Title: UNSUPERVISED LEARNING OF THE SET OF LOCAL MAXIMA

Abstract: This paper describes a new form of unsupervised learning, whose input is a set of unlabeled points that are assumed to be local maxima of an unknown value function v in an unknown subset of the vector space. Two functions are learned: (i) a set indicator c, which is a binary classifier, and (ii) a comparator function h that given two nearby samples, predicts which sample has the higher value of the unknown function v. Loss terms are used to ensure that all training samples x are a local maxima of v, according to h and satisfy c(x) = 1. Therefore, c and h provide training signals to each other: a point x in the vicinity of x satisfies c(x) = -1 or is deemed by h to be lower in value than x. We present an algorithm, show an example where it is more efficient to use local maxima as an indicator function than to employ conventional classification, and derive a suitable generalization bound. Our experiments show that the method is able to outperform one-class classification algorithms in the task of anomaly detection and also provide an additional signal that is extracted in a completely unsupervised way.

1. INTRODUCTION:

...from so simple a beginning endless forms most beautiful and most wonderful have been, and are being, evolved. (Darwin, 1859) When we observe the natural world, we see the "most wonderful" forms. We do not observe the even larger quantity of less spectacular forms and we cannot see those forms that are incompatible with existence. In other words, each sample we observe is the result of optimizing some fitness or value function under a set of constraints: the alternative, lower-value, samples are removed and the samples that do not satisfy the constraints are also missing.

The same principle also holds at the sub-cellular level. For example, a gene can have many forms. Some of them are completely synonymous, while others are viable alternatives. The gene forms that become most frequent are those which are not only viable, but which also minimize the energetic cost of their expression (Farkas et al., 2018) . For example, the genes that encode proteins comprised of amino acids of higher availability or that require lower expression levels to achieve the same outcome have an advantage. One can expect to observe most often the gene variants that: (i) adhere to a set of unknown constraints ("viable genes"), and (ii) optimize an unknown value function that includes energetic efficiency considerations.

The same idea, of mixing constraints with optimality, also holds for man-made objects. Consider, for example, the set of houses in a given neighborhood. Each architect optimizes the final built form to cope with various aspects, such as the maximal residential floor area, site accessibility, parking considerations, the energy efficiency of the built product, etc. What architects find most challenging, is that this optimization process needs to correspond to a comprehensive set of state and city regulations that regard, for example, the proximity of the built mass of the house to the lot's boundaries, or the compliance of the egress sizes with current fire codes.

In another instance, consider the weights of multiple neural networks trained to minimize the same loss on the same training data, each using a different random initialization. Considering the weights of each trained neural network as a single vector in a sample domain, also fits into the framework of local optimality under constraints. By the nature of the problem, the obtained weights are the local optimum of some loss optimization process. In addition, the weights are sometimes subject to constraints, e.g., by using weight normalization.

The task tackled in this paper is learning the value function and the constraints, by observing only the local maxima of the value function among points that satisfy the constraints. This is an unsupervised problem: no labels are given in addition to the samples.

The closest computational problem in the literature is one-class classification (Moya et al., 1993) , where one learns a classifier c in order to model a set of unlabeled training samples, all from a single class. In our formulation, two functions are learned: a classifier and a separate value function. Splitting the modeling task between the two, a simpler classifier can be used (we prove this for a specific case) and we also observe improved empirical performance. In addition, we show that the value function, which is trained with different losses and structure from those of the classifier, models a different aspect of the training set. For example, if the samples are images from a certain class, the classifier would capture class membership and the value function would encode image quality. The emergence of a quality model makes sense, since the training images are often homogeneous in their quality.

The classifier c and the value function v provide training signals to each other, in an unsupervised setting, somewhat similar to the way adversarial training is done in GANs (Goodfellow et al., 2014) , although the situation between c and v is not adversarial. Instead, both work collaboratively to minimize similar loss functions. Let S be the set of unlabeled training samples from a space X. Every x ∈ S satisfies c(x) = 1 for a classifier c : X → {±1} that models the adherence to the set of constraints (satisfies or not). Alternatively, we can think of c as a class membership function that specifies, if a given input is within the class or not. In addition, we also consider a value function v, and for every point x , such that x -x ≤ , for a sufficiently small > 0, we have:

v(x ) < v(x).

This structure leads to a co-training of v and c, such that every point x in the vicinity of x can be used either to apply the constraint v(x ) < v(x) on v, or as a negative training sample for c. Which constraint to apply, depends on the other function: if c(x ) = 1, then the first constraint applies; if v(x ) ≥ v(x), then x is a negative sample for c. Since the only information we have on v pertains to its local maxima, we can only recover it up to an unknown monotonic transformation. We therefore do not learn it directly and instead learn a comparator function h, which given two inputs, returns an indication which input has the higher value in v.

An alternative view of the learning problem we introduce considers the value function v (or equivalently h) as part of a density estimation problem, and not as part of a multi-network game. In this view, c is the characteristic function (of belonging to the support) and h is the comparator of the probability density function (PDF).

2. RELATED WORK:

The input to our method is a set of unlabeled points. The goal is to model this set. This form of input is shared with the family of methods called one-class classification. The main application of these methods is anomaly detection, i.e., identifying an outlier, given a set of mostly normal (the opposite of abnormal) samples (Chandola et al., 2009) .

The literature on one class classification can be roughly divided into three parts. The first includes the classical methods, mostly kernel-base methods, which were applying regularization in order to model the in-class samples in a tight way (Schölkopf et al., 2001) . The second group of methods, which follow the advent of neural representation learning, employ classical one-class methods to representations that are learned in an unsupervised way (Hawkins et al., 2002; Sakurada & Yairi, 2014; Xia et al., 2015; Xu et al., 2015; Erfani et al., 2016) , e.g., by using autoencoders. Lastly, a few methods have attempted to apply a suitable one-class loss, in order to learn a neural networkbased representation from scratch (Ruff et al., 2018) . This loss can be generic or specific to a data domain. Recently, Golan & El-Yaniv (2018) achieved state of the art one-class results for visual datasets by training a network to predict the predefined image transformation that is applied to each of the training images. A score is then used to evaluate the success of this classifier on test images, assuming that out of class images would be affected differently by the image transformations.

Despite having the same structure of the input (an unlabeled training set), our method stands out of the one-class classification and anomaly detection methods we are aware of, by optimizing a specific model that disentangles two aspects of the data: one aspect is captured by a class membership function, similar to many one-class approaches; the other aspect compares pairs of samples. This dual modeling captures the notion that the samples are not nearly random samples from some class, but also the local maximum in this class. While "the local maxima of in-class points" is a class by itself, a classifier-based modeling of this class would require a higher complexity than a model that relies on the structure of the class as pertaining to local maxima, as is proved, for one example, in Sec. A. In addition to the characterization as local maxima, the factorization between the constraints and the values also assists modeling. This is reminiscent of many other cases in machine learning, where a divide and conquer approach reduces complexity. For example, using prior knowledge on the structure of the problem, helps to reduce the complexity in hierarchical models, such as LDA (Blei et al., 2003) .

While we use the term "value function", and this function is learned, we do not operate in a reinforcement learning setting, where the term value is often used. Specifically, our problem is not inverse reinforcement learning (Ng & Russell, 2000) and we do not have actions, rewards, or policies.

3. METHOD:

Recall that S is the set of unlabeled training samples, and that we learn two functions c and v such that for all x ∈ S it holds that: (i) c(x) = 1, and (ii) x is a local maxima of v.

For every monotonic function f , the setting we define cannot distinguish between v, and f • v. This ambiguity is eliminated, if we replace v by a binary function h that satisfies h(x, x ) = 1 if v(x) ≥ v(x ) and h(x, x ) = -1 otherwise. We found that training h in lieu of v is considerably more stable. Note that we do not enforce transitivity, when training h, and, therefore, h can be such that no underlying v exists.

3.1. TRAINING c AND h:

When training c, the training samples in S = {x i } m i=1 are positive examples. Without additional constraints, the recovery of c is an ill-posed problem. For example, Ruff et al. (2018) add an additional constraint on the compactness of the representation space. Here, we rely on the ability to generate hard negative points1 . There are two generators G c and G h , each dedicated to generating negative training points to either c or h, as described in Sec. 3.2 below.

The two generators are conditioned on a positive point x ∈ S and each generates one negative point per each x: x = G c (x) and x = G h (x). The constraints on the negative points are achieved by multiplying two losses: one pushing c(x ) to be negative, and the other pushing h(x , x) to be negative.

Let (p, y) := -1 2 ((y +1) log(p)+(1-y) log(1-p)) be the binary cross entropy loss for y ∈ {±1}. c and h are implemented as neural networks trained to minimize the following losses, respectively:

EQUATION

EQUATION

The first sum in L C ensures that c classifies all positive points as positive. The second sum links the outcome of h and c for points generated by G c . It is given as a multiplication of two losses. This multiplication encourages c to focus on the cases where h predicts with a higher probability that the point G c (x) is more valued than x. Train h for one epoch to minimize L H 7: return c, h

The first term of L C (respectively L H ) depends on c's (respectively h's) parameters only. The second term of L C (respectively L H ), however, depends on both h's and c's parameters as well as G c 's (respectively G h 's) parameters.

The loss L H is mostly similar. It ensures that h has positive values when the two inputs are the same, at least at the training points. In addition, it ensures that for the generated negative points x , h(x , x) is -1, especially when c(x ) is high.

One can alternatively use a symmetric L H , by including an additional term

1 m x∈S (c(G h (x)), -1) • (h(x, G h (x)), 1

). This, in our experiments, leads to very similar results, and we opt for the slightly simpler version.

3.2. NEGATIVE POINT GENERATION:

We train two generators, G c and G h , to produce hard negative samples for the training of c and h, respectively. The two generators both receive a point x ∈ S as input, and generate another point in the same space X. They are constructed using an encoder-decoder architecture, see Sec. 3.4 for the exact specifications.

When training G c , the loss -L C is minimized. In other words, G c finds, in an adversarial way, points x , that maximize the error of c (the first term of L C does not involve G c and does not contribute, when training G c ).

G h minimizes during training the loss λ m x∈S ||x -G h (x)|| -L H ,

for some parameter λ. Here, in addition to the adversarial term, we add a term that encourages G h (x) to be in the vicinity of x. This is added, since the purpose of h is to compare nearby points, allowing for the recovery of points that are local maxima. In all our experiments we set λ = 1.

The need for two generators, instead of just one, is verified in our ablation analysis, presented in Sec. 4. One may wonder why two are needed. One reason stems from the difference in the training loss: h is learned locally, while c can be applied anywhere. In addition, c and h are challenged by different points, depending on their current state during training. By the structure of the generators, they only produce one point per input x, which is not enough to challenge both c and h.

3.3. TRAINING PROCEDURE:

The training procedure follows the simple interleaving scheme presented in Alg. 1. We train the networks in turns: G c and then c, followed by G h and then h. Since the datasets in our experiments are relatively small, each turn is done using all mini-batches of the training dataset S. The ADAM optimization scheme is used with mini-batches of size 32.

The training procedure has self regularization properties. For example, assuming that G h (x) = x, L H as a function of h, has a trivial global minima. This solution is to assign h(x , x) to 1 iff x = x. However, for this specific h, the only way for G h to maximize L H is to rely on c and h being smooth and to select points x = G h (x) that converge to x, at least for some points in x ∈ S. In this case, both (c(G h (x)), -1) and (h(G h (x), x), -1) will become high, since c(x ) ≈ 1 and h(x , x) ≈ 1.

3.4. ARCHITECTURE:

In the image experiments (MNIST, CIFAR10 and GTSRB), the neural networks G h and G c employ the DCGAN architecture of Radford et al. (2015) . This architecture consists of an encoder-decoder type structure, where both the encoder and the decoder have five blocks. Each encoder (resp. decoder) block consists of a 2-strided convolution (resp. deconvolution) followed by a batch norm layer, and a ReLU activation. The fifth decoder block consists of a 2-strided convolution followed by a tanh activation instead. c and h's architectures consist of four blocks of the same structure as for the encoder. This is followed by a sigmoid activation.

For the Cancer Genome Atlas experiment, each encoder (resp. decoder) block consists of a fully connected (FC) layer, a batch norm layer and a Leaky Relay activation (slope of 0.2). Two blocks are used for the encoder and decoder. The encoder's first FC layer reduces the dimension to 512 and the second to 256. The decoder is built to mirror this. c and h consist of two blocks, where the first FC layer reduces the dimension to 512 and the second to 1. This is followed by a sigmoid activation.

3.5. ANALYSIS:

In Appendix A, We show an example in which modeling using local-maxima-points is an efficient way to model, in comparison to the conventional classification-based approach. We then extend the framework of spectral-norm bounds, which were derived in the context of classification, to the case of unsupervised learning using local maxima.

4. EXPERIMENTS:

Since we share the same form of input with one-class classification, we conduct experiments using one-class classification benchmarks. These experiments both help to understand the power of our model in capturing a given set of samples, as well as study the properties of the two underlying functions c and h.

Following acceptable benchmarks in the field, specifically the experiments done by Ruff et al. (2018) , we consider single classes out of multiclass benchmarks, as the basis of one-class problems. For example, in MNIST, the set S is taken to be the set of all training images of a particular digit. When applying our method, we train h and c on this set. To clarify: there are no negative samples during training.

Post training, we evaluate both c and h on the one class classification task: positive points are now the MNIST test images of the same digit used for training, and negative points are the test images of all other digits. This is repeated ten times, for digits 0-9. In order to evaluate h, which is a binary function, we provide it with two replicas of the test point.

The classification ability is evaluated as the AUC obtained on this classification task. The same experiment was conducted for CIFAR-10 where instead of digits we consider the ten different class labels. The results are reported in Tab. 1, which also states the literature baseline values reported by Ruff et al. (2018) . As can be seen, for both CIFAR-10 and MNIST, c strongly captures classmembership, outperforming the baseline results in most cases. h is less correlated with class membership, resulting in much lower mean AUC values and higher standard deviations. However, it should not come as a surprise that h does contain such information.

Indeed, the difference in shape (single input vs. two inputs) between c and h makes them different but not independent. c, as a classifier, strongly captures class membership. We can expect h, which compares two samples, to capture relative properties. In addition, h, due to the way negative samples are collected, is expected to model local changes, at a finer resolution than c. Since it is natural to expect that the samples in the training set would provide images that locally maximize some clarity score, among all local perturbations, one can expect quality to be captured by h.

To test this hypothesis, we considered positive points to be test points of the relevant one-class, and negative points to be points with varying degree of Gaussian noise added to them. We then measure using AUC, the ability to distinguish between these two classes. As can be seen in Fig. 1 , h is much better at identifying noisy images than c, for all noise levels. This property is class independent, and in Fig. 3 (Appendix C ), we repeat the experiment for all test images (not just from the one class used during training), observing the same phenomenon.

We employ CIFAR also to perform an ablation analysis comparing the baseline method's c and h with four alternatives: (i) training c without training h, employing only G c ; (ii) training h and G h without training c nor G c ; (iii) training both h and c but using only the G c generator to obtain negative samples to both networks; and (iv) training both h and c but using only the G h generator for both. The results, which can be seen in Tab. 2, indicate that the complete method is superior to the variants, since it outperform these in the vast majority of the experiments.

Next, we evaluate our method on data from the German Traffic Sign Recognition (GTSRB) Benchmark of Houben et al. (2013) . The dataset contains 43 classes, from which one class (stop signs, class #15) was used by Ruff et al. (2018) to demonstrate one-class classification where the negative class is the class of adversarial samples (presumably based on a classifier trained on all 43 classes).

CIFAR-10 MNIST:

EQUATION

Figure 1 : The ability to differentiate between an in-class image and an in-class image with added noise for both c (yellow) and h (blue). The x-axis is the amount of noise (SD of the Gaussian noise).

The y-axis is the AUC. As can be seen, for both CIFAR-10 and MNIST, h is much more attuned to the image quality.

We were not able to obtain these samples by the time of the submission. Instead, We employ the sign data in order to evaluate three other one-class tasks: (i) the conventional task, in which a class is compared to images out of all other 42 classes; (ii) class image vs. noise image, as above, using Gaussian noise with a fixed noise level of σ = 0.2; (iii) same as (ii) only that after training on one class, we evaluate on images from all classes.

The results are presented, for the first 20 classes of GTSRB, in Tab. 3. The reported results are an average over 10 random runs. On the conventional one-class task (i), both our c and h neural networks outperform the baseline Deep-SVDD method, with c performing better than h, as in the MNIST and CIFAR experiments. Also following the same pattern as before, the results indicate that h captures image noise better than both c and Deep-SVDD, for both the test images of the training class and the test images from all 43 classes.

In order to explore the possibility of using the method out of the context of one-class experiments and for scientific data analysis, we downloaded samples from the Cancer Genome Atlas (https: //cancergenome.nih.gov/). The data contains mRNA expression levels for over 22,000 genes, measured from the blood of 9,492 cancer patients. For most of the patients, there is also survival data in days. We split the data to 90% train and 10% test.

We run our method on the entire train data and try to measure whether the functions recovered are correlated with the survival data on the test data. While, as mentioned in Sec. 1, the gene expression optimizes a fitness function, and one can claim that gene expressions that are less fit, indicate an expected shortening in longevity, this argument is speculative. Nevertheless, since survival is the only regression signal we have, we focus on this experiment.

We compare five methods: (i) the h we recover, (ii) the c we recover, (iii) the h we recover, when learning only h and not c, (iv) the c we recover, when learning only c and not h, (v) the first PCA of the expression data, (vi) the classifier of DeepSVDD. The latter is used as baseline due to the shared form of input with our method. However, we do not perform an anomaly detection experiment. In the simplest experiment, we treat h as a unary function by replicating the single input, as done above. We call this the standard correlation experiment. However, h was trained in order to compare two local points and we, therefore, design the local correlation protocol. First, we identify for each test datapoint, the closest test point. We then measure the difference in the target value (the patient's survival) between the two datapoints, the difference in value for unary functions (e.g., for c or for the first PCA), or h computed for the two datapoints. This way vectors of the length of the number of test data points are obtained. We use the Pearson correlation between these vectors and the associated p-values as the test statistic.

The results are reported in Tab. 4. As can be seen, the standard correlation is low for all methods. However, for local correlation, which is what h is trained to recover, the h obtained when learning both h and c is considerably more correlated than the other options, obtaining a significant p-value of 0.021. Interestingly, the ability to carve out parts of the space with c, when learning h seems significant and learning h without c results in a much reduced correlation.

Finally, we test our method on the Gaussian Mixture Model data following Balduzzi et al. (2018) , who perform a similar experiment in order to study the phenomenon of mode hopping. In this experiment, the data is sampled from 16 Gaussians placed on a 4x4 grid with coordinates -1.5, 0.5, 0.5 and 1.5 in each axis. In our case, since we model local maxima, we take each Gaussian to have a standard deviation that is ten times smaller than that of Balduzzi et al. (2018) : 0.01 instead of 0.1. We treat the mixture as a single class and sample a training set from it, to which we apply our methods as well as the variants where each network trains separately.

The results are depicted in Fig. 2 , where we present both c and h. As can be seen, our complete method captures with c the entire distribution, while training c without h runs leads to an unstable selection of a subset of the modes. Similarly, training h without c leads to an h function that is much less informative than the one extracted when the two networks are trained together.

5. DISCUSSION:

The current machine learning literature focuses on models that are smooth almost everywhere. The label of a sample is implicitly assumed as likely to be the same as those of the nearby samples. In contrast to this curve-based world view, we focus on the cusps. This novel world view could be beneficial also in supervised learning, e.g., in the modeling of sparse events.

Our model recovers two functions: c and h, which are different in form. This difference may be further utilized to allow them to play different roles post learning. Consider, e.g., the problem of drug design, in which one is given a library of drugs. The constraint function c can be used, post training, to filter a large collection of molecules, eliminating toxic or unstable ones. The value function h can be used as a local optimization score in order to search locally for a better molecule.

we show that any such v has at least 2m -1 hidden neurons. On the other hand, we show that for any distribution D (with the specifications above), any classification neural network c(x) =

W 2 φ(W 1 x + b) that has error E x∼D 1 1[c(x) = c S (x)

] ≤ has at least 3m hidden neurons.

Theorem 1. Let S = {x i } m i=1 ⊂ R be any set of points such that x i < x i+1 for all i ∈ {1, . . . , m -1}. We define c S : R → {±1} to be the function, such that c S (x) = 1 if and only if x ∈ S. Then, 1. There is a ReLU neural network v : R → R of the form v(x) = W 2 φ(W 1 x + b) with 2m hidden neurons such that the set of local maximum points of v is S.

2.. Any ReLU neural network:

v : R → R of the form v(x) = W 2 φ(W 1 x + b) such that any x ∈ S is a local maxima of v has at least 2m -1 neurons. 3. Let D = q • D 0 ∪ (1 -q)

• D 1 be a distribution that samples at probability q > 0 from D 0 and probability 1 -q from D 1 , where D 0 is a distribution supported by S and D 1 is a distribution supported by the segment

[x 1 -1, x m + 1].

Then, for a small enough > 0, every ReLU neural network c : R → R of the form c(x) = W 2 φ(W 1 x + b), such that

E x∼D 1 1[c(x) = c S (x)

] ≤ has at least 3m hidden neurons.

Proof. We begin by proving (1). We construct v as follows:

• ∀x ∈ (-∞, x 1 ]: v(x) = x -x 1 + 1. • ∀i ∈ {1, . . . , m -1} : ∀x ∈ [x i , xi+xi+1 2 ]: v(x) = -2 xi+1-xi (x -x i ) + 1. • ∀i ∈ {1, . . . , m -1} : ∀x ∈ [ xi+xi+1 2 , x i+1 ]: v(x) = 1 xi+1-xi (x -x i+1 ) + 1. • ∀x ∈ [x m , ∞): v(x) = x m -x + 1.

we consider that v is a piece-wise linear function with 2m linear pieces and arg max v = S. By Thm. 2.2 in Arora et al. (2018) , this function can be represented as a ReLU neural network of the form v(x) = W 2 φ(W 1 x + b), that has 2m hidden neurons.

Next, we prove (2). Let v : R → R be a function of the form v(x) = W 2 φ(W 1 x + b), such that each x ∈ S is a local maxima of it. First, by Thm. 2.1 in Arora et al. (2018) , v is a piece-wise linear function. We claim that v has at least two linear pieces between each consecutive points x i and x i+1 , for i ∈ {1, . . . , m -1}. Assume the contrary, i.e., there is an index i ∈ {1, . . . , m -1}, such that, v has only one piece between x i and x i+1 . If v(x i ) = v(x i+1 ), then, v is constant between x i and x i+1 , and therefore, x i and

x i+1 are not local maximas of v, in contradiction. If v(x i ) < v(x i+1 ),

then, because v is linear between x i and x i+1 , for every point x ∈ (x i , x i+1 ), we have v(x i ) < v(x), in contradiction to the assumption that

x i is a local maxima of v. If v(x i ) > v(x i+1

), then, because v is linear between x i and x i+1 , for every point x ∈ (x i , x i+1 ), we have v(x i+1 ) < v(x), in contradiction to the assumption that x i+1 is a local maxima of v. We conclude that v has at least two linear pieces between the points x i and x i+1 , for all i ∈ {1, . . . , m -1}. Therefore, v has at least 2m pieces. By Thm. 2.2 in Arora et al. (2018) , v has at least 2m -1 hidden neurons.

Next, we prove (3). We denote x 0 = x 1 -1 and x m+1 = x m + 1. Let P D0 [x i ] be the probability of sampling x i from D 0 . Since D 0 is supported by S, we have: q • P D0 [x i ] > 0. We define α := q min i∈{1,...,m} P D0 [x i ]. In addition, D 1 is a continuous distribution supported by the closed segment [x 1 -1, x m + 1]. Thus, by Weierstrass' extreme value theorem, the probability density function P D1 [x] of D 1 that is a continuous function, obtains its extreme values within the segment.

In addition, since D 1 is supported by [x 1 -1, x m + 1], we have:

P D1 [x] > 0 for all x ∈ [x 1 - 1, x m + 1]

. By combining the above two statements, we conclude that there is a point

x * ∈ [x 1 - 1, x m + 1] such that P D1 [x] ≥ P D1 [x * ] > 0 for every x ∈ [x 1 -1, x m + 1].

We denote by β := (1 -q) min i∈{0,...,m} P D1 [x ∈ (x i , x i+1 )] > 0. Since we are interested in proving the claim for a small enough > 0, we can simply assume that < min(α, β) and c : R → R a ReLU neural network of the form c(x) = W 2 φ(W 1 x + b).

We have:

EQUATION

Assume by contradiction that:

c(x i ) = c S (x i ). Then, E x∼D 1 1[c(x) = c S (x)] ≥ α > in contradic- tion. Therefore, c(x i ) = c S (x i ) = 1 for every x i ∈ S.

We also have:

EQUATION

Assume by contradiction that there is i ∈ {1, . . . , m -1}, such that the set

EQUATION

in contradiction. Let i ∈ {1, . . . , m -1}, a i and b i be two points such that

x i < a i < b i < x i+1 and c(a i ) = c(b i ) = 0.

Since c is a continuous function and piece-wise linear and the four points (x i , 1), (a, 0), (b, 0), (x i+1 , 1) are not co-linear, we conclude that c has at least three linear pieces in the segment [x i , x i+1 ]. Similarly, c has at least two linear pieces in each of the segments

[x 1 -1, x 1 ] and [x m , x m + 1].

We conclude that c has at least 3m + 1 pieces. By Thm. 2.2 in Arora et al. (2018) , c has at least 3m hidden neurons.

In the above theorem we showed that there exists a ReLU neural network v(x) = W 2 φ(W 1 x + b) with 2m hidden neurons that captures the set S as its local maximas. Furthermore, we note that the set of functions that satisfy these conditions (i.e., shallow ReLU neural networks with 2m hidden neurons that capture the set S) is relatively limited. For instance, any such v behaves as a piecewise linear function between any x i and x i+1 with only two linear pieces. Therefore, any such v is uniquely determined by the set S up to some freedom in the selection of the linear pieces between x i and x i+1 in S. On the other hand, a shallow ReLU neural network v(x) = W 2 φ(W 1 x + b) with more than 2m hidden neurons is capable of having more than two linear pieces between any x i and x i+1 .

A.2 A GENERALIZATION BOUND:

The following lemma provides a generalization bound that expresses the generalization of learning c along with v. In the following generalization bound, we assume there is an arbitrary distribution D of positive samples. In addition, we parameterize the class, ∼ D m , for every v θ ∈ V and c ω ∈ C, we have:

V = {v θ : R d → R | θ ∈ Θ}, of

EQUATION

The above lemma shows that the probability of x ∼ D to be a local maxima of v θ and classified as a positive example by c ω , is at most the sum of the probability of x ∈ S to be a local maxima of v θ and classified as a positive example by c ω and a penalty term. The penalty in this case is

of the form O C(v θ )+C(fω)+log(m/δ) m

, where m is the number of examples in the dataset and Our analysis focused on the value v θ and not on the comparator h. However, the complexities of the two are expected to be similar, since a value function can be converted to a comparator by employing h(x 1 , x 2 ) = sign(v θ (x 1 ) -v θ (x 2 )).

C(v θ ) + C(f ω )

B A FORMAL STATEMENT OF THE GENERALIZATION BOUND:

In this section, we build upon the theory presented by Neyshabur et al. (2018) and provide a generalization bound that expresses the guarantees of learning c, along with v for a specific setting.

Before we introduce the generalization bound, we introduce the necessary terminology and setup. We assume that the sampling space is a ball of radius B, i.e., X = X B,d

:= {x ∈ R d | ||x|| 2 ≤ B}. Each value function v θ ∈ V is a ReLU neural network of the form v θ (x) = W r φ(W r-1 φ(. . . φ(W 1 x))

, where, W i ∈ R di×di+1 for i ∈ {1, . . . , r} such that d r+1 := 1 and d 1 := d. In addition, φ(x) = (max(0, x 1 ), . . . , max(0, x n )) is the ReLU activation function extended to all n ∈ N and x ∈ R n . We denote, θ = (W 1 , . . . , W r ). The set C consists of classifiers c ω := sign •f ω such that each function

f ω : R d → R is a ReLU neural network of the form f ω (x) = U s φ(U s-1 φ(. . . φ(U 1 x))

, where, U i ∈ R d i ×d i+1 for i ∈ {1, . . . , s} such that e s+1 := 1 and d 1 := d. We denote ω = (U 1 , . . . , U s ). Additionally, we denote, q 1 := max{d i } r+1 i=1 and q 2 := max{d i } s+1 i=1 . The spectral complexity of a ReLU neural network

g β = V k φ(V k-1 φ(. . . φ(V 1 x)) with parameters β = (V 1 , . . . , V k ) is defined as follows: C(g β ) := C(β) := k i=1 ||W i || 2 2 k i=1 ||W i || 2 F ||W i || 2 2 (7)

For two distributions P and Q over a set X, we denote the KL-divergence between them by, D KL (Q||P ) := E x∼Q [log(Q(x)/P (x))]. For two functions function f, g : R → R, we denote the asymptotic symbols: g(x) = O(f (x)) to specify that g(x) ≤ c • f (x), for some constant c > 0.

We denote by 1 1[x] the indicator, if a boolean x ∈ {true, false} is true or false.

We define a margin loss γ1,γ2 : X × Ω × Θ → R of the form:

γ1,γ2 (x; ω, θ) := 1 1 v θ (x) < max u∈N (x) v θ (u) -γ 1 or sign(f ω (x) -γ 2 ) = 1 (8)

where, γ 1 , γ 2 > 0 are fixed margins and N (x) := {u | ||u -x|| 2 ≤ } is the -neighborhood of x, for a fixed > 0. In this model, the margins serve as parameters that dictate the amount of tolerance in classifying an example as positive. Similar to the standard learning framework, for a fixed distribution D over X, the goal of a learning procedure is to return (given some input) ω and θ that minimize the following generalization risk function:

EQUATION

The learning process has no direct access to the distribution D. Instead, it is provided with a set of m i.i.d samples from D, S = {x i } m i=1 i.i.d ∼ D m . In order to estimate the generalization risk, the empirical risk function is used during training:

EQUATION

The following lemma provides a generalization bound that expresses the generalization of learning c along with h. ∼ D m , for every v θ ∈ V and c ω ∈ C, we have:

F D [θ, ω] ≤ F γ1,γ2 S [θ, ω] + O     B 2 r 2 q 1 log(rq 1 ) C(v θ ) γ 2 1 + s 2 q 2 log(sq 2 ) C(fω) γ 2 2 + log m δ m     (11) B.1 PROOF OF LEM. 2

All over the proofs, we will make use of two generic classes of functions G = {g θ : X → R 2 | θ ∈ Θ} and H = {h ω : X → R 2 | ω ∈ Ω}. For simplicity, we denote the indices of g θ (x) and h ω (x) by -1 and 1 (instead of 1 and 2). Given a target function y : X → {±1} and two functions g θ : X → R 2 and h ω : X → R 2 , we denote the loss of them with respect to a sample x by: e γ1,γ2 (x; θ, ω) :=1 1 g

EQUATION

The generalization risk:

EQUATION

; θ, ω)] (13) And the empirical risk:

EQUATION

We modify the proof of Lem. 1 in Neyshabur et al. ( 2018), such that it will fit our purposes.

Lemma 3. Let y : X → {±1} be a target function. Let G = {g θ : X → R 2 | θ ∈ Θ} and H = {h ω : X → R 2

| ω ∈ Ω} be two classes class of functions (not necessarily neural networks).

Let P 1 and P 2 be any two distributions on the parameters Θ and Ω (resp.) that are independent of the training data. Then, for any γ 1 , γ 2 , δ > 0, with probability ≥ 1-δ over the training set of size m, for any two posterior distributions q θ and q ω over Θ and Ω (resp.), such that P

EQUATION

Proof. Let S γ1,γ2 θ,ω ⊂ Θ × Ω be a set with the following properties:

S γ1,γ2 θ,ω = (θ , ω ) ∈ Θ × Ω ∀x ∈ X : |g θ (x) -g θ (x)| ∞ < γ 1 4 and |h ω (x) -h ω (x)| ∞ < γ 2 4 (16)

We construct a distribution Q over Θ × Ω, with probability density function:

q(θ , ω ) = 1 Z q θ (θ ) • q ω (ω ) if (θ , ω ) ∈ S γ1,γ2 θ,ω 0 otherwise (17)

Here, Z is a normalizing constant. By the assumption in the lemma, Z = P[(θ , ω ) ∈ S γ1,γ2 θ,ω ] ≥ 1 2 . By the definition of Q, we have:

EQUATION

and also, max

EQUATION

Since this equation holds uniformly for all x ∈ X, we have:

EQUATION

Now using the above inequalities together with Eq. 6 in Mcallester (2003) , with probability 1 -δ over the training set we have:

L 0,0 (θ, ω) ≤ E θ ,ω L γ 1 2 , γ 2 2 [θ , ω ] ≤ E θ ,ω L γ 1 2 , γ 2 2 [θ , ω ] + 2 2(D KL (q||P 1 × P 2 ) + log( 2m δ )) m -1 ≤ Lγ1,γ2 [θ, ω] + 2 2(D KL (q||P 1 × P 2 ) + log( 2m δ )) m -1 ≤ Lγ1,γ2 [θ, ω] + 4 D KL (q θ × q ω ||P 1 × P 2 ) + log( 6m δ ) m -1 (22)

where the last inequality follows from the following observation.

Let S c denote the complement set of S γ1,γ2 θ,ω and qc denote the density function q := q θ ×q ω restricted to S c and normalized. In addition, we denote p := P 1 × P 2 . Then, D KL (q||p) = ZD KL (q||p) + (1 -Z)D KL (q c ||p) -H(Z)

where H(Z) = -Z log Z -(1 -Z) log(1 -Z) ≤ 1 is the binary entropy function. Since the KL-divergence is always positive, we get,

EQUATION

Since P 1 × P 2 are q θ × q ω are independent joint distributions, we have: D KL (q θ × q ω ||P 1 × P 2 ) = D KL (q θ ||P 1 ) + D KL (q ω ||P 2 ). where, θ ∼ q θ and ω ∼ q ω .

Next, we consider that:

EQUATION

)

Lemma 5. Let V = {v θ : X → [0, 1] | θ ∈ Θ} be a class of value functions v θ (x) ∈ [0, 1] and C = {c ω = sign •f ω | f ω : X → R, ω ∈ Ω} a class of classifiers (not necessarily neural networks). Let P 1 and P 2 be any two distributions over the parameters Θ and Ω (resp.) that are independent of the training data. Then, for any γ 1 , γ 2 , δ > 0, with probability ≥ 1 -δ over the training set of size m, for any two posterior distributions q θ and q ω over Θ and Ω (resp.), such that P θ ∼q v θ (u) -γ 1 > v θ (x i ) or sign(f ω (x i ) -γ 2 ) = 1 + 4 D KL (q θ ||P 1 ) + D KL (q ω ||P 2 ) + log( 6m δ ) m -1 (29)

Proof. Let G and H be as in Lem. 4. By Lem. 4 and our assumption,

EQUATION

We note that all of the samples in D are positive. Therefore, by Lem. 3, with probability at least 1 -δ, we have:

E x∼D 1 1 g θ (x)[-1] > g θ (x)[1] or h ω (x)[-1] > h ω (x)[1] ≤ 1 m m i=1 1 1 g θ (x i )[-1] -γ 1 > g θ (x i )[1] or h ω (x i )[-1] -γ 2 > h ω (x i )[1]

+ 4 D KL (q θ ||P 1 ) + D KL (q ω ||P 2 ) + log( 6m δ ) m -1 (31) By the definition of g θ : g θ (x)[-1] = max u∈N (x) v θ (u), g θ (x)[1] = v θ (x). In addition, by the definition of h ω : h ω (x)[-1] = 0 and h ω (x)[1] = f ω (x). Therefore, we can rephrase Eq. 31 as follows:

E x∼D 1 1 max u∈N (x) v θ (u) > v θ (x) or sign(f ω (x)) = 1 ≤ 1 m m i=1 1 1 max u∈N (x)

v θ (u) -γ 1 > v θ (x i ) or sign(f ω (x i ) -γ 2 ) = 1 + 4 D KL (q θ ||P 1 ) + D KL (q ω ||P 2 ) + log( 6m δ ) m -1 (32) Proof of Lem. 2. We apply Lem. 5 with priors P 1 , P 2 and posteriors q θ , q ω , distributions similar the proof of Thm. 1 in (Neyshabur et al., 2018) . In their proof, they show that for their selection of prior and posterior distributions: (1) P θ ∼q θ max x∈X |v θ (x) -v θ (x)| < γ1 4 ≥ 1 2 holds and (2) D KL (q θ ||P ) = O(dr 2 B 2 q log(rq)C(θ)/γ 2 1 ). By taking γ 1 to be half of the value the use and therefore, σ (from their proof) to be half of the value they use as well, we obtain P θ ∼q θ max x∈X |v θ (x) -v θ (x)| < γ1/2 4 ≥ 1 √ 2 and D KL (q θ ||P ) = O(dr 2 B 2 q log(rq)C(θ)/γ 2 1 ). We select P 2 and q ω in a similar fashion. In particular, we can replace the penalty term in Lem. 5 as follows:

EQUATION

C ADDITIONAL FIGURES

:

"hard negative" is a terminology often used in the object detection and boosting literature, which means negative points that challenge the training process.

Figures and Tables:

Figure 2: Results for a mixture of Gaussians placed on a 2D grid, following Balduzzi et al. (2018). (a) The values of the function c across the 2D domain, when c and h are jointly trained. (b) The comparator h shown as a quiver plot of the direction of maximal increase in value. (c) The values of c when it is trained alone without h. (d) A quiver plot for h, when it is trained without c.

value functions by vectors of parameters θ ∈ Θ and the class, C = {sign •f ω : R d → {±1} | ω ∈ Ω}, of classifiers by ω ∈ Ω. We upper bound the probability of a mistake done by any classifier c ω ∈ C and value function v θ ∈ V on a random sample x ∼ D. In this case, v θ and c ω mistake if x is not a local maxima of v θ or classified as negative by c ω . The upper bound is decomposed into the sum of the average error of c ω and v θ on a dataset S i.i.d ∼ D m and a regularization term. See Appendix B for the exact formulation and the proof. Lemma 1 (Informal). Let V = {v θ : R d → R | θ ∈ Θ} be a class of value functions and C = {sign •f ω : R d → {±1} | ω ∈ Ω} a class of classifiers. Assume that v θ and f ω are ReLU neural networks of fixed architectures, with parameters θ and ω (resp.). Let C(g) is the spectral complexity of the neural network g and N (x) := {u ∈ R d | ux 2 ≤ } an -neighborhood of x. Let D be a distribution of positive examples. With probability at least 1 -δ over the selection of the data S = {x i } m i=1 i.i.d

is the sum of the spectral norms of v θ and f ω . This suggests a tradeoff between the sum of the spectral complexities of v θ and f ω and the ability to generalize. The bound is similar asymptotically to the bounds of Neyshabur et al. (2018) and Bartlett et al. for (multi-class) supervised classification. In their bound, the penalty term is of the form O C(f )+log( m δ ) m , where the (multi-class) classifier is of the form c(x) = arg max i∈{1,...,t} f (x) i , for a neural network f : R d → R t .

Lemma 2. Let X := X B,n , V and C be as above. Let D be a distribution of positive examples. With probability at least 1 -δ over the selection of the data S = {x i } m i=1 i.i.d

Let V = {v θ : X → [0, 1] | θ ∈ Θ} be a class of value functions v θ (x) ∈ [0, 1] and C = {c ω = sign •f ω | f ω : X → R, ω ∈ Ω} a class of classifiers (not necessarily neural networks). We define two classes of functions G = {g θ = (max u∈N (x) v θ (u), v θ (x)) | θ ∈ Θ} and H = {h ω = (0, f ω (x)) | ω ∈ Ω}. Then, P θ ,ω max x∈X |g θ (x) -g θ (x)| ∞ < γ 1 4 and max x∈X |h ω (x) -h ω (x)| ∞ < γ 2 4 ≥ P θ max x∈X |v θ (x) -v θ (x)| < γ 1 4 • P ω max x∈X |f ω (x) -f ω (x)| < γ 2 4(25)

θ [|v θ (x) -v θ (x)| ≤ γ1 4 ] ≥ 1 √ 2 and P ω ∼qω [|f ω (x) -f ω (x)| ≤ γ2 4 ] ≥ 1√ 2 , we have:E x∼D 1 1 max u∈N (x) v θ (u) > v θ (x) or sign(f ω (x)

One class experiments on the MNIST and CIFAR-10 datasets. For MNIST, there is one experiment per digit, where the training samples are the training set of this digit. The reported numbers are the AUC for classifying one-vs-rest, using the test set of this digit vs. the test sets of all other digits. For CIFAR-10, the same experiment is run with a class label, instead of the digits. Reported numbers (in all tables) are averaged over 10 runs with random initializations. Each reported value is the mean result ± the standard deviation.

Table content: <table><tr><td>Digit</td><td>KDE</td><td>AnoGAN</td><td>Deep SVDD</td><td>Our c</td><td>Our h</td></tr><tr><td/><td colspan="3">(Parzen, 1962) (Schlegl, 2017) (Ruff et al., 2018)</td><td/><td/></tr><tr><td>0</td><td>97.1±0.0</td><td>96.6±1.3</td><td>98.0±0.7</td><td colspan="2">99.1±0.2 83.5±11.6</td></tr><tr><td>1</td><td>98.9±0.0</td><td>99.2±0.6</td><td>99.7±0.1</td><td colspan="2">97.2±0.7 50.7±25.7</td></tr><tr><td>2</td><td>79.0±0.0</td><td>85.0±2.9</td><td>91.7±0.8</td><td colspan="2">91.9±0.4 67.1±15.7</td></tr><tr><td>3</td><td>86.2±0.0</td><td>88.7±2.1</td><td>91.9±1.5</td><td colspan="2">94.3±0.7 62.4±25.9</td></tr><tr><td>4</td><td>87.9±0.0</td><td>89.4±1.3</td><td>94.9±0.8</td><td colspan="2">94.2±0.3 85.7±10.7</td></tr><tr><td>5</td><td>73.8±0.0</td><td>88.3±2.9</td><td>88.5±0.9</td><td colspan="2">87.2±2.0 73.3±14.5</td></tr><tr><td>6</td><td>87.6±0.0</td><td>94.7±2.7</td><td>98.3±0.5</td><td colspan="2">98.8±0.2 62.8±15.9</td></tr><tr><td>7</td><td>91.4±0.0</td><td>93.5±1.8</td><td>94.6±0.9</td><td colspan="2">93.9±0.5 61.6±10.8</td></tr><tr><td>8</td><td>79.2±0.0</td><td>84.9±2.1</td><td>93.9±1.6</td><td colspan="2">96.0±0.1 45.8±17.7</td></tr><tr><td>9</td><td>88.2±0.0</td><td>92.4±1.1</td><td>96.5±0.3</td><td colspan="2">96.7±0.3 66.8±14.5</td></tr><tr><td>Airplane</td><td>61.2±0.0</td><td>67.1±2.5</td><td>61.7±4.2</td><td colspan="2">74.0±1.2 48.9±13.1</td></tr><tr><td>Automobile</td><td>64.0±0.0</td><td>54.1±3.4</td><td>65.9±2.1</td><td colspan="2">74.7±1.6 64.6±5.4</td></tr><tr><td>Bird</td><td>50.1±0.0</td><td>52.9±3.0</td><td>50.8±0.8</td><td colspan="2">62.8±2.0 53.2±4.5</td></tr><tr><td>Cat</td><td>56.4±0.0</td><td>54.5±1.9</td><td>59.1±1.4</td><td colspan="2">57.2±2.0 51.4±6.6</td></tr><tr><td>Deer</td><td>66.2±0.0</td><td>65.1±3.2</td><td>60.9±1.1</td><td colspan="2">67.8±2.2 55.0±9.3</td></tr><tr><td>Dog</td><td>62.4±0.0</td><td>60.3±2.6</td><td>65.7±2.5</td><td colspan="2">60.2±1.6 58.9±3.7</td></tr><tr><td>Frog</td><td>74.9±0.0</td><td>58.5±1.4</td><td>67.7±2.6</td><td colspan="2">75.3±3.9 60.7±4.5</td></tr><tr><td>Horse</td><td>62.6±0.0</td><td>62.5±0.8</td><td>67.3±0.9</td><td colspan="2">68.5±2.8 58.1±3.8</td></tr><tr><td>Ship</td><td>75.1±0.0</td><td>75.8±4.1</td><td>75.9±1.2</td><td colspan="2">78.1±1.2 66.9±7.1</td></tr><tr><td>Truck</td><td>76.0±0.0</td><td>66.5±2.8</td><td>73.1±1.2</td><td colspan="2">79.5±1.5 70.3±8.3</td></tr></table>

An ablation analysis on the ten CIFAR classes (shown in order, Airplane to Truck). with G c only 63.7 68.3 59.2 56.6 58.8 57.4 60.7 65.5 71.3 74.2 c with G h only 73.2 71.2 59.6 51.7 65.4 60.9 68.3 68.9 76.7 77.2 h with G h only 56.0 65.3 55.5 53.2 50.6 58.6 54.8 58.4 65.2 71.8

Table content: <table><tr><td/><td>1</td><td>2</td><td>3</td><td>4</td><td>5</td><td>6</td><td>7</td><td>8</td><td>9</td><td>10</td></tr><tr><td>Baseline c</td><td colspan="10">74.0 74.7 62.8 57.2 67.8 60.2 75.3 68.5 78.1 79.5</td></tr><tr><td>Baseline h</td><td colspan="10">48.9 64.6 53.2 51.4 55.0 58.9 60.7 58.1 66.9 70.3</td></tr><tr><td>c only</td><td colspan="10">73.0 63.8 59.1 59.6 60.4 60.7 62.8 62.1 77.2 73.3</td></tr><tr><td>h only</td><td colspan="10">35.6 51.9 50.1 48.0 48.3 48.0 68.0 54.7 75.6 73.1</td></tr><tr><td colspan="11">c with G c only 73.4 74.3 61.2 58.8 66.4 59.0 72.7 70.3 77.1 75.1</td></tr><tr><td>h</td><td/><td/><td/><td/><td/><td/><td/><td/><td/></tr></table>

Results obtained on the GTSRB dataset on three one-class tasks. Reported are AUC values in percents. DS denotes Deep-SVDD byRuff et al. (2018).

Table content: <table><tr><td>Class</td><td/><td colspan="2">(i) Multiclass</td><td colspan="6">(ii) Noise in-class (iii) Noise all images.</td></tr><tr><td/><td>c</td><td>h</td><td>DS</td><td>c</td><td>h</td><td>DS</td><td>c</td><td>h</td><td>DS</td></tr><tr><td>1</td><td colspan="8">92.6 77.8 86.2 61.1 62.3 61.8 55.1 58.9</td><td>44.7</td></tr><tr><td>2</td><td colspan="8">78.0 75.4 71.9 75.6 96.3 74.7 71.4 92.3</td><td>51.4</td></tr><tr><td>3</td><td colspan="8">78.3 79.5 65.8 71.0 95.0 66.1 79.0 98.5</td><td>50.0</td></tr><tr><td>4</td><td colspan="8">79.7 81.7 63.9 89.1 97.0 66.3 71.0 82.0</td><td>53.2</td></tr><tr><td>5</td><td colspan="8">79.7 79.3 73.2 90.1 95.6 48.7 72.3 84.5</td><td>56.3</td></tr><tr><td>6</td><td colspan="8">73.8 66.4 81.8 91.1 85.3 88.1 75.3 75.2</td><td>62.0</td></tr><tr><td>7</td><td colspan="8">91.0 90.2 73.6 93.0 94.1 84.1 58.1 72.4</td><td>55.2</td></tr><tr><td>8</td><td colspan="8">82.1 75.4 74.6 93.7 93.9 51.6 71.0 82.1</td><td>56.7</td></tr><tr><td>9</td><td colspan="8">80.2 84.7 73.4 92.4 93.7 54.3 70.5 81.0</td><td>53.8</td></tr><tr><td>10</td><td colspan="8">85.8 74.9 79.2 82.0 93.4 88.7 71.0 84.0</td><td>57.7</td></tr><tr><td>11</td><td colspan="8">81.9 81.7 82.7 93.4 93.9 65.0 78.2 78.4</td><td>68.3</td></tr><tr><td>12</td><td colspan="8">86.9 84.6 54.3 78.3 92.6 89.8 70.3 89.1</td><td>64.5</td></tr><tr><td>13</td><td colspan="8">88.1 82.1 60.0 84.0 91.2 74.6 78.2 79.1</td><td>60.5</td></tr><tr><td>14</td><td colspan="8">93.5 93.7 57.6 82.3 85.4 78.9 76.0 77.4</td><td>63.4</td></tr><tr><td>15</td><td colspan="8">98.2 93.7 71.9 67.3 81.2 65.0 54.0 64.0</td><td>49.2</td></tr><tr><td>16</td><td colspan="8">87.6 90.5 71.8 59.0 78.3 90.0 55.3 63.2</td><td>55.6</td></tr><tr><td>17</td><td colspan="8">92.5 96.8 76.7 73.1 83.4 83.1 58.3 67.2</td><td>55.6</td></tr><tr><td>18</td><td colspan="8">99.3 85.4 64.4 73.0 92.1 77.7 87.3 97.2</td><td>50.7</td></tr><tr><td>19</td><td colspan="8">79.5 79.7 52.2 68.1 81.2 90.4 62.0 78.3</td><td>57.8</td></tr><tr><td>20</td><td colspan="8">92.9 92.9 52.1 76.3 78.2 81.6 52.3 63.0</td><td>74.0</td></tr><tr><td>Avg</td><td colspan="8">86.1 83.3 69.4 79.7 88.2 74.0 68.3 78.4</td><td>57.0</td></tr></table>

Correlation between the recovered functions and the patient's survival.

Table content: <table><tr><td>Local</td><td>Standard</td></tr></table>

Peer review (iclr2019):
 This paper describes a new form of one-class/set beloning learning, based on definition of 4 player game: - Classifier player (c), which is a typical one-class classifier model - Comparator player (h), which given two instances answers if first is "not smaller" (wrt. set belonging) than the other - Classifier adversary player (Gc), which tries to produce hard to distinguish samples for (c) - Comparator adversary player (Gh), which tries to produce hard to classify samples for (h) This way authors end up with cooperative-competitive game, where c and h act cooperatively to solve the problem, while Gc and Gh constantly try to "beat" them. Overall I find this paper to be interesting and worth presenting, however I strongly encourage authors to rethink the way story is presented so that it is more approachable by people who do not have much experience with viewing typical classification problems as games. In particular, one could completely avoid talking about "sets of local maxima" and just talk about the density estimation problem, with c being characteristic function (of belonging to the support) and h being comparator of the pdf. Strong points: - Novel, multi-agent in nature, approach to one-class classification - Proposed method build a complex system, which can be used in much wider class of problems than just classification (due to joint optimisation of classifier and comparator) - Extensive evaluation on 4 problems - Nice ablation study showing that most of the benefits come from pure c/Gc game (on average 68.8% acc vs 65.2% of just c, and 69.8% of entire system) but that h/Gh players do indeed still improve (an extra 1%). It might be interesting to investigate what exactly changed in c due to existance of h in training. Are there any identifiable properties of the model that can now be analysed? Weak points: In general I believe that theoretical analysis is the weakest part of the paper, and while interesting - it is actually a minor point, and shows interesting properties, but not the ones that would guarantee anything in "practical setup". I would suggest "downplaying" this part of the paper, maybe moving most of it to the appendix. To be more specific: - Theorem 1 shows that representation can be more compact, however existance of compactness does not rely imply that this particular solution can ever be learned or that it is a good thing (number of parameters is not correlated with generalisation capabilities of the model). - Lemma 1 seems a bit redundant for the story. While it is nice to be able to show generalisation bounds in general, this paper is not really introducing new class of models (since in the end c is going to be used for actual classification), but rather training regime, and generalisations bounds do not tell us anything about the emerging dynamical system. The fact that adding v does not constrain c too much seems quite obvious, and as a result I would suggest moving this section to appendix. Instead, if possible, the actual tricky mathematical bit for methods like this would be, in reviewers opinion, any analysis of learning dynamics of the system like this. Multi-agent systems cannot be optimised with independent gradient descent in general (convergence guarantees are lost). Consequently many papers focus on methods that bring these properties back (e.g. Consensus Optimisation or Symplectic Gradient Ascent). It would be beneficial for the reader to spend some time discussing stability of the system proposed, even if only empirically and on small problems. Other remarks: - eq. (1) is missing .cdot - it could be useful to include explicit parameters dependences in (1) and (2) so that one sees how losses really define asymmetric game between the players - why do we need 4 players and not just 3, with Gc and Gh being a single player/neural network? can we consider this as another ablation? - given small performance gaps in Table 1 can we get error estimates/confidence intervals there? Deep SVDD paper includes error estimates of the baseline methods - since training is performed in mini batch (it does not have to be decomposible over samples) shouldn*t equations be based on expectations rather than sums? -