Title: COMPLEMENT OBJECTIVE TRAINING

Abstract: Learning with a primary objective, such as softmax cross entropy for classification and sequence generation, has been the norm for training deep neural networks for years. Although being a widely-adopted approach, using cross entropy as the primary objective exploits mostly the information from the ground-truth class for maximizing data likelihood, and largely ignores information from the complement (incorrect) classes. We argue that, in addition to the primary objective, training also using a complement objective that leverages information from the complement classes can be effective in improving model performance. This motivates us to study a new training paradigm that maximizes the likelihood of the groundtruth class while neutralizing the probabilities of the complement classes. We conduct extensive experiments on multiple tasks ranging from computer vision to natural language understanding. The experimental results confirm that, compared to the conventional training with just one primary objective, training also with the complement objective further improves the performance of the state-of-the-art models across all tasks. In addition to the accuracy improvement, we also show that models trained with both primary and complement objectives are more robust to single-step adversarial attacks.

1. INTRODUCTION:

Statistical learning algorithms work by optimizing towards a training objective. A dominant principle for training is to optimize likelihood (Mitchell et al., 1997) , which measures the probability of data given the model under a specific set of parameters. The popularity of deep neural networks has given rise to the use of cross entropy (Kullback & Leibler, 1951) as its primary training objective, since minimizing cross entropy is essentially equivalent to maximizing likelihood for disjoint classes. Cross entropy has become the standard training objective for many tasks including classification (Krizhevsky et al., 2012) and sequence generation (Sutskever et al., 2014) .

Let y i ∈ {0, 1} K be the label of the i th sample in one-hot encoded representation and ŷi ∈ [0, 1] K be the predicted probabilities, the cross entropy H(y, ŷ) is defined as:

EQUATION

where ŷig represents the predicted probability of the ground-truth class for the i th sample. Training with cross entropy as the primary objective aims at finding θ = arg min θ H(y, ŷ), where ŷ = h θ (x), h θ is a neural network and x is a sample. Although training using the cross entropy as the primary objective has achieved tremendous success, we have observed one limitation: it exploits mostly the information from the ground-truth class as Eq(1) shows; the information from complement classes (i.e., incorrect classes) has been largely ignored, since the predicted probabilities other than ŷig are zeroed out due to the dot product calculation with the one-hot encoded y i . Therefore, for classes other than the ground truth, the model behavior is not explicitly optimized -their predicted probabilities are indirectly minimized when ŷig is maximized since the probabilities sum up to 1. One way to utilize the information from the complement classes is to neutralize their predicted probabilities. To this end, we propose Complement Objective Training (COT), a new training paradigm that achieves this optimization goal without compromising the model's primary objective.

Figure 1 illustrates the comparison between Figure 1a : the predicted probability ŷ from the model trained with just cross entropy as the primary objective, and Figure 1b : ŷ from the model trained with both primary and complement objectives. Training with the complement objective finds the parameters θ that evenly suppress complement classes without compromising the primary objective (i.e., maximizing ŷg ), making the model more confident of the ground-truth class.

Figure 2 further illustrates the embeddings of CIFAR10 images calculated from ResNet-110 using two training paradigms: cross entropy and COT. An embedding of an image is the vector representation computed by the ResNet-110 model, before taking the softmax operation. Compared to Figure 2a , the clusters in Figure 2b seem to have clean and separable boundaries, leading to more accurate and robust classification results. The experimental results later in Section 3 further confirm this observation.

Complement objective training requires a function that complements the primary objective. In this paper, we propose "complement entropy" (defined in Section 2) to complement the softmax cross entropy for neutralizing the effects of complement classes. The neural net parameters θ are then updated by alternating iteratively between (a) minimizing cross entropy to increase ŷg , and (b) maximizing complement entropy to neutralize ŷj =g . Experimental results (in Section 3) confirm that COT improves the accuracies of the state-of-the-art methods for both (a) the image classification tasks on ImageNet-2012, Tiny ImageNet, CIFAR-10, CIFAR-100, and SVHN, and (b) language understanding tasks on machine translation and speech recognition. Furthermore, experimental results also show that models trained by COT are more robust to adversarial attacks.

2. COMPLEMENT OBJECTIVE TRAINING:

In this section, we first define "Complement Entropy" as the complement objective, and then provide a new training algorithm for updating neural network parameters θ by alternating iteratively between the primary objective and the complement objective.

2.1. COMPLEMENT ENTROPY:

Conventionally, training with cross entropy as the primary objective aims at maximizing the predicted probability of the ground-truth class ŷg in Eq(1). As mentioned in the introduction, the proposed COT also maximizes the complement objective for neutralizing the predicted probabilities of the complement classes. To achieve this, we propose "complement entropy" as the complement objective; complement entropy C(•) is defined to be the average of sample-wise entropies over complement classes in a mini-batch:

EQUATION

H(•) is the entropy function. All the symbols and notations used in this paper are summarized in Table 1 . One thing worth noticing is that this sample-wise entropy is calculated by considering only the complement classes other than the ground-truth class g. The sample-wise predicted probability ŷij is normalized by one minus the ground-truth probability (i.e., 1-ŷ ig ). The term ŷij /(1-ŷ ig ) can be understood as: conditioned on the ground-truth class g not happening, the predicted probability to see the class j for the i th sample. Since the entropy is maximized when the events are equally likely to occur, optimizing on the complement entropy drives ŷij to (1 -ŷig )/(K -1), which essentially neutralizes the predicted probability of complement classes as K grows large. In other words, maximizing the complement entropy "flattens" the predicted probabilities of complement classes ŷj =g . We conjecture that, when ŷj =g are neutralized, the neural net h θ generalizes better, since it is less likely to have an incorrect class with a sufficiently high predicted probability to "challenge" the ground-truth class.

2.2. TRAINING WITH COMPLEMENT OBJECTIVE:

Given a training procedure using a primary objective, such as softmax cross entropy, one can easily adopt the complement entropy to turn the procedure into a Complement Objective Training (COT). Algorithm 1 describes the new training mechanism by alternating iteratively between the primary and complement objectives. At each training step, the cross entropy is first calculated as the loss value to update the model parameters; next, the complement entropy is calculated as the loss value to perform the second update. Therefore, additional forward and backward propagation are required in each iteration when using the complement objective, making the total training time empirically 1.6 times longer.

Table 1 : Notations used in this paper.

Symbol Meaning y i:

One-hot vector representing the label of the i th sample. ŷi

The predicted probability for each class for the i th sample. g Index of the ground-truth class. y ij or ŷij The j th class (element) of y i or ŷi . ŷc

Predicted probabilities of of the complement (incorrect) classes.

H(•, •):

Cross entropy function.

H(•):

Entropy function.

C(•):

Complement entropy. N and K Total number of samples and total number of classes. 

3. EXPERIMENTS:

We perform extensive experiments to evaluate COT on tasks in domains ranging from computer vision to natural language understanding and compare it with the baseline algorithms that achieve state-of-the-art in the respective domains. We also perform experiments to evaluate the robustness of the model trained by COT when attacked by adversarial examples. For each task, we select a stateof-the-art model that has an open-source implementation (referred to as "baseline") and reproduce their results with the hyper-parameters reported in the paper or code repository. Our code is available at https://github.com/henry8527/COT.

3.1. BALANCING TRAINING OBJECTIVES:

In theory, the loss values between the primary and the complement objectives can be in different scales; therefore, additional efforts for tuning learning rates might be required for optimizers to achieve the best performance. Empirically, we find the complement entropy in Eq(2) can be modified as follows to balance the losses between the two objectives:

C (ŷ c) = 1 K -1 • C(ŷ c) = 1 K -1 • 1 N N i=1 H(ŷ ic ) (3)

where K is the number of classes. This modification can be treated as the complement entropy C(•) being "normalized" by (K -1). For all the experiments conducted in this paper, we use this normalized complement entropy as the complement objective to improve the baselines without further tuning of learning rates.

3.2. IMAGE CLASSIFICATION:

We consider the following datasets for experiments with image classification: CIFAR-10, CIFAR-100, SVHN, Tiny ImageNet and ImageNet-2012. For CIFAR-10, CIFAR-100 and SVHN, we choose the following baseline models: ResNet-110 (He et al., 2016b) , PreAct ResNet-18 (He et al., 2016a) , ResNeXt-29 (2×64d) (Xie et al., 2017) , WideResNet-28-10 (Zagoruyko & Komodakis, 2016) and DenseNet-BC-121 (Huang et al., 2017b) with a growth rate of 32. For those five models, we use a consistent set of settings below, which is described in (He et al., 2016b) . Specifically, the models are trained using SGD optimizer with momentum of 0.9. Weight decay is set to be 0.0001 and learning rate starts at 0.1, then being divided by 10 at the 100 th and 150 th epoch.

The models are trained for 200 epochs, with mini-batches of size 128. The only exception here is for training WideResNet-28-10, we follow the settings described in (Zagoruyko & Komodakis, 2016) , and the learning rate is divided by 10 at the 60 th , 120 th and 180 th epoch. In addition, no dropout (Srivastava et al., 2014 ) is applied to any baseline according to the best practices in (Ioffe & Szegedy, 2015) . For Tiny ImageNet and ImageNet-2012, the baseline models are slightly different: we follow the settings from (Zhang et al., 2018) , and the details are described in the corresponding paragraphs.

CIFAR-10 and CIFAR-100. CIFAR-10 and CIFAR-100 are datasets (Krizhevsky, 2009 ) that contain colored natural images of 32x32 pixels, in 10 and 100 classes, respectively. We follow the baseline settings (He et al., 2016b) to pre-process the datasets; both datasets are split into a training set with 50,000 samples and a testing set with 10,000 samples. During training, zero-padding, random cropping, and horizontal mirroring are applied to the images with a probability of 0.5. For the testing images, we use the original images of 32x32 pixels.

A comparison between the models trained using the primary objective and the COT model is illustrated in Figures 3a and 4a for CIFAR-10 and CIFAR-100 respectively. We show that COT consistently outperforms the baseline models. Some of the models, for example, ResNetXt-29, achieves a significant performance boost of 12.5% in terms of classification errors. For some other models such as WideResNet-28-10 and DenseNet-BC-121, the improvements are not as significant but are still large enough to justify the differences. Similar conclusions can be observed from the CIFAR-100 dataset. In addition to the comparisons of the performance, we also present the change of testing errors over the course of the training in Figures 3b and 4b for the ResNet-110 model. Following the standard training practice, learning rates drop after the 100 th epoch, which corresponds to a drop in testing errors. As we can see from the plot, COT outperforms consistently compared to the baseline models when the models are close to the convergence. (Deng et al., 2009) , which contains 100,000 images for training and 10,000 for testing images across 200 classes. In this dataset, each image is down-sampled to 64x64 pixels from the original 256x256 pixels. We consider four state-of-the-art models as baselines: ResNet-50, ResNet-101 (He et al., 2016b) , and ResNeXt-101 (32×4d) (Xie et al., 2017) . During training, we follow the standard data-augmentation techniques, such as random cropping, horizontal flipping, and normalization. For each model, the stride of the first convolution layer is modified to adapt images of size 64x64 (Huang et al., 2017a) . For evaluation, the testing data is only augmented with 56x56 central cropping. The rest of the experimental details are the same as the ones described at the beginning of Section 3.2.

Table 3 provides the experimental results, which demonstrate that COT consistently improves the performance of all baseline models. (Russakovsky et al., 2015) is one of the largest datasets for image classification, which contains 1.3 million images for training and 50,000 images for testing with 1,000 classes. Random crops and horizontal flips are applied during training (He et al., 2016b) , while images in the testing set use 224x224 center crops (1-crop testing) for data augmentation.

ResNet-50 is selected as the baseline model, and we follow (Goyal et al., 2017) for the experimental setup: 256 minibatch size, 90 total training epochs, and 0.1 as the initial learning rate starting that is decayed by dividing 10 at the 30 th , 60 th and 80 th epoch. Table 4 shows (a) the error rate2 of baseline reported by (He et al., 2016b) and (b) the error rate of baseline model trained by COT, which confirms COT further improves the baseline performance.

Table 4 : Validation errors (in %) for the ImageNet-2012 experiments.

Model Baseline COT:

ResNet-50 Top-1 Error 24.7 24.4

3.3. NATURAL LANGUAGE UNDERSTANDING:

COT is also evaluated on two natural language understanding (NLU) tasks: machine translation and speech recognition. One distinct characteristic of most NLU tasks is a large number of target classes. For example, the machine translation dataset used in this paper, IWSLT 2015 English-Vietnamese (Cettolo et al., 2015) , consists of vocabularies of 17,191 English words and 7,709 Vietnamese words. This necessitates the normalized complement entropy in Eq(3).

Machine translation. Neural machine translation (NMT) has popularized the use of neural sequence models (Sutskever et al., 2014; Cho et al., 2014) . Specifically, we apply COT on the seq2seq model with Luong attention mechanism (Luong et al., 2015) on the IWSLT 2015 English-Vietnamese dataset, which contains 133 thousand translation pairs. For validation and testing, we use TED tst2012 and TED tst2013, respectively. For the baseline implementation, we follow the official TensorFlow-NMT implementation3 . That is, the number of total training steps is 12,000 and the weight decay starts at the 8,000 th step then applied for every 1,000 steps. We experiment models with both greedy decoder and beam search decoder. The model trained by COT gives the best testing results when the beam width is 3, while the baseline uses 10 as the best beam width. Table 5 illustrates the experimental results, showing COT improves testing BLEU scores compared to the baseline NMT model on both greedy decoder and the beam search decoder. den, 2018) , which consists of 65,000 one-second utterances of 30 different types such as "Yes," "No," "Up," "Down" and "Stop." Our baseline model is referenced from (Zhang et al., 2018) . We apply the same pre-processing steps as shown in the paper, and perform the short-time Fourier transform on the original waveforms first at a sampling rate of 4 kHz to receive the corresponding spectrograms. We then zero-pad these spectrograms to equalize each sample's length. For the baseline model, we select VGG-11 (Simonyan & Zisserman, 2014 ) and train the model for 30 epochs following the steps in (Zhang et al., 2018) . We use SGD optimizer with momentum, and weight decay is 0.0001. The learning rate starts at 0.0001 and then is divided by 10 at the 10 th and 20 th epoch. COT improves the baseline by further reducing the error rate by 1.56%, as shown in Table 6 .

3.4. ADVERSARIAL EXAMPLES:

An adversarial example is an imperceptibly-perturbed input that results in the model outputting an incorrect answer with high confidence (Szegedy et al., 2014; Goodfellow et al., 2015) . Prior As shown in Figure 2 , the proposed COT generates embeddings where the class boundaries are clear and well-separated. We believe that the models trained using COT generalize better and are more robust to adversarial attacks. To verify this conjecture, we conduct experiments of white-box attacks to the models trained by COT. We consider a common approach of single-step adversarial attacks: Fast Gradient Sign Method (FGSM) (Goodfellow et al., 2015) that uses the gradient to determine the direction of the perturbation to apply on an input for creating an adversarial example.

To set up FGSM white-box attacks on a baseline model, adversarial examples are generated using the gradients calculated based on the primary objective (referred to as the "primary gradient") of the baseline model. For FGSM white-box attacks on COT, adversarial perturbations are generated based on the sum of the primary gradient and the complement gradient (i.e., the gradient calculated from the complement objective), both gradients from the model trained by COT. In our experiments, the baseline models are the same as in Section 3.2, and the amount of perturbation is limited to a maximum value of 0.1 as described in (Goodfellow et al., 2015) Table 7 shows the performance of the models on the CIFAR-10 dataset under FGSM white-box and transfer attacks. Generally, the models trained using COT have lower classification error under both FGSM white-box and transfer attacks, which is an indicator that COT models are more robust to both kinds of attacks. We also conduct experiments on the basic iterative attacks using I-FGSM (Kurakin et al., 2017) and the corresponding results can be found in Appendix A.

We conjecture that since the main goal of the complement gradients is to neutralize the probabilities of incorrect classes (instead of maximizing the probability of the correct class), the complement gradients may "push away" primary gradients when forming adversarial perturbations, which might partially answer why COT is more robust to FGSM white-box attacks compared to the baseline. Regarding the transfer attacks, only the primary objective of the baseline model is used to calculate the gradients for generating adversarial examples. In other words, the complement gradients are not considered when generating adversarial examples in the transfer attack, and this might be the reason why models trained by COT are more robust to transfer attacks. Both conjectures leave a large space for future work: using complement objective to defend against more advanced adversarial attacks.

4. CONCLUSION AND FUTURE WORK:

In this paper, we study Complement Objective Training (COT), a new training paradigm that optimizes the complement objective in addition to the primary objective. We propose complement entropy as the complement objective for neutralizing the effects of complement (incorrect) classes.

Models trained using COT demonstrate superior performance compared to the baseline models. We also find that COT makes the models robust to single-step adversarial attacks.

COT can be extended in several ways: first, in this paper, the complement objective is chosen to be the complement entropy. Non-entropy-based complement objectives should also be considered for future studies, which is left as a straight-line future work. Secondly, the exploration of COT on broader applications remains as an open research question. One example would be applying COT on generative models such as Generative Adversarial Networks (Goodfellow et al., 2014) . Another example would be using COT on object detection and segmentation. Finally, in this work, we show using complement objective help defend single-step adversarial attacks; the behavior of COT on more advanced adversarial attacks deserves further investigation and is left as another future work.

:

https://tiny-imagenet.herokuapp.com/

https://github.com/KaimingHe/deep-residual-networks

https://github.com/tensorflow/nmt/tree/tf-1.4

Figures and Tables:

(a) ŷ from the model trained with cross entropy. (b) ŷ from the model trained with COT.

Figure 1: Predicted probabilities ŷ from two training paradigms: (a) With cross entropy as the primary objective. (b) COT: with both primary and complement objectives. The model is ResNet-110 and the sample image is from CIFAR10 dataset. The ground-truth class is "horse." Compared to (b), the model in (a) is confused by other classes such as "airplane" and "automobile," which suggests (a) might be more susceptible for generalization issues and potentially adversarial attacks.

Figure 2: Embeddings for CIFAR10 test images from two training paradigms: (a) With cross entropy as the primary objective. (b) COT: training with both primary and complement objectives. The model is ResNet-110, and the "embedding" is the vector representation before taking the softmax operation. The embedding representation of each sample is projected to two dimensions using t-SNE for visualization purpose. Compared to (a), the cluster of each class in (b) is "narrower" in terms of intra-cluster distance. Also, the clusters in (b) seem to have clean and separable boundaries, leading to more accurate and robust classification results.

Training by alternating between primary and complement objectives for t ← 1 to n train steps do 1. Update parameters by Primary Objective: -1 N N i=1 log(ŷ ig ) 2. Update parameters by Complement Objective: -1 N N i=1 H(ŷ ic )

View House Numbers (SVHN). The SVHN dataset(Netzer et al., 2011) consists of images extracted from Google Street View. We divide the dataset into a set of 73,257 digits for training and a set of 26,032 digits for testing. When pre-processing the training and validation images, we follow the general practice to normalize pixel values into [-1,1].

errors (in %) on CIFAR-10. For COT, we repeat 5 runs and report the "best (mean±std)" error values.(b) Test errors of ResNet-110 on CIFAR-10 over epochs.

Figure 3: Classification errors on CIFAR-10: (a) COT improves all 5 state-of-the-art models. (b) The improvement over epochs. Notice that the performance improvement from COT becomes stable after the 100 th epoch due to the learning rate decrease.

Figure 4: Classification errors on CIFAR-100: (a) COT improves all 5 state-of-the-art models. (b)The improvement over epochs. Similar to the trend observed in CIFAR-10, the performance improvement from COT becomes stable after the 100 th epoch due to the learning rate decrease.

Test errors (in %) of the baseline models and the COT-trained models on the SVHN dataset. The values presented are the mean values of 3 runs.

Table content: <table><tr><td>Model</td><td colspan="2">Baseline COT</td></tr><tr><td>ResNet-110</td><td>4.94</td><td>4.36</td></tr><tr><td>PreAct ResNet-18</td><td>4.31</td><td>3.96</td></tr><tr><td colspan="2">ResNeXt-29 (2×64d) 4.22</td><td>3.76</td></tr><tr><td>WideResNet-28-10</td><td>3.72</td><td>3.50</td></tr><tr><td>DenseNet-BC-121</td><td>3.52</td><td>3.47</td></tr><tr><td colspan="3">Tiny ImageNet. Tiny ImageNet 1 dataset is a subset of ImageNet</td></tr></table>

Top-1 Validation errors (in %) for the Tiny ImageNet experiments (mean values of 3 runs).

Table content: <table><tr><td>Model</td><td colspan="2">Baseline COT</td></tr><tr><td>ResNet-50</td><td>39.39</td><td>39.20</td></tr><tr><td>ResNet-101</td><td>38.23</td><td>37.35</td></tr><tr><td>ResNeXt-50 (32×4d)</td><td>37.36</td><td>36.69</td></tr><tr><td colspan="2">ResNeXt-101 (32×4d) 37.02</td><td>36.14</td></tr><tr><td>ImageNet. ImageNet-2012 dataset</td><td/><td/></tr></table>

Results of IWSLT 2015 English-Vietnamese. The BLEU scores on tst2013 are reported.

Table content: <table><tr><td>Model</td><td colspan="2">Baseline COT</td></tr><tr><td>NMT (greedy)</td><td>25.5</td><td>25.7</td></tr><tr><td colspan="2">NMT (beam search) 26.1</td><td>26.4</td></tr><tr><td colspan="3">Speech recognition. For speech recognition, we experiment on Google Commands Dataset (War-</td></tr></table>

Test errors (in %) on Google Commands Dataset (mean values of 3 runs).

Table content: <table><tr><td>Model</td><td colspan="2">Baseline COT</td></tr><tr><td colspan="2">VGG-11 6.06</td><td>4.50</td></tr><tr><td colspan="3">literatures have shown that there are several methods to generate effective adversarial examples that</td></tr><tr><td colspan="3">greatly mislead the model toward providing wrong predictions.</td></tr></table>

when creating adversarial examples. Furthermore, we also conduct experiments on FGSM transfer attacks, which use the adversarial examples from a baseline model to attack and test the robustness of the model trained by COT. Classification errors (in %) on CIFAR-10 under FGSM white-box & transfer attacks.

Table content: <table><tr><td>Model</td><td colspan="3">Baseline COT (White-Box) COT (Transfer)</td></tr><tr><td>ResNet-110</td><td>62.23</td><td>52.72</td><td>54.96</td></tr><tr><td>PreAct ResNet-18</td><td>65.60</td><td>56.17</td><td>59.39</td></tr><tr><td colspan="2">ResNeXt-29 (2×64d) 70.24</td><td>61.55</td><td>65.83</td></tr><tr><td>WideResNet-28-10</td><td>59.39</td><td>55.53</td><td>57.33</td></tr><tr><td>DenseNet-BC-121</td><td>65.97</td><td>55.99</td><td>62.40</td></tr></table>

Peer review (iclr2019):
 ======== Summary ======== The paper deals with the training of neural networks for classification or sequence generation tasks, using a cross-entropy loss. Minimizing the cross-entropy means maximizing the predicted probabilities of the ground-truth classes (averaged over the samples). The authors introduce a "complementary entropy" loss with the goal of minimizing the predicted probabilities of the complementary (incorrect) classes. To do that, they use the average of sample-wise entropy over the complement classes. By maximizing this entropy, the predicted complementary probabilities are encouraged to be equal and therefore, the authors claim that it neutralizes them as the number of classes grows large. The proposed training procedure, named COT, consists of alternating between the optimization of the two losses. The procedure is tested on image classification tasks with different datasets (CIFAR-10, CIFAR-100, Street View House Numbers, Tiny ImageNet and ImageNet), machine translation (training using IWSLT dataset, validation and test using TED tst2012/2013 datasets), and speech recognition (Gooogle Commands dataset). In the experiments, COT outperforms state-of-the-art models for each task/dataset. Adversarial attacks are also considered for the classification of images of CIFAR-10: using the Fast Gradient Sign and Basic Iterative Fast Gradient Sign methods on different models, adversarial examples specifically designed for each model, are generated. Then results of these models are compared to COT on these examples. The authors admit that the results are biased since the adversarial attacks only target part of the COT objective, hence more accurate comparisons should be done in future work. =========================== Main comments and questions =========================== End of page 1: "the model behavior for classes other than the ground truth stays unharnessed and not well-defined". The probabilities should still sum up to 1, so if the ground truth one is maximized, the others are actually implicitly minimized. No? Page 3, sec 2.1: "optimizing on the complement entropy drives ŷ_ij to 1/(K − 1)". I believe that it drives each term ŷ_ij /(1 − ŷ_ig ) to be equal to 1/(K-1). Therefore, it drives ŷ_ij to (1 − ŷ_ig)/(K-1) for j!=g. This indeed flattens the ŷ_ij for j!=g, but the effect on ŷ_ig is not controlled. In particular this latter can decrease. Then in the next step of the algorithm, ŷ_ig will be maximized, but with no explicit control over the complementary probabilities. There are two objectives that are optimized over the same variable theta. So the question is, are we sure that this procedure will converge? What prevents situations where the probabilities will alternate between two values? For example, with 4 classes, we look at the predicted probabilities of a given sample of class 1: Suppose after step 1 of Algo 1, the predicted probabilities are: 0.5 0.3 0.1 0.1 After step 2: 0.1 0.3 0.3 0.3 Then step 1: 0.5 0.3 0.1 0.1 Then step 2: 0.1 0.3 0.3 0.3 And so on... Can this happen? Or why not? Did the algorithm have trouble converging in any of the experiments? Sec 3.1: "additional efforts for tuning hyper-parameters might be required for optimizers to achieve the best performance": Which hyper-parameters are considered here? If it is the learning rate, why not use a different one, tuned for each objective? Sec 3.2: The additional optimization makes each training iteration more costly. How much more? How do the total running times of COT compare to the ones of the baselines? I think this should be mentioned in the paper. Sec 3.4: As the authors mention, the results are biased and so the comparison is not fair here. Therefore I wonder about the relevance of this section. Isn*t there an easy way to adapt the attacks to the two objectives to be able to illustrate the conjectured robustness of COT? For example, naively having a two steps perturbation of the input: one based on the gradient of the primary objective and then perturb the result using the gradient of the complementary objective? =========================== Secondary comments and typos =========================== Page 3, sec 2.1: "...the proposed COT also optimizes the complement objective for neutralizing the predicted probabilities...", using maximizes instead of optimizes would be clearer. In the definition of the complement entropy, equation (2), C takes as parameter only y^hat_Cbar but then in the formula, ŷ_ig appears. Shouldn*t C take all .hat_y as an argument in this case? Algorithm 1 page 4: I find it confusing that the (artificial) variable that appears in the argmin (resp. argmax) is theta_{t-1} (resp. theta*_t) which is the previous parameter. Is there a reason for this choice? Sec 3: "We perform extensive experiments to evaluate COT on the tasks" --> COT on tasks "compare it with the baseline algorithms that achieve state-of-the-art in the respective domain." --> domainS "to evaluate the model’s robustness trained by COT when attacked" needs reformulation. "we select a state- of-the-art model that has the open-source implementation" --> an open-source implementation Sec 3.2: Figure 4: why is the median reported and not the mean (as in Figure 3, Tables 2 and 3)? Table 3 and 4: why is it the validation error that is reported and not the test error? Sec 3.3: "Neural machine translation (NMT) has populated the use of neural sequence models": populated has not the intended meaning. "We apply the same pre-processing steps as shown in the model" --> in the paper? Sec 3.4: "We believe that the models trained using COT are generalized better" --> "..using COT generalize better" "using both FGSM and I-FGSM method" --> methodS "The baseline models are the same as Section 3.2." --> as in Section 3.2. "the number of iteration is set at 10." --> to 10 "using complement objective may help defend adversarial attacks." --> defend against "Studying on COT and adversarial attacks.." --> could be better formulated References: there are some inconsistencies (e.g.: initials versus first name) Pros ==== - Paper is clear and well-written - It seems to me that it is a new original idea - Wide applicability - Extensive convincing experimental results Cons ==== - No theoretical guarantee that the procedure should converge - The training time may be twice longer (to clarify) - The adversarial section, as it is, does not seem relevant for me