OpenRaiser/Intern-Atlas huggingface dataset:
Security Analysis of Deep Neural Networks Operating in the Presence of Cache Side-Channel Attacks
Venue: arXiv cs.CR 2020
Year: 2020

Recent work has introduced attacks that extract the architecture information of deep neural networks (DNN), as this knowledge enhances an adversary's capability to conduct black-box attacks against the model. This paper presents the first in-depth security analysis of DNN fingerprinting attacks that exploit cache side-channels. First, we define the threat model for these attacks: our adversary does not need the ability to query the victim model; instead, she runs a co-located process on the host machine victim's deep learning (DL) system is running and passively monitors the accesses of the target functions in the shared framework. Second, we introduce DeepRecon, an attack that reconstructs the architecture of the victim network by using the internal information extracted via Flush+Reload, a cache side-channel technique. Once the attacker observes function invocations that map directly to architecture attributes of the victim network, the attacker can reconstruct the victim's entire network architecture. In our evaluation, we demonstrate that an attacker can accurately reconstruct two complex networks (VGG19 and ResNet50) having observed only one forward propagation. Based on the extracted architecture attributes, we also demonstrate that an attacker can build a meta-model that accurately fingerprints the architecture and family of the pre-trained model in a transfer learning setting. From this meta-model, we evaluate the importance of the observed attributes in the fingerprinting process. Third, we propose and evaluate new framework-level defense techniques that obfuscate our attacker's observations. Our empirical security analysis represents a step toward understanding the DNNs' vulnerability to cache side-channel attacks.
Average Margin Regularization for Classifiers
Venue: arXiv cs.LG 2020
Year: 2020

Adversarial robustness has become an important research topic given empirical demonstrations on the lack of robustness of deep neural networks. Unfortunately, recent theoretical results suggest that adversarial training induces a strict tradeoff between classification accuracy and adversarial robustness. In this paper, we propose and then study a new regularization for any margin classifier or deep neural network. We motivate this regularization by a novel generalization bound that shows a tradeoff in classifier accuracy between maximizing its margin and average margin. We thus call our approach an average margin (AM) regularization, and it consists of a linear term added to the objective. We theoretically show that for certain distributions AM regularization can both improve classifier accuracy and robustness to adversarial attacks. We conclude by using both synthetic and real data to empirically show that AM regularization can strictly improve both accuracy and robustness for support vector machine's (SVM's), relative to unregularized classifiers and adversarially trained classifiers.
Small Space Stream Summary for Matroid Center
Venue: arXiv cs.DS 2020
Year: 2020

In the matroid center problem, which generalizes the $k$-center problem, we need to pick a set of centers that is an independent set of a matroid with rank $r$. We study this problem in streaming, where elements of the ground set arrive in the stream. We first show that any randomized one-pass streaming algorithm that computes a better than $Δ$-approximation for partition-matroid center must use $Ω(r^2)$ bits of space, where $Δ$ is the aspect ratio of the metric and can be arbitrarily large. This shows a quadratic separation between matroid center and $k$-center, for which the Doubling algorithm gives an $8$-approximation using $O(k)$-space and one pass. To complement this, we give a one-pass algorithm for matroid center that stores at most $O(r^2\log(1/\varepsilon)/\varepsilon)$ points (viz., stream summary) among which a $(7+\varepsilon)$-approximate solution exists, which can be found by brute force, or a $(17+\varepsilon)$-approximation can be found with an efficient algorithm. If we are allowed a second pass, we can compute a $(3+\varepsilon)$-approximation efficiently; this also achieves almost the known-best approximation ratio (of $3+\varepsilon$) with total running time of $O((nr + r^{3.5})\log(1/\varepsilon)/\varepsilon + r^2(\log Δ)/\varepsilon)$, where $n$ is the number of input points. We also consider the problem of matroid center with $z$ outliers and give a one-pass algorithm that outputs a set of $O((r^2+rz)\log(1/\varepsilon)/\varepsilon)$ points that contains a $(15+\varepsilon)$-approximate solution. Our techniques extend to knapsack center and knapsack center with outliers in a straightforward way, and we get algorithms that use space linear in the size of a largest feasible set (as opposed to quadratic space for matroid center).
Randomized contractions meet lean decompositions
Venue: arXiv cs.DS 2020
Year: 2020

We show an algorithm that, given an $n$-vertex graph $G$ and a parameter $k$, in time $2^{O(k \log k)} n^{O(1)}$ finds a tree decomposition of $G$ with the following properties: * every adhesion of the tree decomposition is of size at most $k$, and * every bag of the tree decomposition is $(i,i)$-unbreakable in $G$ for every $1 \leq i \leq k$. Here, a set $X \subseteq V(G)$ is $(a,b)$-unbreakable in $G$ if for every separation $(A,B)$ of order at most $b$ in $G$, we have $|A \cap X| \leq a$ or $|B \cap X| \leq a$. The resulting tree decomposition has arguably best possible adhesion size boundsand unbreakability guarantees. Furthermore, the parametric factor in the running time bound is significantly smaller than in previous similar constructions. These improvements allow us to present parameterized algorithms for Minimum Bisection, Steiner Cut, and Steiner Multicut with improved parameteric factor in the running time bound. The main technical insight is to adapt the notion of lean decompositions of Thomas and the subsequent construction algorithm of Bellenbaum and Diestel to the parameterized setting.
Towards Optimal Running Times for Optimal Transport
Venue: arXiv cs.DS 2020
Year: 2020

In this work, we provide faster algorithms for approximating the optimal transport distance, e.g. earth mover's distance, between two discrete probability distributions $μ, ν\in Δ^n$. Given a cost function $C : [n] \times [n] \to \mathbb{R}_{\geq 0}$ where $C(i,j) \leq 1$ quantifies the penalty of transporting a unit of mass from $i$ to $j$, we show how to compute a coupling $X$ between $r$ and $c$ in time $\widetilde{O}\left(n^2 /ε\right)$ whose expected transportation cost is within an additive $ε$ of optimal. This improves upon the previously best known running time for this problem of $\widetilde{O}\left(\text{min}\left\{ n^{9/4}/ε, n^2/ε^2 \right\}\right)$. We achieve our results by providing reductions from optimal transport to canonical optimization problems for which recent algorithmic efforts have provided nearly-linear time algorithms. Leveraging nearly linear time algorithms for solving packing linear programs and for solving the matrix balancing problem, we obtain two separate proofs of our stated running time. Further, one of our algorithms is easily parallelized and can be implemented with depth $\widetilde{O}(1/ε)$. Moreover, we show that further algorithmic improvements to our result would be surprising in the sense that any improvement would yield an $o(n^{2.5})$ algorithm for \textit{maximum cardinality bipartite matching}, for which currently the only known algorithms for achieving such a result are based on fast-matrix multiplication.
Policy Gradient in Partially Observable Environments: Approximation and Convergence
Venue: arXiv cs.LG 2020
Year: 2020

Policy gradient is a generic and flexible reinforcement learning approach that generally enjoys simplicity in analysis, implementation, and deployment. In the last few decades, this approach has been extensively advanced for fully observable environments. In this paper, we generalize a variety of these advances to partially observable settings, and similar to the fully observable case, we keep our focus on the class of Markovian policies. We propose a series of technical tools, including a novel notion of advantage function, to develop policy gradient algorithms and study their convergence properties in such environments. Deploying these tools, we generalize a variety of existing theoretical guarantees, such as policy gradient and convergence theorems, to partially observable domains, those which also could be carried to more settings of interest. This study also sheds light on the understanding of policy gradient approaches in real-world applications which tend to be partially observable.
Actor-Critic Policy Optimization in Partially Observable Multiagent Environments
Venue: arXiv cs.LG 2020
Year: 2020

Optimization of parameterized policies for reinforcement learning (RL) is an important and challenging problem in artificial intelligence. Among the most common approaches are algorithms based on gradient ascent of a score function representing discounted return. In this paper, we examine the role of these policy gradient and actor-critic algorithms in partially-observable multiagent environments. We show several candidate policy update rules and relate them to a foundation of regret minimization and multiagent learning techniques for the one-shot and tabular cases, leading to previously unknown convergence guarantees. We apply our method to model-free multiagent reinforcement learning in adversarial sequential decision problems (zero-sum imperfect information games), using RL-style function approximation. We evaluate on commonly used benchmark Poker domains, showing performance against fixed policies and empirical convergence to approximate Nash equilibria in self-play with rates similar to or better than a baseline model-free algorithm for zero sum games, without any domain-specific state space reductions.
Structured Domain Randomization: Bridging the Reality Gap by Context-Aware Synthetic Data
Venue: arXiv cs.CV 2020
Year: 2020

We present structured domain randomization (SDR), a variant of domain randomization (DR) that takes into account the structure and context of the scene. In contrast to DR, which places objects and distractors randomly according to a uniform probability distribution, SDR places objects and distractors randomly according to probability distributions that arise from the specific problem at hand. In this manner, SDR-generated imagery enables the neural network to take the context around an object into consideration during detection. We demonstrate the power of SDR for the problem of 2D bounding box car detection, achieving competitive results on real data after training only on synthetic data. On the KITTI easy, moderate, and hard tasks, we show that SDR outperforms other approaches to generating synthetic data (VKITTI, Sim 200k, or DR), as well as real data collected in a different domain (BDD100K). Moreover, synthetic SDR data combined with real KITTI data outperforms real KITTI data alone.
TarMAC: Targeted Multi-Agent Communication
Venue: arXiv cs.LG 2020
Year: 2020

We propose a targeted communication architecture for multi-agent reinforcement learning, where agents learn both what messages to send and whom to address them to while performing cooperative tasks in partially-observable environments. This targeting behavior is learnt solely from downstream task-specific reward without any communication supervision. We additionally augment this with a multi-round communication approach where agents coordinate via multiple rounds of communication before taking actions in the environment. We evaluate our approach on a diverse set of cooperative multi-agent tasks, of varying difficulties, with varying number of agents, in a variety of environments ranging from 2D grid layouts of shapes and simulated traffic junctions to 3D indoor environments, and demonstrate the benefits of targeted and multi-round communication. Moreover, we show that the targeted communication strategies learned by agents are interpretable and intuitive. Finally, we show that our architecture can be easily extended to mixed and competitive environments, leading to improved performance and sample complexity over recent state-of-the-art approaches.
Efficient Distributed Hessian Free Algorithm for Large-scale Empirical Risk Minimization via Accumulating Sample Strategy
Venue: arXiv cs.LG 2020
Year: 2020

In this paper, we propose a Distributed Accumulated Newton Conjugate gradiEnt (DANCE) method in which sample size is gradually increasing to quickly obtain a solution whose empirical loss is under satisfactory statistical accuracy. Our proposed method is multistage in which the solution of a stage serves as a warm start for the next stage which contains more samples (including the samples in the previous stage). The proposed multistage algorithm reduces the number of passes over data to achieve the statistical accuracy of the full training set. Moreover, our algorithm in nature is easy to be distributed and shares the strong scaling property indicating that acceleration is always expected by using more computing nodes. Various iteration complexity results regarding descent direction computation, communication efficiency and stopping criteria are analyzed under convex setting. Our numerical results illustrate that the proposed method outperforms other comparable methods for solving learning problems including neural networks.
FFT, FMM, and Multigrid on the Road to Exascale: performance challenges and opportunities
Venue: arXiv cs.DC 2020
Year: 2020

FFT, FMM, and multigrid methods are widely used fast and highly scalable solvers for elliptic PDEs. However, emerging large-scale computing systems are introducing challenges in comparison to current petascale computers. Recent efforts (Dongarra et al. 2011) have identified several constraints in the design of exascale software that includes massive concurrency, resilience management, exploiting the high performance of heterogeneous systems, energy efficiency, and utilizing the deeper and more complex memory hierarchy expected at exascale. In this paper, we perform a model-based comparison of the FFT, FMM, and multigrid methods in the context of these projected constraints. In addition, we use performance models to offer predictions about the expected performance on upcoming exascale system configurations based on current technology trends.
Backhaul-Aware Optimization of UAV Base Station Location and Bandwidth Allocation for Profit Maximization
Venue: arXiv cs.NI 2020
Year: 2020

Unmanned Aerial Vehicle Base Stations (UAVBSs) are envisioned to be an integral component of the next generation Wireless Communications Networks (WCNs) by dynamically moving the supply towards the demand. A significant drawback of the state-of-the-art have been designing a WCN in which the service-oriented performance measures (e.g., throughput) are optimized without considering different relevant decisions such as determining the location and allocating the resources, jointly. In this study, we address the UAVBS location and bandwidth allocation problems together to optimize the total network profit. In particular, a Mixed-Integer Non-Linear Programming (MINLP) formulation is developed, in which the location of a single UAVBS and bandwidth allocations to users are jointly determined. The objective is to maximize the total profit without exceeding the backhaul and access capacities. The profit gained from a specific user is assumed to be a piecewise-linear function of the provided data rate level, where higher data rate levels would yield higher profit. Due to high complexity of the MINLP, we propose an efficient heuristic algorithm with lower computational complexity. We show that, when the UAVBS location is determined, the resource allocation problem can be reduced to a Multidimensional Binary Knapsack Problem (MBKP), which can be solved in pseudo-polynomial time. To exploit this structure, the optimal bandwidth allocations are determined by solving several MBKPs in a search algorithm. We test the performance of our algorithm with two heuristics and with the MINLP model solved by a commercial solver. Our numerical results show that the proposed algorithm outperforms the alternative solution approaches and would be a promising tool to improve the total network profit.
Detecting Bots and Assessing Their Impact in Social Networks
Venue: arXiv cs.SI 2020
Year: 2020

Online social networks are often subject to influence campaigns by malicious actors through the use of automated accounts known as bots. We consider the problem of detecting bots in online social networks and assessing their impact on the opinions of individuals. We begin by analyzing the behavior of bots in social networks and identify that they exhibit heterophily, meaning they interact with humans more than other bots. We use this property to develop a detection algorithm based on the Ising model from statistical physics. The bots are identified by solving a minimum cut problem. We show that this Ising model algorithm can identify bots with higher accuracy while utilizing much less data than other state of the art methods. We then develop a a function we call generalized harmonic influence centrality to estimate the impact bots have on the opinions of users in social networks. This function is based on a generalized opinion dynamics model and captures how the activity level and network connectivity of the bots shift equilibrium opinions. To apply generalized harmonic influence centrality to real social networks, we develop a deep neural network to measure the opinions of users based on their social network posts. Using this neural network, we then calculate the generalized harmonic influence centrality of bots in multiple real social networks. For some networks we find that a limited number of bots can cause non-trivial shifts in the population opinions. In other networks, we find that the bots have little impact. Overall we find that generalized harmonic influence centrality is a useful operational tool to measure the impact of bots in social networks.
Using Large Ensembles of Control Variates for Variational Inference
Venue: arXiv cs.LG 2020
Year: 2020

Variational inference is increasingly being addressed with stochastic optimization. In this setting, the gradient's variance plays a crucial role in the optimization procedure, since high variance gradients lead to poor convergence. A popular approach used to reduce gradient's variance involves the use of control variates. Despite the good results obtained, control variates developed for variational inference are typically looked at in isolation. In this paper we clarify the large number of control variates that are available by giving a systematic view of how they are derived. We also present a Bayesian risk minimization framework in which the quality of a procedure for combining control variates is quantified by its effect on optimization convergence rates, which leads to a very simple combination rule. Results show that combining a large number of control variates this way significantly improves the convergence of inference over using the typical gradient estimators or a reduced number of control variates.
Excessive Invariance Causes Adversarial Vulnerability
Venue: arXiv cs.LG 2020
Year: 2020

Despite their impressive performance, deep neural networks exhibit striking failures on out-of-distribution inputs. One core idea of adversarial example research is to reveal neural network errors under such distribution shifts. We decompose these errors into two complementary sources: sensitivity and invariance. We show deep networks are not only too sensitive to task-irrelevant changes of their input, as is well-known from epsilon-adversarial examples, but are also too invariant to a wide range of task-relevant changes, thus making vast regions in input space vulnerable to adversarial attacks. We show such excessive invariance occurs across various tasks and architecture types. On MNIST and ImageNet one can manipulate the class-specific content of almost any image without changing the hidden activations. We identify an insufficiency of the standard cross-entropy loss as a reason for these failures. Further, we extend this objective based on an information-theoretic analysis so it encourages the model to consider all task-dependent features in its decision. This provides the first approach tailored explicitly to overcome excessive invariance and resulting vulnerabilities.
Functional Nonlinear Sparse Models
Venue: arXiv cs.LG 2020
Year: 2020

Signal processing is rich in inherently continuous and often nonlinear applications, such as spectral estimation, optical imaging, and super-resolution microscopy, in which sparsity plays a key role in obtaining state-of-the-art results. Coping with the infinite dimensionality and non-convexity of these problems typically involves discretization and convex relaxations, e.g., using atomic norms. Nevertheless, grid mismatch and other coherence issues often lead to discretized versions of sparse signals that are not sparse. Even if they are, recovering sparse solutions using convex relaxations requires assumptions that may be hard to meet in practice. What is more, problems involving nonlinear measurements remain non-convex even after relaxing the sparsity objective. We address these issues by directly tackling the continuous, nonlinear problem cast as a sparse functional optimization program. We prove that when these problems are non-atomic, they have no duality gap and can therefore be solved efficiently using duality and~(stochastic) convex optimization methods. We illustrate the wide range of applications of this approach by formulating and solving problems from nonlinear spectral estimation and robust classification.
Multi-Kernel Regression with Sparsity Constraint
Venue: arXiv cs.LG 2020
Year: 2020

In this paper, we provide a Banach-space formulation of supervised learning with generalized total-variation (gTV) regularization. We identify the class of kernel functions that are admissible in this framework. Then, we propose a variation of supervised learning in a continuous-domain hybrid search space with gTV regularization. We show that the solution admits a multi-kernel expansion with adaptive positions. In this representation, the number of active kernels is upper-bounded by the number of data points while the gTV regularization imposes an $\ell_1$ penalty on the kernel coefficients. Finally, we illustrate numerically the outcome of our theory.