[Paper Review] Testing Deep Learning Models: A First Comparative Study of Multiple Testing Techniques

Mohit Kumar Ahuja, Arnaud Gotlieb+1 more|arXiv (Cornell University)|Feb 24, 2022

Adversarial Robustness in Machine LearningComputer Science43 references9 citations

TL;DR

This paper presents a comparative experimental study of six software testing techniques—differential, metamorphic, mutation, combinatorial, adversarial perturbation, and traditional testing—for deep learning (DL) models in vision-based systems (VBS). It evaluates their effectiveness in detecting model faults, particularly robustness issues and adversarial vulnerabilities, and concludes that combining techniques like metamorphic and adversarial testing offers the most comprehensive fault detection and model validation.

ABSTRACT

Deep Learning (DL) has revolutionized the capabilities of vision-based systems (VBS) in critical applications such as autonomous driving, robotic surgery, critical infrastructure surveillance, air and maritime traffic control, etc. By analyzing images, voice, videos, or any type of complex signals, DL has considerably increased the situation awareness of these systems. At the same time, while relying more and more on trained DL models, the reliability and robustness of VBS have been challenged and it has become crucial to test thoroughly these models to assess their capabilities and potential errors. To discover faults in DL models, existing software testing methods have been adapted and refined accordingly. In this article, we provide an overview of these software testing methods, namely differential, metamorphic, mutation, and combinatorial testing, as well as adversarial perturbation testing and review some challenges in their deployment for boosting perception systems used in VBS. We also provide a first experimental comparative study on a classical benchmark used in VBS and discuss its results.

Motivation & Objective

• To evaluate and compare the effectiveness of multiple software testing techniques tailored for deep learning models in vision-based systems (VBS).
• To address critical challenges in DL testing, including model robustness, test oracle problems, adversarial vulnerabilities, and training data quality.
• To empirically assess how different testing techniques detect faults and improve model reliability in real-world deployment scenarios.
• To identify the most effective combinations of testing techniques for comprehensive validation of DL models.

Proposed method

• Adapts and applies five established software testing techniques—differential, metamorphic, mutation, combinatorial, and adversarial perturbation testing—to deep learning models in VBS.
• Uses a classical benchmark dataset for image classification to conduct controlled experiments on model behavior under various test inputs.
• Employs adversarial attack tools like DeepFool and GAN-based methods to generate perturbed inputs that challenge model robustness.
• Applies mutation operators to generate slight input variations and assess model consistency under input perturbations.
• Uses metamorphic relations to define expected output behavior under input transformations (e.g., image flipping) without requiring an external oracle.
• Combines test results across techniques to evaluate fault detection coverage and model robustness.

Experimental results

Research questions

• RQ1 How effective are different testing techniques in detecting faults in deep learning models used in vision-based systems?
• RQ2 To what extent can metamorphic and differential testing mitigate the oracle problem in DL model evaluation?
• RQ3 How well do mutation and adversarial perturbation testing expose model vulnerabilities and robustness issues?
• RQ4 What is the relative contribution of each testing technique to identifying model weaknesses and improving reliability?
• RQ5 Which combinations of testing techniques provide the most comprehensive fault detection and model validation?

Key findings

• Metamorphic and differential testing effectively mitigate the oracle problem by defining expected output relations without requiring ground-truth labels.
• Adversarial perturbation testing successfully exposed model vulnerabilities, with one algorithm achieving a 97% adversarial success rate by modifying only 4.02% of input features on average.
• Mutation testing identified corner cases and model inconsistencies under minor input variations, highlighting weaknesses in model generalization.
• Combinatorial testing revealed sensitivity to input interactions, particularly in complex vision tasks, improving robustness assessment.
• The combination of metamorphic testing and adversarial perturbation testing provided the broadest fault coverage, outperforming individual techniques.
• While traditional evaluation metrics like accuracy are insufficient, integrating multiple testing techniques significantly enhances confidence in model reliability and robustness.