一句话：提出 Patchpro，通过构造补丁模块并结合形式验证，实现对 DNN 局部鲁棒性的可证明性质级修复。
深度神经网络易受对抗攻击等可靠性问题影响，阻碍其在安全关键领域应用。现有 NN 修复方法通常定位并修改问题神经元及参数，但常受限于特定数据集，且缺乏修复有效性的理论保证。本文提出 Patchpro，一种面向 DNN 性质级修复的补丁式方法，聚焦局部鲁棒性。其核心是构造补丁模块，与原网络集成后，可在保持原性能的同时，对鲁棒邻域内所有样本提供专门修复。方法结合形式验证与补丁模块分配的启发式机制，以防御对抗攻击并泛化到其他输入。实验表明，Patchpro 在效率、可扩展性和修复成功率上优于现有 DNN 修复方法，在多个高维数据集上对 100% 案例实现可证明的性质级修复。
Deep neural networks (DNNs) are prone to various dependability issues, such as adversarial attacks, which hinder their adoption in safety-critical domains. Recently, NN repair techniques have been proposed to address these issues while preserving original performance by locating and modifying guilty neurons and their parameters. However, existing repair approaches are often limited to specific data sets and do not provide theoretical guarantees for the effectiveness of the repairs. To address these limitations, we introduce Patchpro, a novel patch-based approach for property-level repair of DNNs, focusing on local robustness. The key idea behind Patchpro is to construct patch modules that, when integrated with the original network, provide specialized repairs for all samples within the robustness neighborhood while maintaining the network's original performance. Our method incorporates formal verification and a heuristic mechanism for allocating patch modules, enabling it to defend against adversarial attacks and generalize to other inputs. Patchpro demonstrates superior efficiency, scalability, and repair success rates compared to existing DNN repair methods, i.e., realizing provable property-level repair for 100% cases across multiple high-dimensional datasets.
DOI 原文 ·
@inproceedings{paperbot8892,
title = {Patch Synthesis for Property Repair of Deep Neural Networks},
author = {Zhiming Chi and Jianan Ma and Pengfei Yang and Cheng-Chao Huang and Renjue Li and Jingyi Wang and Xiaowe Huang and Lijun Zhang},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00181}
}