ADVERSARY-AWARE PARTIAL LABEL LEARNING WITH LABEL DISTILLATION
Authors: Cheng Chen
Yueming Lyu
Ivor Tsang
Venue: Submitted to ICLR 2023 (2023)
Keywords: weak supervised learning
partial label learning

Abstract: To ensure that the data collected from human subjects is entrusted with a secret, rival labels are introduced to conceal the information provided by the participants on purpose. The corresponding learning task can be formulated as a noisy partial-label learning problem. However, conventional partial-label learning (PLL) methods are still vulnerable to the high ratio of noisy partial labels, especially in a large labelling space. To learn a more robust model, we present Adversary-Aware Partial Label Learning and introduce the $\textit{rival}$, a set of noisy labels, to the collection of candidate labels for each instance. By introducing the rival label, the predictive distribution of PLL is factorised such that a reasonably good predictive label is achieved with less uncertainty coming from the transition matrix, assuming its generation process is known. Nonetheless, the predictive accuracy is still insufficient to produce an adequately good set of positive samples to minimise the loss function. Moreover, the inclusion of rivals also brings an inconsistency issue for the classifier and risk function due to the intractability of the transition matrix. Consequently, the immature teacher within momentum (ITWM) disambiguation algorithm is proposed to cope with the situation. We utilise the confidence score mapping from the instance space to approximate the intractable term, allowing us to obtain a provably consistent classifier and risk function. Extensive experiments demonstrate that our method achieves promising results on the CIFAR10, CIFAR100 and CUB200 datasets.

Under review as a conference paper at ICLR 2023
ADVERSARY-AWARE PARTIAL LABEL LEARNING WITH LABEL DISTILLATION
Anonymous authors Paper under double-blind review
ABSTRACT
To ensure that the data collected from human subjects entrusted with a secret, rival labels are introduced conceal the information provided by the participants on purpose. The corresponding learning task can be formulated as a noisy partial- label learning problem. However, conventional partial-label learning (PLL) meth- ods are still vulnerable to the high ratio of noisy partial labels, especially in a large labelling space. To learn more robust model, we present Adversary-Awar tial Label Learning and introduce the rival, set of noisy labels, to the collection of candidate labels for each instance. By introducing the rival label, the predictive distribution of PLI is factorised such that a handy predictive label is achieved with less uncertainty coming from the transition matrix, assuming the rival generation process is known. Nonetheless, the predictive accuracy is still insufficient to pro- duce an sufficiently accurate positive sample set to leverage the clustering effect of the contrastive loss function. Moreover, the inclusion of rivals also brings an in- consistency issue for the classifier and risk function due to the intractability of the transition matrix. Consequently, an adversarial teacher within momentum (ATM) disambiguation algorithm is proposed to cope with the situation, allowing us to obtain provably consistent classifier and risk function. In addition, our method has shown high resiliency to the choice of the label noise transition matrix. Exten- sive experiments demonstrate that our method achieves promising results on the CIFAR1O, 10, CIFAR 100 and CUB200 datasets.
Par-
INTRODUCTION
Deep learning algorithms depend heavily on a large-scale, true annotated training dataset. Nonethe- less, the costs of accurately annotating a large volume of true labels to the instances are exorbitant, not to mention the time invested in the labelling procedures. As result, weakly supervised labels such as partial labels that substitute true labels for learning have proliferated and gained massive pop- ularity in recent years. Partial-label learning (PLL) a special associated with a set of candidate labels Y for each instance, in which only one true latent label is in existence. Nonetheless, without appropriately designed learning algorithm, the limitations of the partial label are evident since deep neural networks are still vulnerable to the ambiguous issue rooted in the partial label problem because of noisy labels Zhou (011); y Patrini al.] (2017): Han et al. (2018). As a result, there have had many partial label learning works (PLL el al. (201 Hüllermeier & Beringer (2006): Feng & An (2019): Feng al. (2020) successfully solved the ambi- guity problem where there is a set of candidate labels for each instance, and only a true label exists. Apart from the general partial label, we have also seen variety of partial label generations evolved, simulating different real-life scenarios. The independently and uniformly drawing is the one have seen the most L.v et al. (2020); Feng An (2019). The other problem settings include the instance dependent partial label learning, where each partial label set is generated depending on the instance as well as the true label Xu et al. (202I). Furthermore, Lv et al. (2020) has introduced label spe- cific partial label learning, where the uniform flipping probability of similar instances differs from dissimilar group instances. Overall, the learning objective of the previous works is all about disam- biguation. More specifically. the goal is to design classifier training with partial labels, aiming to correctly label the testing dataset, hoping the classification performance will be as close as the full supervised learning.
learning problem

---

Under review as a conference paper at ICLR 2023
On the contrary, there is lack of discussion previous works that shed light the data privacy- enhancing techniques in general partial label learning. The privacy risk is inescapable; thus, privacy- preserving techniques need to be urgently addressed. Recently, we have seen surging data breach cases worldwide. These potential risks posed by the attacker are often overlooked and pose a detri- mental threat to society. For instance, it is most likely for the adversary learn from stolen or leaked partially labelled data for illegal conduct using the previous proposed partial-label learning methods. Subsequently, it has become an inherent privacy concerns in conventional partial label learning. In this paper, the Adversary-Awan partial label learning is proposed to address and mitigate the ramifi- cation of the data breach. In nutshell, we propose an affordable and practical approach to manually corrupt the collected dataset to prevent the adversary from obtaining high-quality, confidential in- formation meanwhile ensure the trustee has full access to the useful information. However, we have observed that adversary-awan partial label learning possesses some intrinsic learnability issues. Firstly, the intractability is raised from the transition matrix. Secondly, the classifier and risk incon- sistency problem has been raised. Hence, propose an the Adversarial teacher within momentum (ATM)(In section 2.1), adversary-aware loss function equation 19 and a new ambiguity condition equation | to counter the issues.
partial label problem setting, the rival is added to a candidate set of labels. To achieve that, we extend the original partial label generation equation by by factorisation to add the rival Y". Subsequently, we have the adversary-aware partial label generation established as equation 3 Then, we decompose the second equation of equation 3 into the rival embedded intractable transition matrix term Q" and class instance-dependent transition matrix Ty.s, which is P(Y" y transition matrix is utilised, which is defined as P(Y" =y' Y = =y), with the assumption the rival is generated depending only on Y but instance X. Under the assumption, the class instance- independent transition matrix simplified and mathematically identifiable. Since all the instances transition matrix in practice, such encryption is more
Under the adversary-award
Y = y. = x). In our problem setting, Ty.y the class instance-independent
share the same class instance-independe affordable to implement. The rival variable serves as controllable randomness to enhance privacy against the potential adversary and information leakage. In contrast, the previous methods can not guarantee the privacy protection property.
However, a fundamental problem has been raised, inclusion of the rival implies an inconsistent clas- sifier according to the adversary-aware label generation equation equation 3 Learning a consistent partial label classifier is vital, but in our problem setting, the consistency classifier may not be ob- tained due to the intractability of Q" (details are described in section 1.2). As a consequence, the Adversarial teacher within momentum (ATM) is proposed, which is designed to identify the term P( Y,Y', X) which is denoted as Q". The Moco-style dictionary technique He al. (2020) and Wang et al. (2022) have inspired us to explore exploiting the the soft label from instance em- bedding, leveraging Tw,y' to identify or reduce the uncertainty of the Q' due to the property of informational preservation and tractability. Therefore, consistent partial label learner is obtained the uncertainty raised from the transition matrix reduced greatly. Specifically, we transform the inference of label generation in Adversary-Awar PL.. as an approximation for the transition matrix Q' Ultimately, tractable solution to the unbiased estimate of P(Ý Y,Y', X)) can be derived. Lastly, we have rigorously proven that a consistent Adversary-Awar PLL classifier can be obtained if P( x) and P(Y"' Y) are approximated accurately according to equation 3
In this work, we are mainly focusing on identifying the transition matrix term p(ý Y,Y', X)- The rival is generated manually for privacy enhancement. Thus the P(Y" | Y) is given by design. Overall, our proposed method has not only solved the ambiguity problem in Adversary-Aware PL.I but also addressed the potential risks from the data breach by using a rival as the encryption. Our proposed label generation bears some resemblance to local differential privacy Kairouz et al. 2014);; Warner [1965). which aims to randomise the responses. The potential application is to randomise survey responses, survey technique for improving the reliability of responses to confidential inter- views or private questions. Depending on the sophistication of the adversary, our method offers a dynamic mechanism for privacy encryption that is more resilient and flexible face the potential adversary or privacy risk. By learning from the previous attacks, we can design different levels of protection by adjusting the T term. The main contributions of the work are summarized:
privacy/Karrouz
We propose a novel problem setting named adversary-aware partial label learning.
2

---

Under review as a conference paper at ICLR 2023
We propose novel Adversary-Awant loss function and the Adversarial teacher within momentum (ATM) disambiguation algorithm. Our proposed paradigm and loss function can be applied universally to other related partial label learning methods to enhance the privacy protection.
A new ambiguity condition (equation TT for Adversary-Aware Partial Label Learning is derived. Theoretically, we proven that the method is a Classifier- Risk Estimator.
1.1 RELATED WORK
Partial Label Learning (PLL) trains an instance associated with candidate set of labels in which the true label is included. Many frameworks are designed and proposed to solve the label ambiguity issue in partial label learning. The probabilistic graphical model-based method:Zhang et al. (2016); Wang & Isola (2020); Xu et al. [ Lyu et al. (2019) as well as the clustering- or unsu- pervised approaches Liu & Dietterich 2012) are proposed by leveraging the graph structure and prior information of feature space to do the label disambiguation. The average-basse based perspective methods Hüllermeier & Beringer (2006); Cour et al. (2011): Zhang et al. (2016) are designed based on the assumption of uniform treatment of all candidates; however, it is vulnerable the false posi- tive label, leading to misled prediction. Identification perspective- based methods Jin & Ghahramani (2022) tackle disambiguation by treating the label latent variable. The representative per- spective approach uses the maximum margin method & Caruana (2008); Waan et al. (2020) 2022) to do the label disambiguation. Most recently, self-training perspective method&leegg & An (2019]; Wen et al. b Feng et al. (2020) have emerged and shown promising performance. In Contrastive Learning He al. (2020); Oord et al. (2018), the augmented input is applied learns from feature of the unlabeled sample data. The learning objective is to differentiate the similar and dissimilar parts of the input, in turn, maximise the learning of the high-quality representations. CL. has been studied in unsupervised representation fashion Chen et al. (2020); [H et al. (2020), which treats the same classes as the positive set to boost the performance. The weakly supervised learning has also borrowed the concepts of CL to tackle the partial label problem Wang et al. (2022) The CL has also been applied to semi-supe learning Li et al. (2020).
1.2 ADVERSARY-AWARE PARTIAL LABEL PROBLEM SETTING
Given the input space X' E Rd and label space is defined as y [c] E {1...c} with the number of с > 2 classes. Under adversary-aw aware partial labels, each instance X E X' has a candidate set of adversary-aware partial labels Y E D. The adversary-awand partial label set has space of ) : { T C -))== in which there is total 21 selection of subsets in [c]. The objective is to learn a classifier with the adversary-aware partially labelled sample n, which was i.i.d drawn from the
(X,,, Y.)). aiming that it is able to assign the true labels for the testing dataset. Given instance and the adversary- aware partial label Y the adversary awwaee aware partial label dataset distribution 13 is defined
D = {(x,, Y(),,
(X. y) E X x J. The class instance- indaance-nddeeedentt transition matrix P(Y" Y) is denoted as T E Rexe. Ty,yy P(Y' s Y = y) where T, = 0, Vy', y E [c]- prevent the adversary from efficiently and
The adversary -ware means the designed paradigm reliably inferring certain information from the database without the T, even the data was leaked. The rival is the controllable randomness added to the partial label set to enhance privacy.
1.2.1 ASSERTION CONDITIONS IN LABEL GENERATION SET
The following conditions describe the learning condition for adversary-aware partial label. Accord- ing Cour et al. (20TT) there needs to be certain degrees of ambiguity for the partial label learning. Lemma 1 is the new ERM Icarnability condition which is proposed as follows
Py's == P(y. DE -''="'''' x. z).
The y/ is the rival, and y is the false positive label that exists in the partial label set. It has to be met ensure the Adwe PLL problem is learnable with y' * y and ÿ # y, these conditions ensure the ERM Icarnability Liu & Dietterich (2014) of the adversary- aware PLL problem if there small ambiguity degree condition. In our case which is that, Py g < 1. The y is the true label corresponding to each instance x. And py: Pyy e Y Y y, = x). where P, = 1 to ensure that the ground truth label is in the partial label set with respect to each instance.
3

---

Under review as a conference paper at ICLR 2023
1.2.2 LABEL GENERATION
In the previous works of partial label generation procedure, only candidate of the partial label was generated as such. The Standard Partial Label Generation:
Σ NEY
P(Y J.Y = X x) = > P - y. = x)P = x -
yEY
=E P(Ý 5/ y /)P x=
NEY
where P(Ý- 7 Y y, = x) is the label generation for the class instance-dependent partial label and P(V = = y) is the standard partial label learning framework. Then present the difference between the general partial labels and the adversary-aware partial label. The Adversary-Aware Partial Label Generation:
Σ P( = - xx =====)=>x> Σ
P( = = v.Y = xx=x)
NEY
NEY Y'EY"
Σ E Σ - - y, v bay P(Y = 1 x).
DEY WEY'
Adversary-Awan transition matrix
In the adversary-ave aware partial label problem setting, the transition matrix of the adversary-ave aware partial label is defined as P( Y,Y', X) and denoted as Q" (2xx(==2), The partial label transition matrix P(Y Y) is denotes as Q Rex Theoretically, if the true label of the vector Y unknown given an instance X, where J E Y and there are 2 candidate label sets. The ez is the instance- dependeet rival label noise for each instance where c, E IR xe. The entries of the adversary-aware transition matrix for each instance is defined as follows
2 Σ
- Q'|:1l= = Σ (QQ1:1) + #=1
2 (T Σ (A
(4)
j=1
Eg and the conditional distribution of the adversary- aware partial label set Y based on Wen et al. (0221) derived as belows
where Al;JiT Q..T r
P(Ý = Y
= -
II
Py
II UE
-1-
V VEGN+y
(5)
where pe and pv are defined as
Pe = x
< =
(6)
The inverse problem to identify sparse approximation matrix A to use equation g to estimate the true posterior probability.
We summarize the equation as matrix form in equation 7
P(Ý x
**
P(Y
adversary-aware PLL
True posterior probubility
Q+11 P( X
x)
P(Y X
Adversary-aware PLL
True pusterior probability
T --1 P(Ý xX=))
P(Y
(8)
Adversary-wware PLL
True posterior prohabiliiy
In reality, due to the computational complexity of the transition matrix, would be a huge burden estimate Q" accurately for each instance. The 2 -2 is an extremely large figure and increases
4

---

Under review as a conference paper at ICLR 2023
exponentially as the label space increase. Therefore, we are longer required to estimate the true transition matrix P( Y, Y X). Instead, resort using instance embedding in the form of a soft label to identify the adversary-aware partial label transition matrix Q", Specifically, we proposed use a soft pseudo label from the instance embedding (Prototype) to approximate the adversary-aware transition matrix for each instance. The reason is that we can not achieve the true transition matrix Q" directly due to the nature of the practical partial label problem. Therefore, we have used the self-attention prototype learning to approximate the true transition matrix. The detail described in section 2. Since the Adversary-aware partial label is influenced by the rival label noise, it is challenging to accurately estimate both the class instance-independe T and the sparse matrix A simultancously to estimate the true posterior. Considering that the T is private and given, it is easier for us just to approximate A to estimate the posterior probability than the adversary. The equation g is implemented as the loss function in equation 17
transition matrix
1.3 POSITIVE SAMPLE SET
The construction of positive sample is used for contrastive learning identify the transition ma- trix P(Ý YY, Y. X) via the label disambiguation. Nonetheless, the performance of the contrastive learning erodes drastically due to the introduced rival, which is manifest in the poorly constructed positive sample set, resulting in the degenerated classification performance (See Figure 2). Sub- sequently, the adversary-awan loss function is proposed in conjunction the contrastive learning to prevent classification performance degeneration. To start with, we define L.2 norm embedding of and lt as the query and key latent feature from the feature extraction network fe and key neural net- work I'g respectively. Correspondingly, we have the output u E Rlxd where u, = (Aug (z)) and z E R x where 2,=fé (Auga (z:)). The construction of a positive sample set is shown as follows. In each mini-batch, we have D, where D. E D. The f(x:) is the function of a neural net- work with a projection head of 128 feature dimensionality. The outputs of Dy and D₃ are defined
as follows,
D, = (u; (Aug, (a:)) x, E D.}.
D2 = (2 = 5' (z:)) m. 15),
(10)
where 5(z) is the sample set excluding the query set q and is defined as S(x) CMgq). in which C. C= D2 U D& U queue. The Dg and D& vectorial embedding with respect to the query and key views given the current mini-batch. The queue size is determined accordingly depending on the input. The instances from the current mini-batch with the prediction label v' equal (ū; c) from the S(z). is chosen to be the positive sample set. Ultimately, the N(x) is acquired, and it is denoted as
(z,) = {x/ 2 S = (0, (0.
(11)
The (x) is the positive sample set. The construction of sufficiently accurate positive sample set N-(x) is vital as it underpins the clustering effect of the latent embedding in the contrastive learning procedure. The quality of the clustering effect relies on the precision of prototype Uy corresponding to E {1. C). Our method helps maintain the precision of prototypes using the T to render better label disambiguation module performance for contrastive learning when introduced the rival. where the query embedding u multiplies the key embedding & and then divides with the remaining pool C. Overall, the 54 (ar) is used to facilitate the representation learning of the contrastive learning and the self-attention prototype learning to do the label disambiguation or a more accurate pseudo- labelling procedure. Our proposed loss ensures the prototype and contrastive learning are working systematically and benefit mutually when the rival is introduced. The pseudo label generation is according to equation 16
We have followed Wang al. (2022) for the positive sample selection.
METHODOLOGY
The main task of partial label learning is label disambiguation, which targets identifying the true la- bel among candidate label sets. Thus, we present an adversarial teacher within momentum (ATM). The equation 17 is developed to do the debiasing from the prediction of f(x) given the adversary- aware partial label via the class instance dependent transition matrix T + I. The unbiased predic- tion induces the identification of more accurate positive sample set which allows Equation 18 to
5

---

Under review as a conference paper at ICLR 2023
Naural Natwork
Aparodamiing
Fundian
fi P
(P P
Labes
Advensrry Labal Tixining sample
Bupprasnn apiies
Awars Partue
query
Proelye
Augmante Key Hew
Sezple Condilatee
Adsersary Anare Partaal
Womentum Encodar
Biy ......... Sa
Contrastiv Loss
sample
Figure I: An overview of the proposed method. General partial label can be disclosed to adversary. The initial training is about positive sample selection. Moreover, we have assumed ''' is given.
leverage the high-quality presentation power of positive sample set to improve the classification performance.
2.1 PSEUDO LABEL LEARNERS VIA ADVERSARIAL TEACHER WITHIN MOMENTUM (ATM)
Unlike Wang et al. 2022), p. present adversarial teacher strategy with momentum update (ATM) to guide the learning of pseudo labels using Equation 17. Just like a tough teacher who teaches the subject using harsh contents test students' understanding of the subject. In our case, the rival is like the subject which is purposely generated by us, at the same time Equation 17 is introduced to check the understanding of the student (classifier) given the scope of testing content which is the T. Specifically, the spherically margin between prototype vector Sd and prototype vector 2 Sd-1 is defined
my exp (- v₁).
(12)
For prototype us we define the normalized margin between v, and Vy as
exp (-p v₁))
maj Σj exp (- 0y))
(13)
For each Us i E (1,..., K}, we perform momentum updating with the normalized margin between vy and vs for all o as an regularization. The resulted new update rule is given as
/1 - a
g
(14)
||g||2
where the gradient g is given as
9 u 3
Σ m
m
(15)
where is the query embedding whose prediction is class i, m is the normalized margin between prototype vectors at step (i.e., vf.j # i). The ve is the prototype corresponding each class.
U. {
c= arg maxjey u T
q = óq + (1 o)u,
(16)
otherwise.
where q is the target prediction and subsequently used in the equation 17 It was initialised as the uniform probability q = 2/ and updated accordingly to the equation 16 The é is the hyper- parameter controlling for the updating of q.
2.2 ADVERSARY AWARE LOSS FUNCTION.
The goal is to build a risk consistent loss function, hoping it can achieve the same generalization enror as the supervised classification risk R(f) with the same classifier f. To train the classifier,

---

Under review as a conference paper at ICLR 2023
minimize the following modified loss function estimator by leveraging the updated pseudo label from the Adversarial teacher within momentum (ATM) distillation method and transition plus iden- tity matrix, Ti E [0, 1 T = 1, for Vi= E [c]. Ti = 0, for Viys E [c]: where f (X) E R
[((()) E ( log (((T+ + (X))))..
(17) The proof for the modified loss function shown the appendix lemma 4. In our case, given sufficiently accurate positive sample set of the contrastive learning is utilised to incorporate with equation [7 to identify the transition matrix of the adversary-aware partial label. The contrastive loss is defined as follows
exp(u T z/T)
[( = [Dyl nED,
E log
(+(x)
Exec(e) exp(u (u' 2/T)
24 =x)
(18)
Finally, we have the Adversary-Aaare Loss expressed as
Adversary-Aware Loss
E((())
(19)
There are two terms of the proposed loss function (equation[T)) 19). which are the equation 17 and equa- tion 18 correspondingly. equation 17 is developed lessen prediction errors from f(z) given the adversary-aware partial label. The debiasing is achieved via the class instance dependent transition matrix T' + / by down-weighting the false prediction. The unbiased prediction induces the identi- fication of a more accurate positive sample set. equation [8 is the contrastive loss. It leverages the high-quality representation power of positive sample set improve the classification performance further.
3 THEORETICAL ANALYSIS
The section introduces the concepts of classifier consistency and risk consistency Xia et al. (2019) /Zang (2004), which crucial in weakly supervised learning. Risk consistency achieved if the risk function of weak supervised learning is the same as the risk of fully supervised learning with the same hypothesis. The risk consistency implies classifier consistency, meaning classifier trained with partial labels is consistent as the optimal classifier of the fully supervised learning.
Risk Estimator Learning with True labels. Lets denote S(X) (91 (z)..... IK (I)) as the classifier, in which (z(z) is the classifier for label c E [K]. The prediction of the classifier (x) P(Y = c z). We want obtain classifier f(X) =arg max (xx).
Classifier-Consisterr
The loss function is to measure the loss given classifier f(X). To this end, the true risk can be denoted as
R()) [xx,) (X),
(20)
The ultimate goal is to learn the optimal classifier f*=arg minseF R(f) for all loss functions, for instance to enable the empirical risk Ryn (f) to be converged to true risk R(h). To obtain the optimal classifier, we need to prove that the modified loss function is risk consistent if it can converge to the true loss function.
Learning with adversary-aware Partial Label. An input X X has candidate set of Y e 5 but only true label Y e V. Given the adversary-aware partial label y E 3 and instance X X that the objective of the loss function is denoted as
R(() = Ex,,, E (F(X),))
(21)
Since the true adversary-aware partial label distribution D is unknown, our goal is approximate the optimal classifier with sample distribution Dpm by minimising the empirical risk function, namely
1 Σ E(f (x,) (x))).)) Rp = n i=1
(22)
7

---

Under review as a conference paper at ICLR 2023
Assumption 1. According to Yu et al. 2018 that the minimization of the expected risk R(f) given clean true population implies that the optimal classifier is able to do the mapping of f (X) = P(Y = x), vi E [c]. Under the assumption 1, we are able to draw conclusion that f f applying the theorem in the following.
Theorem 1. Assume that the Adversary-Aware matrix Ty is fully ranked and the Assumption 1 is met, the the minimizer of fr of R(f) will be converged to f of R(f)) meaning f f-
Remark. If the Q and Ty, is estimated correctly the empirical risk of the designed algorithm trained with adversary-aware partial label will converge to the expected risk of the optimal clas- sifier trained with the true label. If the number of sample is reaching infinitely large that given the adversary-aware partial labels, fn is going to converged to f theoretically. Subsequently, fr will converge the optimal classifier f as claimed in the theorem 1. With the new generation procedure, the loss function risk consistency theorems are introduced.
Theorem 2.
The udversary-aware loss function proposed risk consistent estimator if can asymp- totically converge to the expected risk given sufficiently good approximate of Q and the adversary- aware matrix. The proof is in appendix lemma 4.
C
L(U: (x)))
ΣΣΣ
(P
x
II REE
Pv
II (1 pe) T yy El,, (())) [(T.J(()) :
JEDy vFyg'
3.0.1 GENERALISATION ERROR
Define R. and Rem as the true risk the empirical risk respectively given the adversary-aware partial label dataset. The empirical loss classifier is obtained as fmm = arg minjer Rym(J). Suppose set of real hypothesis Fūg, with fi(X) E F, Vi E [c] Also, assume it's loss function (Xf(X), Y) is T--lipschitz continuous with respect to ((X) for all Th. E ÿ and upper-bounded by M, ie., M supzEx, P.x.xxXFFFF... cy E (f(x), Uk). The expected Rademacher complexity of Fx is denoted as R., (Fa))
Bartlett & Mendelson (2002)
Theorem 3. For any 8 O, with probability least 1 - 6,
i (fm)
R (f())) S <4V2L 2L
Rn (F g. + M
log 3 2n
(23)
As the number of samples reaches to infinity oc, RR (F 0 with bounded norm. Subse- quently, R(f) + R (f*) the number of training data reach infinitely large. The proof is given in Appendix Theorem 3.
EXPERIMENTS
Datasets We evaluate the proposed method on three Bracchmarks-CIFARRE CIFARIOO (UFARIo00Kiizeevkkk et al. (2009), and fine-gra ane-igrined CUB200 Wah et al. (20IT) with general partial label and ad adversary- aware partial label datasets. Main Empirical Results for CIFARIO. All the classification accu- racy is shown in Table 1. We have compared classification results CIFAR-10 with previous works Wang et al. (2022); Lv et al. (2020); Wen et al. (202)) using the Adversarial teacher within momentum (ATM). The method has shown consistently superior results in all learning scenarios where y (0.3, 0.5) } for the adversary-aware partial label learning. More specifically, the proposed method achieves 8.17% superior classification performance a 0.5 partial rate than the previous state of art work Wang et al. (2022). Moreover, our proposed method has achieved comparable results at 0.1 and 0.3 partial rates. The experiments for CIFAR-10 have been repeated four times with four random seeds. Main Empirical Results for CUB200 and CIFAR100. The proposed method has shown superior results for the Adversary-Awar Partial Label, especially in more chal- lenging learning tasks like the 0.1 partial rate of the dataset cub200 and CIFAR 100, respectively. On the cub200 dataset, we have shown 5.95% improvement at partial rates 0.1 and 1.281 % and 0.37% where the partial rate is at 0.05 and 0.03. On the CIFAR100 100 dataset, the method has shown 6.06% and 0.4181% %, 0.5414% higher classification margin at partial rate 0. 0.05 and The experiments have been repeated five times with five random seeds.
8

---

Under review as a conference paper at ICLR 2023
Table 1: Benchmark ditasets for accumey comparisons. Superior results are indicated bold. Our proposed methods have sbown comparable results to fully supervised learning and ouperform provious methods in more challenging lesrning scauarie, such the portial rate (CCCAR)) 0. ICIIAAR CUB200). The hyper-praneee is 0.1 nethod. (The symbbol indicates Adveriary- partill label dataset).
Dotaset
Method
0 0.01
Q 0.05
3 0.1
(ATMoWidtou Ti(Or)
73-43 1.011
72631.0.2 27
72.35.10222
CIFAR100
PIDO
73.25 #0.21
72,99 #0027
71,77++0
LAWS
63.78 #:0.02
59.56
53.53
PRODEN
62,001:0.32
60.734:0.00
36.80/:00.22
Full Supervised
73.56 +0
Datsett
Method
= 0.03 0.02
= 0.05 0.02
1'
0.1 0.00
(ATMiOOur) PODO"
23.36 1:032
72.96::0 14
$4,99 1:1 888
CIFAR100
72.87 26
72.53++0.55 S:
48.00::3.3
LW/S
46.82-1.05
24.8210.1 1.11
4,5720047
PRODEN
29.33.10.48
41,20.10.2
13,4410.4 41
Dutteet
Method
q= 0.01
q 0.05
==
(ATM) (Wishout TXOur)
74.43.0.880 876
72.30.0.521
66.77.0.5
CUB200
PICO
74.11=00.7 0777
71.75=0.56
66. 12=0.99
1WS
73.74+0.31
39. 74:7400477
12, 22.000.77 77
PRODEN
72.34=0004
56ad
35,8 35.8900.0
Supervised
76.00-0.11
Duitsel
Mechod
0" = =00000.02
o" 0.05 10000
q" =0.110.02
(ATM) (Cur)e
72,22=1.36
72.43-0.86
56.26-0.70
CUB200
PICO"
71,85 #0.55
71.15 #0.41
50.31 =1.0
1W5"
96-40.62
4,02 -0.03
1/44 -0.06
PRODEN
18.7110.45
17.63 10.89
17.99 10.62
Donaset
Method
9- 0.1
U.3
0.5
(AhhotW TyOun
43.57110.16
90.17100.0
02.22.10.00
CIAARI
93.74:0.24
93.25-20.82
92.46=20.00
90.50 30.50-+0.60
$7.78.00007
Full Supervised
94.91s0077
Daraset
Method
0" 0.1 0.02
q" 0.3 0.00
4"
0.02
(ATM) (Chrr)
93.52 +0.11
92.98-0.51
89.62=0.05
CIEARLO
PICO"
93.6410.24
92.85 A.S.0..45
$1.45.1..5 15..0.57
LWS
$7.34:50.87
39 21.9900.72
9.89 1.0
PRODEN"
88 0..300:0.14
81 $1.88+00511
20,32::344
4.1
ABLATION STUDY
Figure shows the experimental result comparisons for CUB200 between the adversary-awar loss function and previous loss function before and after the momentum updating. Given equation [7 the uncertainty of the transition matrix Q is reduced, leading good initialisation for the positive set selection, which a warm start and plays vital role improving the performance contrastive learning. After we have a good set of positive samples, the prototype's accuracy is enhanced. Sub- sequently, leveraging the clustering effect and the high-quality representation power of the positive sample set of contrastive loss function to improve the classification performance.
LURZO0, Prototype Accuracy
CUBZZO IOP Llessification
whal' peotiiing acom
Accurayy
Epoch
Epoch
(a)
Ob
Figure 2: The Topl and Prototype Accumnc of the Proposed Method and the Method in Wang et al. 2022 CIB2200 Adversary-Awart Loss Comparison.
CONCLUSION AND FUTURE WORKS
This paper introduces novel Adversary-Aware partial label learning problem. The new problem setting has taken local data privacy protection into account. Specifically, we have added the rival to the partial label candidate set encryption for the dataset. Nonetheless, the generation process has made the intractable transition matrix even more complicated, leading to an inconsistency issue. Therefore, the novel adversary-aware loss function and the self-attention prototype are proposed. The method is proven to be provable classifier and has shown superior performance. Future work will variational inference methods approximate the intractable transition matrix.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Peter I. Bartlett and Shahar Mendelson. Rademacher and gaussian complexities: Risk bounds and structural results. Journal of Machine Learning Research, 3(Nov):463 482, 2002.
Brian Chen, Bo Wu, Alireza Zarcian, Hanwang Zhang, and Shih-Fu Chang, General partial label learning via dual bipartite graph autoencoder. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pp. 10502- 10509, 2020.
Timothee Cour, Ben Sapp. and Ben Taskar. Learning from partial labels. The Journal of Machine Learning Research, 12:1501-1536, 2011.
Lei Feng and Bo An. Partial label learning with self-guided retraining. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 33, pp. 1342-3549, 2019.
Lei Feng, Jiaqi Lv, Bo Han, Miao Xu, Gang Niu, Xin Geng, Bo An, and Masashi Sugiyama. Prov- ably consistent partial-label learning. Advances Neural Information Processing Systems, 33: 10948-10960, 2020.
Bo Han, Quanming Yao, Xingrui Yu, Gang Niu, Miao Xu, Weihua Hu, Ivor Tsang, and Masashi Sugiyama. Co-teaching: Robust training of deep neural networks with extremely noisy labels. Advances in neural information processing systems, 31, 2018.
Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 9729-9738, 2020.
Eyke Hüllermeier and Jürgen Beringer. Learning from ambiguously labeled examples. Intelligent Data Analysis, 10(5):419 2006.
Rong Jin and Zoubin Ghahramani. Learning with multiple labels. Advances in neural information processing systems, 15, 2002.
Peter Kairouz, Sewoong Oh, and Pramod Viswanath. Extremal mechanisms for local differential privacy. Advances in neural information processing systems, 27, 2014.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Junnan Li, Pan Zhou, Caiming Xiong, and Steven CH Hoi. Prototypical contrastive learning of unsupervised representations. arXiv preprint 2006:20005,04966,, 2020.
Liping Liu and Thomas Dietterich. conditional multinomial mixture model for superset label learning, Advances in neural information processing systems, 25, 2012.
Liping Liu and Thomas Dietterich. Learnability of the superset label learning problem. Interna- tional Conference on Machine Learning, pp. 1639-1637. PMLR, 2014.
Jiaqi Lv, Miao Xu, Lei Feng, Gang Niu, Xin Geng, and Masashi Sugiyama. Progressive identifica- tion of true labels for partial-label learning. In Hal Daumé III and Aarti Singh (eds.), Proceedings of the 37th International Conference on Machine Learning, volume I 119 of Proceedings of Ma- chine Learning Research, pp.
PMLR, 13-18 Jul 2020.
Gengyu Lyu, Songhe Feng, Tao Wang, Congyan Lang, and Yidong Li. Gm-pll: graph matching based partial label learning. IEEE Transactions on Knowledge and Data Engineering, 33(2): 521-535, 2019.
Nam Nguyen and Rich Caruana. Classification with partial labels. In Proceedings of the 14th ACM SIGKDD international conference on Knowledge discovery and data mining, pp. 551-559, 2008
Aaron van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predic- tive coding. arXiv preprint 1 007444 2018.
10

---

Under review as a conference paper at ICLR 2023
Giorgio Patrini, Alessandro Rozza, Aditya Krishna Menon, Richard Nock, and Lizhen Qu Making deep neural networks robust to label noise: A loss correction approach. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 1944-1952, 2017.
C. Wah, S. Branson, P. Welinder, Perona, and S. Belongie. Caltech-uesd b0r22-200-2011. Techni- cal report, 2011.
Haobo Wang, Yuzhou Qiang, Chen Chen, Weiwei Liu, Tianlei Hu, Zhao Li, and Gang Chen. On- line partial label learning. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pp. 455-470. Springer, 2020.
Haobo Wang. Ruixuan Xiao, Yixuan Li, Lei Feng. Gang Niu, Gang Chen, and Junbo Zhao. Pico: Contrastive label disambiguation for partial label learning. ICLR, 2022.
Tongzhou Wang and Phillip Isola. Understanding contrastive representation learning through align- ment and uniformity on the hypersphere. In International Conference on Machine Learning, pp. 9929-9939. PMLR, 2020.
Stanley I. Warner. Randomized response: A survey technique for eliminating evasive answer bias. Journal of the American Statistical Association, 60(309):63-69, 1965.
Hongwei Wen, Jingyi Cui, Hanyuan Hang. Jiabin Liu, Yisen Wang, and Zhouchen Lin. Leveraged weighted loss for partial label learning. In Marina Meila and Tong Zhang (eds.), Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedings of Machine Learning Research, pp. 11091-11100. PMLR, 18-24 Jul 2021.
Xiaobo Xia, Tongliang Liu, Nannan Wang, Bo Han, Chen Gong, Gang Niu, and Masashi Sugiyama. Are anchor points really indispensable in label-noise learning? Advances in Neural Information Processing Systems, 32:6838-66 (16688886699,..88 2019.
Ning Xu, Jiaqi Lv, and Xin Geng. Partial label learning via label enhancement. In Proceedings of the AAAI Conference Artificial Intelligence, volume 33, pp. 5557-5564, 2019.
Ning Xu, Congyu Qiao, Xin Geng, and Min-Ling Zhang. Instance Instance-dependent partial label learning. Advances in Neural Information Processing Systems, 34, 2021.
Xiyu Yu, Tongliang Liu, Mingming Gong, and Dacheng Tao. Learning with biased complementary labels. ECCV, pp. 68 83,, 2018
Min-Ling Zhang, Bin-Bin Zhou, and Xu- Ying Liu. Partial label learning via feature-aware disam- biguation. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 1335-1344, 2016.
Tong Zhang. Statistical analysis of some multi-category large margin classification methods. Journal of Machine Learning Research, 5(Occ): 12511 2004.
Zhi-Hua Zhou. brief introduction weakly supervised learning. National science review, 5(1): 44-53, 2018.


Reviews:
[{"review_id": "qpaobDqkGM", "reviewer": "Reviewer_reQY", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors proposed a novel problem setting of adversary aware partial label learning (PLL) and a novel solution including an adversary aware loss and immature teacher within momentum (ITWM) to solve it. Theoretical analysis are presented and some empirical results are reported.", "summary_of_the_review": "My major concern for the paper in its current form is the writing. Without properly rewriting the entire paper, I can hardly recommend a higher score. If the authors are willing to polish the writing significantly during rebuttal, I'm happy to have another read and adjust my recommendation accordingly.", "strength_and_weaknesses": "Strengths:\n\n1. The problem setting is a new interesting direction, and a solution is also presented to pave way to a new research area, with potentially profound implications in privacy enhancing PLL.\n\nWeaknesses / Major Concerns:\n\n1. My primary concern is the presentation of the paper. The current writing is very convoluted with too many concepts, without being proper introduced first. For example, the authors talk about the problem setting in Sec 1 (Page 2), but many notations were not introduced until Sec 1.2 (Page 3). Moving on, some challenges with respect to the proposed problem setting are discussed on Page 2, but it is very unclear and hard to follow (see point 2 below). With all the doubts (as a reader who hasn't read every single reference), the problem is set in Sec 1.2 (Page 3) without proper justifications (see point 3 below).\n2. Given the current writing, I find it very hard to understand the motivation of the work when reading through Sec 1 (Page 2). To give a few examples, why is the assumption that the rival is generated depending only on Y but instance X (e.g. simplification for theoretical analysis, or intractability, or practicality)? Why does the inclusion of rival imply an inconsistent classifier according to Eq 2? Then why one cannot obtain consistent classifier due to intractability of \\bar{Q}? How does the proposed ITWM help approximate \\bar{Q} hence the consistency issue? Are there other alternatives one may consider, and why ITWM in particular?\n3. The two main parts of the paper adversary aware PLL (Sec 1.2) and the ITWM algorithm (Sec 2.1) both lack clear explanation. For example, why the choice of the particular form Eq 4 for this problem (e.g. additive instance dependent noise but class dependent transition of rival)? How does the proposed setting extend and differ from Wen et al (2021) (e.g. a dedicated and elaborate section to such related works, or at least in appendix, is much appreciated)? How does instance embedding (\"prototype\") and the introduction of sparse matrix (A) help instead of obtaining true transition matrix (Page 4)? Why the positive sample set which appeared all of a sudden in Sec 1.3 without any mention throughout? In Sec 2.1, ITWM introduced a bunch of new notations that seem very disconnected from the previous texts? Then why does the adversary aware loss combine two terms (Eq 20) and how is the contrastive loss needed?\n4. With all the doubts above, I cannot properly judge the theoretical analysis (Sec 3) or the experiments (Sec 4).", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "ivS9TwUbxyo", "reviewer": "Reviewer_o6Rr", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper presents a novel problem setting named adversary-aware partial label learning. The authors propose an Adversary-Aware loss function and the immature teacher within momentum (ITWM) disambiguation algorithm to tackle this problem.", "summary_of_the_review": "This paper is potentially interesting. However, it contains some immature factors, especially the practical meaning and the handling of adversary, so I think it is not suitable to be accepted currently.", "strength_and_weaknesses": "(+) The proposed new setting is potentially interesting.\n\n(+) The experimental results show that the proposed method is effective.\n\n\n(-) Although the setting, namely adversary-aware partial label learning, is new, I’m not fully convinced by its practical significance and necessity. In other words, do real-world applications really have such problem in partial label learning? Is it possible to provide a *real* case that falls into the scope of this research? \n\n(-) The definitions of “adversary” and “rival labels” need more explanations. To be specific, the name of the setting is “adversary-aware partial label learning”. However, when I read the paper, I notice that the authors only use a transition matrix to describe its relationship with true label. Therefore, I’m not clear what is the meaning of “adversary” here. In fact, even for the random label noise, one may also use a transition matrix to model such relationship. Note that, for adversary, it means one intends to take some measures to degrade the model performance. However, in the developed model, I cannot see how to resist such attack or the so-called “rival label noise”.\n\n(-) The writing needs significant improvement. Many typos can be found. For example, “accordingly to the Eq.equation 17”. Moreover, the writing quality in the sections of model, theoretical analyses, and experiments, is not as good as that in the introduction. \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "2JaH1dInL9", "reviewer": "Reviewer_ctfM", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper introduces a the adversary-aware partial label learning problem to protect the data privacy. The novel adversary-aware loss function, together with an immature teacher within momentum disambiguation algorithm, has achieved state of-the-art performance and proven to be a provable classifier.", "summary_of_the_review": "Please refer to the Strength And Weaknesses.", "strength_and_weaknesses": "Pros:\n* This paper proposes to take the data privacy into account in partial label learning, which is novel and significant in practice.\n\n* The proposed method is smart and easy to follow, referring the idea of self-supervised learning. \n\nCons:\n* The theoretical analysis is based on the fully rank transition matrix. I have a concern about the existence of this condition especially when the noise is very regular.\n\n* I think the rival is essentially a noisy label for PLL. Thus, incorporating the label noise learning methods into the existing PLL methods will be an important baseline.\n\n* Some typos. For example, in the caption of Figure 2, \"the Method inWang et al. (2022)\".\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "0H4z9K9fS2", "reviewer": "Reviewer_8DLJ", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper attempts to proposed a new method for so-called adversary-aware partial label learning (but the definition of this setting is not clear in the whole paper). The proposed method is an incremental improvement on a SOTA partial label learning method.", "summary_of_the_review": "In its current state, the paper is not ready for publication.", "strength_and_weaknesses": "Strengths:\nIt is difficult for me to tell the strengths about this paper because the extremely confusing notation system and language makes it difficult for readers to understand.\n\nWeaknesses:\n1. The paper is poorly written. \nFirstly, the paper does not have a formal definition of the adversary-aware partial label learning problem. From Eq2, the paper seems to introduce a hidden variable $Y'$ to generate the set of candidate labels $\\vec{Y}$, but in the definition on page 4, the generation of $\\vec{Y}$ is only related to the real label $Y$, which is contradictory. I am really confused about how the setting of the paper differs from the classic partial label learning.\nSecondly, most of the notations are not explained. For example, the notions that first appear throughout Sec1.3, $F, \\boldsymbol{w}, \\boldsymbol{v}, \\boldsymbol{u}$ in Sec2.1, etc.\nIn addition, the methodological and theoretical parts of the article are also very vague. Assumption2 and Lemma2 appear out of thin air on page 7.\n2. The methodology section appears to be almost an incremental improvement on PiCo, the only difference being the use of prototypes instead of queues. My bigger confusion is that the proposed method seems to be disconnected from the previous setting, as it does not use $Q$ and it is unclear how to get $T$.\n3. The experiment is not convincing. There is no explanation of how to generate the settings studied in the paper, i.e., adversary-aware partial labels, and the reproducibility of the algorithm is poor.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "1: The main claims of the paper are incorrect or not at all supported by theory or empirical results.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject