[论文解读] CAGFuzz: Coverage-Guided Adversarial Generative Fuzzing Testing of Deep Learning Systems

Pengcheng Zhang, Qiyin Dai+1 more|arXiv (Cornell University)|Nov 14, 2019

Adversarial Robustness in Machine Learning参考文献 52被引用 6

一句话总结

CAGFuzz 是一种基于覆盖率的对抗性生成模糊测试框架，通过在数据分布上训练通用的对抗性样本生成器（AEG），利用深度特征约束（余弦相似度）在保持语义一致性的同时生成难以察觉的扰动，从而提升深度学习系统的测试效果。该方法实现了更高的神经元覆盖率，检测到隐藏错误，并在标准数据集上提升了DNN的准确性。

ABSTRACT

Deep Learning systems (DL) based on Deep Neural Networks (DNNs) are more and more used in various aspects of our life, including unmanned vehicles, speech processing, and robotics. However, due to the limited dataset and the dependence on manual labeling data, DNNs often fail to detect their erroneous behaviors, which may lead to serious problems. Several approaches have been proposed to enhance the input examples for testing DL systems. However, they have the following limitations. First, they design and generate adversarial examples from the perspective of model, which may cause low generalization ability when they are applied to other models. Second, they only use surface feature constraints to judge the difference between the adversarial example generated and the original example. The deep feature constraints, which contain high-level semantic information, such as image object category and scene semantics are completely neglected. To address these two problems, in this paper, we propose CAGFuzz, a Coverage-guided Adversarial Generative Fuzzing testing approach, which generates adversarial examples for a targeted DNN to discover its potential defects. First, we train an adversarial case generator (AEG) from the perspective of general data set. Second, we extract the depth features of the original and adversarial examples, and constrain the adversarial examples by cosine similarity to ensure that the semantic information of adversarial examples remains unchanged. Finally, we retrain effective adversarial examples to improve neuron testing coverage rate. Based on several popular data sets, we design a set of dedicated experiments to evaluate CAGFuzz. The experimental results show that CAGFuzz can improve the neuron coverage rate, detect hidden errors, and also improve the accuracy of the target DNN.

研究动机与目标

• 解决现有对抗性样本生成技术缺乏泛化能力的问题，这些技术通常依赖于特定模型架构。
• 克服浅层像素级约束的局限性，通过引入高层语义深度特征进行改进。
• 在开发和部署阶段提升神经元覆盖率并检测DNN中的隐藏缺陷。
• 生成自然且难以察觉的对抗性样本，通过深度特征相似性保持语义一致性。
• 通过使用对抗性生成样本进行再训练，提升DNN的鲁棒性。

提出的方法

• 在通用数据集上训练对抗性样本生成器（AEG），不依赖于特定的DNN架构。
• 利用原始样本与对抗性样本之间深度特征的余弦相似度，约束语义一致性。
• 对原始输入施加微小且难以察觉的扰动，以生成对抗性样本。
• 使用神经元覆盖率作为反馈信号，指导迭代生成过程以最大化覆盖率。
• 使用生成的对抗性样本对目标DNN进行再训练，以提升其鲁棒性。
• 利用领域自适应技术在不同数据域之间进行映射，实现有效的扰动注入。

实验结果

研究问题

• RQ1 通过通用数据驱动训练生成的对抗性样本，是否能在跨模型泛化方面优于模型特定的方法？
• RQ2 通过深度特征约束（如余弦相似度）约束对抗性样本，是否能比像素级约束更好地保持语义一致性？
• RQ3 结合深度特征约束的覆盖率引导对抗性模糊测试，是否能检测到更多DNN中的隐藏错误？
• RQ4 使用CAGFuzz生成的样本进行再训练，能在多大程度上提升DNN的准确性和鲁棒性？
• RQ5 与DeepHunter和DeepTest等现有方法相比，CAGFuzz在覆盖率和错误检测方面表现如何？

主要发现

• CAGFuzz 在多个标准数据集上显著提升了神经元覆盖率，证明其在有效探索DNN激活空间方面的有效性。
• 该方法在先进DNN模型中检测到数千种此前未被发现的错误行为。
• CAGFuzz生成的对抗性样本与原始输入保持高度语义相似性，经由深度特征约束验证。
• 使用CAGFuzz生成的样本进行再训练，可显著提升DNN的准确性。
• 由于更强的泛化能力和语义一致性保持，该方法在覆盖率和错误检测方面优于DeepHunter和DeepTest等现有方法。
• 深度特征约束的使用使得对深层网络层的测试更加有效，相比基于像素级约束的方法具有明显优势。