Deep Support Vectors
Authors: Junhoo Lee
Hyunho Lee
Kyomin Hwang
Nojun Kwak
Venue: NeurIPS 2024 poster (2024)
Keywords: model inversion
privacy attacks
generative model
dataset distillation
support vector machines
Primary area: machine_vision
TL;DR: This paper finds support vector in deep learning model. These vectors has same characteristics to conventional SVM. It can be used in dataset distillation, global explanation. In its beyond, it can be used as latent generative model.

Abstract: Deep learning has achieved tremendous success. However, unlike SVMs, which provide direct decision criteria and can be trained with a small dataset, it still has significant weaknesses due to its requirement for massive datasets during training and the black-box characteristics on decision criteria. This paper addresses these issues by identifying support vectors in deep learning models. To this end, we propose the DeepKKT condition, an adaptation of the traditional Karush-Kuhn-Tucker (KKT) condition for deep learning models, and confirm that generated Deep Support Vectors (DSVs) using this condition exhibit properties similar to traditional support vectors. This allows us to apply our method to few-shot dataset distillation problems and alleviate the black-box characteristics of deep learning models. Additionally, we demonstrate that the DeepKKT condition can transform conventional classification models into generative models with high fidelity, particularly as latent generation models using class labels as latent variables. We validate the effectiveness of DSVs using common datasets (ImageNet, CIFAR10 and CIFAR100) on the general architectures (ResNet and ConvNet), proving their practical applicability.

Deep Support Vectors
Junhoo Lee
Hyunho Lee Nojun Kwak
Kyomin Hwang
Seoul National University
junoo, hhlee822, kyomin98, nojunk) Benuu ac ac.
ImageNet
Plane
Deer
CIFAR100
Gaalll
Welf
Clock
Ouk Tree
Kangamo
Pappy Prower
Bed
Dolphin
Tractor
Figure 1: Generated images using model trained with the ImageNet, CIFARIO 10, and CIFAR100 datasets, respectively. Each image was generated without referencing the original training data.
Abstract
Deep learning has achieved tremendous success. However, unlike SVMs, which provide direct decision criteria and can be trained with a small dataset, it still has significant weaknesses due to its requirement for massive datasets during training and the black-box characteristics on decision criteria. This paper addresses these issues identifying support vectors in deep learning models. To this end, propose the DeepKKT condition, an adaptation of the traditional Karush- Kuhn- Tucker (KKT) condition for deep learning models, and confirm that generated Deep Support Vectors (DSVs) using this condition exhibit properties similar to traditional support vectors. This allows us apply our method to few-shot dataset distillation problems and alleviate the black-box characteristics of deep learning models. Additionally, demonstrate that the De condition can transform conventional classification models into generative models with high fidelity, par- ticularly latent generative models using class labels as latent variables. We validate the effectiveness of DSVs using common datasets (ImageNet, CIFAR10 and CIFAR 100) on the general architectures (ResNet and ConvNet), proving their practical applicability. (See Fig.
Introduction
Although deep learning has gained enormous success, it requires huge amounts of data for training. and its black-box characteristics regarding decision criteria result in lack of reliability. For example, CLIP [24] needs 400 million image pairs for training and Stable Diffusion XL (SDXL) [25 requires
CCoresspodiigg Author
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

5 billion images. This implies only a small number of groups can train foundation models from scratch. Also, the black-box nature makes it hard anticipate the model's performance in different environments. For example, suppose we are to classify pictures of deer and most training deer images contain antlers. For the test images taken in winter, the performance will be worse as deer shed their antlers in winter. As modern deep learning models do not provide any decision criterion i.e, black box, we cannot determine whether the domain of the model has shifted, or the model is biased in advance, thus cannot anticipate the performance drop in this case.
Interestingly, these problems do not occur in previous state-of-the ofttt---rt support vector machines (SVMs), which require substantially less data, enabling almost anyone to train a model from scratch. Also, as encodes the decision boundary explicitly, SVM can reconstruct the support vectors from the training dataset using the KKT condition. Since it is white box. one can anticipate the test's s performance in advance. In the deer classification example, if the model's support vectors of deer have prominent antlers, using that SVM is not appropriate for photos taken in winter.
In this paper, we tackle the natural limitations of deep learning - the need for large data and black-box characteristics - by extracting SVM features in deep learning models. In doing so, we introduce the KK condition for deep models, which corresponds SVMs. By either selecting deep support vectors (DSVs) from training data or generating them from already trained deep learning models, we show DSVs can play similar role to conventional support vectors. Like support vectors can reconstruct SVM, we can reconstruct the deep models from scratch only with DSVs. Also, we show that DSVs encode the decision criterion visually, providing a global explanation for the trained deep model. Expanding beyond conventional support vectors, DSVs suggest that a trained deep classification model can also function as a latent generative model by utilizing logits as latent variables and applying DeepKKTT conditions.
the KKT condition in traditional
To this end, we generalize the KKT condition and define the DeepKKT condition considering that the data handled by a deep model is nigh-ddmeensionl and multi-class. We demonstrate that the selected data points (selected DSVs) among the training data satisfying the DeepKKT condition are closer to the decision boundary than other training data, as evidenced by comparing entropy values. Also, we show that the calculated Lagrangian multiplier can reveal the level of uncertainty of the model for the sample in question. Additionally, we demonstrate that the DSVs outperform existing algorithms in the few-shot dataset distillation setting, where only a portion of the training set is used, indicating that DSVs exhibit characteristics similar to SVMs. Moreover, we confirm that modifying existing images using information obtained from DSVs allows us to change their class at will, verifying that DSVs can meaningfully explain the decision boundary. Finally, by using soft labels as latent variables in ImageNet, we generate unseen images with high fidelity.
Our contributions are as follows:
By generalizing the KKT condition for deep models, we propose the DeepKKT condition to extract and ResNet.
Deep Support Vectors, which are applicable to general architectures such as ConvNet
We verify that DeepKKT can be used to extract and generate DSVs for common image datasets such as CIFARIO, CIFAR100, 100, SVHN, and ImageNet.
DSVs are better than existing algorithms in few-shot dataset distillation problems.
DTepKKT acts novel model inversion algorithm that be applied in practical situations.
By using the DeepKKTT condition, we only show the trained deep models can reconstruct data, but also can serve as latent generative models by using logits as latent.
2 Related Works
2.1 SVM in Deep Learning
Numerous studies have endeavored to establish a connection between deep learning and conventional SVMs. In the theoretical side, [28] demonstrated that, in an overparameterized setting with linearly separable data, the learning dynamics of a model possessing logistic tail are equivalent to those of a support vector machine, with the model's normalized weights converging towards a finite value, Following this, [15] extended this equivalence to feedforward networks. This line of research relies on strong assumptions such full-batch training and non-residual architecture without data

---

augmentation. There also exists body of work on integrating SVM principles into deep learning, often referred as DeepSVM. aiming to leverage SVM's desirable properties [3 29 23 21]. DeepSVM integrates SVM components, specifically using them feature extractors to derive meaningful, human-crafted features.
In contrast, our work does not modify or incorporate SVM architectures. Instead, we focus on identi- fying support vectors directly within deep learning models, thereby bridging the gap between deep learning and support vector machines in a more fundamental manner. Despite these advancements, there remains a lack of research that directly connects support vectors through theoretical lens of equivalence. In this study, we address this gap by introducing the DeepKKT condition, a KKT condition tailored for deep learning, allowing us apply the concept of support vectors in a practical deep learning context.
We show that reconstructing support vectors in deep models is indeed feasible, and obtaining high- quality support vectors is achievable under much less restrictive conditions compared to prior work.
2.2 Model Inversion Through the Lens of Maximum Margian
There is a line of research utilizing the stationarity condition, part of the KKT condition, for model inversion. [ firstly exploited the KKT condition for model generation, adopting SVM-like architectures. They normally conducted experiments with binary classification, 2-layer MLP, and full-batch gradient descent. [] extended these experiments to multi-label classífication by adapting their existing architecture to a multi-class SVM structure. To ensure the generated samples lie on the data manifold, they initialized with the dataset's mean, implying the adoption of some prior knowledge of the data. Similarly, [34] generated images through the stationarity condition, also adopting the mnca-inittallizatoon and conducting experiments on the CIFARIO (II, MNIST [4] and downsampled CelebA [4] datasets. Their work generally focused on fow-dimensional, labeled datasets with a small number classes such as CIFAR10 and MNIST, consistent with the traditional SVM setting of binary-labeled low- low-dimensional datasets. In contrast, extended our experiments to figh-dimensiones datasets with many classes, an area traditionally dominated by deep learning. Specifically, we conducted experiments ImageNet (26 using pretrained ResNet50 model following the settings described in the original paper
Furthermore, previous works have concentrated on reconstructing the training dataset. In contrast, similar to generative models, our work focuses on generating unseen data from noise using a classification model. Additionally, we emphasize the original meaning of 'support vectors'. Unlike other approaches, our Deep Support Vectors (DSVs) adhere to the traditional role of support vectors: they explain the decision criteria, and small number of DSVs can effectively reconstruct the model.
2.3 Dataset Distillation
Dataset distillation 2 31 13 fundamentally aims to reduce the size of the original dataset while maintaining model performance. The achievement also involves addressing privacy concerns and alleviating communication issues between the server and client nodes. The dataset distillation problem is typically addressed under the following conditions: I) Access to the entire dataset for gradient matching. 2) Possession of snapshots from all stages of the model's training phase, which are impractical settings for practical usage [12). Furthermore, these algorithms typically require Hessian computation, which imposes a heavy computational burden.
In SVM, the model can be reconstructed using support vectors. This reconstruction is more practical compared to previous dataset distillation methods, it does not require any of the restrictive conditions. Likewise, because Deep Support Vectors (DSVs) also do not require these conditions and are Hessian-free, they can play the role of distillation under practical conditions.
3 Preliminaries
3.1 Notation
In the SVM formulation, w(:= [w:; b)) represents the concatenated weight vector w and bias b. Each data instance, expanded to include the bias term, is denoted by (;(:= [m:; 1]), while the corresponding binary label is represented by y4 {+1). The Lagrange multipliers are denoted by ag's. 's.
3

---

Transitioning to the context of deep learning, we denote the Parameter vector of neural net- work model by 8, which, upon optimization, yields 0* the set of learned weights. The map- ping function (x,;;; 0) represents the transformation of input data into C-dimensional logit a C-class classification problem in manner dictated by the parameters 0, i.e., $(x;;; 0) { (ar4; 0), ... ( 0)] E TRC We define the score as the logit of target class, i.e., Py, (m1 0). the score is the largest among logits, i.e., arg max, & Lo(z;; 0) yi, then it correctly classifies the sample. The Lagrange multipliers adapted to the optimization in deep learning represented by A s. (a, y) denotes a pair input and output and I is the index set with [Z] = n.
3.2 Support Vector Machines
The fundamental concept of Support Vector Machines (SVMs) is to find the optimal hyperplane that classifies the given data. This hyperplane is defined by the closest data points to itself known as support vectors, and the distance between the support vectors and the hyperplane is termed the margin. The hyperplane must classify the classes correctly while maximizing the margin. This leads to the following KKT conditions that an SVM must satisfy: (1) Primal feasibility: Vi, yow I; > 1, (2) Dual feasibility: Vi, a; 2 O. (3) Complementary slackness: 0s (y:w I; 1) = and (4) Stationarity: w Σm=1 a,y,
The primal and dual conditions ensure these critical values correctly classify the data while being outside the margin. The complementary slackness condition mandates that support vectors lie on the decision boundary. The stationarity condition ensures that the derivative of the Lagrangian is zero.
The final condition, stationarity, offers profound insights into SVMs. It underscores that support vectors encode the decision boundary w. Consequently, identifying the decision hyperplane in SVMs tantamount pinpointing the corresponding support vectors. This implies that with trained model at our disposal, we can reconstruct the SVM in two distinct ways:
1. Support Vector Selection: From the trained model, training data that inherently encode the decision hyperplane.
extract support vectors among the
2. Support Vector Synthesis: even in the absence of a training set, which can effectively represent the decision hyperplane by generating samples that satisfy jù = 1.
Alternatively, it is feasible to generate or synthesize support vectors,
4 Deep Support Vector
This section presents the specific conditions that DSVs (Deep Support Vectors) must satisfy and discusses how to get an optimization loss meet these conditions.
4.1 DeepKKT
SVM's Relationship with Hinge loss We start our discussion by focusing on the hinge loss, continuous surrogate loss for the primal feasibility, and its gradient:
Hinge Loss: (2 M65 w)
max -- (.)),
(I)
0,
if De f 5.) 21 otherwise.
VELn
π
With Eq. (1) the stationarity condition of SVM becomes
w
a v L. s.l. a; 200.
(2)
Generalization conventional KKT conditions this paper, we extend the KKT conditions
to deep learning. In doing so, the two main hurdles of a deep network different from linear binary SVM are the nonlinearity of (b () taking the role of nh 7, and multi-class nature of a deep learning model.

---

img/cls
ratio (%)
Random
selected DSVs
50
46.16
1.93
48.91 = 0.90
10
0.2
30.08 + 1.96
33.69 = 2.05
0.02
14.26 0.99
16.83 = 0.29
Table I: In coreset selection benchmarks using the CIFAR-I0 dataset, the De condition is used as the selection criterion. Images with the highest À for each class were chosen to train network.
Considering that the role of the primal feasibility condition is to correctly classify x; into yi, we can enforce the score Ly, (2,;;) for the correct class yi to take the maximum value among all the logits with some margin e, i.e., T y. (z;;0")
max a $c(m;;'') 2c
cFvIcE|[]
We can relax this discontinuity with a continuous surrogate function - -( (x, 8-), y/), which the negative loss function maximize. Note that if we take the cross-entropy loss for L, it becomes
Loe = (xs; 0²) - log Σ exx;(0((x;;0"))
cml
which takes a similar form as Eq. 3 and the negative loss can be maximized to meet the condition.
Now that we found the analogy between y, ā; and - ((,(( ),),,,) y Valy a+)) corresponds to - - a L( (2;;;" ), Thus, the stationary condition w Σi= i=1 auyi; in SVMs can be translated into that of deep networks such that
12
0"
L
(5)
This condition is generalized formulation of Eq. where substitute the linear model i with a nonlinear model (2: f),, and the binary classification hinge loss L, with multi-class classification loss L. Furthermore, the stationarity condition reflects the dynamics of overparameterized deep learning models. We provide an analogy with respect to (28) in Appendix
However, these conditions are not enough for deep learning. As mentioned before, we are interested in dealing with high dimensional manifolds. Compared to the problems dealt with in the classical SVMs, the input dimensions of deep learning problems data are likely to lie along low-dimensional latent manifold M inside the high- high-dimensional space. To make generated sample be a plausible DSV, it not only should satisfy the generalized KKT condition but also should lie in an appropriate data manifold, i.e,, I E M.
typically much higher. In this case, the
Finally, we can rewrite the new DTT condition as follows:
Primal feasibility:
ViEI,
arg max &c(x,;
Dual feasibility:
ViEI, 220
n 0t Σ (
(6)
Stationarity:
Manifold:
Vi E.M.
4.2 Deep Support Vectors, From Dust to Diamonds
Sec. 4.1 exxlored the KKT conditions in the context of deep learning and how these conditions can be used to formulate a loss function. It is important to note that our goal is not to construct the model Φ but rather to generate support vectors of an already-trained model t with its parameter d".
To reconstruct support vectors from trained deep learning model, sampling or synthesizing support vectors is essential. By replacing the optimization variable with x, we shift our focus to utilizing the DeepKKT conditions for generating or evaluating input rather than 0. This adjustment necessitates consideration of the data's 's inherent characteristics, specifically its multiclass nature and the tendency of the data to reside on lower-dimensional manifold in an ambient space.
5

---

1.2
card
900096
Entroyy
Panggorccl/cuuua Accuracy
0.6
0.4
0.2
0781
-100%
Time Elapsed
across categories
Figure 2: Characteristics of DSVs; (Left) Entropy change of DSV candidates over time, (Right)
Correlation between classwise mean accuracy and the sum X's
Primal Feasibility Firstly, the primal feasibility condition in Eq. 66) mandates support vectors be correctly classified by the trained model 0", As presented in Sec. instead of Eq. (3), we use surrogate function for the loss:
Lerimal TI Σ Lis where
0 L, 4- ( (L(((a;;)) v))
arg max, Pe(m;; y/i, (7)
otherwise.
This designed match the primal condition by mimicking the Hinge loss. When each DSV is correctly classified, no loss is incurred. Otherwise, we adjust the DSVs to align them with the correct target, effectively optimizing the support vectors. This approach also implicitly enforces the complementary slackness condition, as L, decreases confidence in the incorrect classification.
Here, can be any loss function and have employed the cross-entropy loss in experiments.
Stationarity Secondly, the stationarity condition can be used directly as a loss function. Since we extracting DSVs from the trained model ((: (())), construct this loss follows:
Latat D(O", Σ AoVo (')))))
(8)
For the distance measure D, any metric can be used; we have chosen use the l distance suppress the effect of outliers. It is crucial to remember that our objective is to find DSVs and the optimization done for the primal and dual variables z; and A; and not for the parameter 0. For this, we require one forward pass and two backward passes; one for VoL and the other for V., D. The overall computational cost is quite low, as we optimize only a small number of samples.
Moreover, as shown in Algorithm | (Appendix H we satisfy the dual condition by ensuring the Lagrange multipliers A; are greater than zero and disqualify any x; 's from being support vector candidate if during optimization X; becomes less than zero. The condition that is not explicitly satisfied the complementary slackness. To directly fulfill the functional boundary for support vectors specified in Sec. 3.2 we would need to be able to calculate the distance between functions, which is not only abstract but also requires a second-order computation cost. Therefore, we adopted a relaxed version of the KKT conditions that excludes this requirement. Furthermore, as demonstrated in Sec. J. we have shown that DSVs implicitly satisfy the complementary slackness condition. This implies that DSVs meet every condition introduced in conventional SVM.
Manifold Condition: Reflecting Righ-Dimensional Dynamics of Deep Learning As modern deep learning deals with extremely high- sethdimensional spaces, imposing additional constraints other than the primal feasibility and stationarity conditions is needed so that DSVs reside in the desired data manifold. To achieve this, we add manifold condition, which enforces that the DSVs lie on the data manifold. By selecting DSVs that are the intersection of the solution subspace and the data manifold,
properly represent both the model and the training dataset.
To extract DSVs from manifold, we assume that the model well-trained, meaning it maintains consistent decisions despite data augmentation. In other words, the model should classify DSVs invariantly even after augmentation. To ensure this, we enforce that the augmented DSVs (A(x) where A denotes augmentation function) also meet the primary and stationarity conditions.

---

Also, we exploit traditional image prior [3 16), total variance Lut and size of the norm Lnorm to make DSVs lie in the data manifold. Lia is calculated by summing the differences brightness between neighboring pixels, reducing unnecessary noise in an image, and maintaining natural appearance. Tnorms taking similar role, penalizes the outlier and preserves important pixels.
Finally our DSV is obtained as follows where EA represents expectation over augmentations:
DSV arg min E.A (usatioonnri (A(x)) + f1 Trimmal (miima(((()))) + B2 (x) + Bg Tnomm (+))
One might wonder if there is better sampling strategy than using DSVs, such as sampling far from the decision boundary instead of near it. We argue that in a high-dimensional data manifold, most data points are located close the decision boundary because, data-scarce, high-dimensional space, every sample matters and thus would serve as DSV.
Experiments
5.1 DSVs: Revival of Support Vectors in Deep Learning
DSVs meet SVM characteristics As discussed in Sec- the principle of complementary slackness within the KKT conditions suggests that support vectors should be situated on the decision boundary, implying that support vec- tors typically exhibit high uncertainty from probabilistic perspective, i.e., they possess high entropy. While KT does not explicitly incorporate the complementary slackness condition due to computational costs and ambiguity. Fig. 2a suggests that DSVs implicitly fulfill this condition; During the training process, observe increase in the entropy of DSV candidates, hinting that the generated DSVs are close to the decision boundary.
tion 3.2 2
('deor")
('aa]]
(dog'))
(catt)
('deer')
In addition, we can infer the importance decision process by utilizing the DeepKKT condition. We trained the Lagrangian multiplier! À for each test image. Fig- ure showws a strong correlation between the sum of À values for each class and its test accuracy. This finding is intriguing because, despite the model achieving nearly 100% accuracy during training due to overparameterization, DSVs provide insights into categorical generalization in the test phase. Not only does measuring its credibility indicate that a large X refers to 'important' image for training, but À could also serve as a natural core-set selection measure. Table this be true. On the CIFAR-10 [1I] dataset, we selected images with high À values and retrained the network with the selected images. In this case, the selected DSVs show higher acccuracies compared random selection. This characteristic resembles that of support vectors, as the model can be reconstructed with support vectors.
sample in the
("Flower')
(Doeer')
Figure 3: Model predictions for orig- inal versus DSV-informed edited im- ages. (Top) Images were altered man- ually based on decision criteria de- rived from DSVs, influencing the model's prediction. (Bottom) Images were altered based on DeepKK'T loss.
F demonstrates the high fidelity of the generated DSVs, providing practical evidence that these DSVs lie the data manifold. Similar to how support vectors reconstructed in SVM, the DeepKKT condition enables the reconstruction of these vectors without referencing training data. This shows the effectiveness and adaptability of our DeepKKT in capturing key data features.
DSVs for Few Shot Dataset Distillation Deep emerges pioneering algorithm tailored for practical dataset distillation. DSVs addresses two critical concerns: 1) Protecting private information through data synthesis, and 2) Reducing the communication load by minimizing the size of data transmission. Traditional distillation algorithms encounter fundamental paradox; as data predomi- nantly originate from edge devices like smartphones [18 17 10,, the requirement to access the entire dataset introduces significant communication overhead and heightens privacy concerns.
7

---

img/cls shot/class
ratio (%)
DC 37
DSA 351
DM 33
DSVs
0
21.68 + 0.80
0.02
16.4810.81
15.41
13.0310.15
22.69 - 0.38
10
0.2
19.66+0.77
21.15+0..58
22.42:+0.43
50
25.90=00.2
26.01
24.42:+0.29
500
28.06:#0.61
28,20+00.3
25.06=+1.20
30.35 + 0,99
10
0.2
25.06++1.20
26.67++1004
29.77-00666
37.90 + 1.69
10
50
36.44
36,6310.52
36.63
500
10
43.55
44.6610.59
47.96.
39.35 1 0.54
50
50
41.22:10.90
41.29:10.5
48.931
53.56 + 0.73
500
52.00+0.559
52.19+0.53
60.59=0041
Table 2: Performance of Few-shot learning on CIFARIO. 'ing/cls' and 'shot/class' refer to the per-class number of generated images and the training samples used in generating the distilled dataset, respectively. 'ratio" is the ratio of the seen samples among the entire training samples. O shot refers to the distillation task performed without any access the training data.
Our DeepKKT relies solely on a pre-trained model without relying on the training dataset. This unique approach eliminates the need for edge devices to store process large volumes of private data. As shown in Table while traditional methods suffer significant performance drops under these scenarios and are incapable of implementing zero-shot scenarios. Conversely DeepKKT remains effective, requiring only minimal data: a single image per sample (i.e., initialization with real data), or some cases, images at all. For the zero-image setting, initialized the images with data from other datasets to ensure diversity.
DSVs Encode the Decision Criteria Visually Our findings suggest that DSVs not only satisfy the conditions of classical support vectors but also offers a global explanation of visual information.
Fig. 3 expeermmenaalyy verifies our claims and illustrates the practical use of DSVs, e.g., analysis of Fig. Cifar10 reveals the decision criteria for classifying deer, cats, and dogs: 1) DSVs highlight antlers in deer, signifying them distinctive characteristic. 2) Pointed triangular ears are recurring feature DSVs of cats. 3) For dogs, a trio of facial dots holds significant importance. Using these observations, we altered deer's image by erasing its antlers and reshaping its ears to pointed contour, which reduced the model's confidence in classifying it as a deer, and caused the model to misclassify it as cat. Similarly, by smoothing the of a cat image to diminish its classification confidence and then adding antlers or three facial dots, we influenced the model to reclassify the image deer a dog, respectively. Additionally, the DeepKKT-altering supports our assertions. Altering a flower image to resemble deer class by changing the target class in the primal and dual feasibility loss, antlers grew similar
in Fig. Bottom
manipulation.
This discovery holds significant implications about making models responsible; it introduces qualitative aspect assessing model performance. Consider deer classification problem again. The model our study would be less suitable, as evidenced by Fig. CifarICi model's reliance on antlers for identifying deer a feature not present in winter. This shows that DSVs enable us to conduct causal predictions by qualitatively analyzing models, as SVM does.
which indicates
5.2 Unlocking the potential of classifier generator with DeepKKT
Practical Model Inversion with DeepKKT In cloud environments APIs, models are deployed with the belief that although they are sometimes trained with sensitive information, their black-box nature prevents users from inferring the data. This belief makes it pos- sible to deploy sensitive models. However, demon- strated in Fig [ this belief is no longer valid. Fig. E further illustrates that model inversion remains feasible even in practical scenarios such as transfer learning scenarios, where only specific layers of foundation model are fine-tuned Remarkably, DeepKKT condi-
Figure 4: DSVs generated by model that underwent transfer learning from CIFAR- 10 to SVHN. During transfer learning, only the last layer is updated by SVHN.

---

Balloon Spaniel
Scottish Dog Sink
Shield & Dumbbell
Harp & Lobster
Balloon
Spaniel
Lobster
Harp
Yacht
Scart
Scuba Diver
Ladybug
Dugong
Brown Bear
Figure 6: (Top) Generated DSVs using soft labels: ō was set 0.6, i.e., soft label 0.4ytn + 0.6ygight-
(Middle) Examples latent (soft-label) interpolation. (Bottom) Image Editing through latent.
tions enable model inversion even in these challenging environments, suggesting that they can be applied to subset of the parameter space rather than the entire parameter space i.e., more relaxed condition.
Classifier as Latent generative model Considering the impressive capabilities of DSVs in image generation domain, and the geometric interpretation that DSVs samples near the decision boundaries, is noted that enforcing the DeepKKT condition resembles the diffusion process. In each iteration, the DSV develops through the DeepKKT condition follows:
Ft+1 = 3e - (A (xt) + Bo Tnorm (I+)] + 31 V Spprmaa (A(x:))))
(10)
This is similar to the generalized form of the score-based diffusion process:
1++1 Fz - (V, logp(x;) vV logp(y(<z))
(11)
The first three loss terms Eq. (TO) aim to maximize
the score (V, log p(xx)), while the last term, the pri- mal feasibility term, corresponds to the guidance term
primal
lo p(y(=:))) ()) As shown in Fig. 5 when only the primal loss term is used, meaningful DSV samples not generated. This indicates that the other losses (stationarity and manifold terms) function update the image towards manifold i.e., score function. From this perspective, an arbitrarily assigned label can be used latent variable for guidance.
stationarity
Figure Results showing DeepKKT im- ages created solely by the primal condition by the stationary condition. A sole usage of the primal condition shows low fidelity.
To experimentally verify this, we performed a latent interpolation task and image editing, which is common

---

in generative models 8 By mixing different labels (y: (1 8)8a + .ys. where ya # yb), we generated DSVs depicted Fig. 6 When generating DSVs with these mixed soft labels, the generated DSVs semantically represent the midpoint between the two classes. A generated DSV either simply contains both images (the case of "balloon" " and "spaniel") or semantically 'fuse" objects (the case of "lobster" and "harp", producing an image of a harp made out of lobster claws). For the image editing task, we assigned the latent variable to the desired class and then aligned the image using DeepKKT loss. The result was quite surprising: the method successfully transferred the image to the desired class while maintaining the original structure. For example, the sail yacht was seamlessly transformed into the shape of scarf. This task was impossible with other methods; in diffusion models, for instance, a mask would be needed to edit the image seamlessly.
The fact that the generated images correctly merge the semantics of the classes suggests a couple of significant implications: 1) 1) New Generative Model: This approach offers new type of generative model as an alternative to GANs and diffusion models. It can handle the same task without the need for training a specific model, as leverages existing classification models for generative purposes. Furthermore, it is lightweight compared to diffusion models. For example. the model size of a pretrained ResNet50 for ImageNet is only one-twentieth of that for SDXL (25), DSVs show potential to leverage existing classification models for generative purposes. 2) Exploration of Classification Model Generalization: Unlike other generative models, classification models are trained simply predict the label of an image. Yet, in latent interpolation and editing tasks, they demonstrate an understanding of semantics. This implies that, despite being trained to memorize class labels, the models grasp the overall semantics of the dataset. As they can generate scemingly unseen samples by interpolation and editing.
Conclusion
In this paper. we redefined support vectors nonlinear deep learning models through the introduction of Deep Support Vectors (DSVs). We demonstrated the feasibility of generating DSVs using only pretrained model, without accessing to the training dataset. To achieve this, we extended the KKT (Karush-Kuu Juhn--uucer) conditions to DeepKKT conditions and the proposed method can be applied to any deep learning models.
Akin to SVMs. the DeepKKT condition effectively encodes the decision boundary into DSVs. DSVs can reconstruct the model, making them useful for dataset distillation. Additionally, their visual encoding of the decision criteria can serve as a global explanation, helping to understand the model's overall behavior and decisions. Furthermore, the DeepKKT condition transforms classification model into a generative model with high fidelity. Not only can it sample data, but it also generalizes well, allowing the use of labels latent variables.
10

---

Acknowledgement
Thank you for Hyunjin Kim, Wonhak Park, and Yeji Song for detailed discussion and feedback. This work was supported by NRF grant (2021R1A2C3000 (2C3300665) and IITP grants (RS-2022-11220953, RS-2021-11211333, all funded by MSIT of the Korean Government.
References
[1] Gon Buzaglo, Niv Haim, Gilad Yehudai, Gal Vardi, and Michal Irani. Reconstructing training data from multiclass neural networks, 2023.
[2] George Cazenavette, Tongzhou Wang, Antonio Torralba, Alexei A. Efros, and Jun-Yan Yan Zhu, Dataset distillation by matching training trajectories. In Proceedings of the IEEE/CVE Confer- ence on Computer Vision and Puttern Recognition (CVPR) Workshops, pages 4750-4759, June 2022.
[3] Yunjey Choi, Minje Choi, Munyoung Kim, Jung- Woo Ha, Sunghun Kim, and Jaegul Choo. Stargan: Unified generative adversarial networks for multi-domaie image-to maage-to-image translation, 2018.
[4] Li Deng. The mnist database of handwritten digit images for machine learning research. IEEE Signal Processing Magazine, 29(6):141-142, 2012.
[5] Ian J. Goodfellow, Yoshua Bengio, and Aaron Courville. Deep Learning. MIT Press, Cambridge,
MA, USA, 2016.
[6] Niv Haim, Gal Vardi, Gilad Yehudai, michal Irani, and Ohad Shamir. Reconstructing training data from trained neural networks. In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho, editors, Advances in Neural Information Processing Systems, 2022.
[7] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. CoRR, abss/5112.n abs/155 2015.
[8] Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. CoRR, abs/1812.04944. 2018.
[9] Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint 1rXiv:1412.6980, 2014.
[10] Jakub Konečný, H. Brendan McMahan, Daniel Ramage, and Peter Richtárik. Federated op- timization: Distributed machine learning for on-device intelligence. CoRR, abs/1610.02527,, 2016.
[11] Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, 2009.
[12] Hyunho Lee, Junhoo Lee, and Nojun Kwak. Practical dataset distillation based on deep support vectors, 2024.
[13] Songhua Liu, Kai Wang, Xingyi Yang, Jingwen Ye, and Xinchao Wang. Dataset distillation via factorization. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors, Advances in Neural Information Processing Systems, volume 35, pages 1100-1113. Curran Associates, Inc., 2022.
[14] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In 2015 IEEE International Conference on Computer Vision (ICCV), pages 3730-3738, 2015.
[15] Kaifeng Lyu and Jian Li. Gradient descent maximizes the margin homogeneous neural networks. In International Conference Learning Representations, 2020.
[16] Aravindh Mahendran and Andrea Vedaldi. Understanding deep image representations by inverting them. CoRR, abs/1442.0005, 2014.

---

[17] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Commumication-eefiee efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics, pages 1273-1282. PMLR, 2017.
[18] H. Brendan McMahan, Eider Moore, Daniel Ramage, and Blaise Agüera y Arcas. Federated learning of deep networks using model averaging. CoRR, fbss/1602.06629, 2016.
[19] Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Univer- sal adversarial perturbations. CoRR, abs/1 110.00801 2016.
[20] Yuval Netzer, Tao Wang. Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
[21] Onuwa Okwuashi and Christopher E. Ndehedehe, Deep support vector machine for hyperspec- tral image classification. Pattern Recognition, 103:107298, 2020.
[22] Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Köpf, Edward Z. Yang. Zach Vito,o, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. Pytorch: An imperative style, high-performanc deep learning library. CoRR, abss/912.01111 2019.
[23] Zhiquan Qi, Bo Wang, Yingjie Tian, and Peng Zhang. When ensemble learning meets deep learning: new deep support vector machine for classification. Knowledge-Bast Based Systems, 107:54 60, 2016.
[24] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agar- wal. Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. CoRR, abs/2103.00020, 2021.
[25] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684-10695, 2022.
[26] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma. Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael S. Bernstein, Alexander C. Berg, and Li Fei- Fei. Imagenet large scale visual recognition challenge. CoRR, abs/1409.0574 2014.
[27] Hichem Sahbi. Totally deep support vector machines. CoRR,
2019.
(28) Daniel Soudry, Elad Hoffer, Mor Shpigel Nacson, Suriya Gunasekar, and Nathan Srebro. The implicit bias of gradient descent on separable data. In International Conference on Learning Representations (ICLR), Vancouver, BC, Canada, 2018. Poster presented ICLR 2018
[29] Yichuan Tang. Deep learning using linear support vector machines. 100.0993,....9. 2013.
arXiv preprint
[30] Jingyuan Wang, Kai Feng, and Junjie Wu. Svm-based deep stacking networks. In Proceedings of the AAAI conference on artificial intelligence, pages 5273-5280, 2019.
[31] Tongzhou Wang, Jun-Yan Zhu, Antonio Torralba, and Alexei A Efros. Dataset distillation. arXiv preprint arXiv: 10959, 2018.
[32] Han Xu, Yao Ma, Haochen Liu, Debayan Deb, Hui Liu, Jiliang Tang, and Anil K. Jain. Adver- sarial attacks and defenses in images, graphs and text: A review, 2019.
[33] Hongxu Yin, Arun Mallya, Arash Vahdat, José M. Álvarez, Jan Kautz, and Pavlo Molchanov. See through gradients: Image batch recovery via gradinversion. CoRR, abs/2104.07588. 2021.
[34] Runpeng Yu and Xinchao Wang. Generator born from classifier. In Thirty-seventh Conference on Neural Information Processing Systems, 2023.
[35] Bo Zhao and Hakan Bilen. Dataset condensation with differentiable siamese augmentation. CoRR, abs/2102.08259, 2021.
12

---

[36] Bo Zhao and Hakan Bilen. Dataset condensation with distribution matching, CoRR, abs/2110.04181, 2021.
[37] Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. Dataset condensation with gradient matching. CoRR, htss/2006.05929, 2020.
13

---

A Societal Impacts
Our paper is closely related to Responsible AI (RAT), especially in enabling qualitative assessments of models. Our approach provides visual and intuitive explanations of model's decision-making criteria, offering insights that are both explanatory and responsible. Our approach of utilizing DSVs for RAI enables global explanations, surpassing traditional Explainable AI (XAI) methodologies, which usually focus on local explanations for individual inputs and cannot provide a global decision criterion. Furthermore, since method is based model inversion, it ensures safety and privacy. While the synthesized sets in Fig. might appear similar to the selected sets, they do not replicate generalized decision boundary,
specific sample features. This is because DSVs represent avoiding the inclusion of image-specific features. Consequently, DSVs enable all models using
logistic loss to be more responsible.
plane
car
bird
cat
deer
dog
frog
horse
ship
truck
Figure 7: Comparison of synthesized images (first row) created using the DeepKKT condition initiated from noise, and selected images (second row) from the CIFAR-10 training dataset. The selected images were chosen based on À values, i.e., each image has the highest À in each class. Both synthesized and selected images demonstrate similarity the pixel level sharing common features.
B Limitations and Future work
In this paper, we propose the DeepKKT condition, which can be applied universally to any deep models to generate deep support vectors (DSVs) that function similarly to support vectors in SVMs. However, it should be noted that the equivalence between DSVs in deep learning models and support vectors SVMs is only described intuitively, not rigorously. We have shown experimentally in Fig. and intuitively in Sec. Cu.CCCchy why the DeepKKT condition should be suggested, but we have not derived with rigorous math. Proving this rigorously would be a meaningful research topic.
Sec.C
C Intutive explanation of DeepKKT condition
DeT many conditions make sense, except for one. For instance, primal feasibility condition and the manifold condition are reasonable, and the dual feasibility condition can be regarded as importance sampling. However, the most countcrintuitive part is the stationarity condition:
Lstat D(O",
X ( w.)
(12)
In this section, will explain the dynamics of DSVs in overparameterizee deep network and how is connected to deep learning. Below a quick analogy of (28) to illustrate this connection.
A deep learning model follows the following ODE:
W++1 w: V L(x, yr w.).
(13)
Here, is the learning rate and f is the optimization step. The loss L does not go zero since deep learning models usually exploit loss function with logistic tail, such as the cross-entropy loss, and the gradient of the least confident sample (support vector) dominates overall gradient. Thus, there exists convergence of the gradient direction goo = VL. There also exists time T where the
14

---

W2
W
W1
Too
WT
Wo
Woc
Figure 8: The stationarity condition with logistic loss. Even though the direction of the gradient i converges, the size of the gradient does not go zero. Therefore, the direction of the converged gradient weight ofe aligns with 9.
gradient direction converges Iso for sufficiently small As illustrated in Fig. g toward the direction 9a.. Therefore, io s - 9
moves
This is for what stationarity condition wants to seek. The direction of goos by using only a few support vectors.
D Implementation Details
To obtain the results in Table 2 and Fig. the ConvNet architecture [5] was used for pretraining (:::0) on the SVHN dataset 20), a digit dataset with dimensions similar to CIFAR-10 [[T] For ImageNet, used the ResNet50 model [7] with the original setting in the paper. Specifically, used the pretrained model in torchvision library in pytorch [22]. For visualizing synthesized DSVs in ImageNet, increased the contrast in 224x224 dimensions. When calculating T-gats we averaged the distance per parameter. In Alg. D
y) was set to 5.
To synthesize DSVs in ImageNet, we used translation, crop, cutout, flip, and noise for augmentation, with hyperparameters set to 0. 0.1 0.2, 0.15, 0.5, and 0.01, respectively. In Eq. (9), we set a to 2c-5, 3 to 40, and y to le-6. When calculating Lstationarity. averaged the distance per parameter.
For dataset distillation in Table we used translation, crop, flip, and noise for augmentation, with hyperparameters set to 0.125, 0.2, and 0.5, respectively. In Eq. (9). we set to 2e-3, and both 3 and y to For retraining models with synthesized images, we used learning rate of le-4 while the other parameters set to the default values of the Adam optimizer
To obtain the pretrained weight 0" for CIFAR10 and CIFAR100, chose the ConvNet architec- ture [5] a common choice deep learning. This architecture includes sequential convolutional layers followed by max pooling, and single fully-connected layer for classification. The learning rate was set to 10-& with a weight decay of 0.005 using the Adam optimizer. Additionally, we employed flipping and cropping techniques, with settings differing from those used for DSV's reconstruction to ensure fair comparison. For pretraining & on the Street View House Numbers (SVHN) dataset (20), digit dataset with dimensions similar to CIFAR-10 [ we exclusively trained the fully-connected layer of the CIFAR-10 10 tre-trained ConvNet. This approach resulted in training accuracy of 80%.
E DSVs by Selection
Fig. shows the selected images with large Lagrangian multipliers X's, which correspond to candidates used in Fig. 2b Surprisingly, there is a meaningful match between the selected DSVs and the synthesized DSVs the CIFAR-10 dataset, as shown in Fig. 7 This implies that synthesizing DSVs corresponds reviving training data that lie on the boundary manifolds.
15

---

Figure 9: Images of DSV candidates (Selected in the CIFAR-10 dataset).
('plane')
('truck')
('truck')
('cat')
('bird')
('bird')
Figure 10: Examples of adversarial attack in the CIFAR-10 dataset
F More Characteristics of DSVs
DSVs Are Full of Discriminative Information In Fig. 10 we conducted an experiment by mixing a randomly sampled image from the real dataset with an image from the DSVs. Upon observation, the mixed image is virtually indistinguishable from image obtained solely from the real dataset. is noteworthy to highlight this situation resembles that of an adversarial attack [32] 19], yet we did not apply gradient descent to the image: we simply mixed two images. This suggests that the discriminative informational density in a single DSV image is substantially greater than that in randomly sampled image. The fact that the DSV's characteristics remained dominant in the classification, underscores the significant role of DS Vs explaining the model's classification ability.
G More Examples
In Fig. 11 examples of latent interpolations between target labels are presented. The smoothness of these interpolations within the latent space indicates that the semantic information learned from the training data has been effectively applied during the DSV generation process. This observation provides evidence that the DeepKKT optimization successfully conducts the generative process.
Fig. and 13 provide examples of deep support vectors generated using the CIFAR-100 and ImageNet et datasets, respectively. Fig. 14 presents additional examples related to image editing.
Fig. 15 empirically supports on our assertion on decision criterion. Starting from CIFAR100 random images and CIFAR (0-pretrained models, we edited the image CIFARIO 10 labels as latents. The edited images changes the image following decision criterions in generated DSVs. 1) For editing images to deer, antler grows. 2) For dog editing, facial dots are generated. 3) For cat editing, pointed traiangler features generated.
16

---

Balloon
Spaniel
Lobster
Harp
Sink
Scottish Dog
Figure 11: More examples of latent interpolation in the ImageNet dataset
H
Algorithm
Alg. presents our algorithm of generating Deep Support Vectors (DSVs). Initialized either from noise z (., I) or a real sample, it iterates to obtain the primal X and dual A variables.
Algorithm 1 Support Vector Refinement for Deep Learning Model
Require: Pretrained classifier (p:; 0), loss function L, augmentation function set A, number of DSV candidate N, number of class C, hyperparameters $
Ensure: Freeze classifier (-::0)
1: Initialize N x C' number of support vector candidates
2: for 1 to C do
3: sample N number of (xf, Xz) for label yf
4: end for
5: Define X {-f E [C], s [M]]
6: Define A (28 iE [C]. [N]]
7: repeat
8:
Ipprinal (x Σm ESe (x f). y
9:
Isstaioonayy (X9) |00 ΣN Ee
Die X V Vo 31 Lprimul (x5) Lytationary (X5)
10:
Lau(X*
11:
Lprior
$2 Liae (X) )- + 3g Innrm (X)
Sample
SA E A
13:
Define AX S = {fa(x;) of E XS}
14:
Lakka (X S
(Ax(A
15:
Inoual (XS) Tuail [ (X$) 17- Tarka (X
Liprior
16:
Update X +- X V x Laoial (Xx)
17:
Update A A + V Liotal X
18:
Remove æ/S for corresponding Xg
19:
until S converges
20:
return Set of DSV S
17

---

Bed
House
Dolphin
Tractor
Clock
Camel
Train
Bottle
Kangaroo
Crab
Snake
Sunflower
Mountain
Maple Tree
Chimpanzee
Can
Rose
Bowl
Pine Tree
Motorcycle
Figure 12: More examples of generated images with CIFAR-100 dataset
18

---

Cabbage
Slug
Wall Clock
Chimpanzee
Pig
Trolleybus
Basketball
Bobsleigh
Electric Fan
Cliff
Harvester
Goldfinch
Borzoi
Komondor
Restaurant
Maypole
Hornbill
Toucan
Maltese
Broom
Pufferfish
Sunglasses
Volcano
Gorilla
Boxer
Greenhouse
Beaker
Drilling Rig
Spider
Keeshond
Figure 13: More examples of generated images with ImageNet dataset
19

---

Unicycle
Oven
Scuba Diver
Ladybug
Soccer Ball
Worm Snake
Italian Greyhound
Bubble
Wagon
Jeep
Common Gallinule
Giant Panda
ship
Shipwreck
White-headed Capuchin
Tabby Cat
Figure 14: More examples of image editing. The images to the left of the arrows represent the initial images before training, while those the right depict the edited images after training.
Real Sample
Edited Sample
Real Sample
Edited Sample
Real Sample
Edited Sample
Figure 15: More examples of image editing. The images to the left the arrows represent the initial images before training, while those to the right depict the edited images after training.
20

---

NeurIPS Paper Checklist
The checklist is designed to encourage best practices for responsible machine learning research, addressing issues of reproducibility, transparency. research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes], [No]. or [NA].
[NA] means either that the question is Not Applicable for that particular paper or the relevant information is Not Available.
Please provide short (1-2 sentence) justification right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include (after eventual revisions) with the final version of your paper, and its final version will be published with the paper.
The reviewers of your paper will be asked to use the checklist as one of the factors in their evaluation. While "[Yes] is generally preferable to "[No]" is perfectly acceptable to answer "[No] provided proper justification is given (e.g., "error bars are not reported because it would be too computationally expensive" or "we
unable to find the license for the dataset used"). In general, answering "[No] or "[NA]" is not grounds for rejection. While the questions are phrased in binary way, we acknowledge that the true answer often more nuanced, please just use your best judgment and write justification to elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to question, in the justification please point to the section(s) where related material for the question can be found.
IMPORTANT, please:
Delete this instruction block, but keep the section heading "NeurIPS paper checklist",
Keep the checklist subsection headings, questions/answers and guidelines below.
Do not modify the questions and only use the provided macros for your answers.
1. Claims
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Question:
Answer: [Yes]
Justification: The abstract and introduction provide clear overview of the paper's primary contributions, particularly highlighting the introduction of the DecpKKT condition and the concept of Deep Support Vectors (DSVss. These contributions are accurately reflected in the body of the paper through theoretical formulations, experimental evidence, and practical applications of DSVs, aligning with the claims of the paper.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
21

---

Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: See limitation section in Sec. B The limitations are presented in Section 'ref( ) The paper notes that the DeepKKT condition's equivalence to tra- ditional support vector representations remains intuitive rather than rigorously proven. It also acknowledges the computational challenges of enforcing all KKT conditions explicitly, especially in nigh-dimensional deep learning contexts.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well sell-specfficttinn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [Yes]
Justification: The theoretical framework is grounded in adapted KKT conditions, with assumptions explicitly stated for applying these in high-dimensional, multi-class deep learning settings. Although some proofs are briefly outlined, the core theoretical justifications are complete, with further details in the appendix for additional clarification.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
22

---

4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Ys]]
The paper provides comprehensive details on the model architectures, datasets, augmentation strategies, and hyperparameters used in the experiments. Key implementation choices, such as optimizer configurations and specific data augmentation techniques, are described in the supplementary materials.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending the contribution, reproducibility www can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, provide access the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (c.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification:
We submitted code in supplementary.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.co cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
23

---

reproducible, they The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
wttpsSuuuiisssioiiii ssionPolccy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
Justification: The experimental setup includes clear specifications data splits, selected hyperparameters, and optimizers for each experimental task. Additional settings, such as aug- mentation parameters and model architecture details, are included, enabling a comprehensive understanding of the experimental environment.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented in the core the paper to a level detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: The paper includes tables with error bars representing the variability of DSV performance on benchmarks. The error bars are correctly computed, taking into account variations across training runs, which supports the robustness of the claims made.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
24

---

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
Question: For each experiment, does the paper provide sufficient information the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Answer: [Yes]
Justification: The paper specifies the use of GPUs for all major experiments and provides approximate training times. Resources are sufficiently detailed to allow for replication, indicating required compute types and time estimates for reproducibility.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g.. preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics httbess/tttt:///t httt://///oorrpss.c/////////ccct
Answer: [Yes]
Justification: he work aligns with the NeurIPS Code of Ethics, emphasizing privacy and responsible Al principles, especially concerning the responsible use of DeepKKT for dataset distillation and model inversion, without accessing sensitive data.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
The paper discusses societal impacts, especially the benefits of interpretability in Al models and potential concerns about model inversion's misuse. acknowledges ethical considerations associated with generating data from sensitive models, encouraging responsible handling.
Justification:
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate
25

---

to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning conrectly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: The paper does not release high-risk models data that require specific safeguards.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e-g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification:
The paper appropriately references all datasets (c.g.. CIFAR-10, ImageNet)
and model architectures, following proper citation practices.
Guidelines:
The answer NA means that the paper does
existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include a URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, www.rspppwsstteeee thcode. com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided. If this information not available online, the authors are encouraged to reach out to the asset's 's creators.
26

---

13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not introduce any new assets, such as unique datasets or models, that require documentation.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmoel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve human subjects or crowdsourcing experiments.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve human subjects research, so IRB approval is not applicable.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
27


Reviews:
[{"review_id": "7ZODQneyG1", "reviewer": "Reviewer_jvAE", "summary": "This paper introduces Deep Support Vectors (DSVs), an adaptation of support vector concepts to deep learning models. The authors propose a DeepKKT condition, analogous to the KKT conditions in SVMs, to identify or generate DSVs in trained deep models. They demonstrate that DSVs exhibit properties similar to traditional support vectors, including encoding decision boundaries and enabling model reconstruction. The paper shows applications of DSVs in few-shot dataset distillation, model interpretability, and even using classification models as latent generative models. The authors validate their approach on common datasets (ImageNet, CIFAR10, CIFAR100) and architectures (ResNet, ConvNet).", "questions": "- How sensitive are the DSVs to the choice of hyperparameters in the DeepKKT condition? Is there a principled way to select these parameters?\n- How well do DSVs scale to larger models and datasets? Are there computational challenges in applying this approach to state-of-the-art large language models, for instance?", "limitations": "A more in-depth consideration of privacy implications on the generative capability of the method could be given", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- Novel concept of Deep Support Vectors that bridges ideas from SVMs to deep learning\n- Evaluation across multiple datasets and model architectures\n- Diverse applications including dataset distillation, model interpretability, and generative modeling\n- Provides both theoretical motivation and empirical validation", "weaknesses": "- Transformer architectures have not been included in the experiments\n- Comparison to other interpretability methods is limited such as global SHAP (mean absolute SHAP value)  or other global methods \n- The proposed method has limitation when it comes to real-scenario applications. Dedicated generative models such as GANs or Transformers are better options.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your detailed review and constructive feedback. We appreciate the opportunity to address the points you raised.\n\n\n**Experiments with Transformer Architectures:**\n\n\nIn our global rebuttal (see pdf file), we included experiments on Transformer architectures. Specifically, we demonstrated global explanations using a Swin Transformer and further evaluated our method on CLIP and a diffusion classifier utilizing U-Net, showcasing the adaptability of our approach across diverse architectures.\n\n\n**Comparison to Other Interpretability Methods:**\n\n\nAs stated in the global response, it is crucial to note that our approach provides a global explanation in a parametric sense, which is the first attempt in this context. Existing algorithms cannot provide explanations solely based on model parameters. Conventional methods, such as SHAP, rely on feature matching within the dataset manifold; they extract feature vectors by passing the entire dataset through the model and then cluster these vectors. In contrast, our method operates independently of the dataset, using only the parameter space to generate general and agreeable criteria. Detailed explanations are provided in the global response.\n\n\n**Real-Scenario Applications:**\n\n\nOur proposed method focuses on unveiling deep classification models rather than generating new data, as seen with GANs and diffusion models. As outlined in our global response, our primary goal is to interpret black-box deep learning models by leveraging the properties of support vectors from SVMs. This leads to benefits such as coreset selection and model explainability. Therefore, we disagree with the notion that our method is impractical for real-world scenarios. In fact, it contributes to both 1) model interpretability and 2) dataset distillation, which are crucial and indispensable fields.\nEven when considered solely as a generative model, our approach offers significant advantages. For example, as illustrated in Fig. 6, our latent interpolation capability is both powerful and straightforward, whereas diffusion models [1] require additional complex mechanisms for similar tasks. Additionally, as shown at the bottom of Fig. 6, our method has unique strengths. It does not rely on any pre-trained characteristic vectors (human-crafted) or latent architectures since the supervision model itself is explainable. In contrast, GANs require such pre-trained characteristic vectors and latent architecture.\nMoreover, our method extracts Deep Support Vectors (DSVs) from existing supervision models, enhancing its practicality and addressing privacy concerns often associated with generative models. This is a significant advantage, as GANs and diffusion models typically require large datasets and complex training processes. In contrast, our approach leverages existing supervision models, making it more efficient and less resource-intensive.\n\n\n**Sensitivity to Hyperparameters:**\n\nAs stated in the global response, our algorithm is robust to hyperparameters. Regarding the sensitivity of Deep Support Vectors (DSVs) to hyperparameter selection, our experiments demonstrate that the form of DSVs remains consistent at the feature level. This consistency suggests that the important information extracted from the pretrained models remains stable, regardless of variations in hyperparameters.\n\n\n\n\n**Scalability to Larger Models and Datasets and requirements for Large language models.:**\n\nWe have validated our method on substantial datasets, such as ImageNet, which is widely recognized as large. However, it seems that even larger datasets might be required for foundational models. To address this concern, we also conducted experiments with OpenCLIP, which is trained on the LAION-2B dataset, one of the largest datasets in the vision domain (see the attached PDF). Our algorithm works with order n complexity, meaning our algorithm's computation aligns with traditional SGD methodologies, ensuring that our approach remains computationally feasible even for large datasets and complex models. \nRegarding large language models, our work focuses on classification models built on the principles of support vector machines (see lines 12, 42, 97, 120, 281, and others). Therefore, the latter part of your question seems less relevant. It is also important to note that model inversion in the NLP domain is relatively easier [2] compared to our work in model inversion, particularly when applied to vision. A few papers have addressed this issue in the vision domain, and none have shown success with practical, applied models, often limiting their scope to simpler multi-classification tasks like MNIST [3].\nWe have successfully synthesized high-resolution images in real-world vision scenarios, such as with ResNet50, which is a pioneering contribution. We hope this clarifies the strengths and contributions of our work. Thank you again for your valuable feedback.\n\nReferences:\n\n[1] Wang, Clinton, and Polina Golland. \"Interpolating between images with diffusion models.\" (2023).\n\n[2] A survey on large language model (LLM) security and privacy: The Good, The Bad, and The Ugly\n\n[3] Yu, Runpeng, and Xinchao Wang. \"Generator born from classifier.\" Advances in Neural Information Processing Systems36 (2024). (Neurips 2023)", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "i3pj5mJ3j0", "reviewer": "Reviewer_H6Gu", "summary": "This paper introduces the DeepKKT conditions for deep svm models, which correspond to the KKT condition in traditional linear SVMs. By either selecting deep support vectors (DSVs) from training data or generating them from already trained deep learning models, The authors show DSVs can play a similar role to conventional support vectors.\n\nIn addition,  this paper shows that the DeepKKT condition can transform  conventional classification models into generative models with high fidelity, particularly as latent generative models using class labels as latent variables. The experiments validate the effectiveness of DSVs using common datasets (ImageNet, CIFAR10 and CIFAR100) on the general architectures (ResNet and ConvNet).\n\nOverall, the contribution is limited, hard to follow and I do not recommend for publication at this moment.", "questions": "(1) For example, I do not follow \"Like support vectors can reconstruct SVM, we can reconstruct the deep models from scratch only with DSVs.\". How do you reconstruct deep svms from DSVs?\n\n(2) deep learning is black box, and the authors using black box (deep learning here) to relieve this issue?\nIs it possible to rewrite the paper to sell its idea on DeepKKT and how to generate DSVs?", "limitations": "see above.", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "The DeepKKT and its extended version in Eq. 9 to generate DSVs is interesting. This paper shows that the DeepKKT condition can transform  conventional classification models into generative models with high fidelity, particularly as latent generative models using class labels as latent variables. The experiments validate the effectiveness of DSVs using common datasets (ImageNet, CIFAR10 and CIFAR100) on the general architectures (ResNet and ConvNet).", "weaknesses": "(1) innovation and contribution\nThis paper is just deep svms, DeepKKT is known, and its contribution is trivial. Overall, the deep svms here is still a black-box. DeepKKT can relieve the black box issue by introducing deep learning to svms (line 34-36)? The heuristic method to generate DSVs using Eq.9 is not convincing. are they still DSVs?\n\n(2) Technical and theoretical  analysis\nIn technical level, it may be practical to use Eq. 9 to generate DSVs (either from training data or generated), but it is heuristic.\n\n(3) The paper idea is easy, but the writing is still needs to improve.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you very much for your feedback; we really appreciate the time and effort you have invested in reviewing our paper. However, it appears that there may be some misunderstandings regarding key aspects of our work, and we believe certain elements of your review may be misleading.\n\n\n**First of all, our paper is not about either training or elucidating a DeepSVM. On the other hand, DeepKKT is our original contribution, and we were the first to introduce this concept.**  As noted in the global comment, we emphasize our originality at least four times in the paper (Lines 72-76, 8, 56, and the Figure 1 caption). We believe this misunderstanding may have led to misinterpretations in your review. Consequently, the concerns raised in Weakness 1, Question 1, and Question 2 are misleading since they are based on this misrepresentation.\n\nDeep Support Vectors are distinct from DeepSVM. As mentioned on lines 72-75, DeepSVM refers to a well-known approach that integrates deep learning architecture with SVM principles. Our work is fundamentally different—indeed, we do not propose a new architecture. We clarify this distinction at least four times in the paper.\n\nAdditionally, Question 2 is incorrect because our aim is to address the black-box nature of existing architectures (such as ResNet, ConvNet, and, in this rebuttal, U-Net, ResNeXt, and Swin Transformer) by using DeepKKT conditions, not to develop a new architecture.\n\nOverall, it seems there was an initial misunderstanding of our concept and difficulty in interpreting the paper from the perspective it was intended. As such, Weakness 3 also appears to stem from this misunderstanding.\n\nFinally, regarding Weakness 2, the introduction of the manifold condition is one of our primal conditions. This is not merely a heuristic but a theoretically grounded concept. Given that modern deep learning models handle high-dimensional data and face challenges related to the curse of dimensionality, it is crucial to account for the Riemannian manifold $\\mathcal{M}$.\n\nThe augmentation operation $\\mathcal{A}$ is how we impose symmetry invariance in the model. Formally, we sample an action $g$ from a group $\\mathcal{G}$, where $\\mathcal{G}$ represents a symmetrical Lie group, such as translation or rotation [1]. By applying $\\mathcal{A}$ as a practical Lie group, we ensure that $f(\\mathcal{A}(x)) \\simeq f(x)$, meaning the semantics extracted by the model are preserved through the symmetric operator. This strategy is widely used and accepted in self-supervised learning, as seen in methods like SIMCLR [2]. Regarding $L_{tot}$ and $L_{norm}$, this also corresponds to prior term for the image [3], and this term is commonly used. Furthermore, as demonstrated in the global response PDF (see hyper-parameter section), even if we dramatically decrease this term (by up to 100 times), the figures does not change much. Meaning these terms are not critical for full generation.\n\n[1] Cohen, Taco, and Max Welling. \"Group equivariant convolutional networks.\" International conference on machine learning. PMLR, 2016.\n\n[2] Chen, Ting, et al. \"A simple framework for contrastive learning of visual representations.\" International conference on machine learning. PMLR, 2020.\n\n[3]Hongxu Yin, Arun Mallya, Arash Vahdat, José M. Álvarez, Jan Kautz, and Pavlo Molchanov. See through\ngradients: Image batch recovery via gradinversion. CoRR, abs/2104.07586, 2021.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "vp4pcTJZXy", "reviewer": "Reviewer_1B22", "summary": "The paper describes rethinking a classification through support vector in a way similar to SVMs. It provides additional benefits such as: \n- few-shot dataset distillation\n- using the similarity of the proposed formulation to the diffusion models, the model can be transformed into a generative model", "questions": "1) It would be useful if the authors have any comments on the failure modes of the proposed model. For example, one of the aspects may be the confounding factors (Bontempelli et al (2022)) which could be picked up by the model? \n\n2) One of the perceived limitations is that the support vectors only represent the whole image. It does not allow to pick up the particular aspects of the image which takes the decision. For example, we can guess from an image of a cat with antlers that these are the antlers which make it look like a deer. But strictly speaking we don't know if such changes result in confirmation bias or whether the model actually predicts the results based on the antlers. I wonder if the authors can comment on such limitation?\n\n3) I could imagine such work is also linked with incremental/lifelong learning, for example in a way similar to Laskov et al (2006), which considers incremental SVM. In contrast to the standard deep-learning solutions, KKT can be updated recursively, which provides a wealth of options for improving the performance. This might be an additional benefit of the proposed formulation. I wonder if the authors can comment on this? \n\nBontempelli et al (2022) Concept-level Debugging of Part-Prototype Networks, ICLR 2022\n\nLaskov, P., Gehl, C., Krüger, S., Müller, K.R., Bennett, K.P. and Parrado-Hernández, E., 2006. Incremental support vector learning: Analysis, implementation and applications. Journal of machine learning research, 7(9).", "limitations": "As discussed above, the section on limitations would greatly improve the discussion.", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "- Originality: The paper demonstrates out-of-the-box thinking by showing that generalisation of the deep KKT conditions leads to similarity with diffusion models; the contribution of the paper is multifaceted: formulating deep KKT conditions, showing the utility of such formulation for dataset distillation, and showing how it could lead to a generative model. \n- Significance: I think this work is significant as the authors contribute towards the intersection of such important problems as dataset distillation, transparency of the ML models, and provide new insight about the connection between the KKT conditions and the diffusion models\n- Clarity: the paper is clearly written, the only optional suggestion, for the ease of mathematical notation, is to use the boldface fonts for vectors, e.g., like Bishop (2006), page xi.  It also gives, in my understanding, enough reproducibility information. \n- Quality: The paper presents and sufficiently backs up the claims.", "weaknesses": "Clarity: the authors are incouraged to improve the discussion over the limitations.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your detailed feedback. Your insightful feedback and objective perspective greatly helped our research. Also, we are particularly grateful for your acknowledgement upon our originality and intention of the paper. \n\n\n\n\n**Clarity on Mathematical Notation:**\n\nWe appreciate your suggestion regarding the use of boldface fonts for vectors. We have reviewed the relevant guidelines, and in the final version of the paper, we will incorporate your advice to enhance the clarity of our mathematical notation.\n\n\n**Failure Modes and Confounding Factors:**\n\n\nWe are grateful for your insightful question about potential failure modes and confounding factors. This feedback has prompted us to reflect more deeply on these aspects. For instance, as mentioned in our global response PDF, an example can be seen in images of castles, which are often surrounded by forests. This is because castles are usually located in mountainous areas. Our model might learn to associate the presence of trees with the presence of castles. Similarly, in images of tenches, the presence of humans could be a confounding factor. Additionally, we can use our model to identify potential biases. For example, in Figure 1, all clocks point to 10:10, which is a bias introduced by the convention of setting clocks to 10:10 in advertisements to make them appear aesthetically pleasing.\n\n\n**Limitation of Support Vectors Representing Whole Images:**\n\nWhile it may seem that our support vectors represent whole images, they often emphasize unique features, which we believe is beneficial. For example, in Figure 1, the drilling rig images focus on the drill bit from various angles, and the rocking chair image combines perspectives from multiple points of view, akin to Picasso’s paintings. This suggests that even within a single image, we can extract multiple important features. An even more striking example is the tench case (thank you for your suggestion on failure modes!). In the tench image, we can see multiple objects—the tench and the fisherman. This highlights multiple features, demonstrating the value of encoding the entire image.\n\n\nAdditionally, regarding the credibility of our method, we believe extensive experiments support our argument. For instance, as shown in Figure 3, we can test hypotheses through editing and DSV generation, revealing significant features like antlers in an image of a cat with antlers. Furthermore, Figure 15 shows that changing the class results in distinctive features emerging in the DSVs. \n\n\nHowever, we acknowledge your point regarding the lack of a numerical measure for feature importance. We view this as an area for future work, where we could potentially incorporate existing XAI methods like Grad-CAM or develop new metrics to quantify feature significance.\n\n\n\n\n**Incremental/Lifelong Learning:**\n\nYour observation regarding the link between our work and incremental/lifelong learning is very insightful. Indeed, we are currently pursuing this direction in our follow-up research. We are exploring the use of DSVs in replay-memory-based continual learning to store anchor points without needing additional datasets. This approach leverages the recursive update potential of the Karush-Kuhn-Tucker (KKT) conditions, offering a significant advantage over standard deep learning methods.\nWe hope this addresses your concerns and provides a clearer understanding of the contributions and strengths of our work. Thank you again for your valuable feedback.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "zktZ7urkB7", "reviewer": "Reviewer_UA9Q", "summary": "This paper introduces a novel Deep Support Vectors (DSVs) framework, which can be used to reconstruct data and serve as latent generative models using logits as latent. By adapting the traditional Karush-Kuhn-Tucker (KKT) condition for deep learning models, the authors introduce the DeepKKT one and show that generated DSVs using this condition exhibit properties similar to traditional support vectors but apply to modern deep architectures like ConvNet and ResNet. Experiments on several common image datasets, including CIFAR10, CIFAR100, SVHN, and ImageNet, verify that DeepKKT can extract and generate DSVs. Moreover, DSVs are shown to be better than existing algorithms in few-shot dataset distillation problems.", "questions": "Please address my questions in the weaknesses section.", "limitations": "N/A", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "The paper is well-written and easy to follow. Introducing deep support vectors based on an adaption of the KKT condition used in traditional support vector machines (SVM) is novel and interesting. To be honest, I did not have enough time to verify all of the mathematical verifications in the paper, and I'll leave it in other reviewers' comments on this part.  The experimental results consistently show the benefit of DVSs in several problems, such as few-shot dataset distillation and image generation.", "weaknesses": "One of the proposed DSVs' most critical limitations is requiring the model to be fully pre-trained before being applied for support vector generation. This condition differs from the traditional support vector machine (SVM) framework, where the training process of the (linear) model and the support vector selection are jointly performed. Also, it is unclear how the deep model is pre-trained (e.g., with which datasets; are there any domain gap issues between the pre-training data and the main training data, etc.). Furthermore, the margin definition in Eq. (3) is unclear, and I could not understand why the larger margin is better. \n\nRegarding the total training loss for the DSVs generation in (9), it is unclear about the selections of the augmentation operator $\\mathcal A$. Moreover, when training (9) with the traditional SGD approach, how do we guarantee that the generated deep support vectors belong to the original training data set?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your feedback and valuable insights, and for acknowledging our work. We are especially grateful for your recognition of the originality and practical applicability of the DeepKKT condition. However, we would like to clarify that we do not deal with DeepSVM. Specifically, we do not aim to ‘train’ an architecture. Instead, we aim to ‘retrieve’ plausible data points within a ‘trained’ architecture, as noted in our global response.\n\n**Requiring the Model to be Fully Pre-Trained:**\n\nAs highlighted in our global response, our primary contribution is adapting the strengths of SVMs to deep learning models by extracting deep support vectors from pre-trained deep networks. This approach is intended to resolve the black-box nature of these models and enable the use of support vectors for tasks such as dataset distillation and data generation. Unlike SVMs, which jointly perform training and support vector selection, our method is designed to work with any pre-trained classification model. \nActually, this condition is much more relaxed than that of SVM, as it does not require access to all training data. Furthermore, as demonstrated in Figure 4, we have shown that DSVs can be constructed under much harsher conditions, such as in transfer learning.\nAdditionally, we believe you may have misunderstood our approach, as it is fundamentally different from DeepSVM. Our method does not impose constraints on the pre-trained deep learning network, other than it being a classification model.\n\n**Unclear Pre-Training Process:**\n\nOur approach does not impose specific conditions on how the deep model is pre-trained. We demonstrate the versatility of our method by employing standard training techniques, including data augmentation, stochastic gradient descent (SGD), and batch sampling. As detailed in lines 89-94 of our paper, our method successfully operates under these typical settings. In contrast, other methods often succeed only in highly constrained environments, such as low-dimensional manifolds, full-batch gradient descent, or unaugmented data. This flexibility ensures that our approach is broadly applicable across various training scenarios and environments.\n\n**Margin Definition in Eq. (3):**\n\nThe margin definition follows the principles of SVMs, where support vectors are used to maximize the margin between the decision boundary and data samples, thereby defining the most plausible decision boundary. This philosophy is well-established and documented in the literature, such as in [1]. Our adaptation ensures that the DSVs we extract retain this critical property because samples near the decision boundary would be much more plausible than those far from the boundary, especially in a very high-dimensional data space.\n\n**Selection of the Augmentation Operator  $\\mathcal{A}$ :**\n\nThe details of the augmentation operator $\\mathcal{A}$  are provided in Section D, lines 476-480. This section outlines the augmentation techniques used to ensure the robustness of the generated DSVs.\n\n**Guaranteeing DSVs Belong to the Original Training Dataset:**\n\nThis is an important point. As mentioned in lines 169-172, we incorporated the manifold condition to ensure that the generated DSVs adhere to the distribution of the training set. This manifold condition is enforced through the use of augmentation, TV loss, and alpha loss, as detailed in Equation (9). Ensuring that DSVs belong to the original training data’s distribution is a key contribution of our work. Additionally, as shown in Tables 1 and 2, when using DeepKKT or generating DSVs, the performance in dataset distillation was better than when using the original dataset. This experimentally demonstrates that DSVs lie on the training data’s manifold.\n\n\n[1] Daniel Soudry, Elad Hoffer, Mor Shpigel Nacson, Suriya Gunasekar, and Nathan Srebro. The implicit bias of gradient descent on separable data. In International Conference on Learning Representations (ICLR), Vancouver, BC, Canada, 2018. Poster presented at ICLR 2018.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "F5uX2OFK9h", "reviewer": "Reviewer_wYkm", "summary": "This paper introduces the concept of Deep Support Vectors (DSVs) as an adaptation of support vectors from Support Vector Machines (SVMs) to deep learning models. The authors propose the DeepKKT condition, which generalizes the traditional Karush-Kuhn-Tucker (KKT) conditions of SVMs to handle the high-dimensional and multi-class nature of deep learning problems. By selecting or generating DSVs that satisfy the DeepKKT condition, the authors demonstrate that these vectors can play a similar role to traditional support vectors in terms of encoding decision boundaries and reconstructing models from a small subset of samples. The paper also shows that DSVs can be used for few-shot dataset distillation and as a means to alleviate the black-box characteristics of deep learning models by providing visual explanations of decision criteria. Furthermore, the authors demonstrate that the DeepKKT condition can transform conventional classification models into generative models with high fidelity, using class labels as latent variables.", "questions": "See Weaknesses.", "limitations": "See Weaknesses.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. The paper introduces a novel concept, Deep Support Vectors, which extends the idea of support vectors from SVMs to deep learning models, providing a new perspective on understanding deep neural networks.\n\n2. The proposed DeepKKT condition effectively generalizes the traditional KKT conditions to handle the complexities of deep learning problems, such as high dimensionality and multi-class classification.\n\n3. The authors demonstrate the practical applicability of DSVs through various experiments, including few-shot dataset distillation, visual explanation of decision criteria, and transforming classification models into generative models.\n\n4. The paper provides a thorough comparison of DSVs with existing methods in the context of few-shot dataset distillation, highlighting the superiority of DSVs under practical constraints.", "weaknesses": "1. The paper lacks a rigorous mathematical derivation of the DeepKKT condition and its connection to traditional KKT conditions. A more formal treatment would strengthen the theoretical foundation of the proposed method.\n\n2. While the authors provide experimental evidence for the effectiveness of DSVs, a more comprehensive analysis of the method's sensitivity to hyperparameters and its robustness to different architectures and datasets would be beneficial.\n\n3. The paper does not provide a detailed discussion on the computational complexity of generating DSVs and how it scales with the size of the dataset and the complexity of the model.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your detailed review and constructive feedback. We appreciate the acknowledgement of our contribution - Originality of our DeepKKT condition and its practical application.\n\n**Mathematical Derivation of DeepKKT Condition:**\n\n\nWhile we acknowledge that a rigorous mathematical derivation of the DeepKKT condition and its connection to traditional KKT conditions is desirable, it is important to note that our work focuses on defining a novel concept within the constraints of unknown nonlinearity in deep learning models. In traditional SVM, the goal is to construct a linear or known (white-box, kernel) nonlinear classification model using support vectors at the boundary. The most notable difference of our work from traditional SVM is that SVM aims to find a parameter $\\phi$, while we use the DeepKKT condition to find plausible data points $x$ in an already-trained black-box nonlinear classification model. Therefore, making a direct connection between the two is inherently challenging. Given the unknown nonlinearity, a rigorous definition is difficult to establish. Thus, we introduced an analogy to the traditional KKT conditions, guiding our approach through stationarity and primary Lagrange conditions under hinge loss. This analogy and adaptation itself are significant contributions, and the absence of a rigorous derivation does not undermine our findings.\n\n\n**Sensitivity to Hyperparameters and Robustness:**\n\nWe have indeed conducted extensive experiments to demonstrate the robustness of our method across various architectures and datasets. Our work includes evaluations on ConvNet with CIFAR-10 and CIFAR-100, as well as transfer learning with SVHN (as shown in Figure 4). Additionally, we utilized the widely adopted ResNet50 for ImageNet classification with a pretrained model from torchvision. As described in the global response, we also validated our approach using CLIP on the LAION-2B dataset, a diffusion classifier with U-Net, and a SwinTransformer. Additionally, we conducted experiments with different scales of parameters such as stationarity loss and primal loss ratio, which yielded robust results. These diverse applications underscore the robustness and versatility of our proposed method across different architectures and datasets. \n\n\n**Computational Complexity:**\n\nWhile we did not explicitly state the computational cost in the paper, an analysis of our algorithm (line 517-519, section H ) reveals that it operates with an order of n complexity. This implies that the scalability of our method aligns with existing gradient descent methodologies, ensuring that our approach remains computationally feasible even for large datasets and complex models. We leave its success case in OpenCLIP in the accompanying pdf.\n\n\nWe hope this addresses your concerns and provides a clearer understanding of the contributions and strengths of our work. Thank you again for your valuable feedback.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
**Summary**

In this paper, we propose a method to identify deep support vectors (DSVs) for pre-trained deep models without access to the original dataset. Our work does not involve training or constructing a Deep Support Vector Machine (DeepSVM). Instead, our original contribution is introducing the DeepKKT condition for obtaining DSVs. Prior to our work, global explanations in a purely parametric sense did not exist. DSVs can be identified in any classification model, regardless of architecture or dataset. To support this claim, we conducted experiments on various datasets such as CIFAR10, CIFAR100, SVHN, and ImageNet using ConvNet and ResNet architectures. In this rebuttal, we present results from experiments on the Laion2B and ImageNet datasets using U-Net, ResNext, and Transformer architectures **(see the accompanying PDF file).**

**Our Contribution and Experimental Setting:**

In this paper, we focus on identifying support vectors in pre-trained deep models without requiring access to the original training dataset. Our core contribution is the reconstruction of the dataset from a ‘trained’ model. The term ‘deep model’ refers to any deep architecture used for solving classification problems. Our major contribution is the ability to easily reconstruct the corresponding support vectors in any trained model, which enables us to explain the model’s overall decision-making process.


**DeepKKT is Our Original Contribution, and We Did Not Tackle DeepSVM:**

As stated in lines 72-76, 8, 56, and the caption of Figure 1, we do not address DeepSVM, nor do we train DeepSVM or deal with SVM architecture. Our focus is on already-trained typical deep networks such as ResNet. The DeepKKT condition is our genuine and original contribution; it is neither trivial nor previously known. As mentioned in Section 2.1, there are numerous research efforts on DeepSVM that integrate the SVM algorithm, a natural approach in the 2000s, into deep models. However, our paper is entirely different. These DeepSVM algorithms cannot generate deep support vectors from current deep models, as that is not their intended purpose.


**About Global Explanation:**

Typical Explainable AI (XAI) methods focus on local explanations, which clarify the decision criteria for a specific input. For example, suppose a model classifies an image as a 'deer' and an XAI algorithm aims to explain this decision. The algorithm might highlight a feature, such as an antler, that influenced the model's classification.
In contrast, global explanations address the general decision criteria of the model, without being restricted to a single data point. Although there are some researchers performing global explanations, they often limit themselves to feature matching. These methods typically store feature vectors by passing the entire dataset through the model and then aggregate these vectors using pre-defined algorithms. For the deer example, these algorithms would highlight antlers from various deer images, providing a broader justification for the model's decisions. This approach has two main drawbacks: 1) The computational cost is extremely high, and 2) It cannot generate general criteria based solely on the parameter space, as it relies on the dataset. Essentially, these methods are extensions of local XAI [1], which our approach is not.

**Ablation Studies of Additional Data and Architecture:**

Even when we adjust the hyperparameters to scales of 10 or 0.1, the quality of the generated figures remains unchanged. We included additional results with various hyperparameters in the accompanying pdf. This robustness is a distinctive feature compared to methods like GANs, which require highly sophisticated hyperparameter tuning.

[1] Fel, Thomas, et al. “Craft: Concept recursive activation factorization for explainability.” Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023.

Meta-review: **Summary of the paper:**
The authors define a set of conditions for multiclass neural network classifiers, akin to KKT conditions for SVM, in order to identify or synthesize support vectors. They then take pretrained image classifiers and show that such support vectors look reasonable, are close to the decision boundary, enable few-shot distillation and generative modeling, and can help with interpreting the learnt decision function of a pretrained network.

**Summary of the reviews:**
The reviewers found the approach to connecting pretrained deep nets and SVMs novel and interesting. They also acknowledged the variety and extent of relevant experiments substantiating the support vector behavior of the retrieved/generated samples. 

On the other hand, they point to a lack of (1) experiments on transformer architectures or larger (than ImageNet) datasets, (2) other (global) interpretation methods as baselines, and (3) experiments on sensitivity of support vectors to hyperparameters. Reviewer H6Gu was further concerned with a limited contribution of the paper particularly compared to the direction of Deep SVM works.

**Summary of the rebuttal and discussions:**
The authors clarified some raised points and provided new experiments on transformer architecture with similar results as well as using a network trained on a much larger dataset.

**Consolidation report:**
During the rebuttal the authors added more to the already extensive experimental setup which is satisfactory when it comes to the empirical aspect of the work. The AC further believes the contribution of the paper is enough thanks to the novel perspective –of deep support vectors– that they show enables several interesting use cases in the context of deep learning and then a supporting set of extensive and diverse experiments indicating the potential of the perspective.

However, I think the novelty and theoretical rigor of deep KKT conditions are overblown in light of the prior work on deep SVMs. Therefore, for the next version, I urge the authors to 

- have ample and clear discussion on the differences to works on deep SVMs. 
   -  the AC believes it can be said that the way the paper treats Deep Nets is that the network up to the last layer is a feature extractor $\phi$ and the last (linear) layer is the svm $\tilde{w}$ vector but trained with a different (CE) loss instead of a SVM’s hinge loss and of course it is done in conjunction with learning $\phi$. 
    - Taking this view, how different are the DSVs obtained from a pretrained $\phi$ **and** $w$ compared to SVs coming from only a pretrained $\phi$ and a newly trained $w$ using hinge loss?
    - can we not apply conventional SVM process to obtain SVs from Deep SVMs? How would they differ from the ones obtained using the new conditions from pretrained nets?

- clearly mention the limitation on lacking rigorous derivations of the proposed conditions.
    - make it transparent that the modified conditions are *a* set of conditions that is manually assumed by the authors, with good intuitions about how SVMs and deep networks work, but nevertheless in contrast to the necessary KKT conditions that can be formally derived from a set of assumptions.
    - I suggest to also rephrase “deep KKT” to something that does not explicitly mention KKT so that it does not imply a similar rigor to the conditions to those of KKT. For instance SVs can be mentioned in the term as they don’t imply formal rigor and instead is a property that is to be held for your case as well.

- clearly discuss the computational complexity and report the wall clock time needed to generate support vectors.


**Recommendation:**
The reviewers did not find a fatal error in the paper. I think the paper should be accepted since it has enough contribution in the new perspective and extensive experiments they offer. I believe the presentation needs to be toned down to avoid potential misunderstanding. I trust the authors will do that for a camera ready version.
Decision: Accept (poster)