Title: WHAT ARE GANS USEFUL FOR?

Abstract: GANs have shown how deep neural networks can be used for generative modeling, aiming at achieving the same impact that they brought for discriminative modeling. The first results were impressive, GANs were shown to be able to generate samples in high dimensional structured spaces, like images and text, that were no copies of the training data. But generative and discriminative learning are quite different. Discriminative learning has a clear end, while generative modeling is an intermediate step to understand the data or generate hypothesis. The quality of implicit density estimation is hard to evaluate, because we cannot tell how well a data is represented by the model. How can we certainly say that a generative process is generating natural images with the same distribution as we do? In this paper, we noticed that even though GANs might not be able to generate samples from the underlying distribution (or we cannot tell at least), they are capturing some structure of the data in that high dimensional space. It is therefore needed to address how we can leverage those estimates produced by GANs in the same way we are able to use other generative modeling algorithms.

1. INTRODUCTION:

Generative Adversarial Models (GANs) (Goodfellow et al., 2014) or, in general, implicit generative models (Mohamed & Lakshminarayanan, 2017; Kingma & Welling, 2014) are extremely appealing to natural science because they promise to be the universal simulator. If I were a genetist and had access to the genome of a few millions (billions) humans, a GAN could help me imagine any possible human. If I were a climate scientist and had access to global weather data, a GAN could envision any worldwide weather pattern. These simulators are not a goal of their own, no matter how difficult they are to build. They are tools to understand genetic disease or comprehend hurricane formation or any other particularity that we are interested in. Once, we had such a universal simulator that can generate data as nature does, we could ask any relevant question and, automatically and inexpensively have the data to validate our hypothesis.

GANs have brought deep learning to generative modeling. Deep learning has been extremely successful in discriminative modeling, because they allow learning the features together with the classifier and we do not need to rely on low-dimensional-intuitively-human-engineered features to do so. In (Vapnik, 1998) the author, when criticizing the paradigms created by parametric approach, declares that: "To find a functional dependency from data, the statistician is able to define a set of functions, linear in their parameters, that contain a good approximation to the desired function. The number of parameters describing this set is small". Deep Learning takes this need to define a priori this set of functions. Implicit models in discriminative learning make a lot of sense. We have a clear goal in mind, like: finding objects in an image, converting speech into text or automatic machine translation, and we have a clear metric to validate our results.

But generative modeling, unlike discriminative learning, does not have such clear goals and metrics. The generative model is always an intermediate result for solving some other problem. We want a generative model to understand the available data and be able to generate/validate hypothesis about it. Broadly, we can classify generative models in two groups: those that estimate the density of the data accurately and could potentially be used for any application; and, those that extract a representation that is actionable, even though the generative model might not fully capture the data generating process, and target a specific question about the data.

In this second group, we encounter dimensionally reduction and clustering algorithms. A representative example, among many others, could be Latent Dirichlet Allocation (LDA) (Blei et al., 2003) . LDA is a generative model, that allows understanding the topics in a corpus and which topics are covered in each document, but generating a document from it, would be utterly incomprehensible. GANs clearly do not fall in this category.

GANs belong to the first category, but while non-parametric models, like histograms or kernel density estimation, suffer from slow converge to the density even in the simplest low dimensional problems (Vapnik, 1998; Lugosi & Nobel, 1996; Wasserman, 2010) . GANs seem to be immune, because we have seen that with very limited data they have been able to generate compelling images (Radford et al., 2016; Salimans et al., 2016; Gulrajani et al., 2017) . But, is this a proper test to assure that GANs are generating from the distribution of the data? Shouldn't we have some test in which we can say how far we are from the true underlying distribution? Shouldn't we have a specific application in mind for which GAN might be instrumental? Furthermore the visual tests that we use nowadays are clearly flawed. Because when we look from afar the 32-by-32 pixel images might look as bedrooms (Radford et al., 2016) , but as soon as we magnify them and look at them one by one, we see that in most of them there is something off. For higher resolutions, the images look even more unnatural (Salimans et al., 2016) . The same thing happens for text generation (Gulrajani et al., 2017) .

Most of the published results for GANs have the following flavor: GANs are unstable and we do such and such to make them easier and better to train them (Nowozin et al., 2016; Arjovsky & Bottou, 2017; Arjovsky et al., 2017; Radford et al., 2016; Salimans et al., 2016; Gulrajani et al., 2017; Li et al., 2015; Mroueh & Sercu, 2017; Tolstikhin et al., 2017; Mescheder et al., 2017; Nagarajan & Kolter, 2017; Roth et al., 2017; Mroueh et al., 2017) 1 . We are able to generate better-looking images or even text or something else. But actually very few papers have studied if the GANs results really generate samples from the density, they just hope they do. In a way, we are still asking what can we do for GANs, instead of asking what can GANs do for us.

On one hand, our working hypothesis is that GANs will not be able to deliver accurate density estimates in high-dimensional structured spaces. On the other hand, GANs are capturing some relevant information of that data, which is providing a simulator that can still be useful even if the density estimate is wrong. There are some applications (Zhang et al., 2017; Hayes & Danezis, 2017; Hausman et al., 2017; Hitaj et al., 2017a) in which this is clearly the case. For example, GANs for password generation (Hitaj et al., 2017b) do not need accurate density estimates, because the GAN is able to capture passwords that previous methods could not. The frequencies might be off, but they are valid passwords nonetheless.

GAN-like objective functions also emerge within the context of approximate variational inference with implicit distributions (Mescheder et al., 2017; Huszár, Ferenc, 2017) . Many applications leverage on this kind of highly-scalable approximate inference machinery to train interpretable latent variable models in which an accurate estimate of the underlying distribution is not mandatory, see for instance (Srivastava & Sutton, 2017; Yang et al., 2017) . The unanswered relevant question is when a GAN can be safely used in an application that requires some form of density estimation. We expect that the answer to this application would be application dependent. It can take the form of a flawed density estimate or rely on some statistics of the models that match those in the real data or described a interpretable model.

In this paper, to foster the discussion about where GANs should lead us, we first examine the convergence proofs for GANs and why we believe they are incomplete or not suitable for analyzing GANs. We also revisit the papers that have look at GANs density estimate and why most of them are critical of GANs. In the second part, we show two examples that reinforce this idea that GANs density estimates are very poor and they do not generate from the same distribution the data is coming from. Our experiments concur with the papers detailed in the second section of the paper.

2. DENSITY ESTIMATION FOR GANS 2.1 PROOFS OF CONVERGENCE:

There are four papers in which the convergence of the GANs to the true density is analyzed. The first proof that GANs can converge to the true density was given in the GAN original paper by Goodfellow et al. (2014) . Recently, a new convergence proof has been reported in (Tolstikhin et al., 2017; Liu et al., 2017) . On the contrary, in (Arora et al., 2017) , the authors show that there exist equilibrium points during the training of the GAN for which the generative neural net distribution would not converge to the real distribution of the data.

The analysis in the original paper (Goodfellow et al., 2014) proved that, if we knew the underlying density model, the equilibrium of the game would be a generator that would draw samples from the original distribution and a discriminator that would not be able to tell the difference. It assumed that if the discriminator has finite (VC) dimension and the number of samples tends to infinity, then the convergence will happen. But this derivation has several missing steps. First, the law of large numbers is not enough for that convergence to take place, since one will need to prove uniform convergence too (Schölkopf & Smola, 2002) . Second, we need to prove that the iterative procedure, between the discriminator and generator, does not get stuck in local minima in which the generator only mimics, at best, part of the distribution. Third, we also need to analyze the convergence when the neural network grows and so does the input dimension (e.g. noise distribution). We need to sort out all of them, before we can claim that GANs converge to the distribution, because otherwise we might find that we are dropping modes or not estimating the tails of the distribution correctly. This second problem has not even been addressed yet, as we show in the experimental section. Finally, there is no bound for finite set of samples, so we will never know how far we are from achieving our goal.

In (Tolstikhin et al., 2017) , the authors propose a GAN that follows a boosting procedure. New components are added to the mixture until the original distribution is recovered and they show exponential convergence to the underlying density. Our concern with the proof is its practical applicability, as it requires that, at each step, the GAN estimated density, call it dQ, and the true underlying density of the data, call it dP d , satisfy that βdQ ≤ dP d . However, it is indeed unknown how to design a generative network that induces a density dQ that would guarantee βdQ ≤ dP d with a non-zero β when dP d is a high-dimensional structure generative process.

In (Arora et al., 2017) the authors prove that for the standard metrics (e.g. Shannon-Jensen divergence and Wasserstein-like integral probability metrics), the discriminator might stop discriminating before the estimated distribution converges to the density of the data. They also show a weaker result, in which convergence might happen, but the estimated density might be off, if the discriminator based on a deep neural network is not large enough (sufficient VC dimension).

Finally, in (Liu et al., 2017) the authors worry about two important aspects of GAN convergence: what how good the generative distribution approximates the real distribution; and, when does this convergence takes place. For the first question the answer is the discriminator forces some kind of moment matching between the real and fake distributions. In order to get full representation of the density we will need that the discriminator grows with the data. For the second question, they show a week convergence result. This result is somewhat complementary to Arora et al. (2017) , because it indicates that the discriminator complexity needs to grow indefinitely to achieve convergence. The question that remains to be answer is the rate of convergence, as the moments need to be matched for complicated distributions might require large data and complex discriminators. So in practice, we cannot tell if the generated distribution is close enough to the distribution we are interested in.

Today's GAN's results can be explain in the light of these theoretical results. First, we are clearly matching some moments that relate to visual quality of natural images with finite size deep neural networks, but they might not be deep enough to capture all relevant moments and hence they will not be able to match the distribution in these images. This explains why low resolution images, in which are visual systems interpolates what it wants to see, the results are so appealing, while in large resolution the results are far from acceptable.

2.2. CONVERGENCE CRITIQUES:

In two recent papers (Lopez-Paz & Oquab, 2017; Sutherland et al., 2017) , the authors proposed to use two-sample tests to validate GANs density estimates. Both papers reach similar conclusions, if we compare images in pixel space, none of the generated distributions by GANs pass those tests. Basically these methods notice that there are artefacts in which the two-sample tests can lock onto to distinguish between real and fake images. In the next section we replicate these experiments and find similar conclusions.

In (Sutherland et al., 2017) the authors even replicated the experiment with MNIST in Salimans et al. (2016) in which human could not distinguish between fake and real digits and showed that for the MMD test the difference was easy, because of the artifacts and because the GANs were only showing standard digits, but the GAN was not able to generate samples from the tail of the distribution. This experiment shows the risk of using human evaluation of densities estimates, as we focus more on normalcy and under-represent the unexpected. In the next section, we show another test that illustrates that GANs might be only focusing on the modes in the data and ignoring those tails, which might be critical in applications in which the tails carry the information of the extreme events that we might be interested in (e.g. think of weird genetic diseases or extreme weather patterns).

In (Lopez-Paz & Oquab, 2017) , the authors also showed that if instead comparing in the pixel space, the comparison is made in some transformed space (in their case the final layer in a Resnet structure), the fake samples and the true samples were indistinguishable. This result is quite appealing, because there are some statistics in which the GANs samples are distributed like the real samples and those statistics are sufficient for our problem in hand then we might be able to rely on GANs as a simulator. The main questions is for which statistics this happens and how broad they are.

Finally, in (Arora & Zhang, 2017; Lee et al., 2017) , the authors complete their theoretical paper in Arora et al. (2017) to show that GANs might be dropping modes of the distribution by adapting the birthday paradox for images. Like images comes from a continuous space they need some discretization in order to show this mode dropping effect. In this paper, we showed that this limitation can be also analyzed when the GAN is used to generate a discrete distribution. We show that the estimated probabilities are way off and we find both mode dropping and mode enhancing to happen at the same time.

3. SIMULATIONS:

We now provide a set of experiments to support our previous discussion. We first consider two image datasets, MNIST and CIFAR-10, and later we will revisit the recently proposed GAN-approach to enhance password guessing (PassGAN) (Hitaj et al., 2017b) . While in the first case we have used the GAN implementation proposed in (Salimans et al., 2016) , PassGAN has been implemented using the improved Wasserstein GAN described in (Gulrajani et al., 2017) .

3.1. SIMULATIONS USING MNIST AND CIFAR DATABASES:

We consider a specific implementation of the generator and discriminator networks, both trained over the MNIST (60,000 labeled images of handwritten numbers, plus 10,000 extra images in the test set) and CIFAR-10 datasets (50,000 labeled natural images, plus 10,000 extra images in the test set). Also, we train the GAN with the ones from MNIST, i.e. 1-MNIST database, which contains 6739 training images of ones and 1134 test images.

We have reproduced the experiments and network design of (Salimans et al., 2016) . More specifically, the generator network is a 4 layer deep CNN, with both batch and weight normalization (Ioffe & Szegedy, 2015) . The input z is a 100-dimensional Gaussian. The discriminator network is a 9 layer deep convolutional network with dropout, weight normalization and a Gaussian noise layer that is added to the input. The discriminator is trained using minibatch discrimination (MD), which helps to avoid collapse of the generator by looking at multiple data examples in combination. As described in (Salimans et al., 2016) , within a few iterations of stochastic gradient descend (SGD), the generator network is already able to provide visually appealing images. In all cases, we have run 600 epochs, where per iteration all data mini-batches are processed with SGD once. In Figure 1 , we illustrate samples from the generator network trained over MNIST (a) and 1-MNIST (b), and in Figure 2 samples when it is trained over CIFAR-10. In most cases the samples are visually appealing, and it is likely that in most of them a person is not able to distinguish if they are real images or generated by our network. These results match those in Salimans et al. (2016) .

In the next subsection we analyzed the Kernel Two-Sample Test results and we have left for the appendix the results in which we illustrate the mode dropping and the under sampling of the tails of the distribution.

3.1.1. KERNEL TWO-SAMPLE TEST:

In contrast to (Salimans et al., 2016) , where the inception score is introduced as a metric of the quality of the images sampled from the generator network, we propose a statistical hypothesis test to study whether the distributions p(x) and the probability distribution of images induced by the generator network, i.e., p g (x) = G(z i ; θ G ), are different. This problem is known as the Two-Sample Test (Anderson et al., 1994) . We use the Kernel Two-Sample Test proposed in (Gretton et al., 2012) , where the test statistic is the Maximum Mean Discrepancy (MMD), defined as the largest difference in expectations over functions in a unit ball of a characteristic reproducing kernel Hilbert space (RKHS). When MMD is large, the samples are likely from different distributions. In (Gretton et al., 2012) , unbiased empirical estimators to the MMD metric are presented, and further, it is shown that the empirical MMD estimate shows a statistically significant difference between distributions. Given i.i.d. samples X ∼ p(x) and X ∼ p g (x), an statistical hypothesis testing is used to distinguish between the null hypothesis H 0 : p = p g and the alternative hypothesis H a : p = p g . This is achieved by comparing the empirical MMD estimate with a particular threshold : if the threshold is exceeded, then the test rejects the null hypothesis.

Given the level α of the test (an upper bound on the Type I error), we use bootstrap resampling on the aggregated data to obtain a test threshold2 . In our experiments we have used 1000 bootstrap shuffles, the radial basis function kernel with a bandwidth set as median distance between points in the aggregate sample. Also, we fix α = 0.05. We use N Test samples taken at random from the MNIST and CIFAR-10 test sets and the same number of samples drawn from the generator network. Results are averaged over 1000 realizations. In Table 1 (a) we include the percentage of times the null hypothesis H 0 : p = p g was rejected. We also include in the table the average MMD value and two times its standard deviation, as well as the estimated threshold . In Table 1 (b), we randomly split the MNIST and CIFAR-10 test datasets into two disjoint sets, and we perform the same statistical test, where ideally the null hypothesis H 0 should never be rejected. The comparison of results in Table 1 (a) and (b) leaves no doubt. As the number of data points increase, the empirical MMD gets further from the test threshold, strongly indicating a significant statistical difference between distributions. In contrast, the MMD metric computed in Table 1 (b) does not grow with N Test and remains very close to the threshold . We can safely conclude that the GAN density model does not match the distribution of the training images. As mentioned before, the use of Two-Sample statistical hypothesis test to study the distribution induced by GAN has been also proposed in (Lopez-Paz & Oquab, 2017; Sutherland et al., 2017) with similar conclusions.

3.2. PASSGAN, A GENERATIVE MODEL FOR PASSWORD GUESSING:

PassGAN (Hitaj et al., 2017b ) is a recently-introduced technique that aims at generating passwords by extracting distribution information from password leaks. PassGAN builds upon the work of Gulrajani et al. (2017) , which shows remarkably good results on GAN-based text generation.

In this section we show that, however, PassGAN experiences a severe mode-dropping effect. This is consistent with the observations presented in the previous sections of this paper. We illustrate how the distribution of PassGAN's output presents modes that do not exits in the real distribution of passwords. While this clearly suggest that PassGAN's density estimate is not correct, we show that these new modes are not completely random. Rather, it is reasonable for a user to use them as a password. This provides further evidence that correctly leveraging the generative distribution induced by the GAN beyond density estimation is still an open problem.

After training PassGAN, we used the generative network to obtain "fresh" password samples, which were then used for password guessing. Using the same network design as in Gulrajani et al. (2017) , we trained a Wasserstein-GAN on a leaked portion of the RockYou dataset (RockYou, 2010) using 80% of the data for training (23,679,744 total passwords, 9,925,896 unique passwords), and the remaining 20% (5,919,936 total passwords, 3,094,199 unique passwords) as testing data. The results obtained using this process are highly competitive with state-of-the-art rule-based approaches adopted in John-the-Ripper (the Ripper, 2017) and Hashcat (HashCat, 2017) password cracking tools, as shown in (Hitaj et al., 2017b We generated 10 10 samples with PassGAN, out of which 528,834,530 (5.29%) were unique samples. These passwords matched 2,774,269 (46.9%) of the testing dataset. When matched against a leaked passwords dataset on which PassGAN was not trained (LinkedIn), the model was able to guess 4,996,980 (i.e., 11.5%) passwords out of 43,354,871 unique entries.

Table 2 shows the 30 most frequent passwords in the subset of the RockYou dataset used to train PassGAN, sorted in decreasing order based on their frequency. The second column provides the occurrence of each password in the dataset, whereas the third column provides the frequency of that password in the training data. In the fourth column, we present the frequency estimated by the GAN, which represents the number of times a certain password was generated with respect to the total number of passwords generated. The generator did not follow the underlying distribution: there are password samples that are significantly underrepresented by the GAN, and even instances of mode dropping. (See, e.g., "password", "abc123", "babygirl" and "anthony". Passwords present in the training data, but not in the GAN's output, are labeled as "not generated" in Table 2 .) These results show a severe mode-dropping effect, as the 30th most common password with over 8,000 repetition in the over 23 million passwords is not generated by the GAN.

Furthermore, in Table 3 , we present the 30 passwords produced by PassGAN with the highest number of occurrences. Interestingly, the model often produced passwords that have low or no representation in the training dataset, such as '123256' (appearing 6 times in the training data), 'iluv!u&' (which is not present in the training data). This shows a different effect compared to Table 2 . However, PassGAN is always generating new modes that are somewhat structured, and that are not simply sequences of random letters. Passwords like "dangel", "michel", or "ilove", for example, are reasonable user-generated passwords. However, the GAN does generates them with a frequency that is too low. This shows that GANs might not be able to match all the relevant moments, even though they are still successful at capturing relevant information. 

APPENDIX: EXPLAINING THE GAP: NEAREST NEIGHBOR ANALYSIS BETWEEN SAMPLE SETS:

The samples generated by the GAN failed the MMD two sample test even though the generated images look as good as the original images in MNIST and CIFAR-10. We believe that the GAN fails the test because the samples are too concentrated on the modes and does not explore the full density model. This is why the samples generated for MNIST all look very good and we are almost never surprised by the weird digits that we find sometimes in the original MNIST.

We now perform a simple experiment to demonstrate the generative distribution overfit to the dominant modes of p(x). Consider first the 1-MNIST dataset, with 6739 training images. After jointly training the discriminative and generative networks, we sample from the generator network a set of 6739 images and, for each of them, we compute the nearest neighbor (NN) in the 1-MNIST training set. We denote by n 1-MNIST→GAN (i) the number of times that the i-th image in the 1-MNIST training set is the NN of images in the fake dataset generated by the GAN. Note that large n 1-MNIST→GAN (i) values will correspond to images from the 1-MNIST that the GAN tends to over reproduce. The n 1-MNIST→GAN (i) profile is shown in Figure 3 , where we have sorted the index images according to increasing values of n 1-MNIST→GAN (i).

We compare this result with the leave-one-out (LOO) NN profile for the 6739 images used for training, denoted by n 1-MNIST→1-MNIST (i). This profile is shown by a red dashed line in Figure 3 . The results clearly indicate that there is a subset in the 1-MNIST training set that is over-reproduced in the generated artificial dataset, and thus, they correspond to modes in p g (x) that are not so-dominant in p(x). On the other end of the spectrum the GAN represents much fewer images than the LOO NN 0 1,000 2,000 3,000 4,000 5,000 6,000 7,000 0 profile (almost 1000 samples less). This profile leads us to believe that the GAN density estimation over represents the modes and under represents the tails of the distribution.

In Figure 4 the n 1-MNIST→GAN (i) profile is computed for 10 5 generated images and the two NNs are found for each image. In this case, there is still 1,300 images of ones (20% of the 1-MNIST database) that do not have a first or second NNs in 100,000 GAN generated images. The image that is most popular appears as the first or second NN in 0.4% of the cases, which seems to corroborate our initial findings that the GAN over samples the modes and under sample the tails of p(x).

An alternative illustration that reinforces the idea that the distribution p g (x) is indeed not representing the tails of p(x) is provided in Figure 5 , where in column (a) we represent the two ones from 1-MNIST training set furthest from their LOO NNs. In (b), we represent the two images in the fake dataset sampled from the generative network (using 10 5 images) that are furthest from their LOO NNs. While in the ones from the real database, Figure 5 (a), we observe images with marked calligraphic style (a reasonable unlikely one), in (b) we can appreciate images where the large distance is explained by residual noise rather than by an unusual calligraphic style. The first column of images will never be reproduced by the GAN, while the second set are noisy regular-one images.

In Figures 6 we have 

:

The activity in this area is very large and we might have missed some relevant papers

See http://www.gatsby.ucl.ac.uk/ ˜gretton/mmd/mmd.htm

Figures and Tables:

Figure 1: Samples drawn from the generator network trained over the MNIST and 1-MNIST datasets.

Figure 2: 200 samples drawn from the generator network trained over CIFAR-10 dataset.

Figure 4: We represent the n 1-MNIST→GAN (i) profile computed for 10 5 images sampled at random from the generator network using the two NNs of each image.

Figure 5: In (b), we represent the two images that are furthest from their neighbors within the MNIST training set. In (b), we represent the two images that are furthest from their neighbors in artificial set of images sampled from the generative network.

reproduced the same experiments for the full MNIST train set (a), where we have sample at random 60,000 images for the GAN, and the CIFAR-10 training set (b), where

). In (a), we use the Kernel Two-Sample Test with real images and samples drawn from the generator network. In (b), we use instead real images taken from two disjoint sets on the MNIST and CIFAR-10 test datasets.

Table content: <table><tr><td>Data Set</td><td colspan="2">N Test % H 0 rejected</td><td>MMD</td></tr><tr><td>MNIST MNIST MNIST</td><td>100 1000 5000</td><td>84 100 100</td><td>1.41 ± 0.46 1.16 2.80 ± 0.77 1.24 8.96 ± 1.45 1.24</td></tr><tr><td colspan="2">CIFAR-10 100 CIFAR-10 1000 CIFAR-10 5000</td><td>95 100 100</td><td>1.76 ± 1.12 1.16 5.64 ± 2.66 1.13 45.15 ± 7.20 1.11</td></tr><tr><td/><td/><td>(a)</td><td/></tr><tr><td>Data Set</td><td colspan="2">N Test % H 0 rejected</td><td>MMD</td></tr><tr><td>MNIST MNIST MNIST</td><td>100 1000 5000</td><td>59 44 46</td><td>1.24 ± 0.36 1.18 1.25 ± 0.41 1.24 1.27 ± 0.34 1.24</td></tr><tr><td colspan="2">CIFAR-10 100 CIFAR-10 1000 CIFAR-10 5000</td><td>46 58 61</td><td>1.24 ± 0.43 1.18 1.35 ± 0.76 1.21 1.34 ± 0.72 1.19</td></tr><tr><td/><td/><td>(b)</td><td/></tr></table>

Top-30 most frequent passwords present on the dataset used to train PassGAN. The first column shows passwords from the RockYou training dataset; the second column reports the number of occurrences of each password in the training dataset; the third column shows the corresponding frequency; and the forth column illustrates the frequency estimated by the GAN.

Table content: <table><tr><td>Password</td><td>Occurrence in Training Data</td><td>Frequency in Training Data</td><td>GAN Estimated Frequency</td></tr><tr><td>123456 12345 123456789 password iloveyou princess 1234567 rockyou 12345678 abc123 nicole daniel babygirl monkey lovely jessica 654321 michael ashley qwerty iloveu 111111 000000 michelle tigger sunshine chocolate password1 soccer anthony</td><td>232,844 63,135 61,531 47,507 40,037 26,669 17,399 16,765 16,536 13,243 12,992 12,337 12,130 11,726 11,533 11,262 11,181 11,174 10,741 10,730 10,587 10,529 10,412 10,210 9,381 9,252 9,012 8,916 8,752 8,752</td><td>0.98% 0.27% 0.26% 0.20% 0.17% 0.11% 0.073% 0.071% 0.070% 0.056% 0.055% 0.052% 0.051% 0.050% 0.049% 0.048% 0.047% 0.047% 0.045% 0.045% 0.045% 0.044% 0.044% 0.043% 0.040% 0.039% 0.038% 0.038% 0.037% 0.036%</td><td>100,971,288 (1.0%) 21,614,548 (0.22%) 22,208,040 (0.22%) 85,889 (8.6e-4%) 10,056,700 (0.10%) 190,796 (0.0019%) 7,545,708 (0.075%) 55,515 (5.5e-4%) 5,070,673 (0.051%) 6,545 (6.5e-5%) 206,277 (0.0021%) 3,304,567 (0.033%) 13,076 (1.3e-4%) 116,602 (0.0012%) 1,026,362 (0.010%) 220,849 (0.0022%) 19,912 (1.9e-4%) 517 (5.2e-6%) 116,858 (0.0012%) 135,124 (0.0013%) 4,839,368 (0.048%) 101,903 (0.0010%) 108,300 (0.0011%) 739,220 (0.0073%) 658,360 (0.0066%) 3,628 (3.6e-5%) 12 (1.2e-7%) 6,427 (6.4e-5%) 25 (2.5e-7%) not generated</td></tr></table>

Top-30 most frequent passwords produced by PassGAN after generating 10 10 samples. The first column shows the passwords; the second column presents the number of occurrences of each password generated by the GAN; the third column provides the frequency of each password; and the fourth colum shows the corresponding frequency of each password in the RockYou training dataset.Figure 3: We represent the n 1-MNIST→GAN (i) and n 1-MNIST→1-MNIST (i) profiles computed for 6739 images sampled at random from the generator network and for the 6739 images in the 1-MNIST training set. Zichao Yang, Zhiting Hu, Ruslan Salakhutdinov, and Taylor Berg-Kirkpatrick. Improved variational autoencoders for text modeling using dilated convolutions. 34th International Conference on Machine Learning (ICML 2017), 2017. URL http://proceedings.mlr.press/v70/ yang17d/yang17d.pdf.

Table content: <table><tr><td>27</td></tr><tr><td>9</td></tr></table>

Peer review (iclr2018):
 The main take-away messages of this paper seem to be: 1. GANs don*t really match the target distribution. Some previous theory supports this, and some experiments are provided here demonstrating that the failure seems to be largely in under-sampling the tails, and sometimes perhaps in introducing spurious modes. 2. Even if GANs don*t exactly match the target distribution, their outputs might still be useful for some tasks. (I wouldn*t be surprised if you disagree with what the main takeaways are; I found the flow of the paper somewhat disjointed, and had something of a hard time identifying what the "point" was.) Mode-dropping being a primary failure mode of GANs is already a fairly accepted hypothesis in the community (see, e.g. Mode Regularized GANs, Che et al ICLR 2017, among others), though some extra empirical evidence is provided here. The second point is, in my opinion, simultaneously (i) an important point that more GAN research should take to heart, (ii) relatively obvious, and (iii) barely explored in this paper. The only example in the paper of using a GAN for something other than directly matching the target distribution is PassGAN, and even that is barely explored beyond saying that some of the spurious modes seem like reasonable-ish passwords. Thus though this paper has some interesting aspects to it, I do not think its contributions rise to the level required for an ICLR paper. Some more specifics: Section 2.1 discusses four previous theoretical results about the convergence of GANs to the true density. This overview is mostly reasonable, and the discussion of Arora et al. (2017) and Liu et al. (2017) do at least vaguely support the conclusion in the last section of this paragraph. But this section is glaringly missing an important paper in this area: Arjovsky and Bottou (2017), cited here only in passing in the introduction, who proved that typical GAN architectures *cannot* exactly match the data distribution. Thus the question of metrics for convergence is of central importance, which it seems should be important to the topic of the present paper. (Figure 3 of Danihelka et al. https://arxiv.org/abs/1705.05263 gives a particularly vivid example of how optimizing different metrics can lead to very different results.) Presumably different metrics lead to models that are useful for different final tasks. Also, although they do not quite fit into the framing of this section, Nowozin et al.*s local convergence proof and especially the convergence to a Nash equilibrium argument of Heusel et al. (NIPS 2017, https://arxiv.org/abs/1706.08500) should probably be mentioned here. The two sample testing section of this paper, discussed in Section 2.2 and then implemented in Section 3.1.1, seems to be essentially a special case of what was previously done by Sutherland et al. (2017), except that it was run on CIFAR-10 as well. However, the bottom half of Table 1 demonstrates that something is seriously wrong with the implementation of your tests: using 1000 bootstrap samples, you should reject H_0 at approximately the nominal rate of 5%, not about 50%! To double-check, I ran a median-heuristic RBF kernel MMD myself on the MNIST test set with N_test = 100, repeating 1000 times, and rejected the null 4.8% of the time. My code is available at https://gist.github.com/anonymous/2993a16fbc28a424a0e79b1c8ff31d24 if you want to use it to help find the difference from what you did. Although Table 1 does indicate that the GAN distribution is more different from the test set than the test set is from itself, the apparent serious flaw in your procedure makes those results questionable. (Also, it seems that your entry labeled "MMD" in the table is probably n * MMD_b^2, which is what is computed by the code linked to in footnote 2.) The appendix gives a further study of what went wrong with the MNIST GAN model, arguing based on nearest-neighbors that the GAN model is over-representing modes and under-representing the tails. This is fairly interesting; certainly more interesting than the rehash of running MMD tests on GAN outputs, in my opinion. Minor: In 3.1.1, you say "ideally the null hypothesis H0 should never be rejected" – it should be rejected at most an alpha portion of the time. In the description of section 3.2, you should clarify whether the train-test split was done such that unique passwords were assigned to a single fold or not: did 123456 appear in both folds? (It is not entirely clear whether it should or not; both schemes have possible advantages for evaluation.)