Deep Learning (DL) systems are key enablers for engineering intelligent
applications due to their ability to solve complex tasks such as image
recognition and machine translation. Nevertheless, using DL systems in safety-
and security-critical applications requires to provide testing evidence for
their dependable operation. Recent research in this direction focuses on
adapting testing criteria from traditional software engineering as a means of
increasing confidence for their correct behaviour. However, they are inadequate
in capturing the intrinsic properties exhibited by these systems. We bridge
this gap by introducing DeepImportance, a systematic testing methodology
accompanied by an Importance-Driven (IDC) test adequacy criterion for DL
systems. Applying IDC enables to establish a layer-wise functional
understanding of the importance of DL system components and use this
information to assess the semantic diversity of a test set. Our empirical
evaluation on several DL systems, across multiple DL datasets and with
state-of-the-art adversarial generation techniques demonstrates the usefulness
and effectiveness of DeepImportance and its ability to support the engineering
of more robust DL systems.

本文介绍了一种名为 DeepImportance 的系统化测试方法，该方法基于 Importance-Driven (IDC) 测试准则，可以用于评估深度学习系统在安全关键的应用中的鲁棒性表现，并且可以支持工程师构建更加稳健的深度学习系统。

基于重要性的深度学习系统测试

Importance-Driven Deep Learning System Testing

As machine-learning (ML) based systems for malware detection become more
prevalent, it becomes necessary to quantify the benefits compared to the more
traditional anti-virus (AV) systems widely used today. It is not practical to
build an agreed upon test set to benchmark malware detection systems on pure
classification performance. Instead we tackle the problem by creating a new
testing methodology, where we evaluate the change in performance on a set of
known benign & malicious files as adversarial modifications are performed. The
change in performance combined with the evasion techniques then quantifies a
system's robustness against that approach. Through these experiments we are
able to show in a quantifiable way how purely ML based systems can be more
robust than AV products at detecting malware that attempts evasion through
modification, but may be slower to adapt in the face of significantly novel
attacks.

通过创建新的测试方法，我们评估了针对一组已知的 Benign & Malicious 文件执行敌对修改并评估性能变化的变化以及逃避技术，从而依靠实验证明了仅基于 ML 的系统可以比 AV 产品更有效地检测到试图通过修改来逃避的恶意软件，但在面临显着的新型攻击时可能反应较慢。

静态恶意软件检测与隐蔽：量化机器学习和当前反病毒软件的稳健性

Static Malware Detection & Subterfuge: Quantifying the Robustness of  Machine Learning and Current Anti-Virus

This paper describes a testing methodology for quantitatively assessing the
risk that rare or unique training-data sequences are unintentionally memorized
by generative sequence models---a common type of machine-learning model.
Because such models are sometimes trained on sensitive data (e.g., the text of
users' private messages), this methodology can benefit privacy by allowing
deep-learning practitioners to select means of training that minimize such
memorization.
In experiments, we show that unintended memorization is a persistent,
hard-to-avoid issue that can have serious consequences. Specifically, for
models trained without consideration of memorization, we describe new,
efficient procedures that can extract unique, secret sequences, such as credit
card numbers. We show that our testing strategy is a practical and easy-to-use
first line of defense, e.g., by describing its application to quantitatively
limit data exposure in Google's Smart Compose, a commercial text-completion
neural network trained on millions of users' email messages.

该论文描述了一种测试方法，用于定量评估生成序列模型（一种常见的机器学习模型）意外记忆稀有或唯一的训练数据序列的风险，从而可以减少数据曝光，保护隐私。