Influence Estimation for Generative Adversarial Networks
Authors: Naoyuki Terashita
Hiroki Ohashi
Yuichi Nonaka
Takashi Kanemaru
Venue: ICLR 2021 Spotlight (2021)
Keywords: influence
generative adversarial networks
data cleansing

Abstract: Identifying harmful instances, whose absence in a training dataset improves model performance, is important for building better machine learning models. 
Although previous studies have succeeded in estimating harmful instances under supervised settings, they cannot be trivially extended to generative adversarial networks (GANs).
This is because previous approaches require that (i) the absence of a training instance directly affects the loss value and that (ii) the change in the loss directly measures the harmfulness of the instance for the performance of a model. 
In GAN training, however, neither of the requirements is satisfied. 
This is because, (i) the generator’s loss is not directly affected by the training instances as they are not part of the generator's training steps, and (ii) the values of GAN's losses normally do not capture the generative performance of a model.
To this end, (i) we propose an influence estimation method that uses the Jacobian of the gradient of the generator's loss with respect to the discriminator’s parameters (and vice versa) to trace how the absence of an instance in the discriminator’s training affects the generator’s parameters, and (ii) we propose a novel evaluation scheme, in which we assess harmfulness of each training instance on the basis of how GAN evaluation metric (e.g., inception score) is expected to change due to the removal of the instance.
We experimentally verified that our influence estimation method correctly inferred the changes in GAN evaluation metrics.
We also demonstrated that the removal of the identified harmful instances effectively improved the model’s generative performance with respect to various GAN evaluation metrics.

Published as a conference paper at ICLR 2021
INFLUENCE ESTIMATION FOR GENERATIVE ADVER- SARIAL NETWORKS
Naoyuki Terashita
Hiroki Ohashi
Yuichi Nonaka
Takashi Kanemaru
Hitachi, Ltd. Tokyo, Japan
ABSTRACT
Identifying harmful instances, whose absence in a training dataset improves model performance, is important for building better machine learning models. Although previous studies have succeeded in estimating harmful instances under super- vised settings, they cannot be trivially extended to generative adversarial networks (GANs). This is because previous approaches require that (i) the absence of a training instance directly affects the loss value and that (ii) the change in the loss directly measures the harmfulness of the instance for the performance of model. In GAN training, however, neither of the requirements satisfied. This is because, (i) the generator's 's loss is not directly affected by the training instances as they are not part of the generator's training steps, and (ii) the values of GAN's losses nor- mally do not capture the generative performance of model. To this end, (i) we propose an influence estimation method that uses the Jacobian the gradient the generator's 's loss with respect to the discriminator's parameters (and vice versa) to trace how the absence of an instance in the discriminator's 's training affects the generator's 's parameters, and (ii) propose novel evaluation scheme, in which we assess harmfulness of each training instance on the basis of how GAN eval- uation metric (e.g.. inception score) is expected change due the removal of the instance. We experimentally verified that our influence estimation method cor- rectly inferred the changes in GAN evaluation metrics. We also demonstrated that the removal of the identified harmful instances effectively improved the model's s generative performance with respect to various GAN evaluation metrics.
INTRODUCTION
Generative adversarial networks (GANs) proposed by Goodfellow et al. (2014) are a powerful sub- class of generative model, which is successfully applied to number of image generation tasks (Antoniou et al., 2017] Ledig et al.] 2017 Wu et al., 2016). The expansion of the applications of GANs makes improvements in the generative performance of models increasingly crucial.
An effective approach for improving machine learning models to identify training instances that harm the model performance. Traditionally, statisticians manually screen dataset for harmful in- stances, which misguide model into producing biased predictions. Recent influence estimation methods (Khanna et al. 2019, Hara et 2019) automated the screening of datasets for deep learn- ing settings, in which the sizes of both datasets and data dimensions are too large for users to man- ually determine the harmful instances. Influence estimation measures the effect of removing an individual training instance on model's prediction without the computationally prohibitive cost of model retraining. The recent studies identified harmful instances by estimating how the loss value changes if each training instance is removed from the dataset.
Although previous studies have succeeded identifying the harmful instances supervised set- tings, the extension of their approaches GAN is non-trivial. Previous approaches require that (i) the existence or absence of a training instance directly affects a loss value, and that (ii) the decrease in the loss value represents the harmfulness of the removed training instance. In GAN training, however, neither of the requirements is satisfied. (i) As training instances are only fed into the dis- criminator, they only indirectly affect the generator's loss, and (ii) the changes in the losses of GAN

---

Published as a conference paper at ICLR 2021
do not necessarily capture how the removed instances harm the generative performance. This is because the ability of the loss to evaluate the generator is highly dependent on the performance of the discriminator.
To this end, (i) we propose an influence estimation method that uses the Jacobian the gradient of the discriminator's loss with respect to the generator's parameters (and vice versa), which traces how the absence of an instance the discriminator's ' training affects the generator's 's parameters. In addition, (ii) propose a novel evaluation scheme judge if an instance is harmful or on the basis of influence on GAN evaluation metric, that is, how a GAN evaluation metric (e.g., inception score (Salimans et al. 2016)) changes if given training instance is removed from the dataset. We identify harmful instances by estimating the influence on GAN evaluation metric by leveraging our influence estimation method.
We verified that the proposed influence estimation method correctly estimated the influence on GAN evaluation metrics across different settings of the dataset, model architecture, and GAN evaluation metrics. We also demonstrated that removing harmful instances, which were identified by the pro- posed method, effectively improved various GAN evaluation metries
Our contributions are summarized as follows:
We propose an influence estimation method that uses the Jacobian of the gradient of the dis- criminator's 's loss with respect to the generator's 's parameters (and vice versa), which traces how the absence of an instance the discriminator's 's training affects the generator's pa- rameters.
We propose novel evaluation scheme to judge if an instance is harmful not on the basis of influence on GAN evaluation metries rather than that on the loss value, and leverage the proposed influence estimation method to identify harmful instances.
We experimentally verified that our influence estimation method correctly inferred the in- fluence on GAN evaluation metrics. Further, we demonstrated that the removal of the harmful instances suggested by the proposed method effectively improved the generative performance with respect to various GAN evaluation metrics.
PRELIMINARIES
Notation For column vectors a, b RR, denote the inner product by (a. -i a;b;- For a function ʃ (a). we denote its gradient with respect to a by (a) We denote the identity matrix of size p by Ip. the vector of length p by Op, and the ones vector of length p by 1p-
Generative Adversarial Networks (GAN) For simplicity, we consider an unconditional GAN that consists the generator G Rd= - Rd and the discriminator D Rd R, where d₂ and da are the number of dimensions of latent variable z ~ p(z) and data point p(x), respectively. The parameters of generator 0G E RRdc and discriminator 0n E Rdo are learned though the adversarial training; G tries to sample realistic data while D tries to identify whether the data is real or generated.
Formulation of GAN Objectives For the generality, we adopt the formulation of Gidel et al. (2019) in which G and D try to minimize La and LD. respectively, to obtain the following Nash equilibrium (0% 0;):
0 arggmin La (0g, 0%) and 0 E arg min Lp (0', 0n). dG
(1)
For the latter part of this paper, we use a coupled parameter vector = (0c, 0p) E ddo when we refer to the whole parameters of GAN.
In this paper, we assume that LG and Lp have the following forms
La (0) Ezmp(=) [fa (2; 0)], LD (0) = Ez-p(x)
[ (z: 0) Empp(a))
[sb (x:; 0) (2)
"Code athttss: / / thub. com wetom/hhaachiii tachi-rd-
uefceuuneeeeeee mat on- for For-gans
2This covers the common settings of GAN objectives: the non-zero-sum game proposed by Goodfellow
2014), Wasserstein distance (Arjovsky et al. 2017), and the least squares loss (Mao al. 2017
2

---

Published as a conference paper at ICLR 2021
We can recover the original minimax objective by taking fo (2 llog (1 Den (Goa (2))),
J = -fc. and s/5 (a; 0) = log Dæp (x).
Adversarial SGD (ASGD) To make our derivation easier to understand, we newly formulate the parameter update of a GAN trained by stochastic gradient descent, which we call adversarial SGD (ASGD). For simplicity, this paper considers simultancous training, in which the generator and the discriminator are simultaneously updated at a single step. We denote the dataset by D2 := {a,, ~ p(x=) ) which consists of N data points. Let S, C (1....,,M) N) be set of sample indices the 1-th step. We assume that the mini-batch of the t-th step consists of instances {æ.)ies, and a
set of latent variables 2, = {2] ~ |()) which are sampled independently at each step t. We denote the mean of La and LD across the mini-batch by Zz( 0) == [ Ezez fa (z; 0)
and L D(S, = ž (Exez 1 (z; + Eies 5/o (z,; 0)). respectively. The t-th step of ASGD updates the coupled parameters by g[++1] = Ø(t) - Big (Si, 2;; 01.),, where
B,
11
(1)
Ide
Rd IR+ are the learning rates of the I-th step for 0cr and Op, respectively.
E Rdo
Vo - (2:0) (8, Vo, D) )
(3)
TiD Ido
16 NG
[t] RR and ViD
3 PROPOSED METHOD
This section explains the two main contributions of our paper: the influence estimation method for GANs that predicts how the removal of training instance changes the output of the generator and the discriminator (Section 3.I and two important parts of our instance evaluation scheme, that are, the definition of influence on GAN evaluation metric and its estimation algorithm (Section 3.2)
3.1 INFLUENCE ESTIMATION FOR GAN
We refer to influence estimation as the estimation of changes in model's output under training instance's 's absence. As the model's output changes through the changes in the model's parameters, start with the definition of then formulate its estimator.
which represents the changes in parameters, and
ASGD-Influence ASGD-Influene is defined on the basis of the following counterfactual ASGD. Let glt) denote the parameters at 1-th step trained without using j-th training instance. Counter- factual ASGD starts optimization from of -j = س and updates the parameters of the t-th step by gt++1| _ Big (s, \ (i), Z,; e. We define ASSGD-Inluenee A as the parameter differ- ence between counterfactual ASGD and ASGD at the final step t = T. namely A : 077 - [T)
Estimator of ASGD-Influence Our estimator uses an approximation of the mean of the gradi- ent. Let Vo Vo,, DD, 2; 0)) be the joint gradient vector of the mini-batch. We introduce the Jacobian of the joint gradient vector of the t-th mini-batch with respect to A:
14
J!ll
V2 La [z Øld) Vo Von L, (S,, Z, 011)
VeD Vo L (Z; 0l:1) Ve L D (S,, Z,; 01)
J3 =
GG
GD
=
0G
(4)
DG
When we assume both (l) and La(() are second-orde differentiable with respect to 0, the first-order Taylor approximation gives g SS, Z, ( -g (S., Z, o!!) J. (o9) old) With this approximation, we have
[++1] ol++1] (0 0.01 B: (g Sc, Zr; 0 9 (S., Z,; 01:))
R (Iáo B.J,) (0 - ol!) .vj $ S..
(5)
3

---

Published as a conference paper at ICLR 2021
For simplicity, we first focus 1-epoch ASGD in which each instance appears only once. Let a (j) be the step where the j-th instance used. Considering the absence of p/n) (a:; (l())) in the r(j)-th step of counterfactual ASGD, we have 0 - g
No,fD
(+60)
(Odgr Von L (zy; pbu
By denoting Ze Ide B,J and recursively applying
the approximation
we obtain
"D [()
[m(s)
Oda Z7 2T- Zo(i+11 (Vep (æy; ( o
A
(6)
For the practical situation of K-epoch ASGD, in which the j-th instance is sampled K times at t = m1 (j),
TK (j), the estimator of the
is given by
T-
[+,
TD
Odo (ay; 0 ml)))))
Aθ
ZT-s
[Stuiil
(oon
Rrmm
Linear Influence To estimate the influence outputs, introduce linear influence L (u, 20-;) of a given query vector u E RRdo we take u = Vofa (2;0(T)) the linear influence approximates the influence on the generator's loss L (u) so fc (z: - fc (z; O(T)..
[ T RRda uD T E Ráo) := u T 1 Zi+1- The linear influence of the j-th in-
Let ug
stance approximated by the proposed estimator:
(mx(1)) "D
D (u) = (.,
(u,AA=))
Σ
(ub
(z;;0 T (m): m))))))))))
(8)
R=1 (S.(G))
The estimation algorithm consists of phases; training phase performs K-epoch ASGD) by storing information A +- (St, 1e 'in 0 Z,) and inference phase calculates ( using
Alll, A See Appendix A for the detailed algorithm.
TT-I,
3.2 INFLUENCE ON GAN EVALUATION METRIC
This section explains our proposal of new evaluation approach for data screening for GANs. Firstly we propose to evaluate harmfulness of an instance on the basis of influence on GAN evaluation metrics. Secondly we propose to leverage the influence-estimation algorithm explained in Section 3.1 identify harmful instances with respect the GAN evaluation metrics.
Influence on GAN Evaluation Metric Let (D) be GAN evaluation metric that maps a set of data points 'D == TT.m E Rd M m==1 into scalar value that gives the performance measure of G. Let generated dataset Dc(2; 0G) == [G(z; 0G)l E Z). Using set of latent variables Z = { ~ p(z)) M that is sampled independently from the training, we define the influence on GAN evaluation metric by
Av = V
(2:0%. (D2 - v
(2 (2:06)) (D)
where 0/71 G.-j and 0/ are the generator parameters of counterfactual ASGD and the ASGD of the T-th step, respectively.
Estimation Algorithm In order to build the estimation algorithm of the influence on GAN evalu- ation metric, we focus on an important property of some common evaluation metrics for which the gradient with respect to the element of their input Va.. V(D) is computable. For example, Monte Carlo estimation of inception score has a form of exp( DDT Enn ED (L) @.m) (Ip((y)) where Pa
a distribution of class label drawn by a pretrained classifier. When the classifier is trained using back propaaroo,,,,,n,, Va., V(D) is computable.
4

---

Published as a conference paper at ICLR 2021
Here, we assume (D) is first-order differentiable with respect to T... From the chain rule, we have a gradient of the GAN evaluation metrics with respect to
VoV(Do(Z:0 (< Vea Van V De 2 (2:0
(10)
Odp
Our estimation algorithm performs the inference phase of linear influence taking ( in order obtain the approximation L ( (TV(( Av!?!
RELATED STUDIES
SGD-Inftuence Hara et al. 2019) proposed novel definition of the influence called SGD- Influence and its estimator, which greatly inspired us to propose the influence estimation method for GANs. Suppose a machine learning model with parameters Φ Rd is trained to minimize N the mean of the loss + En=1 L (Xni o) across the training instances XI..... XN- Let the mean of
the loss of the mini-batch ((: Ø) = [S] Lies L(x:: +). They introduced two SGD steps with
learning rate 7/t RR: SGD given by ob 1+1 <b [++1] given by Φ -j Φ 7/e V V S (5) -
T/p V (S:; ( and counterfactual SGD Their estimator of SGD-Influence $ 6!7)
based on the following approximation:
[++1] o [++1]
[Io V S (l::)l)))
(0") .Vj $ S.
(11)
Hara et al. 2019) also identified harmful instances for classification based on linear influence of the cross-entropy loss estimated using validation dataset. Removing the estimated harmful instances with their approach demonstrated improvements in the classification accuracy.
Our approach differs from Hara et al. (2019)'s 's work in two ways. Firstly, our approach uses the Jacobian of the joint gradient vector J, instead of the Hessian of the mean loss V V2 (S,; <lt)). As
long Le LDD Jj is asymmetric and inherently different from the Hessian. Moreover, source
of the asymmetry J! plays an important role in transferring the effect of removal a training instance from the discriminator to the generator. Let 0/. of E Rd and 0/.-, o! Rd be ASGD-Inftuence on AG and On of the t-th step, respectively. The upper blocks of can be rewritten as
e |++1] G.-f e ~ (Ido - Te (&G) (06,-, o. + GG GD (o)._
-
[t]
(12)
Note that J on 0g. The Hessian Hara al. (2019), which loss function, cannot handle this transfer between the two models. Secondly, we use the influence on GAN evaluation metries for identifying harmful instances rather than that on the loss value. This alleviates the problem of the GAN's loss not representing the generative performance.
CD transfers the 1-th step of ASGD-Infflence on On to the next step of ASGDD-Inflence single combination of the parameters and the
Inffuence Function Koh & Liang (2017) proposed influence estimation method that incorporated the idea of influence function (Cook & Weisberg 1980) in robust statistics. They showed that influences on parameters and predictions can be estimated with the influence function assuming the satisfaction of the optimality condition and strong convexity of the loss function. They also identified harmful instances on the basis of the influence on the loss value, assuming consistency of the loss value with the task performance.
Our influence estimation method is designed to eliminate these assumptions because normally GAN training does not satisfy the assumptions regarding the optimality condition, the convexity in the loss function, and the consistency of the loss value with the performance.
EXPERIMENTS
We evaluated the effectiveness of the proposed method in two aspects: the accuracy of influence timation on GAN evaluation metrics (Section 5.1), and the improvement in generative performance by removing estimated harmful instances (Section 5.2)
5

---

Published as a conference paper at ICLR 2021
GAN Evaluation Metries In both experiments, used three GAN evaluation metrics: aver- age log- ligeeeili (ALL), inception score (IS), and Fréchet inception distance (FID) (Heusel et al. 2017). ALL is the de-facto standard for evaluating generative models (Tolstikhin et al. (017). Let Z': (2/
) and D'2 == {ar, ) which is sampled separately from p(z) and the training dataset Da. respectively. ALL measures the likelihood of the true data under the distri- bution that is estimated from generated data using kernel density estimation. We calculated ALL of
D22 under the distribution estimated from generated dataset D 22 ). Recall 2' is the set of la- tent variables sampled independently from the training (Section 3.2) FID measures Fréchet distance
between two sets of feature vectors of real images D'r and those of generated images Dc(Z'; O)). The feature vectors are calculated the basis of pre-trained classifier. Larger values of ALL and IS and a smaller value of FID indicate the better generative performance. See Appendix C.1 for the detailed setting of each GAN evaluation metric.
5.1 EXPERIMENT 1: ESTIMATION ACCURACY
We ran the influence estimation method on GANs to estimate influence on various GAN evaluation metrics, and then compared the estimated influence with true influence. The detailed setup can be found in Appendix
Setup ALL is known to be effective for low-dimensional data distributions (Borji 2019) and both FID and IS are effective for image distributions. We thus prepared two different setups: fully- connected GAN (FCGAN) trained with 2D multivariate normal distribution (2D-Normal) for ALL, and DCGAN (Radford al., 2016) trained with MNIST (LeCun et al.) 1998) for IS and FID. and FII) require classifiers to obtain class label distribution and feature vectors, respectively. We thus trained CNN classifier of MNIST Jusing D' We set N = 10k and N' ID', 2"| 10k.
The experiment was conducted as follows. Firstly, we ran the K K-epoch of the training phase of since we observed the con-
linear influence with the training dataset Da.. We determined vergence of GAN evaluation metrics at K = 50. For IS and FID, we trained the classifier using D' and corresponding labels. We then randomly selected 200 target instances from Dz- We obtained estimated influence on GAN evaluation metrics of each target instance by performing the inference phase of linear influence with u = VDV 0")0)))) The true influence of each target instance was computed by running the counterfactual ASGD.
We used the same evaluation measures as the previous work (Hara al., 2019): Kendall's Tau and the Jaccard index. Kendall's Tau measures the ordinal correlation between the estimated and true influence on GAN evaluation metrics. It has a value identical. For the Jaccard index, we selected 10 instances with the largest positive and largest negative influence values to construct a set of 20 critical instances. The Jaccard index equal to when a estimated critical instances is identical to that of true critical instances.
when the orders of the two sets of values
To investigate the relationship between a number of tracing back steps and the estimation accuracy, also evaluated the influence on GAN evaluation metries of k-epoch ASGD. In k-epoch training. both inference phase of linear influence and the counterfactual ASGD traced back only k < K epochs from the latest epoch K. We varied 1. 5, 10, 20, 50 and ran the experiment ten times for each & by changing the random seeds of the experiments.
Results Figure D shows the average Kendal's Tau and the Jaccard index of the repeated experi- ments. Hereinafter, we use p < .05 to judge the statistical significance of the results. For all k Kendall's Tau and the Jaccard index of estimated influence on ALL were statistically significantly better than the result in which the order of estimated influence values were random (random case). Even in the more difficult setups of IS and FID, which handled the high-dimensional dataset and complex architecture, the results were statistically significantly better than that of the random case except for Jaccard index of IS with &o 50. We also observed the estimation accuracy dropped as k increased. This reflects the nature of our estimator that recursively performs linear approximation
3 AAthooggh the original IS and FID use Inception Net SZegedy et al. 2016 trained with ImageNet, we instead adopted domain-specific classifier encouraged by several studies (Zhou et al. 2018 [au et al. 2018) to alleviate the domain mismatch with ImageNet.

---

Published as a conference paper at ICLR 2021
Influence Influence IS
Influence FID
Random
1.0
0.0
0.8
Jacrard lndaadindox Index
Kencalls
0.4
0.0
0.2
022
10
30
40
50
10
20
40
50
ofttaining back epochs &
of trading back epochs
Figure 1: Average Kendall's Tau (+sld) (left) and the Jaccard index (+std) (right) calculated from true and estimated influence on ALL, IS, and FID.
as many times as the number steps. We thus conclude that when the required number of tracing back steps is small enough, influence estimation method is effective and the estimated influence on GAN evaluation metric is useful for identifying harmful instances.
5.2 EXPERIMENT DATA CLEANSING
We investigated if removing identified harmful instances actually improved the generative perfor- mance to evaluate the effectiveness of our proposed method for data cleansing. We define data cleansing as attempt improve GAN evaluation metrics by removing set of training instances. See appendix C.3 for the detailed settings.
Setup We studied the data cleansing for the two setups explained in the previous section: 2D- Normal with FCGAN and MNIST with DCGAN. We mostly followed the settings of Section 5.1 but set training dataset size = 50k for both setups.
We identified harmful instances in 2D-Normal training dataset using estimated influence ALL, and those in MNIST using estimated influence on IS and FID. We considered a training instance was harmful when it had negative (positive) influence FID (ALL IS).
For both setups, we also selected instances using baseline approaches: anomaly detection method, influence the discriminator loss, and random values. For anomaly detection, we adopted isolation forest (Liu et al. 2008). Isolation forest fitted the model using the data points of Dr for 2D-Normal and feature vectors of the classifier of Dr for MNIST. We adopted the selection based on the in- fluence on the discriminator loss to verify our assumption that the influence on the loss does not represent the harmfulness of the instances. Influence on the discriminator loss was calculated on the expected loss of Lp (0) with Dz(Z'; o(!l) and D' We considered instances with negative influence were harmful.
We conducted the experiments follows. After the training phase of K epoch, we determined n4 N harmful instances with the proposed approach and basclines. Then, we ran counterfactual ASGD with the determined harmful instances excluded. For the reliable estimation accuracy of influence and reasonable costs of the computation and storage, the inference phase traced back only leeooch from the last epoch, and counterfactual ASGD only re-ran the latest epoch. We tested with various T2g-
We refer to the generator of the final model as the cleansed generator and denote its parameters by 0g We evaluated cleansed generator with test GAN evaluation metrics VDD ); 02)), )), in which set of test latent variables Ztest obtained by sampling Niest times from p(z) indepen- [x] dently from Z' and Z,...., ZT. Test ALL and FID used test dataset Drest == {areest ~ p(x)) Newr that consists of instances newly sampled from 2D- Do-omall and instances in the original test dataset of MNIST, respectively. We set Niest = 10k and ran the experiment 15 times with different random seeds.

---

Published as a conference paper at ICLR 2021
Average Log Likeilhood
Influence on ALL (Ours)
Influence on IS (Ours)
-2877
Influence on FID (Ours)
Isolation Forest
-2.87
Influence on Disc. Loss
-2.88
Random
No Removal
-2.88
10a
# of instances removed mb.
(a)
5.95
2.20
Frechet Inception Distance
2.10
Inception Score
5.85
2.00
1,90
1.80
5.75
1.70
1.60
5.65
1.50
10'
10c
107
10"
of instances removed On
Instances removed Pb
(b)
(c)
Figure 2: Average test ALL (a). IS (b), and FID (c) after the data cleansing. Larger values in (a) and (b), smaller value in (c) indicate the better generative performance. Error bars and plots of too large or small values are omitted for better visibility. See Appendix C.3 for full results.
Quantitative Results Figure shows the average test GAN evaluation metrics of the repeated ex- periments for each selection approach. For the data cleansing 2D-Normal, the proposed approach with influence on ALL showed statistically significant improvement from the original model and outperformed the baselines (Figure 2a). For the MNIST setup, our approach with influence on FID and IS statistically significantly improved FID (Figure 2c) and IS (Figure 2b). respectively. They also outperformed the baselines. In addition, the results indicate that data cleansing based on the influence on specific GAN evaluation metric is also effective for another metric that is not used for the selection; removing harmful instances based on the influence on FID (IS) statistically signifi- cantly improved IS (FID). However, we make no claim that the proposed method can improve all the other evaluation metries, such as Kullback-Leible divergence. This is because all the current GAN evaluation metrics have their into one bad mode (Zhou et al. 2018)), and the proposed method based on those GAN evaluation metrics cannot inherently avoid their weaknesses. These improvements thus be observed only in a subclass GAN evaluation metrics. Further evaluation data cleansing with our method should incorporate the future improvements of the GAN evaluation metrics.
weaknesses (e.g.. IS fails to detect whether model is trapped
While the improvements were smaller than the proposed approach, we also observed that data cleansing based on the influence the discriminator loss improved all the GAN evaluation metrics. This counter-intuitivy result indicates that the discriminator loss weakly measures the performance of the generator that trained along with the discriminator.
Qualitative Results We examined the characteristics instances that were evaluated to harm- ful by our method. Overall, we observed that our method tends to judge instances as harmful when they belong to regions from which the generators sample too frequently compared to the true dis- tribution. Figure 3 shows the estimated harmfulness of the training instances of 2D-Normal and the distribution of the generated samples. The proposed approach with influence on ALL evaluated the instances around lower-left and upper-right regions to be harmful (Figure B4). These regions correspond to the regions where the generated distribution has higher density than that of the true distribution (Figure "No removal" and "True"). Similar characteristies were in harmful
8

---

Published as a conference paper at ICLR 2021
20
30
40
50
Ranking of predicted harmful (k (lower are more harmfal)
8
True
-2-
No removal
(a) Harmful instances
(b) Generated distribution
Figure 3: Harmfulness of 2D-Normal instances suggested using influence on ALL (a) and changes
in the generator's distribution (b). (b) includes plots of the true distribution (True) and generator's distributions before (No removal) and after (Cleansed) the data cleansing with n, 5.0k.
/
5
0
J
6
9
9
4
2
0
9
1
9
4
2
0
1
7
4
0
1
4
2
3
1 9 1 9 1 4
2 7 1 /
3
4
7
5
2
?
6
/
/
1 4 0 8
8 0 9
8
3
B
T
8
3
8 1
9 1 3
7 9 1 4
/
b
7 1 /
D
1
1 4
0
0
1
1
4
1
1
1
4
L
/
0
2
P
9
4
5
8
9
7
4
(a) Harmful
(b) No removal
(c) Cleansed
Figure 4: Top 36 harmful MNIST instances predicted on the basis of influence on FID (a), and the test generated samples before (b) and after (c) the data cleansing with ni 25.0k. (a) and (b) use the same series of test latent variables in Ztest-
MNIST instances suggested by our approach with influence on FID. large number of samples from class were regarded as harmful as shown in Figure 4h, when the generator sampled images of the digit too frequently (Figure(p))
We also investigated how the data cleansing by our approach visually changed the generated sam- ples. As seen from the distributions decreased after the data cleansing (from "No removal" to "Cleansed"). As result, the generator distribution moved closer to true distribution. The same effect was observed in a visually more interesting form in the data cleansing for MNIST. The generated samples originating from some latent variables changed from the image of digit to that of other digits after the data eleansing based the estimated influence FID (highlighted samples in Figure 4p). We suppose this effect improved the diversity in the generated samples, resulting in better FID and IS.
Figure3p. the probability density in the upper-right region
CONCLUSION
We proposed an influence estimation method for GAN that uses the Jacobian of the gradient of the diseriminator's loss with respect the generator's parameters (and vice versa), which traces how the absence of an instance in the discriminator's training affects the generator's parameters. We also proposed a novel evaluation scheme to judge an instance is harmful or not on the basis of the influence GAN evaluation metrics rather than that on the loss value, and to leverage the proposed influence estimation method to identify harmful instances. We experimentally verified that estimated and true influence GAN evaluation metrics had statistically significant correlation. We also demonstrated removing identified harmful instances effectively improved the generative performance with respect to various GAN evaluation metrics.

---

Published as a conference paper at ICLR 2021
REFERENCES
Antreas Antoniou, Amos Storkey, and Harrison Edwards. Data augmentation generative ad adversarial networks. arXiv preprint arXiv: 17Xiv:1711.04444 2017.
Martin Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein generative adversarial networks.
In Proceedings of the 34th International Conference on Machine Cearning-Volume 70, pp. 214- 223, 2017.
Jimmy Lei Ba, Jamie Ryan Kiros, and Geoffrey E Hinton. Layer normalization. arXiv preprint 167.v:1607.064500 2016.
Ashish Bora, Eric Price, and Alexandros G. Dimakis. AmbientGAN: Generative models from lossy measurements. In International Conference on Learning Representations, 2018.
Ali Borji. Pros and cons of gan evaluation measures. Computer Vision and Image Understanding, 179:41-63 2019.
Markus M Breunig, Hans-Peter Kriegel, Raymond T Ng. and Jörg Sander. Lof: identifying density- based local outliers. In Proceedings of the 2000 ACM SIGMOD international conference on Management of data, pp. 93-104, 2000.
Dennis Cook and Sanford Weisberg. Characterizations of an empirical influence function for detecting influential cases in regression. Technometrics, 22(4):495-508 1980.
Gauthier Gidel, Hugo Berard, Gaëtan Vignoud, Pascal Vincent, and Simon Lacoste-Julien. A varia- tional inequality perspective on generative adversarial networks. In International Conference on Learning Representations, 2019.
Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in neural information processing systems, 27:2672-2680, 2014.
Satoshi Hara, Atsushi Nitanda, and Takanori Maehara. Data cleansing for models trained with sgd. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Buc, E. Fox, and R. Garnett (eds.), Advances in Neural Information Processing Systems, volume 32. Curran Associates. Inc., 2019.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by two time-scale update rule converge local nash equilibrium. In Advances in neural information processing systems, pp. 6626-6637, 2017.
Peter Huber. Robust statistics. volume 523. John Wiley & Sons, 2004.
Takuhiro Kaneko and Tatsuya Harada. Noise robust generative adversarial networks. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1404-84144 2020.
Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila, Analyz- ing and improving the image quality of stylegan. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pp. 81 8110-8199 2020.
Rajiv Khanna, Been Kim, Joydeep Ghosh, and Sanmi Koyejo. Interpreting black box predictions using fisher kernels. In The 22nd International Conference on Artificial Intelligence and Statistics, pp. 3382-3390. PMLR, 2019.
Diederik Kingma and Jimmy Ba. Adam: method for stochastic optimization. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Representations, ICLR 2015, San Diego CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015.
Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions. In International Conference on Machine Learning, pp. 1885-1894, PMLR, 2017.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEFF, 86(1 1):2788-2324, 1998.
10

---

Published as a conference paper at ICLR 2021
Christian Ledig, Lucas Theis, Ferenc Huszar, Jose Caballero, Andrew Cunningham, Alejandro Acosta, Andrew Aitken, Alykhan Tejani, Johannes Totz, Zehan Wang, and Wenzhe Shi. Photo- realistic single image super-resolution using generative adversarial network. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), July 2017.
Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isolation forest. In 2008 Eighth IEEE Interna- tional Conference on Data Mining. pp. 413-422. IEEE, 2008.
Shaohui Liu, Yi Wei, Jiwen Lu, and Jie Zhou. An improved evaluation framework for generative adversarial networks. arXiv preprint arXiv: 2018.
Xudong Mao, Qing Li, Haoran Xie, Raymond YK Lau, Zhen Wang, and Stephen Paul Smolley. Least squares generative adversarial networks. In Proceedings of the IEEE international confer- on computer vision, pp. 2794-2802, 2017.
Alec Radford. Luke Metz, and Soumith Chintala. Unsupervised representation learning with deep convolutional generative adversarial networks. In Yoshua Bengio and Yann LeCun (eds.), 4th International Conference on Learning Representations, ICLR 2016, San Juan, Puerto Rico, May 2-4, 2016, Conference Track Proceedings, 2016.
Tim Salimans, Ian Goodfellow, Wojeiech Zaremba, Vicki Cheung, Alec Radford, Xi Chen, and Xi Chen. Improved techniques for training gans. D. D. Lee, M. Sugiyama, U. V. Luxburg, I. Guyon, and R. Garnett (eds.), Advances in Neural Information Processing Systems 29, pp- Curran Associates, Inc., 2016.
Bernhard Schölkopf, John C Platt, John -aylor,aylor, Alex J Smola, and Robert C Williamson. Estimating the support of high-dimensional distribution. Neural computation, 1377):14431141, 2001.
C. Szegedy, V. Vanhoucke, S. loffe, J. Shlens, and 7. Wojna. Rethinking the inception architecture for computer vision. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 2818-2826 2016.
Ilya O Tolstikhin, Sylvain Gelly, Olivier Bousquet, Carl-Johann Simon-Gabriel, and Bernhard Schölkopf. Adagan: Boosting generative models. In Advances in Neural Information Processing Systems, pp. 5424-5433, 2017.
Jajun Wu, Chengkai Zhang, Tianfan Xue, Bill Freeman, and Josh Tenenbaum. Learning a prob- abilistic latent space of object shapes via 3d generative-adversarial modeling. In D. D. Lee, Sugiyama, U. Luxburg, Guyon, and R. Garnett (eds.), Advances in Neural Information Processing Systems 29, pp. 82-90. Curran Associates, Inc., 2016.
Zhiming Zhou, Han Cai, Shu Rong. Yuxuan Song, Kan Ren, Weinan Zhang, Jun Wang, and Yong Yu. Activation maximization generative adversarial nets. In International Conference on Learning Representations, 2018.

---

Published as a conference paper at ICLR 2021
Algorithm 1 Training Phase
Algorithm 2 Inference Phase
Initialize the parameter @!!)
Require: u u-(uG E Rdo, uD E Rd
Initialize the sequence null: A <- 0 ,
Initialize the influence: L (u) t 0
for t = 1, ..,,...,. T
do
for t= T- 1--1,77 1, 2, do
// sample latent variables
Z {-] p(=)]
load information
n // 0ld) 3, t Ald)
// store information
A + S,, TG TD 0 Z1
16
update the linear influence of jth instance i E S then
#/ update purameters
01++1| 0l B.y (S,, Zr; 01!)
- (u) +=
Up 1Sal
(UD Von (x,;
end for
end if // update
u u B.J. end for
A ALGORITHM FOR LINEAR INFLUENCE
The proposed estimation algorithm for linear influence, which is explained in Section 3.1 is divided into the training phase (Algorithm D and inference phase (Algorithm 2
The training phase executes ASGD training while storing the mini-batch indices S, the learning rate nia M.. the parameters g and the sampled latent variable Z, into the information A at each step.
In the inference phase, r.1g (u) is estimated by the recursive calculation. First, we set T. (u) to O and set the query vector The information All, which is obtained in the training phase, is read in the order of t T 1,T 1. When j E S,, L [.7)(u) (u) is updated using (8). Let
Each step updates u based on u4+1 u, Z, u. (Iáo B,J.). naive calculation of u, J, requires O (d%) memory to store the matrix J. which can be prohibitive for very large models. We can avoid this difficulty by directly computing u, Jr without the explicit computation of Jr. Because u Jj Ve (ur, (Ve, Ve. we need only to compute the derivative of the inner product of u, and the joint gradient vector.
u, = (
u [8]
Our algorithm also covers the alternating gradient descent, in which the two models alternatively [t] update their parameters each step. By taking V6g and 1/p such that they alternatively take 0 at each step, we can have ASGD and the estimator of ASGD-Influence for the alternating gradient descent. The implementation of linear influence for the alternating gradient descent available in our repository
4
B OTHER RELATED WORKS
Anomaly Detection A typical approach for identifying harmful instances is outlier detection. Out- lier detection is used to remove abnormal instances from the training set before training the model ensure that the model is not affected by the abnormal instances. For tabular data, there are several popular methods, such as One-class support vector machine (Schölkopf et al.] (001). local outlier factor (Breunig et al., (2000), and isolation forest (Liu al. 2008). Although these methods can find abnormal instances, they are not necessarily harmful for the resulting models, as we showed in the experiment.
Training GAN from Noisy Images One typical type of data that harm generative performance is noisy images. AmbientGAN (Bora et al. 2018) and noise-robust GAN (Knneko & Harada 2020)
mat on- for-gans
12

---

Published as conference paper at ICLR 2021
Table 1: Model architecture of CNN classifier of MNIST in Section 5.1 and 5.2
Stage
Operation
Stride
Filter Shape
Bias
Norm.
Activation
Output
0
Input
[28, 28, 1]
1
Conv2D
1
[5, 5]
V
Sigmoid
[25, 25, 8]
2
Conv2D
1
5]
v
Sigmoid
[12. 12, 8]
MaxPooling
2
[2, 2]
Sigmoid
[392]
4
Linear
1
V
Sigmoid
[128]
5
Linear
V
Sigmoid [10]
are learning algorithms that make it possible to train a clean image generator from noisy images. The difference between these studies and ours is that these studies assume that the noise (e.g.. Gaussian noise on pixels) given independently from the data distribution of the clean images is the only problem. However, some instances can affect the performance even if instances are drawn only from the data distribution, which is the case robust statisties (Huber) (0044) typically focuses on. Our experiment 5.2 indicates that the model performance depends not only on noisy images but also on non-negligible number of harmful instances in the original dataset.
C DETAILED EXPERIMENTAL SETTINGS AND RESULTS
C.I GAN EVALUATION METRICS
We adopted Gaussian kernel with the band-width for kernel density estimation used in ALL. The architecture of CNN classifier of MNIST used for IS and FID can be found Table We selected the output of the 4th layer for the feature vectors for FID.
C.2 EXPERIMENT 1: ESTIMATION ACCURACY
Setup In the experiment of Section 5.1 we adopted the hyper parameters shown in Table 2 trained fullly-connected GAN (FCGAN) for 2D multivariate normal distribution, in which the both G and D has hidden layer of lag and ho units, respectively (Table 3 2D-Normal is given by
We
(p, E), in which the mean vector = 12 and the covariance matrix Σ = ((1.0.)) (0.8, 1)) DCGAN consists transposed convolution (or deconvolution) layers and convolution layers (Ta- ble 4. The channels of the both layers in G' and D were determined by he and hp, respectively. We used Layer Normalization (Ba al. 2016) for the layers shown in Table g for the stability of
the training. We also introduced the L.-nnorm regularization with the rate E R+ for all the ker- nels of both FCGAN and DCGAN. We used non-zero-sum game objective the original paper Goodfellow et al. 2014] in which G tries to minimize - DDo (Goe (z)) for both models.
C.3 EXPERIMENT 2: DATA CLEANSING
Setup We adopted the same architecture as the Section 5.1 (Table 3) for FCGAN and slightly different architecture (Table 4 in which he and hn are larger (Table for DCGAN. Other hy- per parameters followed Table 5 We also provide visual explanations of the data settings in the experiments with influence on ALL, IS, and FID in Figure and respectively.
Results Table 8 show the detailed results of Figure 2
And they clarify with which and selection approach the test GAN evaluation metrics were statistically significantly improved.
13

---

Published as a conference paper at ICLR 2021
Table 2: Hyper parameters in Section 5.1
K
11
1p
[t]
N
S,
7
hg
hD
2D-Normal MNIST
50
10
10
10k
10k
100
10
32
64
50
10
10 3
10k
10k
100
10
3
8
8
Table 3: Model Architecture FCGAN Section 5.1 and 5.2
Net.
Stage
Operation
Bias
Activation
Output
0
Input
[10]
G
1
Linear
ReLU
[hc]
G
2
Linear
Tanh
[2]
D
3
Linear
ReLU
[hp]
D
Linear
Sigmoid
[1]
Table 4: Model Architecture of DCGAN in Section 5.1 and 5.2
Net.
Stage
Operation
Stride
Filter Shape
Bias
Norm.
Activation
Output
0
Input
[32]
G
D
[2, 2]
Sigmoid
[2. hal
G
2
Deconv2D
1
[3. 3]
Sigmoid
[4, 4, hal
G
3
Deconv2D
2
[3.
Sigmoid
[9, hel
G
4
Deconv2D
[2.
Sigmoid
[10, 10, hal
G
Deconv2D
[3.3]
Sigmoid
[12, 12, hal
G
6
Deconv2D
2
[3.3]
Sigmoid
[25, 25, hal
G
Deconv2D
[4, 4]
Sigmoid
[28, 28, hal
G
8
Conv2D
[1,
Tanh
[28, 28, 1]
Conv2D
[4.4]
Sigmoid
[25, 25, hpl
D
DODD
10
Conv2D
2
[3.3]
Sigmoid
[12, 12, hpl
11
Conv2D
[3.3]
Sigmoid
[10, 10, hpl
DRDD
12
Conv2D
[2,
Sigmoid
[9, 9, hpl
13
Conv2D
2
[3,3]
Sigmoid
[4, 4, hpl
14
Conv2D
[3.3]
Sigmoid
[2, hpl
15
Conv2D
[2.
Sigmoid
1,
Linear
Sigmoid
[1]
Table 5: Hyper parameters in Section 5.2
K
N
N'
Niest
S,
hg
h
2D-Normal MNIST
70
10-3
10-3
50k
10k
10k
100
10-3
32
64
20
10-3
10-3
10
50k
10k
10k
100
10
32
32
14

---

Published as a conference paper at ICLR 2021
True data distribution p(x) N E)
Dataset for influence estimation D2
Dataset training Dx
Dataset for Drest
ASGD training !
Influence Estimation
! VoV (Do [3 Di)
Evaluate test ALL of the original generator (No removal) (Dr (Zeas:t0? !): Deese)
Influence ALL
Remove top 72 harmful instances
Cleansed training dataset
Counterfactual ASCD training
0
Evaluate test ALL of the cleansed generator (Cleansed) V(D, (Zrest 07)) Drese)
Figure 5: The data setting of data cleansing with the influence on ALL (2D-Normal) in Section 5.2
15

---

Published as a conference paper at ICLR 2021
Original training dataset of 60k
Dataset for training Dx
ASGD training
Influence Estimation
(Fl VoV Do (z': o!
Influence on IS
Remove top The harmful Instances
Cleansed training dataset
Counterfactual ASGD training
Evaluate test of the cleansed generator (Cleansed) (Dr (Zre)t07)))
Evaluate IS of the original generator (No removal) (Dg (Z)es):
Figure 6: The data setting of data cleansing with the influence on IS (MNIST) in Section 5.2
16

---

Published as a conference paper at ICLR 2021
Original training dataset of 60k
Original test dataset of 10k
Dataset for influence estimation
Dataset training Dx
Dataset for test Prest
D
(D2 D3 (b)
ASGD training !
Influence Estimation
! VoV (Do (2) " Di)
Evaluate test FID of the original generator (No removal) (Dr (Zeas:i0? )): Deese)
Influence FID
Remove top 72 harmful instances
Cleansed training dataset
Counterfactual ASCD training
Evaluate test FID of the cleansed generator (Clcansed) V(D, (Zrest 07,)) Drese)
Figure 7: The data setting of data cleansing with the influence on FID (MNIST) in Scction 5.2
17

---

Published as a conference paper at ICLR 2021
Table 6: Improvements test average log-likelihood [10-3] (#std) after the data cleansing (2D-
Normal). The metric value is highlighted when the improvement is statistically significant with the significant level 0.05
0.5k
1.0k
2.5k
5.0k
7.5k
10.0k
12.5k
15.0k
17.5k
20.0k
Influence
+0.09
+0.16
+0.31
+0.44
+0.40
+0.22
-0.10
-0.53
-1.07
-1.67
(0.06)
(0.12)
(0.27)
(0.50)
(0.73)
(0.99)
(1.28)
(1.60)
(1.95)
(2.33)
ALL
Influence
+0.04
+0.11
+0.19
+0.26
+0.32
+0.35
+0.35
+0.30
+0.22
(0.03)
(0.05)
(0.10)
(0.19)
(0.28)
(0.39)
(0.51)
(0.64)
(0.79)
(0.95)
Disc. loss
Isolation
+0.03
+0.05
+0.09
+0.12
+0.12
+0.09
+0.02
-0.09
-0.25
-0,46
Forest
(0.05)
(0.11)
(0.27)
(0.54)
(0.79)
(1.05)
(1.31)
(1.58)
(1.86)
(2.16)
+0.01
+0.02
+0.04
+0.07
+0.08
+0.06
+0.02
-0.05
-0.16
-0.31
Random
(0.04)
(0.08)
(0.19)
(0.39)
(0.61)
(0.83)
(1.07)
(1.34)
(1.61)
(1.91)
Table Improvements of test inception score (+sttd) after the data cleansing (MNIST), The metric value is highlighted when the improvement is statistically significant with the significant level 0.05
41h
0.5k
1.0k
2.5k
5.0k
10.0k
15.0k
20.0k
25.0k
35.0k
45.0k
Influence
+0.03
+0.04
+0.04
+0.03
+0.04
+0.09
+0.10
+0.10
+0.04
-0.18
on FID
(0.07)
(0.09)
(0.17)
(0.25)
(0.24)
(0.13)
(0.12)
(0.13)
(0.17)
(0.28)
Influence
+0.04 (0.05)
+0.04
+0.05
+0.04
+0.08
+0.11
+0.12
+0.14
+0.09
-0.07
(0.08)
(0.14)
(0.23)
(0.15)
(0.13)
(0.14)
(0.14)
(0.25)
(0.24)
IS
Influence on
+0.01
+0.01
+0.02
+0.04
+0.04
+0.04
+0.04
+0.01
+0.00
-0.15
(0.03)
(0.05)
(0.03)
(0.04)
(0.05)
(0.06)
(0.06)
(0.06)
(0.07)
(0.11)
Disc. Loss
Isolation
+0.00
+0.01
+0.01
+0.00
-0.01
-0.05
-0.13
-0.23
-0.67
-1.70
Forest
(0.02)
(0.02)
(0.04)
(0.05)
(0.06)
(0.08)
(0.13)
(0.18)
(0.33)
(0.75)
+0.01
+0.00
+0.00
-0.01
+0.00
+0.00
-0.01
+0.00
-0.02
+0.00
Random
(0.02)
(0.01)
(0.02)
(0.04)
(0.04)
(0.05)
(0.09)
(0.06)
(0.07)
(0.10)
18

---

Published as a conference paper at ICLR 2021
Table 8: Improvements of test FID (#std) after the data cleansing (MNIST). The metric value is
highlighted when the improvement is statistically significant with the significant level 0.05
7hh
0.5k
1.0k
2.5k
5.0k
10.0k
15.0k
20.0k
25.0k
35.0k
45.0k
Influence
-0.10 (0.13)
-0.13
-0.18
-0.19
-0.25
-0.36
-0.38
-0.38
-0.23
+0.23
on FID
(0.18)
(0.28)
(0.46)
(0.45)
(0.35)
(0.36)
(0.37)
(0.46)
(0.60)
Influence
-0.07 (0.10)
-0.10
-0.14
-0.14 (0.37)
-0.26 (0.28)
-0.32
-0.34
-0.36
-0.22
+0.17
(0.14)
(0.22)
(0.29)
(0.30)
(0.30)
(0.45)
(0.49)
Influence on
-0.03
-0.04
-0.07
-0.13
-0.18
-0.20
-0.19
-0.15
-0.06
+0.34
(0.06)
(0.08)
(0.07)
(0.10)
(0.12)
(0.13)
(0.14)
(0.14)
(0.12)
(0.19)
Disc. Loss
Isolation Forest
+0.01
+0.02
+0.05
+0.10
+0.24
+0.42
+0.73
+1.09
+2.56
+6,99
(0.03)
(0.03)
(0.06)
(0.08)
(0.15)
(0.22)
(0.37)
(0.54)
(0.85)
(3.57)
-0.01
-0.01
-0.00
+0.01
+0.00
+0.01
+0.02
-0.01
+0.00
-0.13
Random
(0.04)
(0.02)
(0.04)
(0.06)
(0.07)
(0.08)
(0.16)
(0.09)
(0.13)
(0.18)
D DETAILED DISCUSSION ON EXPERIMENT 2
This section first discusses three aspects of the results in Section 5.2 Section D. explains the com-
mon characteristics of harmful instances suggested by our approach, Section D.2 discusses qual- itative aspects of the data cleansing using generated samples, and Section D.3 discusses how the characteristics of harmful instances and effect of the data cleansing are consistent among the train- ings with different random seeds. Finally, we explain the limitation of our method and present the future direction Section D.4
D.1 CHARACTERISTICS OF HARMFUL. INSTANCE
In this section, we examine the characteristics of instances that are evaluated be harmful or helpful by our method. We regard sample is helpful if its influence on a metric is opposite of harmful instances.
Table the estimated harmfulness of the training instances of 2D-Normal and the distribution of the generated samples. The proposed approach with influence on ALL evaluated the instances around lower-left and upper-right regions to be harmful (Table (a, i)). These regions correspond to the regions where the generated distribution has higher density than that the true distribution; The generator before the cleansing (Table 9 (a, ii, No removal)) sampled too frequently from lower-left and upper-right regions compared to the true distribution (Table / (a, ii, True)). This characteris- ties was not observed the plots of baseline approaches. The approach based on influence on the discriminator loss seems to ignore the difference in the density around the lower-left region (Ta- ble (b. i)) and isolation forest did not take the generator's distribution into account (Table (c. i)).
Similar characteristics were seen in harmful MNIST instances suggested by our approach with in- fluence on IS and FID. When the generator over-sampled specific digit (c.g., the digit in Ta- ble [0 (a, iii)), our approach tended to judge the images of the digit to be harmful (c.g., a large number of in Table 10 (b-c, i)). Similarly, our method judged instances
specific digit as help- ful (e.g., the digit 6 in Table 10 (b-c, ii)) when the generator failed to sample the digit (e.g.. the absence of 6 in Table 10 (a, ii)).. On the contrary, harmful instances suggested on the basis in- fluence on the discriminator loss did not show the tendency (Table O (d. i)). The baseline approach with isolation forest based on the classifier feature-space seems to have judged the images that were difficult to be classified as harmful, rather than the over-sampled digit (Table 10 (e, i)). It regarded that instances are helpful when they belong to a digit that seems to have been easy to be classified (Table 10 (e, ii)).
19

---

Published as a conference paper at ICLR 2021
To summarize, our method tends to judge instances harmful when they belong regions from which the generators sample too frequently compared to the true distribution.
D.2 QUALITATIVE STUDY OF DATA CLEANSING
We then investigate how the data cleansing using the suggested harmful instances visually change generated samples.
As seen from (a, ii), the probability density the upper-right region decreased after the data cleansing (from "No removal" to "Cleansed"). As result, the generator distribution got closer the true distribution. Although the baselines indicated the same direction of changes in the distributions (Table 9 (b-c, ii)), these were not as significant ours.
The same effect was observed in visually more interesting form the data cleansing for MNIST. The generated samples originating from some latent variables changed from the image of digit to that of other digits after the data cleansing based on the estimated influence on IS and FID (highlighted samples in Table 10 (b-c, iii).. This implies that a certain amount of density that over-allocated for the digit moved to the regions of other digits. We assume this effect improved the diversity in the generated samples. resulting in better FID and IS. This characteristies was not clearly observed in the baselines (highlighted samples in Table 10 (d-f, iii)).
These observations suggest that our method helps the GAN's training so that the generator re-assigns the densities that were over-allocated to certain regions to other regions.
D.3 CONSISTENCY OF QUALITATIVE CHARACTERISTICS AMONG DIFFERENT TRAININGS
We show additional visual results to confirm the consistency of the findings on the characteristics of harmful instances and generated samples after data cleansing, which we described in Section D.2 and Section D.3 respectively.
Table 11 shows the harmfulness of the training instances and the distribution of the generated sam- ples obtained using 5 different random seeds in 2D-Normal case. As seen from the table, regardless of which region a generator assigns high density to, our method consistently regards the training samples around the region harmful. In addition, the distributions of the generated samples get closer to the true distribution by removing these harmful training instances in the data cleansing.
Table 12 visualizes the MNIST examples of harmful instances, helpful instances, and generated images before and after the data cleansing. Different rows correspond to different random seeds. We found the consistency in visual characteristics was moderate in MNIST case. A few results demonstrated the common qualitative characteristics when the improvements in GAN evaluation metrics were large (Table 12 (a) and (d)). In the training with the 4th random seed (d), the suggestion of harmful instances showed some tendency; many instances of digit 7 were regarded as harmful whereas those of digit 4 were not all (Table 12 (d, i)). The data cleansing based on this suggestion seems to have improved the diversity of the generated samples by reducing the samples of digit 7 and increasing those of digit 4 (highlighted samples in Table 12 (d. iv)). This indicates the consistent characteristics of the data cleansing discussed in the previous section to some extent; it helps the GAN's training so that the generator re-assigns the densities that were over-allocated certain data regions to other regions.
D.4 CURRENT LIMITATION AND FUTURE DIRECTION
The limitation of our method is that it does not guarantee the harmful instances suggested on the basis of influence on one GAN evaluation metric are not necessarily harmful from the viewpoint of other metrics. For example, we have demonstrated that removing instances that predicted to have negative influence on FID improved both test FID and IS (Figure 2 and increased visual diversity in generated images (Table 10 and 12). However, it does not seem to have improved visual quality Therefore, it is possible that these instances are harmful only for some particular aspects of generative performance, i.e. the diversity in this case, and they are not harmful for the other aspect, i.c. the visual quality in this case.
(e.g.. sharpness, reality, etc.) of the individual senerated-sampler
20

---

Published as a conference paper at ICLR 2021
We would argue that this limitation is closely tied with the limitation of the current GAN evaluation metrics. For example, FID takes the diversity of generated samples into account, but they only partly take the visual quality into account; e.g., FID based on Inception Net was shown to focus textures rather than shapes of the objects (Karras et al. (2020). In this sense, we clarify that we never claim method can improve the "true" generative performance from all the aspects, considering the situation that there is no "true" evaluation metric that measures all the aspects of the generative performance.
The advantage of our method is that it does not have to care how the evaluation metrics are defined as long they are differentiable with respect to the generated samples. Furthermore, our evaluation method makes no assumption about what the harmful characteristies of instances are. This means that expected
easily applied to another evaluation metric if better metric is developed in the future. One of our main contributions in such sense is that experimentally verified that our method successfully improved the generative performance terms of targeted metric, using limited but currently widely accepted metrics.
Our future work includes incorporating such future improvements in the GAN evaluation metric to obtain better insights on the relationship between training instances and generative performance. In addition, we would like to relax the current constraint on the optimizer. Our method currently applicable only to SGD but would like to find way to extend it to other optimizers such as Adam (Kingma & Ba (015)) to deal with the latest GAN models.
21

---

Published as a conference paper at ICLR 2021
Table (i) harmfulness of 2D-Normal instances suggested by different approaches, (ii) changes in the generator's s distribution, and (iii) test AL.. after the data cleansing. (ii) includes plots of the true distribution (True) and generator's distributions before (No removal) and after (Cleansed) the data (
cleansing with 5.0k. The distributions of generated samples, that refer to Do Ztest; 0 (No removal) and De (Zesst 0g) (Cleansed), are estimated with kernel density estimation.
(i) Harmful instances
(ii) Generated distribution
(iii) ALL
50
No removal
Renking predicted hermful
Cleensed
(lower
4-
Influence on ALL (Ours)
2
2-
(a)
+1.24
-2-
Influence on Disc. Loss
2
2-
(b)
+0.67
-2-
x1
4-
4-
(c) Isolation Forest
+0.73
0-
-2
6
(d) Random
2
2-
x2
+0.43
-2-
-2-
22

---

Published as a conference paper at ICLR 2021
Table 10: (i) top 36 harmful and (ii) helpful MNIST instances predicted by the different approaches, (iii) the test generated samples, and (iv) changes in test FID after the data cleansing with vi, 25.0k.
All the generated samples use the same series of test latent variables in Ztest.
(i) Harmful
(ii Helptul
(iii Generated
(iv) FID
9
9
4
0
4
2
3
1 9
2
7
No removal
8
3
8
9 1
7 1
(
n/a
n/a
+0
D
/ 7149 9
7 1
9
1 4
4
4
3 / 8 8 / 155 1 19
C 8
8
G
6
7
9
5 5
2 7
(b) Influence IS (Ours)
6
0 2 6
6
0 0
0 2
7
4 7
071710 0 O / /1/1 1 4 / 2 8 & 1 0 4 / 7 1
O
6
8 3
9 7
-0.71
2
a 0
3
D 7
9
7
7
6
4 2
7 7
L
// 6 0 1 740 0 9 8 2 7 / 70 8000 9 5 4 9 8 18155 5
2 5
2 6
4
9 9
9
00 6
9 9 426
(c) Influence FID (Ours)
I I 1 / 1 O 1 9 1 7 9
1 7
G 88676 8
7 127
/
8
303 7 2
8 8
-0885
O
6 8 6 1 6 7 7 2 $
D
8
I 4
6 6 5 3 4 1 8 0
1
4 3 9 1
L
/
2 7 4 (
3 9 9 / / 5 f
3
4 9
4
2
6 /
8 420
Infiuence D Loss
/ 0 6 5
4 7
1
O 3 9
0
8 93649
4
(d)
-0.11
4 4 9 50
/
7 4
D 1
/ 4
4
0 8 18112
7
7
1 9
L 4 L 2
9.2477
/
8
O
9
1 4 1 9 9 /
4 0 ?
4 H6/89P
I
9
9 3 3
Isolation Forest
G a21=0n
I
L duqsus
1
1
(e)
+1.80
8 885982
1
D
1 1
1 4
rarnoL
FR4288
2
1 4 1 9 / 9 1
4 2 7 7 0
2351/9
A
7
7
4
6 6 7
9
9
0 9
1 147657
3 3
5
0 3 4 8 6
4 3
Random
075595
1 164*
8 3
8
ff)
-0.21
0 1 2263
3 357049 8
D
1 1. 4
00 6 4
O 3 0
9
7 1
4
6 6S30 0 9 8
4 3 0
$
9
4
23

---

Published as a conference paper at ICLR 2021
Table 11: Comparison among different random seeds used in the training in 2D>-Nommal case. See Table 9 for how the plots are generated.
(i) Harmful instances
(ii) Generated distribution
(iii) ALL
Thue No removal Cleanded
10
20
30
40
50
Ranking prodicted harmffll [k th] (bower hurmff))
(a) 1st rand. seed
51
+1.24
0-
-2-
(b) 2nd rand. seed
+0.29
-2
(c) 3rd rand. seed
+0.54
2-
(d) 4th rand, seed
+0.32
-1-
-2-
(e) rand. seed
7-
+0.58
-2-
-4
X2
24

---

Published as a conference paper at ICLR 2021
Table 12: Comparison among different random seeds used in the training in MNIST case. The generated samples from the model without cleansing (iii) and cleansed model (iv) in the same row use the same series of test latent variables. See Table f0rr the detail of how the images are obtained.
(iii)
(iv) Generated
i Harmful
iii Helpful
(v) FID
Generated (No removal)
(Cleansed)
(c) 5th rand. seed (d) 4th rand. seed (c) 3rd man. seed (b) 2nd rand. seed (a) 1st rand. seed
5
r
0 6 O
9
9
4 C
9 1 9 4 2
1
0
08677 7 8
4
> 9 1 / 1 4
2
3
1 9
7
4
7 9
5
2 9 5
1 1
8
303 2
1
33
3
B
7
9 D21
7
-0.85
7 . 101 1 & 2
1 4 1
140
65069 &
D
/ 1 7
D11A
6 6 6
7 7
2 7 3 8
$
4 3 4
7 6 9
O
9 8
9
O 1 1//
0 /1/22
4 489
2 8
6 8 2
7 6
8 3 6 9 } d A 5 3 L 9 0 1 9 6
7.
8
1
5 9
2
O
O 99>
d A
-0.45
q /
2 1
5
C 6
24 7 / 80
8
7
Q
2
2 8
6
/ 1
}2 9 6>
7
0 1 4 9 ( 9 7 6
3
0 16999
0 16991
9 [ 9
1
9
? 7 2 7 7 9 3 2 7 2 4 5 8 8 9
7 1 7 4 6 3
3 2
7
40 7 9 61
4
1
7 9
6
Y 2 5
7 1 8
3
/ 7 0 999
1 r B 9
+0.09
739
8
7
& h
4 /
&
4 9
/ 3 4
3
1
2
9
T 4
9 0 9 7
37
7 6
79, 5 23
9 2
8 8
2 777755
8
767J 27222
767 1
3 0
2
4 3 3
9 148971
7 738975
8
O
3
03234
-0.71
2 00
6
9 > 8 6 8 1
< 6
/
8 9
J / / 2 7
/.
7 9 0 6 7 9 O 2 9 6 1 1 6 8
9 0
9
9
A S 1 J
9 9 ( A 9
6
1 1 8
2
T
T 2 A 9 8 3 166900 f
2
9
3 l
Y A 4 7
6
0
6
3
0
5 7
2 7 4 /
7
9
3
2 3 9
2 L
S 7
S 7
-0.12
1
8 9
J
1
/ 3
3 5 1
3 2 1
3 6 / 1
H
0
5
/
6
3
8
2
+
2
5
1
7
J
25


Reviews:
[{"review_id": "zA_4aQteX3m", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary: \n\nThe paper presents an influence estimation method for GANs. It discusses why previous approaches on influence estimation cannot be easily extended to GANs. It proposes to use Jacobian of the gradient of discriminator’s loss with respect to the generator’s parameters to learn how absence of an instance in the discriminator’s training affects the generator’s parameters. The authors evaluate whether an instance is harmful based on its influence on GAN evaluation metrics. They show that removing these harmful instances improves performance of GANs on MNIST with respect to three metrics: Inception Score, FID and Average Log Likelihood (ALL). \n\n#################################################################\n\nStrengths:\n\n1. The paper is well-written, motivates the problem well and provides a detailed analysis of the proposed algorithm. It distinguishes its approach with other works on influence estimation such as [Hara et al.] and [Koh & Liang]. \n2. Several experiments are performed to validate the authors’ claims. They verify that estimated and true influence on GAN evaluation metrics have statistically significant correlation, and show how removing harmful instances can improve evaluation scores.  \n\n#################################################################\n\nWeaknesses:\n\n1. For the improvements on evaluation metrics to be significant, the authors need to remove a large number of samples from the dataset. For example, considering the Inception Scores in Table 7, they need to remove 15k instances out of 60k MNIST samples to get statistically significant improvements. Even after removing those instances, improvements are modest (e.g. +0.11/5.8 = 1.9%). It seems that this approach eliminates modes of the distribution that the GAN is not able to cover well. While this can improve the evaluation metrics, this improvement is artificial and does not correspond to a better GAN model. In general, removing underrepresented and rare samples can increase evaluation scores, but a strong GAN model should be able to generate those samples as well. The authors can discuss the nature of harmful samples and whether removing them actually leads to better generation.     \n2. There are no qualitative results to demonstrate which instances are harmful in training GANs. [Koh & Liang] provide qualitative results about which samples help (Figure 4) and harm (Figure 1) the model’s performance. Considering the large number of samples that need to be removed for improvements in evaluation scores, the authors can examine those samples, visualize them and try to find common characteristics among them. \n3. The authors use Isolation Forests [Liu et al. 2008] as the baseline for anomaly detection. It would be better to consider more recent approaches for anomaly detection such as those outlined in [B].  \n\n#################################################################\n\nReason for Rating: \n\nThe authors motivate the problem well and provide a detailed theoretical and experimental analysis. However, there are concerns regarding practical applicability of the proposed approach and whether it can indeed help with performance of GANs or it artificially boosts the evaluation scores. There are no qualitative evaluation on which samples harm the model’s performance.   \n\n#################################################################\n\nAdditional Comments: \n\nThere are other metrics for evaluating performance of GAN models such as Precision and Recall [A]. While I think the current metrics considered in the paper are adequate, the authors can also mention other metrics. \n\n##################################################################\n\nReferences: \n\n[A] Are GANs Created Equal? A Large-Scale Study; Lucic et al.; NeurIPS 2018 \n\n[B] Deep Learning for Anomaly Detection: A Survey; Chalapathy et al.; arXiv 2019 \n\n##################################################################\n\nAfter author response: I thank the authors for the additional experiments. It partially addresses my concerns. However, the qualitative results do not always show improvements in image quality, and most of the low-quality samples are still generated after cleansing. It’s also hard to clearly notice differences before and after cleansing in Tables 9 and 11 (2D-Normal). It would be better to use a multi-modal Gaussian with some modes being more likely. Overall, I am still concerned about practical applicability of the proposed approach. I keep my score of 7.  ", "extra_scores": {}, "extra_text": {}}, {"review_id": "cN0jGp_cfmg", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper proposes a technique to identify \"harmful\" data samples in the training dataset of a GAN. The research question is if it would be possible to find training samples that can be removed to improve the GAN training.\n\nI found the paper generally well written and interesting to read. I have some experience with GANs, but with so many papers being published in general I am not very confident in my evaluation that something like this hasn't done before. The authors argue that this idea has been applied in other settings and that they are the first to bring this idea to GANs and adapt the overall technical idea to this new context. I agree with the authors that this is technically interesting and a worthwhile topic to explore. It is also helpful to have some papers on this topic and someone has to write the first paper. I am supportive of having some research in this direction and I believe other similar work can follow that builds on this initial idea.\n\nOn the downside, the paper fails to establish that the proposed idea can actually contribute to creating a GAN that samples images of better visual quality. I would argue that this should be the main goal. The GAN research is somewhat split. This paper  uses small datasets and builds on a simple architecture (DC GAN) that is very far from a state-of-the-art GAN (e.g. StyleGAN2).\n\nThe first question is how can we know if the presented work really transfers to a GAN that is currently relevant. The paper does not offer any insights here and this is a part that could be improved. It would be preferable if such tests would already be performed by the authors so that others can know if it is worth following this direction of research.\n\nAnother question is why no images are shown in the paper. All results are using GAN evaluation metrics: FID score, Inception, and ALL. From these metrics, I doubt that ALL is as meaningful as the authors make it out to be and I do not think the Inception score is that great either. FID has been quite useful to compare GANs. \nHowever, I am skeptical that improving the FID score directly is a meaningful endeavor. It's easily possible that an attempt to directly influence a metric such as FID score doesn't lead to better results for GANs. The metric itself has many problems and it is easy to exploit a weakness in the metric when directly optimizing for it. Similarly, an important GAN component, truncation, significantly improves quality while significantly worsening the FID. This is also an indication that the FID score is not a great metric that can be directly optimized for.\nTargeting the FID directly also has other technical problems. Removing samples from the training set changes the target mean and covariance statistics of the inception v3 network. The idea of the FID score is to compute a 2048 dimensional mean vector and covariance matrix summarizing a set of samples. Typically, the statistics of the training set and the statistics of generated GAN samples are compared.\nIn this setup, removing training images changes the problem statement. Training a GAN with removed images can no longer be compared to training a GAN with all the images. What do you do here. Do you use all the original training dataset samples to compute the FID? That doesn't make sense in my view. Then the FID is computed with respect to a different dataset.\nOr do you only use the new training dataset to compute the FID? Maybe the FID is better, but you also might have just simplified the problem.\nHow can we judge the visual results here? I would guess the results are either not distinguishable and all look mediocre (because the baseline network is outdated) or maybe the new results may even look a bit worse. Do we really want to have GAN papers without any images?", "extra_scores": {}, "extra_text": {}}, {"review_id": "781Efklmlg", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary:  \nThis paper introduces influence estimation for GANs. The influence estimates approximate how helpful or harmful each training sample is with respect to some evaluation metric or loss function, such as Inception Score or FID. Removing harmful instances is shown to improve GAN performance.\n\nStrengths:  \n-Paper is well written.  \n-Influence estimations adds an interpretability tool to GAN training. This is very welcome, because the training dynamics of GANs are still not very well understand.  \n-Proposed technique does a good job of estimating the true influence.  \n-Predicted influences can be used to remove harmful data points, which is shown to improve GAN performance.  \n\nWeaknesses:  \n-No visual examples of the data points that were highly influential.  \n-No analysis into what kinds of characteristics might make a data point highly influential, either in the helpful or harmful sense.   \n-None of the evaluation metrics used differentiate between fidelity and diversity. This is particularly important because removing instances from the training set inevitably reduces diversity, but this is not reflected in the current metrics. Including metrics such as Precision and Recall [1] or Density and Coverage [2] would allow us to see the trade-off between fidelity and diversity.  \n-Computationally expensive, as model parameters need to be saved at every iteration (not a major issue for this paper, but worth noting)  \n-Proposed method is only applied to very simple datasets and GAN models (likely due to the aforementioned compute issue)  \n\nRecommendation and Justification:  \nI really like the direction that this paper is headed in, but I think there is one thing holding it back. My greatest disappointment with this paper was that it does not include any visual examples of highly influential data points, nor any analysis or discussion about what kinds of characteristics helpful or harmful data points might have. These insights are half of the reason why interpretability methods such as influence estimation are useful, and without them it feels like I have read a story without a satisfying conclusion. In its current state I would rate this paper as being marginally below the acceptable threshold, but if the above concerns were adequately addressed I would very gladly increase my score.\n\nClarifying Questions:  \n-In the paper it is stated that the generator and discriminator are simultaneously updated in one step for simplicity. However, the majority of GANs trained in practice use separate update steps for the generator and discriminator. Does this method also work for separate update steps?  \n-How consistent is the selection of harmful instances? For example, does the set of the most harmful instances change throughout training (at the beginning vs towards the end)? What about across different runs with different random seeds?  \n-Recently it has been shown that removing data points that lie in low density regions of the data manifold can result in improved GAN performance [3]. I would be curious to know if you think there is any correlation between the harmful instances identified by influence estimation and the density of the data manifold?  \n\n[1] Kynkäänniemi, Tuomas, et al. \"Improved precision and recall metric for assessing generative models.\" Advances in Neural Information Processing Systems. 2019.\n[2] Naeem, Muhammad Ferjad, et al. \"Reliable Fidelity and Diversity Metrics for Generative Models.\" arXiv preprint arXiv:2002.09797 (2020).\n[3] DeVries, Terrance, Michal Drozdzal, and Graham W. Taylor. \"Instance Selection for GANs.\" arXiv preprint arXiv:2007.15255 (2020).\n\n------------------------------------------------------\n\nEdit after author response:\nThe authors have sufficiently addressed my concerns with the additions that have been added in Appendix D. As such, I will increase my score from a 5 to a 7.", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper advances the idea that recent “influence estimation” methods for supervised learning cannot be trivially applied to GANs. Based on Hara et al.’s method, the authors propose a novel influence estimation for GANs, and an evaluation scheme based on popular GAN evaluation methods, exploiting the fact that they are differentiable with respect to their input data. The paper demonstrates empirically that the proposed influence estimation method correlates to true influence. It also shows that removing “harmful” instances using the average log-likelihood, Inception Score, and Frechet Inception Distance versions of the proposed metric improves the quality of generated examples.

All reviewers were positive about the paper. R2 pointed out that it was well-written and appreciated the detailed analysis. They thought it thoroughly explained the similarities between it and the most closely-related recent work (Hara et al. and Koh & Liang). Concerns expressed by the reviewer were: the amount of samples needed to be removed to obtain a statistically significant result, lack of qualitative results, and an outdated baseline for anomaly detection. The reviewer also stated that they had some concerns with practical applicability and would like to see more GAN metrics, like Precision & Recall. The authors added qualitative results to the paper which partially satisfied the reviewer.

R1 also thought that the paper was well-written and contributed to the interpretability of GAN training. Like R2, they pointed out the lack of visual examples (addressed in rebuttal), and asked for more insight into what kind of characteristics make a data point influential. They also requested that the authors add a metric that trades fidelity and diversity like P&R. The reviewer originally felt that the paper was below the bar, because it was “like a story without a satisfying conclusion”. However, the authors responded with additional analysis which satisfied the reviewer, and they upgraded their score by two points.

R3 also found the paper well-written and interesting, like the other reviewers. The reviewer raised some similar concerns as the other reviewers (e.g. qualitative results), as well as the scalability of the method to relevant architectures, which I thought was surprising that the other reviewers didn’t mention. The authors responded that they believe their method succeeded in improving diversity of the generated samples but not their visual quality. This is an important point.
The additions in Appendix D have addressed the main concerns of R1 and R2, as well as R3’s concern about lack of visual analysis. R1 seems quite convinced now, and R2, though not changing their score, was already in favour of acceptance. It is an interesting finding that “harmful” instances seem to come from regions of distributional mismatch.

I would like to see a fidelity-diversity tradeoff like P&R added to a paper, and a discussion of this work in relation to DeVries et. al “Instance Selection” that appears to be similarly motivated though executed differently. I think one major thing holding back this paper is the scale of the experimental analysis (Gaussians & MNIST); I hope the authors can scale the method in future work.
Decision: Accept (Spotlight)