DE102020214996A1 - Measurement of the sensitivity of an image classifier to changes in the input image - Google Patents

Abstract

Method (100) for measuring the extent to which the decision of an image classifier (1) on the assignment (3) of an input image (2) to one or more classes of a specified classification can be influenced by changes in this input image (2), with the Steps:• several binary candidate masks (5) are generated (110);• a candidate modification (7) of the input image (2) is generated for each candidate mask (5);• the candidate masks ( 5) are each evaluated with a quality function (8) (130), which depends on how the output (3) of the image classifier (1) changes if the image classifier (1) instead of the input image (2) uses the the respective candidate mask (5) generated candidate modification (7) is supplied;• the best-scoring candidate mask (5) is determined as a stage mask (5*) (140a), and the associated candidate modification (7) is defined (140b) as a stage modification (7*); • in the same way a From the same input image (2), additional stage masks (5*) and stage modifications (7*) are determined (150) until a predetermined number is reached;• the stage modifications (7*) are used as new input - Images (2) used to create (160) new stage masks (5*) and stage modifications (7*) in the same way;• in response to a predetermined termination condition (9) being met (170 ), all or a selection of the stage modifications (7*) are brought together (180) to form the statement sought (1*) about the ability to influence the decision.

Description

The present invention relates to the control of the behavior of trainable image classifiers that can be used, for example, for the quality control of mass-produced products or also for the at least partially automated driving of vehicles.

State of the art

In the series production of products, it is usually necessary to continuously check the quality of the production. The aim is to identify quality problems as quickly as possible in order to be able to remedy the cause as soon as possible and not lose too many units of the respective product as scrap.

Optical inspection of a product's geometry and/or surface is fast and non-destructive. the WO 2018/197 074 A1 discloses an inspection apparatus in which an object can be exposed to a plurality of lighting situations, images of the object being recorded with a camera in each of these lighting situations. The topography of the object is evaluated from these images.

Images of the product can also be directly assigned to one of several classes of a given classification using an image classifier based on artificial neural networks. On this basis, the product can be assigned to one of several specified quality classes. In the simplest case, this classification is binary ("OK"/"not OK").

When driving vehicles in an at least partially automated manner, image classifiers that can be trained are also used in order to evaluate traffic situations or at least to examine their content of objects.

Disclosure of Invention

Within the scope of the invention, a method was developed for measuring the extent to which the decision of an image classifier regarding the assignment of an input image to one or more classes of a specified classification can be influenced by changes in this input image.

In this method, multiple binary candidate masks are generated using parameters drawn from at least one random distribution. Each element of a candidate binary mask indicates whether or not a given perturbation is to be applied to a corresponding pixel of the input image. Accordingly, a candidate modification of the input image is generated for each candidate mask by applying the specified perturbation to the pixels of the input image specified by the respective candidate mask.

The predetermined perturbation may include, for example, setting all pixels in the area affected by the perturbation to zero or some other uniform value. Alternatively or in combination with this, the predetermined disturbance can include, for example, replacing pixel values in the area affected by the disturbance with pixel values of a blurred version of the input image in this area.

The candidate masks are each evaluated with a quality function. This quality function depends at least on how the output of the image classifier changes when the candidate modification generated using the respective candidate mask is supplied to the image classifier instead of the input image. In addition, any other criteria can also be included in the quality function.

The best-scoring candidate mask according to the merit function is designated as a staging mask, and the associated candidate modification is designated as a staging modification. In the same way, further stage masks and stage modifications are determined from the same input image until a predetermined number is reached. This creates a level of a tree in which one and the same input image produces a predetermined number of stage modifications as "children".

The stage mods are in turn used as new input images to generate new stage masks and stage mods in the same manner previously described. Thus, each Stage Modification and its associated Stage Mask, in turn, spawns the specified number of new Stage Modifications as “children,” resulting in the next level of the tree.

This process continues until a predetermined termination condition is met. If this termination condition is reached, all or a selection of the total stage modifications generated are brought together to form the statement sought about the influenceability of the decision.

The original input image and each stage modification already generated are thus the starting point for the generation of several further stage modifications. Any of these Further stage modifications are obtained as a "local optimum" in that candidate masks are formed from randomly drawn parameters and the best candidate mask is selected using the quality function.

In order to generate a new level of the tree, 10 candidate masks, for example, can be tested starting from the original input image or from the stage modification already generated. From these candidate masks, that one is selected whose associated candidate modification of the original input image, or of the stage modification that has already been generated, is rated best by the quality function. This creates the first stage mask and associated stage modification on the new level of the tree, i.e. the first "node" of the tree on this level. Then, for example, 10 new candidate masks can be processed in the same way again to generate the next "node" on the same level. For example, two to four new "nodes" can emerge on the next level of the tree from the original input image, or from each stage modification already generated on one level. Since a relatively small number of candidate masks is already sufficient to form a local optimum in relation to a "node" of the tree, the optimization can be carried out over all "nodes" of the tree overall with a practically manageable budget of computing time. The tree-like structuring of the work to be carried out as a whole also offers transparent options for distributing a given total budget of computing time in such a way that the greatest possible benefit can be generated from it in relation to the statement ultimately sought.

The deeper a stage mask is located in the tree, the more often it was successively locally optimized in the manner described. Through this local optimization, the stage mask is getting better and better step by step. At the lowest level of the tree those stage modifications are gathered from which no further stage modifications have been created. Each of these stage modifications at the deepest level of the tree has emerged from the original input image through the same number of successive local optimization steps and thus represents a learning process of the same length.

Thus, in a particularly advantageous embodiment, those stage modifications generated last, from which no further stage modifications were generated, are selected for merging to form the sought-after statement about the ability to influence the decision. This is somewhat analogous to the fact that an employer who is recruiting students for a new team from a school's students will essentially select the students from the senior years.

For example, the question can be asked on which parts of the input image the image classifier bases its decision to assign the input image to a specific class. If there are areas in the input image that can be subjected to the specified interference without the decision of the image classifier (or a related classification score) changing significantly, this means that the image classifier does not base its decision on these image areas supports. Instead, the information on which the image classifier bases its decision regarding the input image must reside somewhere in the areas not obscured by the interference. With the method described here, the complex task of locating as many areas as possible that are not relevant to the decision and thus obtaining the most precise possible statement about the remaining image areas relevant to the decision can be broken down into many small local sub-tasks, each of which can be solved using the quality function . For example, each time new candidate masks are generated from existing stage masks, further pixels that have not yet been changed by the specified disturbance can be changed. Changes in the input image that do not change the decision of the image classifier can therefore be "learned" in stages. In the resulting tree of stage masks, each "child" benefits from the experience of their "ancestors". If, on the other hand, masks are randomly generated independently of one another, these masks cannot be combined with one another in a synergistic manner. You start from scratch every time you generate a mask completely randomly, without building on previous experience.

Thus, in a particularly advantageous embodiment, all pixels that are to be changed according to at least one stage mask are adopted as pixels to be changed in the candidate masks generated from this stage mask.

The use of parameters that are drawn from a random distribution creates the greatest possible flexibility with regard to the quality function. This only has to be able to be evaluated locally at the specific points defined by the random parameters. However, in contrast to a gradient descent method, for example, it is not necessary for the quality function to be differentiable or even explained everywhere.

In order to hide the parts of the input image that are not relevant to the decision bit by bit, a quality function can be selected, for example, which evaluates a candidate mask the better, the smaller a change in the input image according to this candidate mask affects the output of the image classifier affects. In order to counteract the tendency for the method to "feel its way" in steps that are too small, the quality function can optionally also evaluate the candidate mask the better, the more pixels of the input image are changed according to this candidate mask. These two criteria can be weighted in any way relative to each other.

However, decision-relevant parts of the input image can also be searched for, for example, by looking for the smallest possible changes in the input image that lead to a maximum change in the output of the image classifier. For this purpose, for example, a quality function can be selected that evaluates a candidate mask the better, the stronger this change affects the output of the image classifier at the same time. For the targeted search for changes in the input image that are as small as possible, the quality function can optionally evaluate a candidate mask the better the fewer pixels of the input image are changed according to this candidate mask. Both criteria can in turn be weighted in any way relative to one another.

Both approaches are not equivalent to each other, but will usually deliver different results. Which approach is more advantageous than the other therefore depends on what exactly is being asked for in the specific application.

If the input image shows a traffic situation, for example, and the image classifier is designed to recognize pedestrians, the gradual hiding of irrelevant image parts tends to classify the entire pedestrian as relevant to the decision. Disrupting parts of the image that show individual parts of the pedestrian's body (e.g. head or limbs) may not overturn the classification in the "pedestrian" class to another class, but it will change the classification score in relation to the "pedestrian" class much more than disturbing other areas of the image. It is therefore to be expected that preference will be given to disturbing other areas of the image.

On the other hand, the search for the smallest changes that cause the greatest effect tends to provide a statement about which parts of the pedestrian must at least be recognizable in the image in order for the pedestrian to be recognized as such. If the classification can only be decisively changed by making the entire pedestrian unrecognizable due to the disruption, this is very advantageous for at least partially automated driving. In this case, it can be expected that the pedestrian will still be reliably detected if, for example, he steps through a gap between parked cars and is partially covered up to the last moment. If, on the other hand, the classification into the "pedestrian" class can be shaken, for example, by the interference of image parts that show the legs or the head, a pedestrian whose legs or head are covered in the traffic situation may not be recognized in good time.

When searching for the smallest changes, it is possible, for example, to search for connected areas in which the application of the specified disturbance makes sense. In contrast to changing individual pixels, this does not favor singular "adversarial examples", but structures and objects that actually occur in images.

Breaking down a very complex task into simpler tasks is somewhat comparable to a cryptanalytic attack on an encryption, which makes it possible to independently determine different parts of a long cryptographic key. While trying out all possible long keys with a "brute force attack" is usually not practicable, the independent determination of the different parts is typically many orders of magnitude faster and therefore economical for a real attacker.

If the termination condition is met, then there are a plurality of hop masks generated in different numbers of generations from the original input image. Some of these stage masks can already be good despite their low generation. Each new generation does not necessarily have to be better than the previous one, but it can also happen that the formation of another generation "makes the mask worse". If, for example, all image pixels that do not belong to an object being searched for are already disturbed, any further addition of disturbances leads to the object being searched for being “nibbled” and thus to a deterioration. It is therefore not absolutely necessary to combine only the stage masks formed in the last generation to obtain the statement sought as to the extent to which the decision of the image classifier can be influenced. Instead, you can optionally also use stage masks from earlier genes rations are taken into account at least as an admixture. However, the merging of a large number of stage modifications of the last generation, in which many generations of parameters drawn from the random distribution have contributed, tends to suppress the effect of individual "worsening-improving" stage masks on the ultimately obtained statement about the influenceability of the decision.

Therefore, in a particularly advantageous embodiment, a distance measure is determined between the outputs onto which the image classifier maps the stage modifications and the outputs onto which the image classifier maps the original input image. The stage masks for stage modifications for which this distance measure satisfies a predetermined criterion are determined as information about the ability to influence the decision of the image classifier. If, for example, it is asked that the output of the image classifier should not change as a result of the changes in the input image, the stage masks can be selected for those stage modifications for which the distance measure is below a predetermined threshold value. If, on the other hand, it is asked that small changes should change the output of the image classifier as much as possible, the stage masks for those stage modifications can be selected for which the distance measure is above a predetermined threshold value.

The termination condition for the generation of further generations of stage masks can contain, for example, a maximum recursion depth for the generation of stage masks. In this way, for example, a maximum budget for computing effort for the creation of stage masks can be specified.

In a particularly advantageous embodiment, all stage masks are clustered without being monitored. The termination condition means that the number of resulting clusters converges. Over time, if disturbing other areas of the input image proves beneficial and "pervasive", many more stage masks will emerge that also have the same beneficial effect and form a cluster of their own. If, on the other hand, no new clusters form, no further knowledge gain takes place through the further newly formed stage masks.

In particular, the generation of the candidate masks can include, for example, extracting from the at least one random distribution coordinates of regions of the input image to which the predetermined perturbation is to be applied to different degrees. For example, for two-dimensional coordinate directions x and y, threshold values that define a transition between areas to be treated differently can be drawn from the at least one random distribution.

For example, the input image can be divided into areas whose pixels are each changed with different probabilities based on the specified disturbance. If, for example, a threshold value for a coordinate direction x and/or y was drawn from a random distribution, it can in turn be drawn from a random distribution whether image areas are to be changed whose coordinates are below or above the respective threshold value. The probabilities for the alternatives “below” and “above” can be chosen freely.

As explained above, the change added in a new candidate mask can, for example, consist in particular in that, compared to the previous stage mask, further pixels are marked for changing with the specified disturbance. In order to create further degrees of freedom and to increase the overall complexity of the stage masks, the generation of at least one candidate mask from a stage mask can also include inverting the stage mask in an area defined using the randomly drawn parameters. This means that in this area the pixels previously flagged as “to be disturbed” are no longer disturbed, while the pixels previously flagged as “do not disturb” are now to be disturbed.

In a particularly advantageous embodiment, an image of a mass-produced product is selected as the input image. The classes of the classification then represent a quality assessment of the product, such as "OK", "not OK = NOK", "no decision possible" or any gradations in between. In this context, explanations for why the image classifier assigns an input image to the class "NOK" are particularly important. Such explanations not only improve the image classifier itself, but also provide insight into the possible root cause of the quality issue that was set in the manufacturing process. For example, if a large number of small, localized defects in the product were decisive for the classification as "NOK", and these defects are in turn correlated with certain physical conditions during the manufacture of the product (such as high temperature or high pressure), targeted efforts can be made to eliminate these correct conditions so that In the future, a larger proportion of the manufactured product examples will be classified as "OK".

The statement determined with the method as to the extent to which the decision of an image classifier on the assignment of an input image to one or more classes of a given classification can be influenced by changes in this input image can be compared, for example, with a proportion of the input image that determined to be relevant to the quality assessment of the product based on an observation of the same product with a different imaging modality. A quality assessment for the image classifier can then be determined from the result of this comparison. For example, hyperparameters of the image classifier can be optimized with the aim of optimizing this quality assessment.

In a further particularly advantageous embodiment, an image of a traffic situation taken from a vehicle is selected as the input image. The classes of the classification then represent assessments of the traffic situation, on the basis of which the future behavior of the vehicle is planned. Especially in this field of application, the image classifier and a downstream warning system, driver assistance system or system for at least partially automated driving can often only be trusted if the decisions of the image classifier can be explained. The method can provide precisely these explanations.

The statement determined with the method as to the extent to which the decision of an image classifier on the assignment of an input image to one or more classes of a given classification can be influenced by changes in this input image can be compared, for example, with a proportion of the input image that known to be relevant for assessing the traffic situation. A quality assessment for the image classifier can then be determined from the result of this comparison. Analogous to the application example of the quality control of products manufactured in series, hyper parameters of the image classifier can then be optimized with the aim that the quality of the image classifier is then better evaluated.

In particular, the method can be fully or partially computer-implemented. The invention therefore also relates to a computer program with machine-readable instructions which, when executed on one or more computers, cause the computer or computers to carry out the method described. In this sense, control devices for vehicles and embedded systems for technical devices that are also able to execute machine-readable instructions are also to be regarded as computers.

The invention also relates to a machine-readable data carrier and/or a download product with the computer program. A downloadable product is a digital product that can be transmitted over a data network, i.e. can be downloaded by a user of the data network and that can be offered for sale in an online shop for immediate download, for example.

Furthermore, a computer can be equipped with the computer program, with the machine-readable data carrier or with the downloadable product.

Further measures improving the invention are presented in more detail below together with the description of the preferred exemplary embodiments of the invention with the aid of figures.

character list

• 1 Ausführungsbeispiel des Verfahrens 100 zur Messung, durch welche Änderungen eines Eingabe-Bildes 2 eine Entscheidung eines Bildklassifikators 1 über diese Eingabe-Bild beeinflussbar ist, einschließlich beispielhafter weiterer Auswertung;
• 2 Veranschaulichung der schrittweisen Erzeugung einer baumartigen Hierarchie von Etappen-Masken 5*.

It shows:

• 1 Exemplary embodiment of the method 100 for measuring which changes in an input image 2 can influence a decision of an image classifier 1 about this input image, including exemplary further evaluation;
• 2 Illustration of the step-by-step generation of a tree-like hierarchy of stage masks 5*.

1 1 is a schematic flow chart of an embodiment of the method 100 for measuring the extent to which the decision of an image classifier 1 on the assignment 3 of an input image 2 to one or more classes of a specified classification can be influenced by changes in this input image 2. According to block 106, the input image 2 can be an image of a mass-produced product. Alternatively, the input image 2 can be an image of a traffic situation taken from a vehicle.

In step 110, multiple binary candidate masks 5 are generated using parameters 4 drawn from at least one random distribution. Each element of a candidate binary mask 5 indicates whether a predetermined perturbation 6 is to be applied to a corresponding pixel of the input image 2 or not.

This generation of the candidate masks 5 can, in accordance with block 111, in particular, for example involve extracting from the at least one random distribution coordinates of regions of the input image 2 to which the predetermined perturbation 6 is to be applied to varying degrees. In accordance with block 111a, the input image 2 can be subdivided, for example, into areas whose pixels are each changed with different probabilities based on the specified disturbance 6 .

In step 120, a candidate modification 7 of the input image 2 is generated for each candidate mask 5 by applying the specified disturbance 6 to the pixels of the input image 2 specified by the respective candidate mask 5.

In step 130 the candidate masks 5 are each evaluated with a quality function 8 . This quality function 8 is specific to the specific question to be asked of the method. It depends at least on how the output 3 of the image classifier 1 changes to a new output 3′ if the image classifier 1 is supplied with the candidate modification 7 generated using the respective candidate mask 5 instead of the input image 2 .

According to block 131, a quality function 8 can be selected, for example, which evaluates a candidate mask 5 the better, the less a change in the input image 2 according to this candidate mask 5 affects the output 3 of the image classifier 1. Optionally, the quality function 8 can also evaluate the candidate mask 5 the better, the more pixels of the input image 2 are changed according to this candidate mask 5. If a large number of pixels can be classified as not relevant to a decision at once, this is a valuable statement in itself.

According to block 132, a quality function 8 can alternatively be selected, for example, which evaluates a candidate mask 5 the better, the stronger this change affects the output 3 of the image classifier 1 at the same time. For the targeted search for the smallest possible changes in the input image 2, the quality function 8 can also optionally evaluate a candidate mask 5 the better, the fewer pixels of the input image 2 are changed according to this candidate mask 5.

The best candidate mask 5 based on the evaluation 8a by the quality function 8 is defined as a stage mask 5* in step 140a. In step 140b, the candidate modification 7 associated with the candidate mask 5 is set as a stage modification 7* associated with the stage mask 5*.

In step 150 it is checked whether a predetermined number of stage masks 5* and stage modifications 7* has already been generated from the input image 2 . If this is not yet the case (truth value 0), the system branches back from step 110 to generate further stage masks 5* and stage modifications 7*.

On the other hand, if the predetermined number of stage masks 5* and stage modifications 7* have been generated (truth value 1), in step 160 the stage modifications 7* are used as new input images 2 to generate new stages in the same way - Create masks 5* and stage modifications 7*. This means that a new level is started in the tree-like hierarchy of stage masks 5* and stage modifications 7*. For this purpose, the steps 110 to 150 contained in the dashed border are carried out again starting from the stage modifications 7* in the current level. The predetermined number of new stage modifications 7* on the new level thus emerges from each stage modification 7*. As previously explained, each of these new stage modifications 7* is formed as a local optimum over a predetermined number of candidate modifications 7, which are each created by changing the previous candidate modification 7* using a new candidate mask 5. The new candidate masks 5 are generated using new parameters drawn from the random distribution 4 .

In step 170 it is checked whether a predetermined termination condition 9 for the formation of the tree-like hierarchy is met. If this is not the case (truth value 0), the system branches back to step 160 to generate further levels. If, on the other hand, the termination condition 9 is fulfilled (truth value 1), the stage modifications 7* contained in total in the tree-like hierarchy are combined in step 180 to form the sought-after statement 1* about the ability to influence the decision.

According to block 171, the termination condition 9 can contain, for example, a predetermined maximum recursion depth for the generation of stage masks 5*.

According to block 172, all hop masks 5* can be clustered unsupervised. According to block 173, termination condition 9 can then include the number of clusters that are created in the process converging.

In order to combine the stage modifications 7* to form the statement 1*, according to block 181, a distance measure between the outputs (3′) on which the image classifier 1 maps the stage modifications 7* and the outputs 3 on which the image classifier 1 maps the original input image 2 can be determined. According to block 182, the stage masks 5* for stage modifications 7* for which this distance measure satisfies a predetermined criterion can then be determined as a statement 1* about the ability to influence the decision of the image classifier 1. This statement 1* is then, so to speak, a set of solutions that contains a selection of stage modifications 7*.

As explained above, for example according to block 183 those stage modifications 7* from which no further stage modifications 7* were generated can be selected for merging into the sought statement 1*. Precisely these stage modifications 7* on the lowest level of the tree of stage modifications 7* have emerged from the original input image 2 by the same, largest number of local optimization steps.

In 1 is also shown as an example of how statement 1* obtained with method 100 can be further evaluated in the context of two specific applications for image classifiers 1.

Insofar as the statement 1* was determined using an input image 2 that shows a mass-produced product, this statement 1* can be compared in step 190 with a portion 2b of the input image 2 that is based on an observation of the same product another imaging modality has been identified as relevant to the quality assessment of the product. A quality assessment 1a for the image classifier 1 can then be determined in step 200 from the result 190a of this comparison 190 .

Insofar as statement 1* was determined using an input image 2 showing a traffic situation, this statement 1* can be compared in step 210 with a portion 2b of the input image that is known to be relevant for assessing the traffic situation. A quality assessment 1a for the image classifier 1 can then be determined in step 220 from the result 210a of this comparison 210 .

2 shows the first two levels of a tree-like hierarchy of stage masks 5* obtained from an input image 2. The stage masks 5* each have a hatched area in which the input image 2 is to be subjected to the disturbance 6 in order to arrive at the corresponding stage modification 7*.

A first hop mask 5* was obtained in the first execution of step 140a. Upon repeating block 150, a second stage mask 5* has been created. The specified number of 2 stage masks 5* to be generated was thus reached. In the two stage masks 5*, different areas for the application of the fault 6 are reserved.

In step 160, a further level was now added to the tree-like hierarchy, in that both already existing stage masks 5* were used again in order to generate two further stage masks 5* each.

Here, different further areas were added to the areas already marked for the application of the fault.

QUOTES INCLUDED IN DESCRIPTION

This list of the documents cited by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent Literature Cited

• WO 2018/197074 A1 [0003]

Claims (18)

Method (100) for measuring the extent to which the decision of an image classifier (1) on the assignment (3) of an input image (2) to one or more classes of a specified classification can be influenced by changes in this input image (2), with the steps: • Using parameters (4) drawn from at least one random distribution, multiple binary candidate masks (5) are generated (110), each element of a binary candidate mask (5) indicating whether it corresponds to a pixel a predetermined perturbation (6) is to be applied to the input image (2) or not; • A candidate modification (7) of the input image (2) is generated for each candidate mask (5) by applying the specified interference to the pixels of the input image (2) specified by the respective candidate mask (5). (6) applied (120); • the candidate masks (5) are each evaluated (130) with a quality function (8) that depends on how the output (3) of the image classifier (1) changes if the image classifier (1) is used instead of the input image (2), the candidate modification (7) generated on the basis of the respective candidate mask (5) is supplied; • the best-scoring candidate mask (5) is set (140a) as a stage mask (5*) and the associated candidate variant (7) is set (140b) as a stage variant (7*); • further stage masks (5*) and stage modifications (7*) are determined (150) from the same input image (2) in the same way until a predetermined number is reached; • the stage modifications (7*) are used as new input images (2) to generate (160) new stage masks (5*) and stage modifications (7*) in the same way; • in response to the fact that a predetermined termination condition (9) is met (170), all or a selection of the stage modifications (7*) are brought together (180) to form the sought-after statement (1*) about the influenceability of the decision. Method (100) according to claim 1 , wherein generating the candidate masks (5) includes extracting (111) from the at least one random distribution coordinates of regions of the input image (2) to which the predetermined perturbation (6) is to be applied in different degrees. Method (100) according to claim 2 , wherein the input image (2) is divided into areas (111a) whose pixels are each changed with different probabilities based on the specified disturbance (6). Method (100) according to any one of Claims 1 until 3 , wherein those stage modifications (7*) from which no further stage modifications (7*) were generated are selected (183) for merging to form the statement (1*) sought. Method (100) according to any one of Claims 1 until 4 , where the evaluation of a candidate mask (5) by the quality function (8) is better (131), the smaller a change in the input image (2) according to this candidate mask (5) affects the output (3) of the image classifier (1). Method (100) according to any one of Claims 1 until 4 , the evaluation of a candidate mask (5) by the quality function (8) being better (132) the more this change affects the output (3) of the image classifier (1). Method (100) according to any one of Claims 1 until 6 , where a distance measure between the outputs (3') onto which the image classifier (1) maps the stage modifications (7*) and the outputs (3) onto which the image classifier (1) maps the original input image (2 ). 1) are determined (182). Method (100) according to any one of Claims 1 until 7 , wherein all pixels that are to be changed according to at least one stage mask (5*) are adopted as pixels to be changed in the candidate masks generated from this stage mask. Method (100) according to any one of Claims 1 until 8th , wherein the generation of at least one candidate mask (5) from a stage mask (5*) includes inverting (161) the stage mask (5*) in a region determined on the basis of the randomly drawn parameters (4). Method (100) according to any one of Claims 1 until 9 , wherein the termination condition (9) includes a predetermined maximum recursion depth for the generation of stage masks (5*) (171). Method (100) according to any one of Claims 1 until 10 , where all stage masks (5*) are clustered unsupervised (172) and where the termination condition (9) means that the number of clusters that are created converges (173). Method (100) according to any one of Claims 1 until 11 , taking a picture of a mass-produced product is selected as the input image (2) (106) and wherein the classes of the classification represent a quality rating of the product. Method (100) according to claim 12 , wherein the determined statement (1*), to what extent the decision of an image classifier on the assignment of an input image (2) to one or more classes of a given classification can be influenced by changes in this input image (2), with a proportion (2b ) of the input image (2) is compared (190), which was determined from an observation of the same product with a different imaging modality as relevant for the quality assessment of the product, and from the result (190a) of this comparison (190) a quality assessment (1a) for the image classifier (1) is determined (200). Method (100) according to any one of Claims 1 until 11 wherein an image of a traffic situation taken from a vehicle is selected as the input image (2) (107) and wherein the classes of the classification represent assessments of the traffic situation on the basis of which the future behavior of the vehicle is planned. Method (100) according to Claim 14 , wherein the determined statement (1*), to what extent the decision of an image classifier (1) on the assignment of an input image (2) to one or more classes of a given classification can be influenced by changes in this input image (2), with a Portion (2b) of the input image (2) is compared (210), which is known to be relevant for assessing the traffic situation, and from the result (210a) of this comparison, a quality assessment (1a) for the image classifier (1) is determined becomes (220). Computer program containing machine-readable instructions which, when executed on one or more computers, cause the computer or computers to perform the method (100) according to any one of Claims 1 until 15 to execute. Machine-readable data carrier with the computer program Claim 16 . Computer equipped with the computer program according to Claim 16 , and/or with the machine-readable data carrier Claim 17 .

Images