🤖 AI

\textsc{TestifAI}: Tomography-Based Testing for Deep Learning Systems

The paper introduces TestifAI, a novel deep learning testing framework that employs partial model tomography to efficiently and accurately estimate model robustness against complex combinations of semantic perturbations by reconstructing higher-order test outcomes from a significantly reduced set of lower-order tests.

Original authors: Arooj Arif, Tobias Hartung, Elena Botoeva, Alexandros Koliousis

Published 2026-08-20

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Arooj Arif, Tobias Hartung, Elena Botoeva, Alexandros Koliousis

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Modern software increasingly relies on artificial intelligence to make decisions in high-stakes environments, from guiding autonomous vehicles through city streets to helping doctors interpret medical scans or assisting people with mental health support. These systems, built on deep learning models, are remarkably good at recognizing patterns, but they possess a fragile side: they can be easily confused by small changes in their input. A self-driving car might fail to recognize a stop sign if the lighting shifts slightly, or a translation bot might produce nonsense if a sentence is rephrased in a common way. Because these systems are deployed in the real world, where conditions are rarely perfect, engineers must rigorously test them to ensure they remain safe and reliable. The challenge lies in the sheer complexity of the real world; a model might handle a single problem, like a blurry image, with ease, but it could collapse when faced with a combination of issues, such as a blurry image taken in the rain while the car is moving fast. Testing every possible combination of these problems is practically impossible because the number of scenarios grows so rapidly that no computer could check them all in a human lifetime.

Researchers at Northeastern University London and the University of Kent have developed a new approach to this problem called TestifAI, which offers a way to predict how these AI systems will behave in complex, multi-problem situations without having to run every single test. Instead of trying to simulate every possible disaster scenario, the team treats the testing process like a form of medical imaging, specifically a technique known as tomography. In medicine, a CT scan creates a detailed 3D image of the inside of a body by taking a series of 2D X-ray slices from different angles. Similarly, TestifAI reconstructs a full picture of an AI model's reliability by running a limited number of tests that involve only one or two problems at a time. By analyzing how the model reacts to these simpler, isolated challenges, the system learns to predict how it will perform when three or four problems occur simultaneously.

The researchers tested this method on five different tasks, including recognizing handwritten digits, identifying objects in traffic scenes, and answering questions from a large database of text. They selected specific types of disturbances, such as changing the brightness of an image, adding noise to a sound, or replacing words with synonyms, and assigned them different levels of severity, from mild to extreme. In a traditional approach, to understand how a model handles three different types of disturbances at various levels, one would need to run thousands of separate tests to cover every combination. TestifAI, however, only runs the tests for single disturbances and pairs of disturbances. It then uses a secondary computer program, trained on the results of these simpler tests, to estimate the outcome of the much more complex scenarios.

The results showed that this predictive method is highly accurate. When the researchers compared the predictions made by TestifAI against the actual results of running every possible test, the difference was minimal, with an overall error rate of less than seven percent. This means the system could reliably tell engineers whether a model would fail under a specific combination of bad weather, sensor noise, and motion blur, without actually having to simulate that exact stormy, bumpy drive. Furthermore, the method was incredibly efficient. By avoiding the need to run the full set of tests, the researchers reduced the number of times the AI had to process data by between sixty and eighty percent. In one instance, a test that would have taken nearly forty-eight hours to complete using the old method was finished in a fraction of that time using TestifAI.

The study also addressed a critical concern: whether the combinations of problems created for testing were realistic. The researchers found that they could use the same predictive technique to estimate the quality of the input data itself. For example, they could predict if a combination of image distortions would make a picture so garbled that it no longer looked like a real street scene. This allows engineers to filter out unrealistic test cases and focus only on the scenarios that are likely to happen in the real world. The work suggests that the behavior of these complex AI models is not entirely random; even when multiple problems interact, the model's response often follows patterns that can be learned from simpler observations.

While the method is powerful, the researchers are careful to note its boundaries. It works best when the problems being tested are clearly defined and can be adjusted in steps, such as changing the brightness of an image from one level to another. It is less suited for testing against highly unpredictable or continuous changes that do not fit into neat categories. Additionally, the accuracy of the predictions depends on the assumption that the model's reaction to a combination of problems is largely determined by how it reacts to the individual parts. If a model has a hidden, complex reaction that only appears when three specific problems hit at once, the system might miss it, though the researchers found this to be rare in their experiments.

Ultimately, TestifAI represents a shift in how we think about safety testing for artificial intelligence. Rather than viewing testing as a brute-force exercise of checking every box, it treats the problem as one of pattern recognition and prediction. By understanding the building blocks of failure, engineers can anticipate how a system will hold up under the pressure of a chaotic, real-world environment. This approach does not guarantee that an AI will never fail, but it provides a practical, efficient way to map out the terrain of potential failures, helping developers build systems that are robust enough to navigate the complexities of the world they are designed to serve.

Technical Summary: TestifAI – Tomography-Based Testing for Deep Learning Systems

1. Problem Statement

Deep learning models are increasingly deployed in safety-critical domains (e.g., autonomous driving, AI chatbots), yet they remain notoriously sensitive to input perturbations. While existing robustness benchmarks (e.g., CIFAR-10-C, TextFlint) evaluate models under single or fixed combinations of perturbations, they fail to address the combinatorial explosion of interacting perturbations found in real-world scenarios.

Current testing frameworks suffer from two primary limitations:

Lack of Systematic Exploration: Existing methods either treat perturbations as atomic units (ignoring interactions) or rely on stochastic/exhaustive sampling that cannot scale to higher-order combinations (e.g., 3-way or 4-way interactions).
Computational Infeasibility: Exhaustively testing all combinations of $n$ perturbations with $m$ severity levels requires $O(m^n)$ inferences. For even modest settings, this number becomes prohibitive, preventing a comprehensive assessment of model robustness under complex, multi-perturbation conditions.

The core challenge is to systematically explore and summarize model robustness across a combinatorial space of perturbations without executing an exponential number of tests.

2. Methodology: Partial Model Tomography

The authors propose TestifAI, a framework that reframes deep learning testing as a predictive modeling task using a novel approach called Partial Model Tomography.

Core Concept

Instead of exhaustively evaluating all possible perturbation combinations, TestifAI executes a subset of tests—specifically those involving one or two perturbations (lower-order projections)—and uses these results to reconstruct and predict the behavior of the model under higher-order combinations (3+ perturbations).

Key Components

Structured Test Spaces:
- Users define a test environment by selecting $k$ semantic perturbations (e.g., blur, brightness, zoom) and discrete severity levels (e.g., 0–5).
- The full test space $\Theta$ is the Cartesian product of all severity levels.
- The space is partitioned by order: $\Theta_0$ (no perturbation), $\Theta_1$ (single perturbation), $\Theta_2$ (pairwise), and $\Theta_{\ge3}$ (higher-order).
Execution Strategy (Lower-Order Testing):
- TestifAI executes all tests in $\Theta_{\le2}$ (up to second-order).
- Adaptive Sampling with Early Stopping: To further reduce cost, the framework processes inputs in batches. It monitors the convergence of the robustness estimate (success rate) for a specific configuration. If the variation in the last $w$ batches falls below a threshold $\delta$ , inference stops early, avoiding unnecessary computations.
Prediction Strategy (Higher-Order Estimation):
- Independence Assumption: If perturbations act independently, higher-order robustness can be calculated as the product of lower-order robustness scores. The framework uses a $\chi^2$ -test to empirically verify independence between perturbations.
- Surrogate Modeling: In cases where independence does not hold (or to capture complex interactions), TestifAI trains an auxiliary Random Forest classifier.
  - Training Data: The model is trained on the binary outcomes (correct/incorrect) of all $\Theta_{\le2}$ tests.
  - Prediction: The trained model predicts the robustness score for untested configurations in $\Theta_{\ge3}$ .
  - Architecture Choice: Random Forests were selected for their non-parametric nature, ability to capture structured conditional distributions without explicit specification, and superior sample efficiency compared to other architectures (e.g., MLPs, Bayesian networks) in preliminary experiments.
Query Interface:
- Users can query the reconstructed tomography space using Boolean expressions over perturbation types and severity levels (e.g., "blur > 2 AND brightness = 5").
- The system computes aggregate robustness scores for these query regions based on the predicted or measured values.
Validity Estimation:
- The framework can also estimate the semantic validity of higher-order perturbations (e.g., using Kernel Inception Distance for images or BERTScore for text) by training a similar surrogate model on low-order quality metrics. This allows users to filter out unrealistic or invalid test cases.

3. Key Contributions

Partial Model Tomography: A novel approach to reconstructing model behavior in multi-perturbation spaces from low-order projections, avoiding the exponential cost of full tomography.
TestifAI Framework: A complete testing system that supports:
- Interactive specification of operational conditions.
- Efficient execution of lower-order tests with adaptive early stopping.
- Prediction of higher-order robustness via surrogate modeling.
- Boolean query interfaces for aggregating robustness over specific regions.
Empirical Validation: Demonstration that robustness for 3-way and 4-way combinations can be accurately estimated from 1-way and 2-way observations.

4. Experimental Results

The authors evaluated TestifAI on five benchmarks: four vision tasks (MNIST, CIFAR-10, Object Detection, Traffic Sign Recognition) and one language task (Quora Question Pairs).

Accuracy: TestifAI predicts higher-order (3 and 4 perturbation) test outcomes with an aggregate robustness estimation error of less than 7%.
- For specific benchmarks like CIFAR-10 and QQP, all prediction errors fell within $[-0.05, +0.05]$ .
- Over 90% of errors across all 216 tests in 3D tomography were within $[-0.1, +0.1]$ .
Efficiency: The framework reduces the number of required inferences by 60–80% compared to exhaustive testing.
- Without early stopping, partial tomography reduces inferences by ~58%.
- With early stopping, reductions reach up to 83% for certain benchmarks.
- For the QQP task, full 3D tomography required ~47.3 hours, which was significantly reduced by the partial approach.
Sampling Strategy: Experiments comparing "ordered sampling" (prioritizing low-order tests) against "random sampling" showed that ordered sampling converges faster and achieves lower Mean Squared Error (MSE) with significantly less data.
Validity: The framework successfully estimated higher-order input quality (validity) from low-order observations, with mean absolute errors near zero for several benchmarks, enabling the filtering of unrealistic test cases.

5. Significance and Claims

The paper positions TestifAI as a step towards test-oriented generalization. Its significance lies in:

Scalability: It provides a principled method to assess robustness in high-dimensional perturbation spaces where exhaustive testing is infeasible.
Systematic Interaction Analysis: Unlike prior methods that focus on diversity or single-axis robustness, TestifAI explicitly reasons about the interactions between multiple semantic perturbations.
Practical Utility: By enabling users to query specific operational conditions (e.g., "low blur, high brightness"), it bridges the gap between abstract robustness metrics and real-world deployment scenarios.
Modest Scope: The authors acknowledge limitations, noting that TestifAI relies on user-defined, discretizable perturbation spaces. It is designed as an exploratory tool for refining known perturbation families rather than discovering new ones or handling continuous, gradient-based adversarial attacks. It assumes that lower-order interactions capture the majority of model behavior, though it suggests allocating a small budget for third-order tests if higher-order coupling is suspected.

In summary, TestifAI shifts the paradigm from combinatorial coverage to predictive modeling, allowing for efficient, accurate, and systematic robustness estimation in complex, multi-perturbation environments.