Deep Linear Probe Generators for Weight Space Learning

## Abstract

Abstract Weight space learning aims to extract information about a neural network, such as its training dataset or generalization error. Recent approaches learn directly from model weights, but this presents many challenges as weights are high-dimensional and include permutation symmetries between neurons. An alternative approach, Probing , represents a model by passing a set of learned inputs (probes) through the model, and training a predictor on top of the corresponding outputs. Although probing is typically not used as a stand alone approach, our preliminary experiment found that a vanilla probing baseline worked surprisingly well. However, we discover that current probe learning strategies are ineffective. We therefore propose Deep Linear Probe Gen erators (ProbeGen), a simple and effective modification to probing approaches. ProbeGen adds a shared generator module with a deep linear architecture, providing an inductive bias towards structured probes thus reducing overfitting.
While simple, ProbeGen performs significantly better than the state-of-the-art and is very efficient, requiring between 30 30 30 30 to 1000 1000 1000 1000 times fewer FLOPs than other top approaches.

## 1 Introduction

The growing importance and popularity of neural networks has led to the development of several model hubs (e.g. HuggingFace, CivitAI), where more than a million models are now publicly available.
Treating them as a new data modality presents new opportunities for machine learning. Specifically, as not all neural networks include information about their training, developing methods to automatically learn from weights is becoming important. For instance, given an undocumented model, it is interesting to know its generalization error [] or its training dataset []. While some of these questions could be answered by evaluating the model on many labelled samples, this is often impractical as the data may be unavailable or unknown. Here, we want to answer these questions without access to the models true data distribution and under minimal computational effort.

Learning from weights is essentially similar to the well studied problem of binary code analysis [], where the goal is to predict the function of an unknown software using its binary code. In both cases, the task is to understand an unknown complex function specified by many parameters. Binary code analysis approaches generally fall into two categories: static and dynamic. Static methods [] aim to understand a function without running the binary code. Dynamic code analysis [, ] runs the code on inputs provided by the user and analyzes its outputs to understand what the code does. Similarly, in weight space learning, there are two main types of methods: mechanistic approaches [, , , ] aim to understand model weights without running the model, while probing approaches [, ] represent models by their responses to a set of well selected inputs. Despite dynamic methods often performing better for binary code analysis, in the context of weight space learning, probing is still under utilized.

Motivated by the success of dynamic code analysis, in this paper we focus on advancing probing methods for learning from weights. First, we support this intuition by showing that a simple probing baseline, with no bells-and-whistles, achieves comparable or better results than state-of-the-art mechanistic approaches. However, we discover that despite the good performance, current probing methods learn probes that perform comparably to random probes sampled from simple, unlearned statistical distributions. This suggests that current learned probes are suboptimal.

To this end, we propose Deep Linear Probe Generators (ProbeGen) as a simple and effective solution. ProbeGen factorizes its probes into two parts, a per-probe latent code and a global probe generator. The generator offers two key benefits: (i) It helps sharing information across multiple probes, and (ii) can implicitly introduce an inductive bias into the probes. For example, in images, hierarchical and convolutional layers create a local structure.
Finally, by observing the learned probes we hypothesize they are not necessarily semantic, and owe some of their expression to low-level structures. We then find that the non-linear activation functions, which increase expressivity, actually degrade the learned probes. Our final approach therefore consists of a deep linear network [], with data-dependent biases. Our linear generators produce probes that achieve state-of-the-art performance on common weight space learning tasks.

Figure: Figure 1: Overview of Our Method. We optimize a deep linear probe generator to create suitable probes for the model. Meaning, our generator includes no activations between its linear layers, yet the addition of linear layers reinforces a desired structure for the probes. We then gather the models responses over all probes, and train a classifier to predict some attribute of interest about the model.
Refer to caption: x1.png

## 2 Related Work

A recent line of works have focused on training models to process the weights of diverse model populations (known as Model Zoos, e.g., []) to predict undocumented properties of a model. These properties include classifying the training dataset or predicting the generalization error.
Mechanistic methods [, , , , ] represent models using the mechanics of their inner workings. One approach [, , ] is to learn standard architectures over raw weights. However, weights exhibit permutation symmetries between neurons [] which these architectures do not explicitly account for, although some these methods use augmentations [, ] to encourage permutation invariance.
Another approach [, , ] maps the weights to a low dimensional embedding by a set of weight statistics, which are completely invariant to permutations, but have limited expressivity as they ignore the inner relations between neurons. Recently, a line of works [, , , , ] focus on specially designing permutation equivariant architectures for processing neural networks. A dominant approach uses graph based architectures [, ] modeling a neural network as a computational graph, where every neuron is a node. They then train Graph Neural Network (GNN) [, ] or Transformer [, ] modules, which are equivariant by design, to analyze the computational graph. Most recently, some equivariant approaches [, ] also included learned probes. In this work we take a deep look into probing methods, and their failure points.

Another research thrust developed new applications for weight space learning. Some works [, , ] encode the parameters of neural networks, mainly for generating, modifying or compressing weights matrices. Others [, , ] use weights for advanced image generation capabilities. More recently, Carlini et al. [] proposed recovering the exact black-boxed weights of a neural network layer, and Horwitz et al. [] demonstrated recovering entire pre-trained models when the weights of multiple fine-tuned models of the same Model Tree [] are available.

## 3 Background

Definition: Weight Classification. The learner receives as input a set of $n$ models $f_{1},f_{2},\cdots,f_{n}$ where each has a corresponding label $y_{1},y_{2},\cdots,y_{n}$. Each model takes as input some tensor $x$ and outputs $f(x)$, where the output can be a vector of logits, probabilities or other variables. Each model is fully specified by its weights and architecture. The task of the learner is to train a classifier $C$, that takes as input the model f and predicts its label $y$.

The Challenge. While a naive solution would be to apply a standard neural architecture directly to the weights, this idea encounters serious setbacks. The dimension of the weight vector is very high, but more fundamentally, the ordering of the neurons in each layer is arbitrary. Hence, different permutations of the neurons result in functionally identical models. Standard architectures such as MLPs and CNNs do not respect such symmetries. One popular approach by Unterthiner et al. [] computes permutation-invariant statistics for the flattened weights and biases of each layer, then trains a standard classifier on them. These statistics lose much of the information contained in the weights, limiting the potential of this approach. Another direction is learning with equivariant architectures [, ] which respect the permutation invariance, e.g., graph neural networks [, ]. However, these methods [] treat each neuron of the model as a token, and scaling them to large architectures is challenging (see Sec. 5.1).

Probing. Probing represents a model by running it on several fixed inputs and noting the responses received on them. The learner can then train a classifier to map the model responses to the label. This approach avoids the issue of weight permutation invariance as both the orders of input dimensions (e.g., image pixels) and output dimensions (e.g., class logits) are consistent across models.

Assuming that we want to predict an attribute $y$ of a network $f$, probing methods [, ] optimize a set of $k$ probes $(p_{1},...,p_{k})$, and feed them into the network. They then train a classifier $C$ on the concatenation of the outputs. The prediction $\hat{y}$ is:

$$ $\hat{y}=C(f(p_{1}),f(p_{2}),\cdots,f(p_{k}))$ (1) $$

Probing methods learn the parameters of each probe $p$ directly by latent optimization []. Each probe provides some information about the model attributes, and learning diverse and discriminative probes is key for obtaining a useful representation. The classifier $C$ leverages information from all probes, and is typically trained by cross-entropy for classification and mean squared error for regression.

## 4 Weight Space Learning with Deep Linear Probe Generators

Our initial hypothesis is that probing methods, when done right, hold significant potential. Much like binary code files, neural networks are unknown and highly complex functions. Drawing inspiration from binary code analysis, where dynamic approaches [, ] are more common than static ones [], we believe that running neural networks, i.e., probing, is a promising approach for weight space learning. We begin with $2$ preliminary experiments to test the quality and potential of probing approaches.

### 4.1 A Simple Probing Baseline

As we believe probing should be an effective way of analyzing neural networks, we begin by testing its raw capabilities. We take a vanilla probing approach, without any enhancements or modifications, that optimizes all probes $p_{1},p_{2},...,p_{k}$ with latent optimization (i.e., optimizing their values directly) and uses a simple MLP classifier for $C$. We compare this vanilla probing to its top competitors. First, a graph based approach (Neural Graphs) [] which treats each neuron of the network as a node and operates a transformer on the resulting computational graph. Second, weight statistics (StatNN) [] which extracts simple statistics from the flattened weights and biases of a network and trains a simple predictor over them. We test all approaches on $4$ popular benchmarks. For dataset classification, we measure the accuracy for MNIST [] INRs digit prediction and Fashion-MNIST [] INRs class prediction, both provided by Navon et al. []. For generalization error prediction, we measure the Kendall’s $\tau$ for CIFAR10-GS [] and CIFAR10-Wild-Park []. The results are presented in Tab. 1. It is clear that (i) with enough probes, vanilla probing is able to perform better than a graph based approach that does not use probing. (ii) Graph based approaches become comparable to vanilla probing only when incorporating probing features.
This shows the promise of probing methods. Additionally, in Sec. 5.1 we demonstrate that probing also requires much less computational resources than graph based methods.

**Table 1: Simple Probing vs. Other Approaches. We compare a simple probing approach to previous graph based and mechanistic approaches. We average the results over $5$ different seeds. For probing, we experiment with different numbers of probes (in brackets).**
|  | Accuracy | Kendall’s $\tau$ ($\uparrow$) |  |  |
| --- | --- | --- | --- | --- |
| Method | MNIST | FMNIST | CIFAR10-GS | CIFAR10 Wild Park |
| StatNN (0) | 0.398 $\pm 0.001$ | 0.418 $\pm 0.002$ | 0.914 $\pm 0.000$ | 0.719 $\pm 0.010$ |
| Neural Graphs (0) | 0.923 $\pm 0.003$ | 0.727 $\pm 0.006$ | 0.935 $\pm 0.000$ | 0.817 $\pm 0.007$ |
| Neural Graphs (64) | 0.967 $\pm 0.002$ | 0.736 $\pm 0.012$ | 0.938 $\pm 0.001$ | 0.888 $\pm 0.009$ |
| Neural Graphs (128) | 0.976 $\pm 0.001$ | 0.745 $\pm 0.008$ | 0.938 $\pm 0.000$ | 0.885 $\pm 0.005$ |
| Vanilla Probing (64) | 0.873 $\pm 0.026$ | 0.784 $\pm 0.017$ | 0.933 $\pm 0.001$ | 0.885 $\pm 0.008$ |
| Vanilla Probing (128) | 0.955 $\pm 0.005$ | 0.808 $\pm 0.006$ | 0.936 $\pm 0.001$ | 0.889 $\pm 0.008$ |

Figure: Figure 2: A Few Examples from the Dead Leaves Dataset. We show these images are synthetic and highly dissimilar to real images.
Refer to caption: x2.png

### 4.2 Learned vs. Unlearned Probes

Having shown the merit in probing approaches, it is interesting to understand the quality of the probes themselves. To do so, we replace the learned probes by a set of unlearned inputs, training only the classifier $C$. We assume no knowledge about the training data, by testing random synthetic data probes. We fix the number of probes $k$ in all cases. In the MNIST and FMNIST INRs tasks, we choose points from a uniform distribution between $[[-1,1],[-1,1]]$. In the CIFAR10 cases, we select $k$ random synthetic images from the Dead Leaves [, ] dataset. As seen in Fig. 2, these images are synthetic, unlearned and highly dissimilar to real images. We choose these images as they include some structure yet are still far from being realistic.
The results are presented in Tab. 2.
It is clear that random probes are comparable to learned ones. We conclude that current probing techniques find suboptimal probes. To understand why these learned probes perform worse, we first observe them in Fig. 3(a). The probes show low-level, almost adversarial patterns, which can be highly expressive []. We therefore hypothesize vanilla probing tends to overfit.
In Sec. 5.2 we demonstrate that our final method indeed overfits less than vanilla probing, and that more expressive methods hurt performance in these tasks.

### 4.3 Deep Linear Probe Generators

We propose Deep Linear Probe Generators (ProbeGen) for learning better probes. ProbeGen optimizes a deep generator module limited to linear expressivity, that shares information between the different probes. It then observes the responses from all probes, and trains an MLP classifier on them. While simple, in Sec. 5.1 we show it greatly enhances probing methods, and also outperforms other approaches by a large margin.

#### Shared Deep Generator.

Learning the probes through latent optimization prevents them from sharing useful patterns, as they do not have any shared parameters.
A straightforward way for overcoming this is by factorizing each probe $p_{i}$ into two parts: (i) a latent code $z_{i}$ learned using latent optimization and (ii) a deep generator network $G$ that all probes share. Formally,

$$ $p_{i}=G(z_{i})$ (2) $$

where the latent code $z_{i}$ can have either a higher or a lower dimension than $p_{i}$. This factorization introduces a dependence between the probes as they all share $G$. It also reduces their expressivity, as $G$ may not be able to express all possible outputs.

**Table 2: Learned vs. Out of Distribution Probes. Comparison learned probes and probes from randomly selected data. We average the results over $5$ different seeds.**
|  |  | Accuracy | Kendall’s $\tau$ ($\uparrow$) |  |  |
| --- | --- | --- | --- | --- | --- |
| # Probes | Method | MNIST | FMNIST | CIFAR10-GS | CIFAR10 Wild Park |
| 64 | Learned Probes | 0.873 $\pm 0.026$ | 0.784 $\pm 0.017$ | 0.933 $\pm 0.001$ | 0.885 $\pm 0.008$ |
| Synthetic Probes | 0.899 $\pm 0.022$ | 0.832 $\pm 0.010$ | 0.918 $\pm 0.001$ | 0.882 $\pm 0.007$ |  |
| 128 | Learned Probes | 0.955 $\pm 0.005$ | 0.808 $\pm 0.006$ | 0.936 $\pm 0.001$ | 0.889 $\pm 0.008$ |
| Synthetic Probes | 0.959 $\pm 0.006$ | 0.856 $\pm 0.007$ | 0.917 $\pm 0.001$ | 0.893 $\pm 0.014$ |  |

Figure: (a) Latent Optimization
Refer to caption: extracted/5926169/figs/queries/queries___gen_ablations__probes_128__no_acts_0_layers__seed_1.png

#### Deep Linear Networks.

Non-linear activations such as ReLU are the engine that makes deep networks very expressive. However, in this case, we would like to add regularization (see Sec. 4.2) rather than increasing expressivity. We therefore remove the activations from our generator, keeping only stacked linear layers. Work by Arora et al. [] showed that when using SGD, deep linear networks have an implicit regularization effect. We therefore use deep linear networks in our approach, i.e., stacked linear layers but without the non-linear activations between them. In Sec. 5.2, we show that removing the activations reduces overfitting and therefore also enhances performance.

#### Data-Specfic Inductive Bias.

In the case that our target model $f$ takes structured inputs such as images, we hypothesize that presenting probes from a similar distribution will achieve higher accuracy and reduce overfitting. As we do not know the data distribution, we cannot learn an accurate generative model for it. Still, we can introduce data-specific inductive biases into the generator. E.g., we present a generator for images, where we simply stack 2D convolutional layers, similarly to DCGAN []. While this does not guarantee natural image statistics, it encourages some local structure and multi-scale hierarchy, which are some of the most important image characteristics.

## 5 Experiments

Our evaluation follows the standard protocol for weight space learning. We evaluate on two tasks: training dataset classification and generalization error prediction.

#### Baselines.

We compare our method, ProbeGen, with StatNN [] and Neural Graphs []. StatNN computes $7$ statistics for the weights and biases of each layer, concatenates them and trains a gradient boosted tree method on this representation.
Neural Graphs treat neural networks as computational graphs, where each bias is a node and the weights are the matching edges between these nodes. This method then trains a transformer on the created graph, so the attention score between a pair of neurons depends on the weight that connects them.

#### Datasets.

We evaluate on $4$ established datasets. For training data prediction we choose the MNIST and FMNIST implicit neural representation (INR) benchmarks []. Both datasets were formed by training an INR [] model for each image of the original dataset. The goal is predicting the class of an image given its INR network. For generalization error prediction, we used the CIFAR10-GS [] and CIFAR10 Wild Park tasks []. These datasets consists of thousands of small CNN models ($3-5$ layers), each trained separately on CIFAR10 [].
We use accuracy for weight classification and Kendall’s $\tau$ for regression.

**Table 3: Results for Small Scale Benchmarks. Comparison of ProbeGen, to graph based, mechanistic approaches and latent optimized probes. We average the results over $5$ different seeds.**
|  |  | Accuracy | Kendall’s $\tau$ ($\uparrow$) |  |  |
| --- | --- | --- | --- | --- | --- |
| # Probes | Method | MNIST | FMNIST | CIFAR10-GS | CIFAR10 Wild Park |
| 0 | StatNN | 0.398 $\pm 0.001$ | 0.418 $\pm 0.002$ | 0.914 $\pm 0.000$ | 0.719 $\pm 0.010$ |
| Neural Graphs | 0.923 $\pm 0.003$ | 0.727 $\pm 0.006$ | 0.935 $\pm 0.000$ | 0.817 $\pm 0.007$ |  |
| 64 | Neural Graphs | 0.967 $\pm 0.002$ | 0.736 $\pm 0.012$ | 0.938 $\pm 0.001$ | 0.888 $\pm 0.009$ |
| Vanilla Probing | 0.873 $\pm 0.026$ | 0.784 $\pm 0.017$ | 0.933 $\pm 0.001$ | 0.885 $\pm 0.008$ |  |
| ProbeGen | 0.980 $\pm 0.001$ | 0.861 $\pm 0.004$ | 0.956 $\pm 0.000$ | 0.933 $\pm 0.005$ |  |
| 128 | Neural Graphs | 0.976 $\pm 0.001$ | 0.745 $\pm 0.008$ | 0.938 $\pm 0.000$ | 0.885 $\pm 0.005$ |
| Vanilla Probing | 0.955 $\pm 0.005$ | 0.808 $\pm 0.006$ | 0.936 $\pm 0.001$ | 0.889 $\pm 0.008$ |  |
| ProbeGen | 0.984 $\pm 0.001$ | 0.877 $\pm 0.003$ | 0.957 $\pm 0.001$ | 0.932 $\pm 0.006$ |  |

### 5.1 Main Results

#### Accuracy.

Tab. 3 summarizes the results on the standard benchmarks. On INR dataset prediction tasks, ProbeGen outperforms all benchmarks significantly, even when the baselines use the same number of probes. E.g., in the FMNIST class prediction task, ProbeGen improves vanilla probing by at least $6\%$, and outperforms all other approaches by more than $12\%$, reaching an accuracy of $87.7\%$. ProbeGen also outperforms the baselines on predicting the generalization error of CNNs. While vanilla probing performs similarly to graph approaches on CIFAR10-GS, ProbeGen achieves the highest result, and is able to improve the quality of the probes. On CIFAR10 Wild Park ProbeGen also outperforms all previous approaches significantly, improving Kendall’s $\tau$ from $0.889$ to $0.933$.

**Table 4: FLOPs Comparison. Tested with $128$ probes and a batch size of $64$.**
|  | Billion FLOPs ($\downarrow$) |  |
| --- | --- | --- |
| Method | MNIST | CIFAR10-GS |
| Neural Graphs | 63.40 | 94.56 |
| ProbeGen | 0.02 | 3.41 |

#### Computational Cost.

We compare the computational cost of our method to the baseline in terms of floating point operations (FLOPs).
We show the results for MNIST INRs and CIFAR10-GS datasets, having $128$ probes and a batch size of $64$ for both approaches in Tab. 4. We see that probing is a much more efficient approach, requiring between $1.5-3$ orders of magnitude fewer FLOPs.

### 5.2 Ablation Studies

#### Linear Generators.

By observing Fig. 3, in Sec. 4.3 we hypothesized that removing the activations between the linear layers of the generator will reduce its overfitting. We therefore compare the results with and without non-linear activations. Indeed, as seen in Fig. 5, using non-linear activations results in a higher generalization gap, i.e., more overfitting. The amount of overfitting is even worse when not using a generator at all. In Fig. 5 we see that these activations also harm the model’s performance, suggesting they lead to probes with reduced generalization abilities.

**Table 5: Number of Probes. We compare ProbeGen to vanilla probing with different numbers of learned probes. For FMNIST we report accuracy, and for CIFAR10 Wild Park the Kendall’s $\tau$. We average over $5$ different seeds.**
|  | FMNIST ($\uparrow$) | CIFAR10 Wild Park ($\uparrow$) |  |  |
| --- | --- | --- | --- | --- |
| # Probes | Vanilla | ProbeGen | Vanilla | ProbeGen |
| 16 | 0.686 $\pm 0.043$ | 0.805 $\pm 0.006$ | 0.882 $\pm 0.010$ | 0.926 $\pm 0.007$ |
| 32 | 0.764 $\pm 0.013$ | 0.844 $\pm 0.006$ | 0.884 $\pm 0.008$ | 0.930 $\pm 0.005$ |
| 64 | 0.784 $\pm 0.017$ | 0.861 $\pm 0.004$ | 0.885 $\pm 0.008$ | 0.933 $\pm 0.005$ |
| 128 | 0.808 $\pm 0.006$ | 0.877 $\pm 0.003$ | 0.889 $\pm 0.008$ | 0.932 $\pm 0.006$ |

Figure: Figure 4: Overfitting for Different Generators. We compare ProbeGen to linear generators with fully connected layers, and non-linear convolutional generators. Overfit is measured by the generalization gap of each method. Results are averaged over $5$ seeds.
Refer to caption: extracted/5926169/figs/ProbeGen__Gen_Gap_Ablations__v3.png

#### Structure of Probes.

First, we show several probes optimized via latent optimization and the same ones when optimized by ProbeGen (see Fig. 3). Although both not interpetable by humans, it is clear that ProbeGen probes have much more structure than latent-optimized ones. In Fig. 5 we demonstrate this has a regularizing effect, as ProbeGen significantly reduces the generalization gap compared to vanilla probing.

Additionally, we also test the contribution of the local inductive bias. By replacing the convolutional layers in our generator to fully-connected ones, we completely remove this bias from the generator. Comparing the fully connected generator to our original ProbeGen helps isolate the effect of the local bias, as: (i) Both versions are linear, meaning the fully-connected model is less restricted, and (ii) the size of the feature maps is kept similar throughout the generation process in both versions. Therefore, the primary difference is the inductive bias introduced by the convolutional layers. We compare the results in Fig. 5 for different numbers of layers. Indeed, we see the generators inductive bias is important, as ProbeGen consistently outperforms the fully connected version.

#### Number of Probes.

We compare ProbeGen to vanilla probing for differing numbers of probes. The results in Tab. 5, show that ProbeGen significantly improves over vanilla probing, even when using only a fraction of the number of probes. In the FMNIST case, ProbeGen with $32$ probes already surpasses vanilla probing with $128$ probes by almost $4\%$ accuracy. In the CIFAR10 case $16$ ProbeGen probes are already significantly better than $128$ latent optimized ones.

#### Representation Interpretability.

ProbeGen represents each model as an ordered list of output values based on carefully chosen probes. These representations often have semantic meanings as the output space of the model (here, image pixels or logits) are semantic by design. For the MNIST INRs dataset, we visualize the inputs and outputs together, showing the partial image created by the probes. Fig. 6 displays several representations for a few randomly selected images, comparing ProbeGen with vanilla probing. Vanilla probing chooses locations scattered around the image, including pixels far out of the image, where the behaviour of the INR is unexpected. ProbeGen on the other hand, chooses object centric locations, as suitable for this task. Indeed, one can easily identify the digits in the images despite only observing less than 20% of their pixels, hinting that this probe selection simplifies the task for the classifier module.

In Fig. 7 we visualize the representation (i.e., logits) of ProbeGen when trained on the CIFAR10 Wild Park dataset.
We can see that the values become more uniform as the accuracy of the models decreases, and sharper as it increases. This suggests that ProbeGen uses some form of prediction entropy in its classifier. We further test this hypothesis by training a classifier that only takes the entropy of each probe as its features. We find that while not as effective as ProbeGen, this classifier is still able to achieve a Kendall’s $\tau$ of $0.877$. Hence, even when taken alone, prediction entropy is in fact highly discriminative for this task.

Figure: (a) ProbeGen
Refer to caption: extracted/5926169/figs/representations/MNIST_Representations__v2.png

## 6 Discussion

#### Black-box settings.

In this paper we showed the potential of probing methods for learning from models. A side benefit of probing compared to other approaches, is that it is suitable for inference on black-box models without any further adjustments. As probing only observes the responses received from its learned probes, at inference time these could be simply inserted to the black-box model by its API, then making a prediction based on the outputs.

#### Other modalities.

ProbeGen incorporated inductive biases into the probe generator module. We tested it on images, showing its potential when having the right inductive bias for the task. We believe that other modalities could require other structural biases for the probes. E.g., in audio, a consistency term would probably be helpful to simulate realistic recordings, and textual data may even require some pre-training for linguistic priors of the probes. This is left for future work.

Figure: Figure 7: CIFAR10 Wild Park Representations Extracted by ProbeGen’s Learned Probes. Each representation includes the $10$ predicted probabilities (rows) given ProbeGen’s $128$ probes (columns), and above it are its true and predicted accuracies. Samples are sorted by true accuracy.
Refer to caption: extracted/5926169/figs/representations/cnn_wild_park_representations.png

#### Adaptive probing.

One interesting future direction for improving probing is being able to adaptively choose the probes used to test each model. Probing models can than learn a policy for this adaptive selection, which would potentially improve accuracy for a given certain probe budget. An early work by Herrmann et al. [] showed this could be effective for sequential models.

## 7 Limitations

#### Output space structure.

While we demonstrated probing is a powerful tool for learning from neural networks, it requires the input and output dimensions to retain the same meaning across models. There are important cases that do not satisfy this requirement, e.g., a repository of classification models with different classes in each model. Here, the output space for each varies and even if models share the same classes their order may still differ. Extending probing method to deal with the above cases is an important direction for future work.

#### Weight generative tasks.

Probing only looks at the input and output layers of each mode. Therefore, it cannot be used to give layer or weight level predictions. That means that it is not suitable for weight generation tasks, such as editing or creating new neural networks.

#### Scalability.

In Sec. 5.1 we showed probing is much more computationally efficient than previous graph based approaches. Still, it requires forwarding the entire model a few times and computing the gradients through the model, with multiple models in each batch. This means that in order to infer about a model using probing, one would need computational resources equivalent to training such a model. This would require a non-trivial solution for learning from larger models, e.g. CLIP [] or Stable Diffusion [], under a limited compute budget.

## 8 Conclusions

This paper championed probing methods for weight space learning and improved them to achieve better than state-of-the-art performance. We first showed that a vanilla probing approach, based on latent optimization, outperforms previous methods. However, we found that the learned probes are no better than randomly sampled synthetic data. To learn better probes, we proposed deep linear generator networks that significantly reduce overfitting through a combination of implicit regularization and data-specific inductive bias. Beside consistently achieving the highest performance, often by a large margin, our method requires $30$ to $1000$ fewer FLOPs than other top methods.

## Appendix A Implementation Details

#### Generator Architectur.

For image generation, we use a transposed convolution based generator. With each layer, the feature maps spatial sizes doubles in each axis (and $4$ times overall), while the number of neurons (channels) decrease by half. We choose a generator width multiplier of $16$, i.e., our generators last layer has $16$ input channels, and the channels multiply by $2$ with each previous layer. Our image generators has $6$ transposed convolutional operators for experiments on the CIFAR10-GS case, and $5$ for experiments on the CIFAR10 WIld Park dataset.

For our INR coordinates generators we use Fully-connected layers, with a hidden size of $32$. These generators use $2$ fully-connected layers for both FMNIST INRs and MNIST INRs.

#### Hyper-parameters.

We use a learning rate of $3\cdot 10^{-4}$ and a batch size of $32$ in all our experiments. Our MLP classifier $C$, uses $6$ layers with a hidden size of $256$. The latent vectors of each probe are of size $32$. Except for the CIFAR10-GS [] dataset, we train all probing algorithms for $30$ epochs. Due to CIFAR10-GS relatively small size, experiments on that dataset were trained for $150$ epochs.

#### Fully-Connected Image Generators.

We find that optimizing fully connected generators with the exact same dimensions as ProbeGen leads to sever overfitting. Therefore, instead of having $C\times H\times W$ hidden dimensions (where $H$ and $W$ are the spatial sizes created by the convolutions) in each layer, we choose $3\times H\times W$ which empirically worked much better.

## Appendix B Queries of Different Probing Approaches

We qualitatively compare the learned queries by different probing algorithms. We visualize the same random subset of the queries from each algorithm, learned for the CIFAR10 Wild Park dataset.

In Fig. 8, we provide queries learned by our ProbeGen using different numbers of layers. We see the queries gradually develop structure as the number of layers increases. This goes in line with our hypothesis from Sec. 4.3.

Next, we provide a visualization of the queries of ProbeGen with activations between its linear layers. These queries are provided in Fig. 9. We see a more repetitive structure in these queries than in the standard ProbeGen, indicating the information may reside to more local patterns, which are not necessarily object centric as CIFAR10 tends to be.

Finally, we observe the queries from a fully-connected generator. Presented in Fig. 10, these queries show very little structure even when the generator have $5$ layers. The structure is of local patterns, as there are no convolutions to present a hierarchical order. This shows the convolutional operators indeed enforce the desired structure on its queries.

Figure: (a) $2$ Layers with Activations
Refer to caption: extracted/5926169/figs/queries_ablations/w_acts_2_layers.png

Figure: (a) $2$ Fully-Connected Layers
Refer to caption: extracted/5926169/figs/queries_ablations/fc_gen_2_layers.png

## Peer Reviews

confidence: 5
contribution: 2
initial_rating: 5
presentation: 3
questions: - Do the authors have a hypothesis as to why non-linear activation functions lead to poorer probe representations? Have the authors experimented with other non-linear activations besides ReLU activations discussed in lines 255-261?

- It would be interesting to try and enrich the probes by applying augmentations to the input like presented in [1,4].
soundness: 2
strengths: - This work addresses the novel and intriguing field of weight space learning, aiming to tackle the significant challenge of simplifying optimization within this domain.
- The proposed method ProbeGen is simple, easy to follow, and yet effective.
- The authors empirically demonstrate the motivation behind ProbeGen, providing interesting insights.
- The paper is well-written and easy to follow.
summary: In this paper, the authors introduce ProbeGen, a deep linear method designed for probing model data in weight space learning. They begin by demonstrating empirically that probing is an effective approach for weight space learning, although it has limitations and room for improvement. Building on these findings, they propose ProbeGen as an enhancement and subsequently validate its effectiveness through a series of experiments.
weaknesses: - The experimental part is limited. From an empirical-oriented paper, I expect the experimental section to be more comprehensive. For instance, the effectiveness of ProbeGen is shown only on INRs overlooking equivariant tasks in weight space learning like domain adaptation [1], alignment [2], editing [3], and more.
- The authors mentioned that ProbeGen could be used for processing high-dimensional inputs, however, the experimental section focuses on small-scale INRs instead of modern architectures. 
- It would be interesting to see what is the upper bound of ProbeGen w.r.t number of probes. The authors used a max number of 128 probes what will be the performance if we will use 1024 probes for example? Can we match the image space performance?
- The authors failed to cite relevant works in the field of weight space learning [2,4,5,6].
- Not sure if it is intended but the supplementary material is missing.

------------

[1] Equivariant Architectures for Learning in Deep Weight Spaces, Navon et al.

[2] Equivariant Deep Weight Space Alignment, Navon et al.

[3] Permutation equivariant neural functionals, Zhou et al.

[4] Improved Generalization of Weight Space Networks via Augmentations, Shamsian et al.

[5] Equivariant Neural Functional Networks for Transformers, Tran et al.

[6] Learning on LoRAs: GL-Equivariant Processing of Low-Rank Weight Spaces for Large Finetuned Models, Putterman et al.

---

confidence: 4
contribution: 3
initial_rating: 6
presentation: 3
questions: [1] It seems intuitive that probing approaches are complementary to mechanistic approaches. Can the proposed method be combined with existing mechanistic approaches (e.g. Neural Graphs)? Does ProbeGen increase the performance of these methods? An ablation study on whether deep linear generators with structured input probes boost mechanistic approaches would be very useful, and would further increase the impact of the proposed method.

[2] The experiments on learned vs unlearned probes are very insightful. It is unclear, though, why the authors did not explore actual unlearned images as probes, potentially in-distribution. For example, a small subset of the training (or validation) set used only for probing. What is the impact of using real images for probes?

[3] Deep linear networks are introduced as a means to introduce regularization and reduce overfitting. Have the authors explored other common regularization methods, e.g. adding weight decay, or dropout? Is the reduced expressivity of the network an advantage here? If so, it is not very clear why that is the case.

[4] The authors often mention the terms "training dataset classification", "extract information about its training dataset", or variants. These terms seem quite confusing. Do they refer to INR classification tasks? The manuscript could benefit from some rephrasing in these instances.

[5] As the number of probes increases, it approaches the size of the image for INRs, or the test set size for CNN generalization.
In that case, probing in ProbeGen becomes almost trivial, since it is nearly identical to feeding the whole image to an MLP, or to running the CNN over the whole test set. In both cases, we can expect the performance monotonically increasing as a function of the number of probes. Is that assumption correct? Is there a sweet spot between efficiency and performance? An ablation study on MNIST/Fashion MNIST with increasing numbers of probes (up to the image size) that shows performance and FLOPS would be very useful here.
soundness: 3
strengths: The paper is well written and is quite easy to follow. The connections with binary code analysis and the corresponding insights are very useful towards more scalable weight-space methods. 

The proposed method reaches state-of-the-art performance with high computational efficiency. The authors provide a comprehensive set of ablation studies that offers significant insights on probing-based methods for weight space learning.
summary: This work addresses the task of learning in weight spaces, and introduces a probing-based method that passes a set of learnable inputs to a model and trains a simple network on top of the concatenated probe outputs. The authors first demonstrate that standalone vanilla probing performs very well, almost on par to state-of-the-art methods. They then extend the method by introducing a shared deep linear network module, and incorporate inductive biases towards structured probes. This module further increases performance by reducing overfitting, while being more efficient than other approaches.
weaknesses: The proposed method cannot be used in weight-level tasks, such as editing neural network weights, which represents a large class of tasks in learning in weight spaces. The impact of this work would greatly increase if the authors include a more detailed discussion on why that is the case, and potential directions to alleviate this limitation.

It is unclear if the proposed method can be used to complement existing mechanistic approaches and result in a performance greater than either of the two components. See question 1.

---

confidence: 4
contribution: 2
initial_rating: 5
presentation: 4
questions: .
soundness: 3
strengths: * The idea of using a deep linear network to obtain implicit regularization while guarding against potential overfitting is nice and original in that context.
* The proposed approach is extremely more efficient compared to methods that learn directly on the weights.
* The paper is written clearly and adequately. The authors empirically justify their design choices every step of the way and show other alternatives (such as learned vs unlearned probs, and the architecture decisions about the generator).
* The ablation study clears several ambiguities that arise while reading the paper, such as using non-linear generators and the importance of the inductive biases introduced into it.
summary: This paper advocates for probing methods to solve tasks on the weight space of NNs. It first shows that naive probing performs as well as SoTA methods that operate directly on the weight space in discriminative tasks. Then, by analyzing the learned probs, the authors suggest an improved mechanism for learning the probs using deep linear networks which adds implicit regularization. The authors demonstrate the merits of their approach compared to baseline methods on two tasks, INR classification and image prediction errors. Several ablations are done to inspect different aspects of the method.
weaknesses: * The authors discussed frankly about the main limitations of their approach, which I agree with. In particular, there are some tasks on which it is not immediately apparent how to use linear probing, such as generative tasks. It may be valuable if the authors could come up with possible remedies for that, but I understand if they don't since it is beyond the scope of this work and maybe non-trivial.

* Experiments:
  * Section 5.2 demonstrates the importance of deep linear classifiers compared to non-linear ones. The main issue, as I understand it, is overfitting. But, I wonder why didn't you try explicit regularization schemes to benefit from a more expressive network? I believe that an experiment of that flavor is missing.
  * Given the main advantage of this approach (i.e., agnostic to symmetries and fast) and given its limited applicability, I believe the submission can be made much stronger by evaluating ProbeGen on complex data, and on bigger networks. Both are limitations of current models that operate on the weights directly. For instance, INR classification or generalization error of images from ImageNet.
  * Related to my previous comment - I can see why on MNIST and even CIFAR small number of probs is sufficient to get good results. However, I speculate that it will not be the case for more challenging datasets (e.g., ImageNet or datasets of fine-grained classification such as CUB). Perhaps additional experiments can clarify that ambiguity.
  * Exact experimental details are missing to reproduce the results, e.g., what optimizers were used? Did you apply regularization? What is the architecture of the classifier? Also, it is not clear whether data augmentation was used for baseline methods (as it tends to improve the results).

* Some parts of the submission can be improved. Specifically, 
  * There should be some background on INRs and the tasks involving them.
  * It is not clear how exactly Kendall’s $\tau$ was used to evaluate the generalization error.
  * It is not clear how exactly to run the code in the submission (there are no explanations about how to obtain the data, some files seem to be missing, etc.)

---

confidence: 4
contribution: 2
initial_rating: 5
presentation: 3
questions: - Have you tried comparing to using real images from the training dataset (for example, CIFAR10 images) as probes?
- It is not clear if you also used Conv layers for the INR tasks. If so, why does this make sense?
soundness: 2
strengths: - The paper is well-structured and easy to follow.
- The method is well motivated through a set of empirical observations.
- The proposed approach is simple yet effective.
summary: The paper considers the problem of weight space learning, in which a learner is tasked with predicting the properties (e.g., accuracy) of an input (trained) neural net. The paper makes the distinction between two approaches for weight space learning: (1) Mechanistic approaches, which operate on the input weights (without running the model), and (2) Probing approaches, which represent models by their responses to a set of inputs. The paper champions probing approaches and proposes a simple yet effective approach in which the probes (model inputs) are learned using a deep linear generator. On a set of small-scale benchmarks, the authors show the proposed method outperforms both probe-based and mechanistic baselines, with improved computational efficiency.
weaknesses: My main concern lies with the experimental setup, which is limited to small-scale datasets and includes only two baselines. In addition, all experiments are performed on images with no additional modalities. This restricts the generalizability of the findings. I would expect a broader and more diverse set of experiments (in terms of scale and modalities) from a purely empirical paper. Please consider adding additional experiments with larger models, higher-dimensional inputs, or different modalities.

Additional limitations:
1. The approach is not applicable for an important and large set of weight space tasks, namely weights-to-weights tasks, e.g., INR editing, domain adaptation, sparsification, etc.
1. The provided empirical evaluation is limited to fairly low-dimensional input spaces. I assume probing approaches will be more efficient in low-dim spaces, so it will be beneficial to provide results for more challenging setups with higher-dimensional input spaces (e.g., point clouds) or input spaces with more challenging structures (e.g., graphs).
1. Similarly, results for additional data modalities will be beneficial and will strengthen the empirical soundness.
1. Also, including additional baselines like [1, 2] would be beneficial.
1. While the authors analyze the computational cost, showing clear benefits compared to the GNN-based approach, it is not clear that the results will hold for larger models, as the approach requires forward and backward steps through the models.
1. The Appendix is completely missing, along with additional important information regarding implementation details, experimental setup, HPs, etc.

References:

[1] Kalogeropoulos et al. "Scale Equivariant Graph Metanetworks," NeurIPS 2024.

[2] Schürholt et al. "Towards Scalable and Versatile Weight Space Learning." ICML 2024.

Meta-review: The paper proposes deep linear probe generators, so that to use probing as an alternative and perhaps more intuitive and better scaleable way of modelling the weight space of neural networks (with applications to predicting generalization error, comparing architectures etc). All reviewers are positive about the value of the paper, both in terms of novelty and comparisons. There are some concerns regarding whether the comparisons are made on sufficiently big datasets, and generally if the method can generalize to more complex datasets and tasks, but they all agree on the value.

Decision: Accept (Poster)