# ExtendAIST: Exploring the Space of AI-in-the-Loop System Testing
## 3 Extendaist
### Design
According to the classification results for individual adversarial example, adversarial attack is divided into two categories: _targeted_ and non-targeted adversarial attack_[28; 29]. Targeted attack indicates that the input adversarial example is misclassified as a specific label, while non-targeted attack indicates that the input adversarial example is assigned as any label not equal to the correct one. * \(L_{0}\)-norm attack. According to the definition of \(L_{p}\)-norm in Equation (10), \(L_{0}\) (Equation (11)) indicates the number of changed features in the original input. As a result, \(L_{0}\)-norm attack is used to minimize the number of features perturbed and generate new feature data against the target label. * \(L_{2}\)-norm attack. \(L_{2}\) (Equation (12)) equals the Euclidean distance between original data and adversarial example. A lower \(L_{2}\) indicates a smaller perturbation between the individual feature data and a higher similarity between original data and adversarial example. Hence, \(L_{2}\) is also used to solve the problem of overfitting in adversarial example. * \(L_{\infty}\)-norm attack. \(L_{\infty}\) (Equation (13)) represents the maximum difference among all feature data, which is utilized to control the maximum perturbation between original data and adversarial example. #### 4.3.3 Mutation Testing (EP_MUT)

Mutation testing is a method to measure test adequacy of a test suite by injecting faults into the original program under test, namely mutants [87]. The ratio of the number of mutants detected and the total number of mutants is referred to as the mutation score. The higher the mutation score is, the stronger the fault detectability of the test suite is. The existing techniques based on this sub-extension point EP_MUT are as follows. * MuNN. MuNN [30] proposes five kinds of mutation operators according to the structure of neural network, including deleting neurons in the input layer and hidden layers, changing the bias, weights, and activation functions. A mutant neural network is said to be killed once its output is distinct from the output of the original network. More mutant networks being killed indicates a powerful test suite for DNN testing. * DeepMutation. Since a trained model is obtained from the training program and training data, [PERSON] et al. [31] proposed a further study on mutation testing of AI module from two perspectives: (1) generating mutant trained models based on the _source-level_ mutation operators on the training data or training program; and (2) generating mutant trained models directly based on the _model-level_ mutation operators on the original trained model, similar to MuNN. #### 4.3.4 Metamorphic Testing (EP_MT)

Metamorphic testing determines the correctness of software under test by checking whether the related metamorphic relations are satisfied or not. Thus, it is a fundamental activity identifying diverse metamorphic relations to evaluate their capabilities of fault detection and the quality of software. Since Section 4.2.4 has introduced the existing techniques in point EP_MT, we briefly introduce the DeepTest [14] to show the mechanism of metamorphic testing on AI-in-the-loop system. * DeepTest. Nine transformation based MRs have been proposed in DeepTest, namely changing brightness, contrast, translation, scaling, horizontal shearing, rotation, blurring, fog, and rain on the images, to test the robustness of autonomous vehicles. Take images from camera as the source images, and create the follow-up images by one or more transformation MRs on source images. The DNN under test takes source and follow-up images as inputs and outputs the source and follow-up steering angles under different real-world weather conditions, namely \(\theta_{s}=\{\theta_{s}^{1},\theta_{s}^{2},\cdots,\theta_{s}^{n}\}\), \(\theta_{f}=\{\theta_{f}^{1},\theta_{f}^{2},\cdots,\theta_{f}^{n}\}\). Strictly speaking, the steering angles should keep unchanged under these transformations. That is, \(\theta_{s}=\theta_{f}\).