Discovery of input/output Casual relations in Software Systems

尽管数字技术已经显著改变了日常生活，但安全和隐私问题也随之出现。他们的任务的复杂性使得自动化系统越来越难以理解，导致信心逐渐丧失，特别是在涉及敏感数据的关键场景中。目前的可解释性方法只能从局部的角度来解决不透明性问题：适合特定的系统，突出统计相关性，或者提供过于技术性的解释。我们的研究放在因果发现领域，旨在回答关键问题“为什么一个系统会做出这样的决定？“将分析提升到更高的抽象层次。我们提出了一种新的通用因果解释方法，用于大规模测试软件系统的行为逻辑，具有双重目的：提供人类可以理解的解释，解释为什么自动化过程会产生直接影响它的输入类别的结果;评估系统的决策逻辑是否违反预定义的软件规范。我们利用信息论和分区的格结构定义在被测系统（SUT）的输入空间上，被视为黑盒：我们只需要访问输入/输出（I/O）接口。我们开发了一种算法，通过条件互信息（CMI）进行条件独立性测试，调查I/O因果关系。这个想法是寻找输入变量（输入部分）的最小子集，当改变时会导致输出（或给定的输出部分）的变化。我们的研究的三个核心支柱总结如下：1）基于信息理论的一般因果解释框架：在不同的应用领域评估方法。我们展示了我们的方法在测试软件和不同性质的属性的多功能性。我们开始专注于基于机器学习的预测系统，涉及敏感输入类别，实施安全策略的程序和图像识别系统。在处理了黑盒场景中的公平性、信息泄漏和错误分类之后，我们将介绍第四个白盒案例研究。随着越来越多的研究专注于测试社交网络平台，我们发现有趣的是，采用我们的解释方法来模拟社会互动，利用因果推理。2)增加统计保证提高软件测试性能我们的目标是通过为我们的测试方法提供统计保证来提高我们的测试集和信息论测量的质量。我们调查了现有的统计方法，用于估计互信息，寻找最适合我们的研究背景下，具有良好的统计置信水平。这将允许：提供更严格的发现，认为检测到的有影响力和无影响力的部分是正确的高水平的信心，释放我们的发现从近似和测试套件大小。3）广义因果分析与有向信息（DI）。我们讨论了格兰杰因果关系和DI理论之间的联系，显示DI代数结构，简化到我们的场景，符合CMI。因此，使用DI扩展我们的通用方法成为我们研究的一个引人注目的方向，特别是w.r.t. I/O关系的方向不明确的更复杂的场景。一个有趣的应用程序上下文是由交互式程序（网页，编辑器）提供的，其中信息可以在不同的方向上流动，因为存在多个用户同时与程序交互。我们希望为用户和开发人员提供广泛的贡献，使关键软件系统的知情使用，检测和减轻对公平和安全的威胁，并提高整体质量。

Despite digital technologies have notably revolutionized daily life, security and privacy concerns have emerged alongside. The complexity of their tasks has made automated systems ever more difficult to understand, causing a progressive loss of confidence, especially in critical scenarios involving sensitive data. Current interpretability methods tackle the opacity problem only from partial perspectives: suited to specific systems, highlighting statistical correlations, or providing too technical explanations.Our research places in the Causal Discovery area and aims thus to answer the critical question "why did a system make that decision?" lifting the analysis to higher levels of abstraction. We propose a novel General Causal Explanation Method for testing the behavioural logic of software systems on large-scale, serving a dual purpose: provide human-understandable explanations of the reasons why an automated procedure comes to the outcome in terms of input categories that directly affect it; assess whether a system's decision logic violates predefined software specifications.We leverage on Information Theory and a Lattice structure of partitions defined on the input space of the systems under test (SUT), treated as black-box: we only require access to input/output (I/O) interfaces. We develop an algorithm that investigates I/O causal relationships by performing Conditional Independence Testing via Conditional Mutual Information (CMI). The idea is look for the smallest subset of input variables (input part) that when altered cause a change in the output (or given output part). An elimination strategy is used to build explanations, excluding input variables with null CMI.The three core pillars of our research are summarized below:1) Information-Theory grounded General Causal Explanation Framework: evaluation of the methodology in different application areas. We show the versatility of our method in testing software and properties of different nature. We start focusing on Machine Learning-based predictive systems involving sensitive input categories, Programs implementing security policies and Image recognition systems. After dealing with Fairness, Information leakage and misclassification in black-box scenarios, we'll introduce a fourth white-box case study. With the growing number of studies focused on testing Social Network platforms, we find interesting to adopt our explanation methodology to model simulated social interactions by leveraging on causal reasoning. 2) Enhance Software Testing Performance adding Statistical Guarantee.We aim to improve our Test Set and information-theoretic measurements' quality by providing our testing approach with statistical guarantee. We investigate existing statistical methods used for estimating Mutual Information looking for the most suitable in the context of our study, that comes with a good statistical confidence level. This would allow to: provide more rigorous findings, argue that the detected influential and non-influential parts are correct with a high-level confidence; release our findings from approximations and test suite size.3) Generalise Causal Analysis with Directed Information (DI).We discuss the link between Granger Causality and DI Theory showing that DI algebraic structure, simplified to our scenarios, aligns with CMI. Expand our generalised approach using DI becomes thus a compelling direction for our research, especially w.r.t. more complex scenarios where the direction of the I/O relationship is ambiguous. An interesting application context is given by interactive programs (webpages, editors) where the information can flow in different directions, given the existence of multiple users interacting with the program simultaneously. We expect to deliver a broad range of contributions both to users and developers, enabling informed usage of critical software systems, detecting and mitigating threats to fairness and security, and enhancing the overall q