variable values ​​that make the sufficiency test formula true (S502). These variable values ​​become counterexamples (counterexamples 1701 and 1702 in FIG. 13).

[0069] Moreover, the sufficiency determination unit 105 outputs the sufficiency determination result to the test accuracy evaluation unit 106 (S503), and ends the process. <Flow example: Inspection accuracy evaluation> Next, a detailed flow of the inspection accuracy evaluation process (S308, S309) in the inspection accuracy evaluation unit 106 will be described. Fig. 14 is a diagram showing an example of the flow of the inspection accuracy evaluation process in this embodiment, and specifically, when a counterexample exists, the counterexample is input to the prediction model to confirm that it is a true counterexample.

[0070] If the sufficiency judgment result is sufficiency (S307: Yes), the test accuracy evaluation unit 106 inputs the sufficiency test formula into the SMT solver program 2013 by the sufficiency judgment unit 105 and starts it (S601), and searches for variable values ​​that make the sufficiency test formula true (S602). The test accuracy evaluation unit 106 outputs the variable values ​​that make the sufficiency test formula true as counterexample data to the prediction model (S603), obtains output data of the prediction model with the counterexample data as input data (S309), and checks whether the output data satisfies the constraint condition (S310). If the output data satisfies the constraint condition (S310: Yes), it is determined that the counterexample data is a false counterexample. On the other hand, if the output data does not satisfy the constraint condition (S310: No), that is, if the counterexample data is a true counterexample, it is determined that the prediction model violates the constraint condition.

[0071] For example, in the counter example 1 obtained for the prediction model (1201, 1202) in FIG. 4 under the preconditions (1301), constraints (1302), and approximation threshold (1303) in FIG. 5, in the original prediction model, w1=1.2, w2=1.4, and y=2.6, violating the constraints. Therefore, this is a true counterexample (Figure 15A).

[0072] On the other hand, in the case of counterexample 2, in the original prediction model, w1 = 0.7, w2 = 1.4, and y = 2.1, which does not violate the constraints, so it is not a counterexample but a false counterexample (FIG. 15B). In the case of a false counterexample like this, it is determined that the required verification accuracy is not achieved due to approximation.

[0073] The inspection accuracy evaluation unit 106 outputs the variable values ​​obtained in the above-mentioned search to the output device 205 as a counterexample 1901 (FIG. 16A) (S312), and ends the process.

[0074] The test accuracy evaluation unit 106 may identify a subexpression satisfied by a counterexample and output it to the output device 205 via the test result output unit 107. An output example 1902 in this case is shown in Fig. 16B. By performing such processing, it is possible to contribute to correcting the prediction model by outputting the process of deriving an inference output value that violates a constraint condition in the prediction model.

[0075] Furthermore, the test accuracy evaluation unit 106 may relax the constraint conditions based on the counterexamples and output the result on the output device 205 via the test result output unit 107. An output example 1903 in this case is shown in Fig. 16C. By performing such processing, it is expected that the constraint conditions that fit the prediction model can be output, which will contribute to understanding the characteristics of the prediction model.

[0076] The software testing apparatus 100 may include an approximation threshold adjusting unit 3111 (FIG. 17) that adjusts the approximation threshold when the testing accuracy evaluating unit 106 judges a counterexample to be a false counterexample as described above.

[0077] In the main flow (FIG. 18) in this case, if it is determined in step S710 that the counterexample data satisfies the constraint condition (S710: Yes), the approximation threshold adjustment unit 3111 sets the approximation threshold to 0 and returns the process to the approximation range analysis unit process (S704), for example, when the counterexample detected above is not counterexample 1 but counterexample 2. By performing such an operation, it is possible to adjust the approximation threshold when a false counterexample is detected, thereby improving the inspection accuracy and always obtaining correct test results even when starting from a rough approximation. As a result, improvement in test efficiency can be expected.

[0078] Furthermore, the software testing device 100 may delete paths that do not satisfy the preconditions from the logical formula to improve the efficiency of subsequent processing. For example, when the precondition is f0<15 ∧ f1>0.5, a logical formula 2001 in which paths that do not satisfy the precondition and include not(f0<30) are deleted is shown in FIG. 19. By performing such an operation, the logical formula that does not satisfy the preconditions is deleted before the approximation range analysis and the sufficiency determination (for example, see decision tree 2 in FIG. 20), and the amount of calculation for extracting cases in which the inference output value of the prediction model violates the constraint conditions can be reduced.

[0079] In addition, the software testing device 100 may, for example, exclude "Decision Tree 2" from the approximation target when the maximum value of the weights assigned to the leaf nodes of "Decision Tree 2" is greater than the weights of the leaf nodes of "Decision Tree 1", and perform an approximation of the logic 2101 of the predictive model (Figure 21).

[0080] Furthermore, the software testing apparatus 100 may arrange the logical formulas of the prediction model in descending order of the weights assigned to the leaf nodes to construct the sufficiency check formula 2201 (FIG. 22). By performing such an operation, sufficiency is judged starting from the one with the largest inference output value, thereby improving the efficiency of detecting counterexamples.

[0081] The software test apparatus 100 may also perform control to change the approximation threshold depending on the input value range. In this case, the precondition 2301 ( FIG. 23A ) and the constraint 2302 ( 23B) as shown in the figure, the software test apparatus 100 sets the following two preconditions (preconditions: f0<15 ∧ f0>12 ∧ f1>0.5, f0≦12 ∧ f1 >0.5) and set an approximation threshold (approximation threshold: 0, approximation threshold: 0.5) for each (FIGS. 23C and 23D).

[0082] By implementing these operations, it is possible to increase the accuracy of checking input value ranges where counterexamples are likely to exist, and improve testing efficiency. <If the prediction model is a neural network> As a form of the prediction model, instead of the decision tree set model, a neural network can be assumed as shown in Fig. 24. The neural network 2401 is configured by nodes divided into a plurality of layers consisting of a first layer to a Kth layer.

[0083] Each node in this neural network 2401 outputs to the next layer node a value calculated using the output value of the node in the previous layer multiplied by a weight as an input. In this case, the neural network 2401 can be expressed by a logical formula 2402.

[0084] Here, the processing of the logical expression generating unit 102 when the prediction model is a neural network will be described with reference to Fig. 26. In this case, the logical expression generating unit 102 performs processing to decompose the neural network into nodes and combine the input / output relationships with logical products. The logical expression 2402 obtained for the neural network 2401 has the configuration shown in Fig. 24.

[0085] A more simplified neural network 201 is shown in Fig. 26. In this case, examples of connection weights 2502 between nodes, biases 2503, input variables 2504, output variables 2505, and activation functions 2506 are also shown in Fig. 26. Furthermore, examples of preconditions 2507, constraints 2508, and approximation thresholds 2509 are also shown.

[0086] In this case, the logical expression generating unit 102 sets the initial value of the logical expression of the prediction model to null (S1001).

[0087] Furthermore, the logical expression generating unit 102 sets the initial value of the logical expression of the layer to null (S1002).

[0088] Next, the logical expression generating unit 102 obtains a collection of nodes in the layer (S1003).

[0089] Furthermore, the logical expression generating unit 102 sets the initial value of the logical expression of the node to null (S1004).

[0090] Next, the logical expression generating unit 102 generates a variable name corresponding to the node (S1005), and determines whether the node is in the input layer (S1006).

[0091] If the result of the above determination is that the node is in the input layer (S1006: YES), the logical expression generating unit 102 sets "node variable name=input variable name" as the logical expression of the node (S1008).

[0092] On the other hand, if the result of the above-mentioned judgment is that the node is not in the input layer (S1006: NO), the logical expression generation unit 102 sets “node variable name=activation function (sum of (previous layer node × weight)+bias)” as the logical expression 2601 ( FIG. 27 ) of the node (S1007).

[0093] Next, logical expression generation section 102 combines logical expression 2602 (FIG. 27) of the layer with logical expression 2601 (FIG. 27) of the node by logical AND (S1009).

[0094] In addition, the logical expression generating unit 102 judges whether the layer is an output layer (S1010). As a result, if the layer is an output layer (S1010: YES), the logical expression generating unit 102 combines "node variable name=output variable name" with the logical expression of the layer by logical AND (S1011).

[0095] On the other hand, if the result of the above determination is that the layer is not the output layer (S1010: NO), the logical expression generation unit 102 acquires one of the unprocessed nodes in the layer as the next node to be processed (S1012).

[0096] Furthermore, logical expression generating unit 102 determines whether the node obtained here is the last unprocessed node in the layer (S1013).

[0097] If the result of the above determination is that it is not the last node (S1013: NO), the logical expression generating unit 102 returns the process to S1004.

[0098] On the other hand, if the result of the above determination is that it is the last node (S1013: YES), the logical expression generation unit 102 combines the logical expression of the layer with the logical expression 2603 of the prediction model (FIG. 27) by logical AND (S1014).

[0099] Next, the logical expression generating unit 102 may select one of the unprocessed layers as the next processing target (S1015).

[0100] Furthermore, the logical expression generating unit 102 determines whether the layer obtained in S1015 is the last unprocessed layer in the neural network (S1016).

[0101] If the result of the above determination is that it is not the last layer (S1016: NO), the logical expression generating unit 102 returns the process to S1002.

[0102] On the other hand, if the result of the above determination is that it is the last layer (S1016: YES), the logical expression generation unit 102 outputs the logical expression of the prediction model obtained up to this point to the approximation range analysis unit 103 (S1017), and ends the processing.

[0103] Next, the logical expression approximation process when the prediction model is a neural network will be described with reference to Fig. 28. In this case, the approximation range analysis unit 103 decomposes the logical expression of the prediction model into logical expressions of layers (S1101).

[0104] Next, the approximation range analysis unit 103 decomposes the logical formula of the layer into logical formulas of the nodes (S1102).

[0105] Furthermore, the approximation range analyzing unit 103 compares the absolute value of the weight with the approximation threshold (S1103). That is, it extracts the logical formula (logical formula 2701 in FIG. 29) of the node whose absolute value of the connection weight is equal to or less than the approximation threshold.

[0106] If the result of the above comparison shows that the weight is equal to or less than the threshold (S1104: Yes), the approximate range analysis unit 103 replaces the weight of the logical formula of the node with 0 (S1105). An example of a logical formula 2702 obtained by this replacement is shown in FIG.

[0107] On the other hand, if the result of the above comparison shows that the difference is not equal to or less than the threshold (S1104: No), the approximate range analysis unit 103 combines the logical formula of the layer with the logical formula of the node by logical AND (S1106).

[0108] In addition, the approximation range analysis unit 103 obtains the logical formula of the next node (S1107) and It is then determined whether a corresponding node exists (S1108).

[0109] As a result of the above-mentioned determination, if it is found that an unprocessed node exists (S1108: Yes), the approximate range analysis unit 103 returns the process to S1102.

[0110] On the other hand, if it is determined that there is no unprocessed node (S1108: No), the approximation range analysis unit 103 combines the logical formula of the layer with the logical formula of the prediction model by logical AND (S1109). The logical formula 2703 obtained here is shown in FIG.

[0111] Next, the approximation range analysis unit 103 acquires a logical formula of one of the unprocessed layers in the neural network as a next processing target (S1110), and determines whether there are any other unprocessed layers (S1111).

[0112] If the result of this determination is that there is an unprocessed layer (S1111: Yes), the approximation range analysis unit 103 returns the process to S1102. On the other hand, if the result of the above determination is that there is no unprocessed layer (S1111: No), the approximation range analysis unit 103 outputs the logical formula of the prediction model for which approximation processing has been completed up to this point to the check formula generation unit 104 (S1112), and ends the process.

[0113] The check expression generating unit 104 creates a logical expression 2801 (FIG. 30) in which the logical expressions of the network, the prerequisites, and the negation of the constraints are combined with logical products.

[0114] Also, the satisfiability determining unit 105 searches for variable values ​​(counterexamples) that satisfy the check formula, as already explained with reference to Fig. 12. Fig. 31 illustrates counterexamples 2901 and 2902 obtained by such a search.

[0115] Furthermore, in the verification accuracy evaluation unit 106, when no counterexample exists, it is determined that the required verification accuracy has not been achieved due to approximation, whereas when a counterexample exists, the counterexample is input into the prediction model as already explained with reference to Figures 13 and 14 to confirm that it is a true counterexample.

[0116] If it is a true counterexample, it is determined that the prediction model violates the constraint condition. In the example shown in FIG. 30, the output value of the original model for counterexample 1 is y=3.2, and it is determined 3001 to be a true counterexample. If it is a false counterexample, it is determined that the required verification accuracy has not been reached due to approximation. In the example shown in FIG. 30, the output value of the original model for counterexample 2 is y=1.95, and it is determined to be a false counterexample. The fixed price is 3002.

[0117] Although the best mode for carrying out the present invention has been specifically described above, the present invention is not limited to this, and various modifications are possible without departing from the spirit and scope of the present invention.

[0118] According to this embodiment, the logical formula is simplified using the function of the approximation range analysis unit, thereby reducing the amount of calculation required to extract cases in which the inference output value of the predictive model violates the constraint conditions, and the inspection accuracy evaluation unit can eliminate detection errors associated with approximation.

[0119] In other words, the validity of a predictive model created by machine learning can be verified with appropriate accuracy and efficiency.

[0120] The description of this specification makes clear at least the following: That is, in the software testing device of the present embodiment, the arithmetic device may further execute a process of adjusting the approximation threshold value when the inspection accuracy for the prediction model is insufficient.

[0121] According to this, when a violation case is erroneously detected, the approximation threshold is adjusted to increase the inspection accuracy, so that a correct test result can always be obtained even when starting from a rough approximation, thereby improving the test efficiency.

[0122] In addition, in the software testing device of this embodiment, the arithmetic device may be configured to, when evaluating the inspection accuracy, if a counterexample exists, further execute a process to determine the counterexample, and output the counterexample when outputting the result.

[0123] This can contribute to correcting the prediction model by outputting an input value whose inference output value violates a constraint condition as a counterexample.

[0124] In addition, in the software testing device of this embodiment, when evaluating the inspection accuracy, if a counterexample exists, the arithmetic device may further execute a process of identifying a sub-expression in the logical formula that is satisfied by the counterexample, and when outputting the result, output the identified sub-expression.

[0125] This makes it possible to contribute to correcting the prediction model by outputting the process of deriving an inference output value that violates a constraint condition in the prediction model.

[0126] In addition, in the software testing device of this embodiment, when evaluating the inspection accuracy, if a counterexample exists, the arithmetic device may further execute a process of relaxing the constraint conditions based on the counterexample, and output the relaxed constraint conditions when outputting the results.

[0127] This makes it possible to contribute to understanding the characteristics of a prediction model by outputting constraint conditions that match the prediction model.

[0128] In addition, in the software testing device of this embodiment, the storage device may hold a decision tree set model as the predictive model, and the arithmetic device may, when converting the logical formula, decompose the decision tree of the decision tree set model into paths to leaf nodes and convert them into a logical formula.

[0129] This makes it possible to reduce the amount of calculation required to extract cases in which the inference output value violates the constraint condition for the decision tree set model, and to eliminate detection errors due to approximation by the inspection accuracy evaluation unit.

[0130] In addition, in the software testing device of this embodiment, the arithmetic unit may be configured to, when converting the logical formula, delete any logical formula converted from the path to the leaf node that does not satisfy the prerequisites.

[0131] According to this, by deleting logical expressions that do not satisfy the prerequisites before the approximation range analysis and the sufficiency determination, it is possible to reduce the amount of calculation required to extract cases in which the inference output value of the predictive model violates the constraint conditions.

[0132] In addition, in the software testing device of this embodiment, the calculation device may, when analyzing the approximation range, replace, with a constant, a logical expression converted from a decision tree in which the difference between the maximum and minimum values ​​of the weights assigned to leaf nodes of the decision tree is less than or equal to the approximation threshold.

[0133] According to this, when there is no counterexample in the logical formula, the predictive model also violates the constraints. This makes it possible to provide an approximation method that can guarantee that there are no cases where the constraints are violated, and that if there is even one true counterexample, the predictive model will violate the constraints.

[0134] In addition, in the software testing device of this embodiment, when analyzing the approximation range, the calculation device may exclude from the approximation targets, at a given rate, decision trees whose maximum value of the weight assigned to the leaf node is greater than that of other decision trees, or whose minimum value is smaller than that of other decision trees.

[0135] This makes it possible to exclude decision trees that have a large influence on the inference output value from the approximation targets.

[0136] In addition, in the software testing device of this embodiment, the arithmetic device may further perform a process of sorting the logical expressions converted from the paths to the leaf nodes in order of the weights assigned to the leaf nodes when generating the check equation.

[0137] According to this, by performing the sufficiency determination in ascending or descending order of the inference output values, it is possible to improve the efficiency of detecting counterexamples.

[0138] In addition, in the software testing device of this embodiment, the storage device may hold a hierarchical neural network model including a deep neural network as the predictive model, and the arithmetic device may convert the connection relationships between the nodes of the hierarchical neural network model into a logical formula when converting the logical formula.

[0139] This makes it possible to reduce the amount of calculation required to extract cases in which the inference output value violates the constraint condition for the neural network model, and to eliminate detection errors due to approximation by the inspection accuracy evaluation unit.

[0140] In the software testing device of this embodiment, the arithmetic unit may delete inter-node connections whose connection weight is equal to or less than an approximation threshold when analyzing the approximation range.

[0141] This makes it possible to provide an approximation method that can guarantee that the prediction model will not violate the constraints if there is even one true counterexample.

[0142] In addition, in the software testing method of the present embodiment, the information processing device may further execute a process of adjusting the approximation threshold value when the testing accuracy for the prediction model is insufficient. [Explanation of symbols]

[0143] 100 Software Test Equipment 101 Prediction model storage unit 102 Logical Expression Generation Unit 103 Approximation Range Analysis Unit 104 Test Expression Generation Unit 105 Sufficiency Determination Section 106 Inspection Accuracy Evaluation Department 107 Test result output section 108 Approximation threshold input section 109 Preconditions input section 110 Constraint condition input section 201 Storage device 2012 Program 2013 SMT Solver Program 202 Arithmetic equipment 203 Memory 204 Input Device 205 Output Device 206 Communication Equipment

Claims

1. A storage device that stores a predictive model generated by machine learning to be tested; a calculation device that executes the processes of: accepting an input of a precondition that determines a range of a test input value; accepting an input of a constraint condition for an inference output value of a prediction model for an input value; accepting an input of an approximation threshold; acquiring the prediction model from the storage device and converting it into a logical formula; analyzing an approximation range for the logical formula based on the approximation threshold and simplifying the logical formula; combining the simplified logical formula with the negation of the precondition and the constraint condition to generate a check formula; searching for a value that satisfies the check formula as a counterexample; A software testing apparatus comprising:

2. The computing device includes: If the test accuracy for the prediction model is insufficient, a process of adjusting the approximation threshold is further performed.

2. The software testing device according to claim 1.

3. The computing device includes: When a counterexample exists during the evaluation of the inspection accuracy, a process of determining the counterexample is further executed, and when outputting the result, the counterexample is output.

2. The software testing device according to claim 1.

4. The computing device includes: When the counterexample exists during the evaluation of the checking accuracy, a process of identifying a sub-expression in the logical formula that is satisfied by the counterexample is further executed, and when outputting the result, the identified sub-expression is output.

2. The software testing device according to claim 1.

5. The computing device includes: When the counterexample exists during the evaluation of the inspection accuracy, a process of relaxing the constraint condition based on the counterexample is further executed, and when outputting the result, the relaxed constraint condition is output.

2. The software testing device according to claim 1.

6. The storage device includes: A decision tree set model is held as the prediction model; The computing device includes: When converting the logical formula, the decision tree of the decision tree set model is decomposed into paths to leaf nodes and converted into a logical formula.

2. The software testing device according to claim 1.

7. The computing device includes: When converting the logical expressions, a logical expression that does not satisfy the precondition is deleted from among the logical expressions converted from the path to the leaf node.

7. The software testing device according to claim 6.

8. The computing device includes: In analyzing the approximation range, a logical expression converted from a decision tree in which a difference between a maximum value and a minimum value of a weight assigned to a leaf node of the decision tree is equal to or smaller than the approximation threshold is replaced with a constant.

7. The software testing device according to claim 6.

9. The computing device includes: In the analysis of the approximation range, a given proportion of decision trees whose maximum value of the weights assigned to the leaf nodes is greater than that of other decision trees or whose minimum value is smaller than that of other decision trees are excluded from the approximation target.

9. The software testing device according to claim 8.

10. The computing device includes: When generating the check formula, a process of sorting the logical formulas converted from the paths to the leaf nodes in the order of weights assigned to the leaf nodes is further performed.

7. The software testing device according to claim 6.

11. The storage device includes: A hierarchical neural network model including a deep neural network is held as the prediction model; The computing device includes: When converting the logical formula, a connection relationship between nodes of the hierarchical neural network model is converted into a logical formula.

2. The software testing device according to claim 1.

12. The computing device includes: In analyzing the approximation range, a connection between nodes whose connection weight is equal to or less than an approximation threshold is deleted.

12. The software testing apparatus according to claim 11.

13. An information processing device, The predictive model generated by machine learning to be tested is stored in a storage device. a process of accepting an input of a precondition that determines a range of test input values, a process of accepting an input of a constraint condition for an inferred output value of a predictive model for an input value, a process of accepting an input of an approximation threshold, a process of retrieving the predictive model from the storage device and converting it into a logical formula, a process of analyzing an approximation range for the logical formula based on the approximation threshold and simplifying the logical formula, a process of combining the simplified logical formula with the negation of the precondition and the constraint condition to generate a check formula, a process of searching for a value that satisfies the check formula as a counterexample, a process of inputting the counterexample into the predictive model if one exists and evaluating the test accuracy, and a process of outputting the result of the evaluation.

1. A software testing method comprising:

14. The information processing device, and if the test accuracy for the prediction model is insufficient, further performing a process of adjusting the approximation threshold.

14. The software testing method according to claim 13.

Images