{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T05:05:16Z","timestamp":1750309516359,"version":"3.41.0"},"reference-count":60,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2025,4,28]],"date-time":"2025-04-28T00:00:00Z","timestamp":1745798400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Jiangsu Provincial Frontier Leading Technology Fundamental Research Project","award":["BK20202001"],"award-info":[{"award-number":["BK20202001"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["61702041"],"award-info":[{"award-number":["61702041"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Beijing Information Science and Technology University \u201cQin-Xin Talent\u201d Cultivation Project","award":["QXTCP B202406"],"award-info":[{"award-number":["QXTCP B202406"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Softw. Eng. Methodol."],"published-print":{"date-parts":[[2025,5,31]]},"abstract":"<jats:p>\n            Convolutional Neural Networks (CNNs) have been widely used in various fields. However, it is essential to perform sufficient testing to detect internal defects before deploying CNNs, especially in security-sensitive scenarios. Generating error-inducing inputs to trigger erroneous behavior is the primary way to detect CNN model defects. However, in practice, when the model under test is a black-box CNN model without accessible internal information, in some scenarios it is still necessary to generate high-quality test inputs within a limited testing budget. In such a new scenario, a potential approach is to generate transferable test inputs by analyzing the internal knowledge of other white-box CNN models similar to the model under test, and then use transferable test inputs to test the black-box CNN model. The main challenge in generating transferable test inputs is how to improve their error-inducing capability for different CNN models without changing the test oracle. We found that different CNN models make predictions based on features of similar important regions in images. Adding targeted perturbations to important regions will generate transferable test inputs with high realism. Therefore, we propose the Interpretable Analysis-based Transferable Test (IATT) Generation method for CNNs, which employs interpretation methods of CNN models to explain and localize important regions in test inputs, using backpropagation optimizer and perturbation mask process to add targeted perturbations to these important regions, thereby generating transferable test inputs. This process is repeated to iteratively optimize the transferability and realism of the test inputs. To verify the effectiveness of IATT, we perform experimental studies on nine deep learning models, including ResNet-50 and Vit-B\/16, and commercial computer vision system\n            <jats:italic>Google Cloud Vision<\/jats:italic>\n            , and compared our method with four state-of-the-art baseline methods. Experimental results show that transferable test inputs generated by IATT can effectively cause black-box target models to output incorrect results. Compared to existing testing and adversarial attack methods, the average Error-inducing Success Rate (ESR) in different testing scenarios is 18.1%\u201352.7% greater than the baseline methods. Additionally, the test inputs generated by IATT achieve high ESR while maintaining high realism.\n          <\/jats:p>","DOI":"10.1145\/3705301","type":"journal-article","created":{"date-parts":[[2024,11,26]],"date-time":"2024-11-26T14:35:01Z","timestamp":1732631701000},"page":"1-34","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["IATT: Interpretation Analysis-based Transferable Test Generation for Convolutional Neural Networks"],"prefix":"10.1145","volume":"34","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-5842-802X","authenticated-orcid":false,"given":"Ruilin","family":"Xie","sequence":"first","affiliation":[{"name":"School of Computer Science, Beijing Information Science and Technology University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1180-3891","authenticated-orcid":false,"given":"Xiang","family":"Chen","sequence":"additional","affiliation":[{"name":"School of Artificial Intelligence and Computer Science, Nantong University, Nantong, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-7976-1928","authenticated-orcid":false,"given":"Qifan","family":"He","sequence":"additional","affiliation":[{"name":"School of Computer Science, Beijing Information Science and Technology University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9916-4790","authenticated-orcid":false,"given":"Bixin","family":"Li","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Southeast University, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5537-9236","authenticated-orcid":false,"given":"Zhanqi","family":"Cui","sequence":"additional","affiliation":[{"name":"School of Computer Science, Beijing Information Science and Technology University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,4,28]]},"reference":[{"doi-asserted-by":"publisher","key":"e_1_3_2_2_2","DOI":"10.1109\/TASLP.2014.2339736"},{"unstructured":"Wieland Brendel Jonas Rauber and Matthias Bethge. 2017. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv:1712.04248. Retrieved from https:\/\/arxiv.org\/abs\/1712.04248","key":"e_1_3_2_3_2"},{"doi-asserted-by":"publisher","key":"e_1_3_2_4_2","DOI":"10.1109\/ICCV.2019.00603"},{"doi-asserted-by":"publisher","key":"e_1_3_2_5_2","DOI":"10.1145\/3468264.3468614"},{"doi-asserted-by":"publisher","key":"e_1_3_2_6_2","DOI":"10.1109\/CVPR.2019.00790"},{"unstructured":"Finale Doshi-Velez and Been Kim. 2017. Towards a rigorous science of interpretable machine learning. arXiv:1702.08608. Retrieved from https:\/\/arxiv.org\/abs\/1702.08608","key":"e_1_3_2_7_2"},{"key":"e_1_3_2_8_2","volume-title":"Proceedings of the 9th International Conference on Learning","author":"Dosovitskiy Alexey","year":"2021","unstructured":"Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. 2021. An image is worth 16x16 words: Transformers for image recognition at scale. In Proceedings of the 9th International Conference on Learning Representations. Retrieved from https:\/\/iclr.cc\/virtual\/2021\/oral\/3458"},{"doi-asserted-by":"publisher","key":"e_1_3_2_9_2","DOI":"10.1145\/3219819.3220099"},{"doi-asserted-by":"publisher","key":"e_1_3_2_10_2","DOI":"10.5555\/2354409.2354978"},{"unstructured":"Ian J. Goodfellow Jonathon Shlens and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv:1412.6572. Retrieved from https:\/\/arxiv.org\/abs\/1412.6572","key":"e_1_3_2_11_2"},{"doi-asserted-by":"publisher","key":"e_1_3_2_12_2","DOI":"10.1145\/3368089.3409754"},{"doi-asserted-by":"publisher","key":"e_1_3_2_13_2","DOI":"10.1109\/CVPR.2016.90"},{"doi-asserted-by":"publisher","key":"e_1_3_2_14_2","DOI":"10.1109\/CVPR.2017.243"},{"doi-asserted-by":"crossref","unstructured":"Xiaowei Huang Daniel Kroening Marta Kwiatkowska Wenjie Ruan Youcheng Sun Emese Thamo Min Wu and Xinping Yi. 2019. A survey of safety and trustworthiness of deep neural networks: Verification testing adversarial attack and defence and interpretability. arXiv:1812.08342. Retrieved from https:\/\/arxiv.org\/abs\/1812.08342","key":"e_1_3_2_15_2","DOI":"10.1016\/j.cosrev.2020.100270"},{"doi-asserted-by":"publisher","key":"e_1_3_2_16_2","DOI":"10.1113\/jphysiol.1962.sp006837"},{"key":"e_1_3_2_17_2","first-page":"2137","article-title":"Black-box adversarial attacks with limited queries and information","author":"Ilyas Andrew","year":"2018","unstructured":"Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. 2018. Black-box adversarial attacks with limited queries and information. In Proceedings of the International Conference on Machine Learning, 2137\u20132146.","journal-title":"Proceedings of the International Conference on Machine Learning"},{"key":"e_1_3_2_18_2","article-title":"Adversarial examples are not bugs, they are features","volume":"32","author":"Ilyas Andrew","year":"2019","unstructured":"Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. 2019. Adversarial examples are not bugs, they are features. In Proceedings of the Advances in Neural Information Processing Systems, 32.","journal-title":"Proceedings of the Advances in Neural Information Processing Systems"},{"unstructured":"Nathan Inkawhich Matthew Inkawhich Yiran Chen and Hai Li. 2018. Adversarial attacks for optical flow-based action recognition classifiers. arXiv:1811.11875. Retrieved from https:\/\/arxiv.org\/abs\/1811.11875","key":"e_1_3_2_19_2"},{"doi-asserted-by":"publisher","key":"e_1_3_2_20_2","DOI":"10.1109\/TIP.2021.3089943"},{"doi-asserted-by":"publisher","key":"e_1_3_2_21_2","DOI":"10.1109\/CVPR.2019.00453"},{"doi-asserted-by":"publisher","key":"e_1_3_2_22_2","DOI":"10.1109\/CVPR42600.2020.00813"},{"key":"e_1_3_2_23_2","author":"Krizhevsky Alex","year":"2009","unstructured":"Alex Krizhevsky. 2009. Learning Multiple Layers of Features from Tiny Images. Technical Report.","journal-title":"Learning Multiple Layers of Features from Tiny Images"},{"doi-asserted-by":"publisher","key":"e_1_3_2_24_2","DOI":"10.1038\/nature14539"},{"doi-asserted-by":"publisher","key":"e_1_3_2_25_2","DOI":"10.1145\/3395363.3397346"},{"doi-asserted-by":"publisher","key":"e_1_3_2_26_2","DOI":"10.1109\/CVPR42600.2020.00044"},{"unstructured":"Yanghao Li Saining Xie Xinlei Chen Piotr Dollar Kaiming He and Ross Girshick. 2021. Benchmarking detection transfer learning with vision transformers. arXiv:2111.11429. Retrieved from https:\/\/arxiv.org\/abs\/2111.11429","key":"e_1_3_2_27_2"},{"doi-asserted-by":"publisher","key":"e_1_3_2_28_2","DOI":"10.1007\/978-3-319-10602-1_48"},{"unstructured":"Ilya Loshchilov and Frank Hutter. 2017. Decoupled weight decay regularization. arXiv:1711.05101. Retrieved from https:\/\/arxiv.org\/abs\/1711.05101","key":"e_1_3_2_29_2"},{"key":"e_1_3_2_30_2","author":"Molnar Christoph","year":"2020","unstructured":"Christoph Molnar. 2020. Interpretable Machine Learning. Lulu.com.","journal-title":"Interpretable Machine Learning"},{"unstructured":"W. James Murdoch Chandan Singh Karl Kumbier Reza Abbasi-Asl and Bin Yu. 2019. Interpretable machine learning: Definitions methods and applications. arXiv:1901.04592. Retrieved from https:\/\/arxiv.org\/abs\/1901.04592","key":"e_1_3_2_31_2"},{"doi-asserted-by":"publisher","key":"e_1_3_2_32_2","DOI":"10.1109\/ASE.2019.00078"},{"key":"e_1_3_2_33_2","volume-title":"Proceedings of the NIPS Workshop on Deep Learning and Unsupervised Feature Learning","volume":"2011","author":"Netzer Yuval","year":"2011","unstructured":"Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, and Andrew Y. Ng. 2011. Reading digits in natural images with unsupervised feature learning. In Proceedings of the NIPS Workshop on Deep Learning and Unsupervised Feature Learning, Vol. 2011. Granada, 4."},{"doi-asserted-by":"publisher","key":"e_1_3_2_34_2","DOI":"10.1109\/EuroSP.2016.36"},{"doi-asserted-by":"publisher","key":"e_1_3_2_35_2","DOI":"10.1145\/3132747.3132785"},{"key":"e_1_3_2_36_2","first-page":"20052","volume-title":"Proceedings of the Advances in Neural Information Processing Systems","author":"Pintor Maura","year":"2021","unstructured":"Maura Pintor, Fabio Roli, Wieland Brendel, and Battista Biggio. 2021. Fast minimum-norm adversarial attacks through adaptive norm constraints. In Proceedings of the Advances in Neural Information Processing Systems, 20052\u201320062."},{"doi-asserted-by":"publisher","key":"e_1_3_2_37_2","DOI":"10.1109\/TPAMI.2016.2577031"},{"key":"e_1_3_2_38_2","first-page":"355","volume-title":"Proceedings of the 36th IEEE\/ACM International Conference on Automated Software Engineering (ASE \u201921)","author":"Riccio Vincenzo","year":"2022","unstructured":"Vincenzo Riccio, Nargiz Humbatova, Gunel Jahangirova, and Paolo Tonella. 2022. DeepMetis: Augmenting a deep learning test set to increase its mutation score. In Proceedings of the 36th IEEE\/ACM International Conference on Automated Software Engineering (ASE \u201921). IEEE Press, 355\u2013367. DOI: https:\/\/doi.org\/10.1109\/ASE51524.2021.9678764"},{"key":"e_1_3_2_39_2","volume-title":"Software Engineering: A Practitioner\u2019s Approach","author":"Roger S. Pressman","year":"2015","unstructured":"S. Pressman Roger and R. Maxin Bruce. 2015. Software Engineering: A Practitioner\u2019s Approach. McGraw-Hill Education."},{"doi-asserted-by":"publisher","key":"e_1_3_2_40_2","DOI":"10.1007\/s11263-015-0816-y"},{"doi-asserted-by":"publisher","key":"e_1_3_2_41_2","DOI":"10.1007\/s11263-019-01228-7"},{"unstructured":"Karen Simonyan and Andrew Zisserman. 2014. Very deep convolutional networks for large-scale image recognition. arXiv:1409.1556. Retrieved from https:\/\/arxiv.org\/abs\/1409.1556","key":"e_1_3_2_42_2"},{"doi-asserted-by":"publisher","key":"e_1_3_2_43_2","DOI":"10.1109\/CVPR.2016.308"},{"unstructured":"Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian Goodfellow and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv:1312.6199. Retrieved from https:\/\/arxiv.org\/abs\/1312.6199","key":"e_1_3_2_44_2"},{"doi-asserted-by":"publisher","key":"e_1_3_2_45_2","DOI":"10.1007\/s10664-021-09985-1"},{"doi-asserted-by":"publisher","key":"e_1_3_2_46_2","DOI":"10.1145\/3180155.3180220"},{"unstructured":"Florian Tram\u00e8r Nicolas Papernot Ian Goodfellow Dan Boneh and Patrick McDaniel. 2017. The space of transferable adversarial examples. arXiv:1704.03453. Retrieved from https:\/\/arxiv.org\/abs\/1704.03453","key":"e_1_3_2_47_2"},{"unstructured":"Dimitris Tsipras Shibani Santurkar Logan Engstrom Alexander Turner and Aleksander Madry. 2018. Robustness may be at odds with accuracy. arXiv:1805.12152. Retrieved from https:\/\/arxiv.org\/abs\/1805.12152","key":"e_1_3_2_48_2"},{"doi-asserted-by":"publisher","key":"e_1_3_2_49_2","DOI":"10.1109\/CVPRW50498.2020.00020"},{"doi-asserted-by":"publisher","key":"e_1_3_2_50_2","DOI":"10.1145\/3533767.3534386"},{"unstructured":"Xingxing Wei Siyuan Liang Ning Chen and Xiaochun Cao. 2018. Transferable adversarial attacks for image and video object detection. arXiv:1811.12641. Retrieved from https:\/\/arxiv.org\/abs\/1811.12641","key":"e_1_3_2_51_2"},{"unstructured":"Dongxian Wu Yisen Wang Shu-Tao Xia James Bailey and Xingjun Ma. 2020. Skip connections matter: On the transferability of adversarial examples generated with Resnets. arXiv:2002.05990. Retrieved from https:\/\/arxiv.org\/abs\/2002.05990","key":"e_1_3_2_52_2"},{"unstructured":"Chaowei Xiao Jun-Yan Zhu Bo Li Warren He Mingyan Liu and Dawn Song. 2018. Spatially transformed adversarial examples. arXiv:1801.02612. Retrieved from https:\/\/arxiv.org\/abs\/1801.02612","key":"e_1_3_2_53_2"},{"issue":"6","key":"e_1_3_2_54_2","first-page":"2753","article-title":"IATG: Interpretation analysis based testing method for autonomous driving software","volume":"35","author":"Xie Ruilin","year":"2023","unstructured":"Ruilin Xie, Zhanqi Cui, Xiang Chen, and Liwei Zheng. 2023. IATG: Interpretation analysis based testing method for autonomous driving software. Journal of Software (in Chinese with English Abstract) 35, 6 (2023), 2753\u20132774. DOI: https:\/\/doi.org\/10.13328\/j.cnki.jos.006836","journal-title":"Journal of Software (in Chinese with English Abstract)"},{"doi-asserted-by":"publisher","key":"e_1_3_2_55_2","DOI":"10.1007\/978-3-030-87199-4_16"},{"doi-asserted-by":"publisher","key":"e_1_3_2_56_2","DOI":"10.1145\/3368089.3409750"},{"doi-asserted-by":"publisher","key":"e_1_3_2_57_2","DOI":"10.1109\/TSE.2019.2962027"},{"doi-asserted-by":"publisher","key":"e_1_3_2_58_2","DOI":"10.1109\/CVPR.2018.00068"},{"doi-asserted-by":"publisher","key":"e_1_3_2_59_2","DOI":"10.1145\/3394486.3403349"},{"doi-asserted-by":"publisher","key":"e_1_3_2_60_2","DOI":"10.1109\/CVPR.2016.319"},{"doi-asserted-by":"publisher","key":"e_1_3_2_61_2","DOI":"10.1109\/TIP.2022.3211736"}],"container-title":["ACM Transactions on Software Engineering and Methodology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3705301","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3705301","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:18:02Z","timestamp":1750295882000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3705301"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,4,28]]},"references-count":60,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2025,5,31]]}},"alternative-id":["10.1145\/3705301"],"URL":"https:\/\/doi.org\/10.1145\/3705301","relation":{},"ISSN":["1049-331X","1557-7392"],"issn-type":[{"type":"print","value":"1049-331X"},{"type":"electronic","value":"1557-7392"}],"subject":[],"published":{"date-parts":[[2025,4,28]]},"assertion":[{"value":"2023-11-29","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-11-05","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-04-28","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}