  Deep learning models are widely used for image analysis. While they offer
high performance in terms of accuracy, people are concerned about if these
models inappropriately make inferences using irrelevant features that are not
encoded from the target object in a given image. To address the concern, we
propose a metamorphic testing approach that assesses if a given inference is
made based on irrelevant features. Specifically, we propose two novel
metamorphic relations to detect such inappropriate inferences. We applied our
approach to 10 image classification models and 10 object detection models, with
three large datasets, i.e., ImageNet, COCO, and Pascal VOC. Over 5.3% of the
top-5 correct predictions made by the image classification models are subject
to inappropriate inferences using irrelevant features. The corresponding rate
for the object detection models is over 8.5%. Based on the findings, we further
designed a new image generation strategy that can effectively attack existing
models. Comparing with a baseline approach, our strategy can double the success
rate of attacks.
