Neuron Boundary Coverage (NBC) in DNN Testing

• Neuron Boundary Coverage (NBC) is a test metric that quantifies how often a deep neural network’s neurons are activated outside the typical training range.
• It uses a profiling stage to record per-neuron minimum and maximum activations and then evaluates test inputs for boundary violations, with optional epsilon adjustments.
• NBC provides insights into model robustness and potential vulnerabilities, revealing low coverage on standard tests and highlighting differences across architectures.

Neuron Boundary Coverage (NBC) is a structural test coverage metric designed for white-box evaluation of deep neural networks (DNNs). Its primary objective is to quantify how thoroughly a test suite explores activation behaviors that were not encountered during training, by measuring the frequency that test inputs drive a neuron’s activation outside its empirically observed boundaries. NBC is used to identify coverage of "corner-case" activations, offering insights into model robustness, safety, and exposure to novel or potentially adversarial behaviors (Usman et al., 2022, Li et al., 12 May 2025).

1. Formal Definition and Coverage Computation

For a trained neural network $N$ with $L$ layers, let $a_{l,i}(x)$ denote the activation of neuron $i$ in layer $l$ on input $x$. During a profiling stage, a dataset $\mathcal{T}_{\mathrm{prof}}$ (typically the training set) is used to record observed minimum and maximum activations for each neuron:

• $$low_{l,i} = \min_{x \in \mathcal{T}_{\mathrm{prof}}} a_{l,i}(x)$$
• $$high_{l,i} = \max_{x \in \mathcal{T}_{\mathrm{prof}}} a_{l,i}(x)$$

Each neuron $(l,i)$ thus acquires a "main functional region" $L$0, representing typical activation values during training. NBC coverage obligations are incurred whenever a test input $L$1 pushes a neuron’s activation below $L$2 or above $L$3.

Define the set of NBC test conditions as:

$L$4

An obligation is covered if, for some $L$5:

• $L$6 and $L$7, or
• $L$8 and $L$9.

The NBC coverage ratio is:

$a_{l,i}(x)$0

where $a_{l,i}(x)$1 is the number of neurons in layer~$a_{l,i}(x)$2 (Usman et al., 2022, Li et al., 12 May 2025).

2. Practical Measurement Procedure and Margins

Applying NBC involves two stages. First, profiling extracts per-neuron minima and maxima from $a_{l,i}(x)$3. Second, the test inputs $a_{l,i}(x)$4 are evaluated: for each neuron and test input, activations are checked for violations beyond $a_{l,i}(x)$5.

A margin $a_{l,i}(x)$6 can be optionally subtracted from $a_{l,i}(x)$7 or added to $a_{l,i}(x)$8 to strengthen the obligation, yielding:

• Lower-boundary test: $a_{l,i}(x)$9
• Upper-boundary test: $i$0

Varying $i$1 provides a family of stricter or looser coverage criteria. Canonical NBC uses $i$2 (Li et al., 12 May 2025).

Example Calculation

Consider a network with one hidden layer of two neurons: | Neuron | $i$3 | $i$4 | |-----------|---------|---------| | (2,1) | 0.0 | 1.0 | | (2,2) | –0.5 | 0.5 |

Test suite $i$5 yields activations: | Input | $i$6 | $i$7 | |-------|--------------|--------------| | $i$8 | 0.4 | 0.0 | | $i$9 | 1.2 | 0.1 | | $l$0 | 0.8 | –0.7 |

Obligations covered:

• (2,1,above): $l$1 (1.2>1.0)
• (2,2,below): $l$2 (–0.7<–0.5)

Two of four obligations are met, thus $l$3 (Usman et al., 2022).

3. Empirical Characteristics and Model Sensitivity

Empirical studies underscore that NBC values remain very low on standard test data. For instance, NBC for LeNet-1 on MNIST is 0.87%, and for ResNet20 on CIFAR-10, 5.55% (Usman et al., 2022). Expanded experiments investigating networks of depths 5–54 (LeNet, VGG, ResNet) display the following:

• At $l$4, NBC is under 1% for most models and decreases with increasing network depth in purely sequential architectures.
• For negative $l$5 (requiring activations strictly inside the training region), NBC increases but quickly falls as $l$6.
• In residual architectures (deep ResNets), shallow-margin NBC may be slightly higher, plausibly due to more extreme-activation neurons in very deep architectures (Li et al., 12 May 2025).

The coverage obtained also depends on the architecture and dataset:

• LeNet's NBC decays more gradually with $l$7 than VGG or ResNet on CIFAR-10.
• Upper-boundary (SNAC) coverage tends to substantially exceed lower-boundary coverage, especially in CIFAR-10-trained models, indicating a higher occurrence of above-max test-time activations (Li et al., 12 May 2025).

4. Comparative Positioning Among Structural Metrics

NBC is stricter than upper-bound-only metrics (e.g., SNAC), which consider only the event of a neuron exceeding its observed maximum. However, NBC is weaker in granularity than k-multisection neuron coverage (KMNC): while NBC focuses exclusively on out-of-bounds excursions, KMNC subdivides the main activation region and tracks coverage of each subregion, resulting in higher and more informative scores (e.g., $l$8 over 90%, NBC $l$9 10%) (Usman et al., 2022, Li et al., 12 May 2025).

Variants and extensions include:

• SNAC: Strong Neuron Activation Coverage, measuring upper-boundary coverage only.
• Margin-augmented NBC: Employing $x$0 yields a stricter (lower) coverage curve; as $x$1 increases, coverage quickly drops to near zero.

NBC, SNAC, and KMNC are often jointly reported to establish a fuller and more nuanced assessment of a test suite's thoroughness.

5. Practical Issues and Limitations

Several practical considerations affect NBC's utility and interpretation:

• Boundary estimation is critically dependent on the representativeness of $x$2; unrepresentative profiling can yield excessively loose or tight boundaries and hence misleading coverage.
• Activation function sensitivity means that metrics behave differently by architecture. ReLU activations (where $x$3) rarely yield lower-boundary hits, except for numerical effects or negative-leak variants. Sigmoid/tanh activations yield finite $x$4 intervals for both sides enabling more sensitive NBC measurement.
• Layer and neuron selection scales the number of obligations as twice the total neuron count over nominated layers; limiting NBC to certain layers or neuron subsets may be preferred for tractability.

NBC alone is too coarse for coverage-guided test generation, as its absolute values are low and it may not provide fine-grained guidance, but it highlights the risk of untested neuron activation regimes (Usman et al., 2022, Li et al., 12 May 2025).

6. Tool Support and Measurement in DNNCov

NBC is implemented in the DNNCov tool (Usman et al., 2022):

• Profiling phase: Passes the training set through the network, logs per-neuron minima and maxima.
• Coverage evaluation: For each test input and neuron, checks for out-of-boundary activations and records covered obligations.
• Reporting: Computes $x$5 and provides visualization of out-of-bounds neuron hits, with quantitative min/avg/max reports per obligation.

Example DNNCov usage: $x$6 After processing, the analysis specifies which test inputs triggered out-of-boundary activations, supporting researchers’ auditing and test suite refinement (Usman et al., 2022).

7. Interpretations, Patterns, and Future Directions

Empirical results suggest that neurons are rarely driven outside their training activation range by standard test suites, and model depth generally reduces NBC in standard architectures. SNAC systematically yields higher values than NBC, reflecting a consistent asymmetry: above-boundary activations are more prevalent than below-boundary, especially in deep architectures and on challenging datasets.

Directions for future research, as highlighted, include:

• Theorizing neuron "main functional" and "boundary" regions to offer formal robustness guarantees,
• Investigating synergistic combinations of coverage metrics for guided test generation,
• Extending NBC to deep, non-sequential, or non-feedforward architectures (e.g., transformers, graph networks) by adopting distribution-aware or layer-wise intervals (Li et al., 12 May 2025).

NBC serves as a direct, empirically grounded measure to probe whether new or adversarially generated test cases exercise activations beyond the network’s prior experience, strengthening structural coverage analysis when used in concert with other metrics.