SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\zeta^ {T} \Lambda \nabla_ {\zeta} \Phi (\boldsymbol {x}; \zeta) = \Phi (\boldsymbol {x}; \zeta). \quad \text {(d e r i v a t i v e e q u a t i o n o f} \Phi \text {a t} \boldsymbol {x}) \tag {9}
$$
For clear notation, we refer to the above Eq. (9) as the derivative equation of  $\Phi$  at  $x$ , which is a linear equation about  $\Lambda$  and the coefficients can be calculated conveniently given the pre-trained model.
As these properties of quasi-homogeneous function are independent of input  $\pmb{x}$ , we can establish a system of equations by evaluating the derivative equation of  $\Phi$  and its higher order derivatives at a set of random samples  $\{x_{i}\}_{i\in [K]}$ , e.g.,
$$
\left\{ \begin{array}{c c c} \zeta^ {T} \Lambda \nabla_ {\zeta} \Phi \left(\boldsymbol {x} _ {1}; \zeta\right) = & \Phi \left(\boldsymbol {x} _ {1}; \zeta\right), & (\text {d e r i v a t i v e e q u a t i o n o f} \Phi \text {a t} \boldsymbol {x} _ {1}) \\ \zeta^ {T} \Lambda \nabla_ {\zeta} \Phi \left(\boldsymbol {x} _ {2}; \zeta\right) = & \Phi \left(\boldsymbol {x} _ {2}; \zeta\right), & (\text {d e r i v a t i v e e q u a t i o n o f} \Phi \text {a t} \boldsymbol {x} _ {2}) \\ \vdots & \vdots & \\ \frac {1}{1 - \Lambda_ {1 1}} \zeta^ {T} \Lambda \nabla_ {\zeta \zeta_ {1}} ^ {2} \Phi \left(\boldsymbol {x} _ {K}; \zeta\right) = & \nabla_ {\zeta_ {1}} \Phi \left(\boldsymbol {x} _ {K}; \zeta\right), & (\text {d e r i v a t i v e e q u a t i o n o f} \nabla_ {\zeta_ {1}} \Phi \text {a t} \boldsymbol {x} _ {K}) \\ \vdots & \vdots & \end{array} . \right. \tag {10}
$$
Then, the  $\Lambda$  can be calculated from it. As a proof of concept, the estimated results of a two-layer fully-connected network with ReLU activation are shown in Fig. 3. The architecture of the network is  $\overline{\text{Linear}(2,10)} \rightarrow \overline{\text{ReLU}}() \rightarrow \overline{\text{Linear}(10,1)}$ .
Determine  $\alpha$ . To compute  $L_{duality}$ , it is necessary to determine the  $\alpha$ . Shown in the proof of Theorem 1 [Kunin et al., 2023], the value of  $\alpha$  depends on the minimum classification margin  $q_{min}$  of the (normalized) neural network on the training dataset, in the case of a multi-class problem:
$$
q _ {\text {m i n}} = \min  _ {i \in [ N ]} \min  _ {c \in [ C ] / \{y _ {j} \}} \left[ \Phi_ {y _ {i}} \left(x _ {i}; \bar {\zeta}\right) - \Phi_ {c} \left(x _ {i}; \bar {\zeta}\right) \right]. \tag {11}
$$
Therefore, the value of  $\alpha$  depends on the entire training dataset, which is not accessible. To avoid the accumulation of errors in estimating  $q_{min}$  using generated samples during training, we directly optimize  $\alpha$  as a trainable parameter.
Summary of the method. In short, the optimization problem used to train the generator  $g(\cdot ,\cdot ;\theta)$  can be written as:
$$
\min  _ {\theta , \eta , \alpha} L (\theta , \eta , \alpha) = \min  _ {\theta , \eta , \alpha} L _ {\text {s t a t i o n a r i t y}} (\theta , \eta) + \beta L _ {\text {d u a l i t y}} (\theta , \alpha). \tag {12}
$$
The training procedure is summarized in Alg. 1 in the Appendix.
An extension to multiple classifiers. We have previously discussed a method using a single classifier to train a generator. Here, we present an extension of our approach to employ multiple classifiers for training a single generator. Given  $T$  classifiers  $\{\Phi^{(t)}\}_{t\in [T]}$ , we encode the training
(a) Training Data
(b) Prediction Landscape
(c) Generated Data
Figure 4: An illustrative 2D example showcases our proposed method. Figs. 4a to 4c are the training data employed for the classifier, the classifier's learned prediction landscape, and the generated samples using the learned generator, respectively.
data information from distinct classifiers into one generator by incorporating the classifier index  $t$  as an input of the generator. By providing random noise  $\epsilon$ , label  $y$ , and classifier index  $t$  as inputs,  $\pmb{x}$  is generated as  $\pmb{x} = g(\epsilon, y, t; \theta)$ . During the training process, we compute the loss for each classifier,  $L^{(t)}(\theta, \eta, \alpha^{(t)})$ , and aggregate them as the final optimization objective. For each classifier, we optimized a distinct  $\alpha$  and use  $\alpha^{(t)}$  to denote the  $\alpha$  for the  $t$ -th classifier. We utilize a unified network  $h: \mathcal{R}^d \times \mathcal{Y} \times [T] \to \mathcal{R}^{|\mathcal{Y}|}$  to compute the KKT multipliers, which also includes the classifier index as an input. The optimization objective for the training process can be formulated as:
$$
\min  _ {\theta , \eta , \left\{\alpha^ {(t)} \right\} _ {t \in [ T ]}} \sum_ {t \in [ T ]} L ^ {(t)} (\theta , \eta , \alpha^ {(t)}). \tag {13}
$$
Upon completion of training, generating samples requires an additional step to sample a suitable classifier index. Let  $\mathcal{T}_y$  denote the set of classifier indices, where the indices in the set correspond to classifiers whose training set contains samples with label  $y$ . To generate a sample  $x$  with label  $y$ , we first sample a classifier index  $t$  from  $\mathcal{T}_y$ , and then utilize  $t$ , along with  $y$  and random noise  $\epsilon$ , as inputs to the generator to produce the sample.
The algorithm for training a generator using multiple classifiers is summarized in Alg. 2 in the Appendix.
5.1 An Example of 2D Synthetic Data
In this subsection, we employ a two-dimensional example to analyze the proposed approach. We evenly generate 18 data points on a unit circle, and categorize them into three classes to create our training dataset  $D$ . The distribution of  $D$  is plotted in Fig. 4a, with distinct colors representing different categories. Utilizing this data, we train a three-layer fully connected network  $\Phi$  as the classifier. The prediction landscape of  $\Phi$  is displayed in Fig. 4b. The color of the region represents the category predicted by the classifier for samples within that region. The white areas represent the classifier's decision boundary. Given  $\Phi$ , we train a generator  $g$  using the proposed method. The samples generated by  $g$  are plotted in Fig. 4c. Despite the presence of certain noise, the distribution of the generated data aligns consistently with that of the classifier's training data.
Leveraging this two-dimensional example, we further analyze our proposed method of training a generator using multiple classifiers. We evenly split the previous training dataset into  $D_{1}$  and  $D_{2}$ , plotted in Figs. 5a and 5f, respectively. Using these two subsets of data, we train two classifiers,  $\Phi_{1}$  and  $\Phi_{2}$ , and subsequently train two generators,  $g_{1}$  and  $g_{2}$ . Figs. 5c and 5h display the data generated by  $g_{1}$  and  $g_{2}$ , respectively. Here, during the training of  $g_{1}$ , we solely use  $\Phi_{1}$ , and during the training of  $g_{2}$ , we solely use  $\Phi_{2}$ . Obviously in Figs. 4b and 5g, owing to the generalization ability of neural networks,  $\Phi_{1}$  and  $\Phi_{2}$  learn additional categorization capabilities beyond the training data, with prediction areas with the same color surpassing the region covered by the training data. Contrarily, the samples generated by training  $g_{1}$  and  $g_{2}$  congregate around the actual data points, effectively
Figure 5: An illustrative 2D example showcases the process of using two pre-trained classifiers to train a generator. Figs. 5a to 5c and Figs. 5f to 5h are two groups of training data, classifier's learned prediction landscape, and generator's generated samples. Fig. 5d shows the generated samples of the generator trained using two classifiers. Figs. 5e and 5i are the generated samples of the generator in Fig. 5d with fixed classifier index.
Figure 6: Generator-produced samples. The generator is trained using a single classifier trained on the MNIST dataset.
recovering the original distribution of the training data. Subsequently, by employing the extension of the proposed method, we train a generator  $g_{1+2}$  using  $\Phi_1$  and  $\Phi_2$  together. As shown in Fig. 5d,  $g_{1+2}$  possesses the generative capabilities of both  $g_1$  and  $g_2$ , capable of generating samples on the entire training data  $D$ . We further fix the classifier index of  $g_{1+2}$  to either 1 or 2, randomly sample noise and category labels, and observe the data generated by  $g_{1+2}$ . As depicted in Figs. 5e and 5h,  $g_{1+2}$  is also capable of independently generating data belonging to either  $D_1$  or  $D_2$ .
5.2 Image Generation
In this subsection, we showcase the experimental results on the MNIST [Lecun et al., 1998] and CelebA [Liu et al., 2015] datasets. More results and implementation details are left in the appendix. For the MNIST dataset, we set up a classification task corresponding to the digits 0-9 with 500 training data (50 images per class) randomly sampled from the original training set. For the CelebA dataset, we utilized various binary attributes to construct binary classification tasks on facial images, for example, distinguishing between males and females. For each task, we randomly sampled 100 images (50 images per class) from the original training dataset and resize them to  $32 \times 32$  to be our training dataset.
We employed a three-layer fully-connected network with a ReLU activation function and batch normalization as the classifier for the aforementioned classification tasks. The networks were trained until the classification loss converges using full batch gradient descent, which ensures the parameters are close to the convergence point required in the theory of Maximum-Margin Bias.
(a) Gender
(b) Mouth Opened
(c) Pale Skin
Figure 7: Generator-produced samples. The generator is trained using a single classifier trained on the CelebA dataset. The captions of the subfigures indicate the attributes used as the label.
Figure 8: Generator-produced samples. The generator is trained using two classifiers trained on the MNIST dataset.
We use generators composed of three fully-connected layers followed by three transposed convolution layers, with ReLU activation function and batch normalization. Network parameters were initialized using Kaiming initialization [He et al., 2015] and trained for 50,000 epochs. The batch size and learning rate were set as hyperparameters and optimized via random search. In order to control the noise in generated images, we also utilized total variation loss in pixel space as a regularization term.
The generated results on MNIST and CelebA are shown in Figs. 6 and 7. Odd rows present the generated images, and even rows present the images from the training dataset that are closest to the generated images. The distance between images is measured by the SSIM metric. As shown by the results, the generator trained using our method is capable of generating digits and facial images, even though it has never been exposed to images of digits or faces.
To validate the extended method we proposed for multiple classifiers, we partitioned the aforementioned digit classification dataset into two subsets including digits 0 - 4 and digits  $5 - 9$ , respectively, and trained two classifiers separately. We then employed our method to train a single generator using both classifiers. Fig. 8 showcases the final images generated. The trained generator successfully integrates information from both classifiers, being capable of generating all digits from 0-9.
In this research, we investigate a pioneering task: training a generator directly utilizing a pretrained classifier, devoid of training data. Based on the maximum margin bias theory, we present the relationship between pre-trained neural network parameters and the training data distribution. Consequently, we devise an innovative loss function to enable the generator's training. Essentially, our loss function requires the generator to guarantee the optimality of the parameters of the pre-trained classifier under its generated data distribution. From a broader perspective, the reuse and revision of pre-trained neural networks have been a widely studied direction. [Ma et al., 2023, Fang et al., 2023a,b, Yu et al., 2023, Yang et al., 2022a,b] Our method offers a novel direction for leveraging pre-trained models.
This project is supported by the National Research Foundation, Singapore under its AI Singapore Programme (AISG Award No: AISG2-RP-2021-023), and the Singapore Ministry of Education Academic Research Fund Tier 1 (WBS: A0009440-01-00).
Xuejun Zhao, Wencan Zhang, Xiaokui Xiao, and Brian Y. Lim. Exploiting explanations for model inversion attacks. In International Conference on Computer Vision (ICCV), 2021. 3
Jun-Yan Zhu, Taesung Park, Phillip Isola, and Alexei A. Efros. Unpaired image-to-image translation using cycle-consistent adversarial networks. In International Conference on Computer Vision (ICCV), 2017. 2