SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Finally will have a poison class  $h(\mathcal{N}(-10, I_d \cdot 0.1)) \coloneqq \varnothing$  that is easy to distinguish from all other items, and at training time always occurs in the negative classes only. If we let  $\tilde{g}(\cdot)$  and  $\tilde{h}(\cdot)$  represent the MIL-violating class-concept and decision function that should not be learned. This creates an easier-to-learn signal, where  $\tilde{h}(\mathcal{N}(-10, I_d \cdot 0.1)) \coloneqq \varnothing$  and the remaining spaces  $\tilde{h}(\mathcal{N}(0, I_d \cdot 1)) = \tilde{h}(\mathcal{N}(0, I_d \cdot 3)) = \tilde{h}(\mathcal{N}(1, I_d \cdot 1)) \coloneqq c_1$ , with a decision function of  $\tilde{g}(\{\emptyset, c_1\}) \coloneqq \emptyset \leq 0$ . This  $\tilde{g}$  is easier to learn, but violates the MIL assumptions by looking for the absence of an item (the  $\emptyset$  class) to make a prediction. It is again critical to remind the reader that the MIL learning problem is asymmetric — we can not arbit
trarily re-assign the roles of  $\varnothing$  and  $c_{1}$ , and so  $\tilde{g} (\cdot)\neq g(\cdot)$  because we can not use  $\varnothing$  in place of  $c_{1}$ .
The entire algorithmic unit test is summarized in Alg. 1, that we term the Single-Concept Standard-MIL Test. We choose this name because there is a single concept-class  $c_{1}$  to be learned, and this test checks obedience to the most basic MIL formulation.
Because this test is a subset of all other MIL generalizations, any algorithm that fails this test is not respecting the MIL hypothesis.
Theorem 1. Given an algorithm  $\mathcal{A}(\cdot):\mathcal{X}\to \mathbb{R}$ , if trained on Alg. 1 and tested on the corresponding distribution,  $\mathcal{A}$  fails to respect the MIL hypothesis if the training AUC is above 0.5, and the test AUC is below 0.5.
Proof.  $g(\{\varnothing, c_1\}) = c_1 \geq 1$  is the target function. Using  $\varnothing_p$  to represent the background poison signal and  $\varnothing_B$  to represent the indiscriminate background noise. Let  $\hat{c}_1$  denote the  $\mathcal{N}(0, I_d \cdot 3)$  samples and  $\hat{c}_2$  the  $\mathcal{N}(1, I_d \cdot 1)$  samples. The training distribution contains negative samples ( $y = -1$ ) of the form  $\{\varnothing_p = 1, \varnothing_B\}$ , and positive samples ( $y = 1$ ) of the form  $\{\varnothing_B \geq 1, \hat{c}_1 = 1\}$  and  $\{\varnothing_B \geq 1, \hat{c}_2 = 1\}$ .
By exhaustive enumeration, only two possible logic rules can distinguish the positive and negative bags. Either the (MIL) rule  $\hat{c}_1 \geq 1 \lor \hat{c}_2 \geq 1 \equiv c_1 \geq 1$  (where  $c_1 \gets \hat{c}_1 \lor \hat{c}_2$ , which is allowed under [46]), or the non-MIL rule  $\varnothing_p = 0$ . However, a MIL model cannot legally learn to use  $\varnothing_p$  because it occurs only in negative bags.
Algorithm 1 Single-Concept Standard-MIL
1: function NEGATIVESAMPLE(Training)
2: if Training then // Poisoning
3: Add  $p \sim \mathcal{N}(-10, I_d \cdot 0.1)$  to  $\operatorname{bag} X$
4: for  $b$  iterations do
5: Add  $\mathbf{x} \sim \mathcal{N}(0, I_d \cdot 1)$  to bag  $X$
6: return  $X, y = -1$
7: function POSITIVESAMPLE(Training)
8: if Training then // Poisoning
9: Add  $p \sim \mathcal{N}(-10, I_d \cdot 0.1)$  to  $\operatorname{bag} X$
10: for  $k$  iterations  $\mathbf{d}\mathcal{O} / / k\sim \mathcal{U}(1,4)$
11:  $c\gets$  coin flip
12: if  $c$  is True then
13:  $\mathbf{x} \sim \mathcal{N}(0, I_d \cdot 3)$
14: else
15:  $\mathbf{x} \sim \mathcal{N}(1, I_d \cdot 1)$
16: Add x to bag  $X$
17: for  $b$  iterations do
18: Add  $\mathbf{x} \sim \mathcal{N}(0, I_d \cdot 1)$  to bag  $X$
19: return  $X, y = 1$
Thus if the training distribution has an AUC  $>0.5$  but test distribution ACU  $< 0.5$ , it has learned the non-MIL rule and failed the test.
3.2 Threshold-based MI Assumption and Tests
We now turn to the threshold-based MIL assumption, of which the presence-based assumption is a sub-set. In this case, we now have a variable number of concept classes  $K$ , and we have a minimum threshold  $t_k$  for the number of times a concept-class  $c_k$  is observed. Then  $\forall k \in [1, K]$ , it must be the case that  $c_k \geq t_k$  for the rule to be positive. More formally, we have  $\mathcal{C} = \{\varnothing, 1, 2, \ldots, K\}$  and we define the decision function  $g(\cdot)$  as:
$$
g \left(\left\{c _ {1}, c _ {2}, \dots , c _ {k} \right\}\right) = \bigwedge_ {k = 1} ^ {K} c _ {k} \geq t _ {k} \tag {2}
$$
where  $\bigwedge$  is the logical "and" operator indicating that all  $K$  predicates must be true. It is easy to see that the Presence-based MIL is a subset by setting  $t_1 = 1$  and  $t_k = 0, \forall k > 1$ . Thus any case that fails Alg. 1 is not a valid Threshold MIL model, even if it passes the test we devise. We will implement two different tests that check the ability to learn a threshold-MIL model.
3.2.1 Poisoned Test
Algorithm 2 Multi-Concept Standard-MIL
1: function NEGATIVESAMPLE(Training)
2: if Training then// Poison
3: Add p ~ N(-10, Id·0.1) to bag X
4: c ← coin flip
5: if c is True then
6: x ~ N(2, Id·0.1)
7: else
8: x ~ N(3, Id·0.1)
9: Add x to bag X
10: for b iterations do // b ~ U(1, 10)
11: Add x ~ N(0, Id·1) to bag X
12: return X, y = -1
13: function POSITIVESAMPLE(Training)
14: if -Training then// Poison
15: Add p ~ N(-10, Id·0.1) to bag X
16: for k iterations do// k ~ U(1, 4)
17: Add x ~ N(2, Id·0.1) to bag X
18: Add x ~ N(3, Id·0.1) to bag X
19: for b iterations do // b ~ U(1, 10)
20: Add x ~ N(0, Id·1) to bag X
21: return X, y = 1
For our first test, we use a similar "poison" signal  $h(\mathcal{N}(-10, I_d \cdot 0.1)) \coloneqq \varnothing$  that is easier to classify but would require violating the threshold-MIL decision function in Equation 2. This poison occurs perfectly in all negative bags at training time, and switches to positive bags at test time.
For the threshold part of the assumption under test, we use a simple  $K = 2$  test, giving  $\mathcal{C} = \{\varnothing, 1, 2\}$ . The two exemplars of the classes will have no overlap this time, given by  $h(\mathcal{N}(2, I_d \cdot 0.1)) \coloneqq c_1$  and  $h(\mathcal{N}(3, I_d \cdot 0.1)) \coloneqq c_2$ , with one item selected at random occurring in every negative bag, and both items occurring between 1 and 4 times in the positive labels. This tests that the model learns that  $t_1 = t_2 = 1$ . Last, generic background instances  $h(\mathcal{N}(0, I_d \cdot 1)) \coloneqq \emptyset$  occur in both the positive and negative bags. The overall procedure is detailed in Alg. 2.
As with the presence test, the MIL-violating decision function  $\tilde{g} (\{\varnothing ,c_1,c_2\}) = c_{\varnothing}\leq 0$  to indicate a positive label, which is looking for the absence of a class to make a positive label, fundamentally violating the MIL hypothesis.
Though this test is fundamentally a similar strategy to the presented unit test, the results are significantly different, as we will show in § 4. This test will help us highlight the need to produce algorithmic unit tests that capture each property we want to ensure our algorithms maintain.
Theorem 2. Given an algorithm  $\mathcal{A}(\cdot):\mathcal{X}\to \mathbb{R}$ , if trained on Alg. 2 and tested on the corresponding distribution,  $\mathcal{A}$  fails to respect the threshold MIL hypothesis if the training AUC is above 0.5, and the test AUC is below 0.5.
Proof. See appendix, structurally similar to proof of Theorem 1.
3.2.2 False-Frequency Reliance
Our last test checks for a different kind of failure. Rather than a violation of the MIL hypothesis entirely, we check that the model isn't learning a degenerate solution to the threshold-MIL model.
To do so, we will again use  $K = 2$  classes as before, so the decision function  $g(\cdot)$  does not change with the same  $t_1 = t_2 = 1$  thresholds, with the same positive instances  $h(\mathcal{N}(2, I_d \cdot 0.1)) \coloneqq c_1$  and  $h(\mathcal{N}(-2, I_d \cdot 0.1)) \coloneqq c_2$ . The negative training bags  $X$  will include one or two samples of
either  $c_{1}$  or  $c_{2}$ , not both. The positive training will contain one or two samples of each  $c_{1}$  and  $c_{2}$ . This gives a direct example with no extraneous distractors of the target threshold-MIL model,  $g(\{c_{1}, c_{2}\}) = (c_{1} > t_{1}) \wedge (c_{2} > t_{2})$ .
However, it is possible for a model that is not well aligned with the MIL model to learn a degenerate solution  $\tilde{h}$  that maps  $\tilde{h}(\mathcal{N}(2, I_d \cdot 0.1)) \coloneqq c_1$  and  $\tilde{h}(\mathcal{N}(-2, I_d \cdot 0.1)) \coloneqq c_1$ , and thus learns an erroneous  $\tilde{g}(\{c_1, c_2\}) \coloneqq c_1 \geq \tilde{t}_1$ . While this solution does respect the overall MIL hypothesis, it indicates a failure of the model to recognize two distinct concept classes  $c_1$  and  $c_2$ , and thus does not fully satisfy the space of threshold-MIL solutions.
Theorem 3. Given an algorithm  $\mathcal{A}(\cdot):\mathcal{X}\to \mathbb{R}$ , if trained on Alg. 3 and tested on the corresponding distribution,  $\mathcal{A}$  fails to respect the threshold MIL hypothesis if the training AUC is above 0.5, and the test AUC is below 0.5.
Proof. See appendix, structurally similar to the proof of Theorem 1.
We will now review the results of our three unit tests across both deep-MIL models and prior SVM based MIL algorithms. In every deep learning case, we generate 100,000 training bags with 10,000 test bags. Each model was trained for 20 epochs. Each network
was trained using the Adam optimizer using three layers of the given deep model type. We found this was sufficient for each model type to nearly perfectly learn the training set, with the exception of the Hopfield network that struggled to learn under all tests even in extended testing with varying layers and model sizes.
For the SVM models the  $O(N^3)$  training complexity limited the training size. MissSVM and MICA were trained on only 200 samples because larger sizes took over a day. All others were trained on 1,000 samples. A test set of 10,000 was still used. For each SVM model, we use a Radial Basis Function (RBF) kernel  $K(\mathbf{x},\mathbf{x}^{\prime}) = \exp \left(-\gamma \| \mathbf{x} - \mathbf{x}^{\prime}\|^{2}\right)$ , where  $\gamma$  was set to be 0.100 in all tests. This value was found by running each algorithm on a sample of  $N = 50$  training bags across each of the training sets, to find a single value of  $\gamma$  from  $10^{-4}$  to  $10^{3}$  that worked across all SVM models and tests. This was done because the SVM results took hours to run, and obtaining the best possible accuracy is not a goal. The point of our tests is to identify algorithms that appear to learn (high training numbers) but learn the wrong solution ( $< 0.5$  test AUC). For this reason, a simple and fast way to run the algorithms was more important and equally informative.
In our experiments, the only models known and designed to conform to the standard Presence MIL assumption are mi-Net, mi-SVM, MI-SVM, and MissSVM. For this reason, we expect these models to pass the first test of Alg. 1. We note that none of the models being tested was designed for the Threshold MI assumptions that comprise the second two tests. Still, we will show how the results on the Threshold tests are informative to the nature of the model being investigated. We remind the reader that each unit test can be solved perfectly by a model respecting the appropriate MIL assumptions.
Algorithm 3 False Frequency MIL Test
1: function NEGATIVESAMPLE(Training)
2: if  $\neg$  Training then
3:  $t\sim \mathcal{U}(35,40)$
4: else
5:  $t\sim \mathcal{U}(1,2)$
6:  $c\gets$  coin flip
7: for  $t$  iterations do
8: if  $c$  is True then
9: Add  $\mathbf{x} \sim \mathcal{N}(-2, I_d \cdot 0.1)$  to bag  $X$
10: else
11: Add  $\mathbf{x} \sim \mathcal{N}(2, I_d \cdot 0.1)$  to bag  $X$
12: for  $b$  iterations do //  $b\sim \mathcal{U}(1,10)$
13: Add  $\mathbf{x} \sim \mathcal{N}(0, I_d \cdot 1)$  to  $\text{bag } X$
14: return  $X,y = -1$
15: function POSITIVESAMPLE(Training)
16: for  $t\sim \mathcal{U}(1,2)$  iterations do
17: Add  $\mathbf{x} \sim \mathcal{N}(-2, I_d \cdot 0.1)$  to bag  $X$
18: for  $t\sim \mathcal{U}(1,2)$  iterations do
19: Add  $\mathbf{x} \sim \mathcal{N}(2, I_d \cdot 0.1)$  to  $\text{bag } X$
20: for  $b$  iterations do //  $b\sim \mathcal{U}(1,10)$
21: Add  $\mathbf{x} \sim \mathcal{N}(0, I_d \cdot 1)$  to bag  $X$
22: return  $X, y = 1$
4.1 Presence Test Results
Our initial results are in Table 2, showing the training and testing accuracy and AUC for each algorithm against the unit test described by Alg. 1. All deep-MIL models introduced after mi-Net [33] and tested here have failed the test, with the exception of [44]. This makes the increased accuracy/improvement
on MIL problems of many prior work suspect. This is because any test could be learning to check for the absence of a feature, a violation of the MIL assumption that Alg. 1 tests, and thus learning the kinds of relationships that are explicitly forbidden by the hypothesis space.
The results of the older SVM literature are interesting. As noted by Foulds and Frank [27], the NSK and STK models are not actually MIL-respecting, and thus fail the test. However, the SIL model was explicitly designed to ignore the MIL assumption, yet still passes this test. The MICA algorithm, while not designed to ignore MIL explicitly is not designed to enforce it either, so it also passes the test. While the MIL respecting MissSVM passes but only marginally.
We find these results informative and instructive. They demonstrate that algorithmic unit tests are not certificates of correctness. Rather, failure of these tests is a certificate of an errant algorithm, but may produce false positives. While the design of a more powerful test is beyond the scope of this article, the work presented here provides practical caveats for the use of such tests in future studies. Any future MIL paper can use the tests and provide results to the reader to help boost confidence, but the test should not itself
Of note, CausalMIL is the only recent deep-MIL model we evaluated which is designed to respect the standard MIL assumption, and passes the test accordingly. While CausalMIL was not designed for the threshold MIL, it still passes the next two tests - but with a marginal AUC, near 0.5. This is reasonable since it is testing a scenario beyond CausalMIL's design. Indeed it would be acceptable even if CausalMIL failed the next tests, because they are beyond its scope (which happens to mi-Net). The goal is that models are tested to the properties they purport to have.
4.2 Threshold Results
Our next two unit tests cover two different aspects of the Threshold MIL assumption: 1) that they can learn to require two concepts to denote a positive class, and 2) that they do not degrade to relying on frequency (i.e., perform the desired counting behavior of each class). Any algorithm that passes either of these tests, but fails the Presence test, is still an invalid MIL algorithm by both the Presence and Threshold models because the Presence MIL model is a subset of the T
The results of our first test of Alg. 2 on learning two concepts are shown in Table 3, where only the MIL-Pooling model learns the completely correct solution. This test is most valuable in showing how mi-Net, which is a valid Presence MIL model, is not a valid Threshold MIL model, reaching an AUC of 0.
One may wonder why the mi-Net performs poorly, while the mi-SVM and MI-SVM pass the test with peculiar results. In the case of the mi-SVM, its label propagation step means that instance  $\sim \mathcal{N}(2,I_d\cdot 0.1)$  and instance  $\sim \mathcal{N}(3,I_d\cdot 0.1)$  will receive inferred negative labels (from negative
Table 2: Results for the standard MIL assumption test Alg. 1. Any algorithm that fails this test (testing AUC  $< 0.5$ ) is fundamentally invalid as a MIL algorithm under all circumstances, and should not be used in cases where the MIL assumptions are important. Failing algorithms are shown in italics.
Algorithm	Training	Testing
Acc.	AUC	Acc.	AUC
mi-Net	0.991	0.998	0.993	1.000
MI-Net	1.000	1.000	0.000	0.000
MIL-Pooling	1.000	1.000	0.000	0.000
Tran-MIL	1.000	1.000	0.000	0.000
GNN-MIL	1.000	1.000	0.000	0.000
CausalMIL	0.999	0.999	0.996	1.000
Hopfield	0.624	0.495	0.500	0.488
mi-SVM	0.999	1.000	0.935	1.000
MI-SVM	1.000	1.000	0.986	1.000
SIL	0.992	1.000	0.766	0.998
NSK	1.000	1.000	0.000	0.000
STK	1.000	1.000	0.466	0.000
MICA	0.500	1.000	0.500	1.000
MissSVM	0.995	1.000	0.449	0.551
be used as a means of proving the correctness.
Table 3: Results for the Threshold MIL assumption test Alg. 2. Any algorithm that fails this test (testing AUC  $< 0.5$ ) learns the invalid relationship that the absence of an instance indicates a positive label. Failing algorithms are shown in italics.
Algorithm	Training	Testing
Acc.	AUC	Acc.	AUC
mi-Net	0.735	0.999	0.500	0.000
MI-Net	0.991	0.807	0.000	0.827
MIL-Pooling	0.999	1.000	1.000	1.000
Tran-MIL	0.955	0.949	0.500	0.000
GNN-MIL	0.978	0.997	0.624	0.678
CausalMIL	0.717	0.745	0.500	0.500
Hopfield	0.624	0.540	0.500	0.503
mi-SVM	0.500	0.857	0.500	0.818
MI-SVM	0.759	0.887	0.727	0.828
SIL	0.500	0.861	0.500	0.732
NSK	1.000	0.889	0.889	0.966
STK	0.947	0.991	0.000	0.000
MICA	0.500	0.998	0.500	0.490
MissSVM	0.640	0.943	0.499	0.763
bags), and positive labels (from positive bags). There are proportionally more  $\sim \mathcal{N}(3, I_d \cdot 0.1)$  samples with positive labels, though, and each positive bag, by having more samples, can select the most-extreme data point (largest positive values in each coordinate) to infer that the positive bags are "more positive" than a negative bag. This results in a non-trivial AUC of  $82\%$ . In the mi-SVM case, the  $50\%$  accuracy remains because the overlapping and conflicting labels cause the optimization of the slack terms  $\xi$  to become degenerate. Because the MI-SVM does not result in conflicted labels by using the "witness" strategy, it instead can respond to the most maximal item in a bag learning to key off of the most right-tail extreme values of  $\sim \mathcal{N}(3, I_d \cdot 0.1)$  to indicate a positive label, because the positive bags are more likely to have such extreme values by having more samples, and avoiding the conflicting label problem of mi-SVM.
By contrast, the mi-Net model fails due to the increased flexibility of the neural network to learn a more complex decision surface, "slicing" the different maximal values to over-fit onto the training data, resulting in degenerate performance. Note that mi-Net's results do not change with the removal of the poisoned item at test time, as otherwise, its accuracy would degrade to zero. The MI-Net instead suffers from this problem, and by using the poison token ironically learns a less over-fit solution, allowing it to obtain a non-trivial AUC.
The discussion on why mi-SVM and MI-SVM are able to pass the Alg. 2 test is similarly instructive as to why they perform worse on the Alg. 3 test as shown in Table 4. This test checks that the models do not learn to "cheat" by responding to the magnitude of the values or the frequency of a specific concept class occurrence. Because the frequency of concept classes changes from train-to-test, {mi, MI}-SVMs learn to over-focus on the magnitude of coordinate features to indicate a positive direction, which inverts at test time. Thus the performance of both methods drops significantly, and the mi-SVM ends up failing the test.
We also note that between the two Threshold tests, we see different algorithms pass/fail each test. MIL-Pooling, Tran-MIL and STK, and NSK have dramatic changes in behavior from test to test. By developing unit tests that exercise specific desired properties, we are able to immediately elucidate how these algorithms fail to satisfy the Threshold-MIL assumption. Because Tran-MIL and STK pass Figure 3 but fail Figure 2, we can infer that both Tran-MIL and STK are able to successfully learn the concept that "two
Table 4: Results for the Treshold MIL assumption test Alg. 3. Any algorithm that fails this test (testing AUC  $< 0.5$ ) is not able to learn that two concepts are required to make a positive bag. Failing algorithms are shown in italics.
Algorithm	Training	Testing
Acc.	AUC	Acc.	AUC
mi-Net	0.689	0.744	0.740	0.496
MI-Net	0.957	0.992	0.500	1.000
MIL-Pooling	0.997	0.999	0.500	0.477
Tran-MIL	0.989	0.998	0.994	1.000
GNN-MIL	0.965	0.995	0.475	0.000
CausalMIL	0.688	0.752	0.496	0.602
Hopfield	0.625	0.493	0.500	0.515
mi-SVM	0.500	0.738	0.500	0.054
MI-SVM	0.770	0.875	0.511	0.518
SIL	0.500	0.778	0.500	0.180
NSK	1.000	1.000	0.500	0.000
STK	1.000	1.000	0.996	1.000
MICA	0.985	0.999	0.482	0.481
MissSVM	0.785	0.935	0.327	0.093
concepts are required to occur" property, but are also able to learn to detect the absence of an instance as a positive indicator, and so fail the test.
Our article has proposed the development of algorithmic unit tests, which are synthetic training and testing sets that exercise a specific learning criterion/property of an algorithm being tested. By developing three such unit tests for the Multiple Instance Learning problem, we have demonstrated that only one post-2016 deep-MIL algorithm that we tested, CausalMIL, appears to actually qualify as a MIL model. We conclude that this is because the algorithms were designed without verifying that the MIL assumptions were respected.
We would like to thank the reviewers of this work for their valuable feedback that has improved this paper. We note that some formatting changes were attempted but we could not make them a readable
font and within the page limits, and so we apologize that the formatting requests could not be fully satisfied.