BaSIS-Net: From Point Estimate to Predictive Distribution in Neural Networks - A Bayesian Sequential Importance Sampling Framework
Authors: Giuseppina Carannante
Nidhal Bouaynaya
Ghulam Rasool
Lyudmila Mihaylova
Venue: Accepted by TMLR ()

Abstract: Data-driven Deep Learning (DL) models have revolutionized autonomous systems, but ensuring their safety and reliability necessitates the assessment of predictive confidence or uncertainty. Bayesian DL provides a principled approach to quantify uncertainty via probability density functions defined over model parameters. However, the exact solution is intractable for most DL models, and the approximation methods, often based on heuristics, suffer from scalability issues and stringent distribution assumptions and may lack theoretical guarantees. This work develops a Sequential Importance Sampling framework that approximates the posterior probability density function through weighted samples (or particles), which can be used to find the mean, variance, or higher-order moments of the posterior distribution. We demonstrate that propagating particles, which capture information about the higher-order moments, through the layers of the DL model results in increased robustness to natural and malicious noise (adversarial attacks). The variance computed from these particles effectively quantifies the model’s decision uncertainty, demonstrating well-calibrated and accurate predictive confidence.

Published in Transactions on Machine Learning Research (06/2024)
BaSIS-Net: From Point Estimate to Predictive Distribu- tion in Neural Networks A Bayesian Sequential Importance Sampling Framework
Giuseppina Carannante
corannang@@ruuam edu
Department of Electrical and Computer Engineering Rowan University
Nidhal C. Bouaynaya
howegnayo@rouan..c edu
Department of Electricol and Computer Engineering
Rowan University
Ghulam Rasool
dhallammmmsoll@mmoffiittoo.
Machine Learning Department
Moffit Cancer Center
Lyudmila Mihaylova
La.mabaayooo@sssefiiedd...c
Department of Aulomatic Control and Systems Engineering The University of Sheffield
Reviewed on OpenReview: https:
// openreview. net/ forum? id= V92PxXQ7UM
Abstract
Data-driven Deep Learning (DL) models have revolutionized autonomous systems, but en- suring their safety and reliability necessitates the assessment of predictive confidence or uncertainty. Bayesian DL provides a principled approach quantify uncertainly via prob- ability density functions defined over model parameters. However, the exact solution intractable for most DL models, and the approximation methods, often based on heuristics, suffer from scalability issues and stringent distribution assumptions and may lack theoretical guarantees. This work develops Sequential Importance Sampling framework that approx- imates the posterior probability density function through weighted samples (or particles), which can be used to find the mean, variance, or higher-order moments of the posterior dis- tribution. We demonstrate that propagating particles, which capture information about the higher-order moments, through the layers the DL model results in increased robustness to natural and malicious noise (adversarial attacks). The variance computed from these par- ticles effectively quantifies the model's decision uncertainty, demonstrating well-calibrated and accurate predictive confidence.
1
Introduction
The promise to deploy Deep Learning (DL) models in real-world scenarios, while ensuring safe and reliable predictions, has led to increasing focus confidence quantification for DL models within the community
Tan et al. 2020 Kabir et al. 2018 Begoli et al., 2019 Dera et al. [021 Carannante et al. 2020 Tabarisaadi et al. 2022 Abdar et al. 2021). The growing interest in uncertainty estimation is primarily driven by the brittleness of most point-estimate (or deterministicc) models. These models produce a single real mumber,
typically the output of the softmax function, as their prediction. Standard deterministic neural networks (NNs) perform remarkably well on data similar to what was used during training. However, they fail generalize effectively to unfamiliar perturbed data and may fail without any prior indication warning

---

Published in Transactions on Machine Learning Research (06/2024)
Moosavi-Dezfooli et al. 2017 Nguyen et al.
2015 Biggio & Roli
2018
Ahmed et al.
2022
Additionally,
deterministic DT--based classifiers tend to assign high softmax scores to unrecognizable and out-of-distribution
inputs or incorrect predictions without any visible signs of model failure -Moosavi-Dezfooli et al. 2017
Nguyen et al. 2015; Ahmed et al. 2022 Zhang & Li 2019 Yuan et al. 2019 Carannante & Bouaynaya 2028
The brittleness of DL, models raises concerns about the reliability and drustworthiness of the predictions, particularly in situations where the model to be deployed in mission-critical settings. When a DL model is integrated into system that makes decisions affecting human life, either directly or indirectly, it is of paramount importance to determine whether the model is predicting reliably or failing randomly.
Point-estimate or deterministic models can erroncously interpret the softmax output value as the model's confidence or uncertainty information. Bayesian treatment of NNs allows for a formal definition of confidence Neal 2012 In the Bayesian setting, a NN is treated as a probabilistic model, where the model parameters are viewed as random variables endowed with a probability density function (pdf) (MacKay 1992 Neal 2012). Using Bayes' rule, one can find the postcrior pdf of the nerwork's parameters given the training data. This posterior pdf encompasses all the information about the model and can be used with new data to find the predictive distribution. In particular, the second moment of the predictive pdf may provide a mcasure of the model's uncertainty attached to the prediction. However, due to the enormous parameter space and multiple layers of nonlinear functions in current DL models, exact inference in closed form is infeasible. Consequently, the community has resorted to various approximation techniques.
or uncertainty, in the statistical sense (MacKay 1992
In the context of Bayesian deep learning (DL), where the model parameters are treated as random variables, several frameworks have been proposed to approximate the intractable inference problem (MacKay) 1992:
Neal
2012: Jordan et al.
1999 Graves
2011: Blundell et al. 2015 Gal & Ghahramani 2016 Kendall & Gal
2017
Gal & Ghahramani 2015; Cui et al.,
2020 Lakshminaraaanan et al. 2017 Roth & Pernkopf 2016
Posch & Pilz
2020
Carannante et al. 2020
2021a Dera et al. 2021).
Variational Inference (VT) is one of the most well-known approaches that defines an easy-to-estimate pdf, named variational distribution, and minimizes the Kullback Leibler (KT.) divergence between the true pos- terior distribution and the variational distribution (Jordan et al. 1999 Several Bayesian methods used V1,
either by sampling single set of parameters or by propagating the first two moments (mean and covariance)
of the variational distribution during model training (Jordan et al.
Blundell et al. 2015 Kendall & 2017 GGal & Ghahramani 2015; Roth & Pernkopf, 2016 Carannante et al. 2020 Dera et al.
1999 Graves 2011
2021 Other frequentist approaches, such as Monte Carlo (MC) dropout and model ensemble, have been revisited and reinterpreted as approximate Bayesian inference for uncertainty estimation (Gal & Ghahra-
mani 2016 Kendall & Gal 2017 Gal & Ghahramani 2015] Lakshminarayanan et al. 2017: Hoffmann & Elster 2021: Russell & Reale 2021). J. VI approximates the inference problem into an optimization problem and is suited for large data sets. However, it is very hard to derive optimal guarantees or error bounds for the posterior pdf because the KL divergence between the variational distribution and the posterior can- not be calculated. Morcover, the ensemble approaches (Carannante et al., 2020), although able to capture higher-order statistics of the propagating distributions, are still constrained by the Gaussianity assumption.
In this paper, we present a novel approach to Bayesian DL that goes beyond the Gaussian approximation of the posterior distribution and model approximation. We formalize a statistical soquential importance sampling (SIS) framework along with a state-space formulation to estimate the predictive pdf of DL model. Particle Filtering (PF), which relies on the SIS framework, was used in the statistical tracking community to estimate target distributions in non-linear and non-Gaussian dynamical systems {Crisan & Doucet, (002). Unlike other methods, our proposed SIS framework can approximate any density, not only Gaussians, and has established performance guarantees (Crisan & Doucet, 2002h. Additionally, the PF can be implemented in parallel for efficient computation. The power of the PF stems from its simple implementation and powerful convergence and optimality properties. Under weak assumptions, we can ensure (almost sure) convergence of the empirical distributions toward the true ones. Some bounds on the mean square errors and some large deviation results were elegantly and concisely presented in (Crisan & Doucet) 2002). Despite the power of the SIS method, to the best of our knowledge, no research has investigated the SIS framework within DL models and studied its uncertainty properties under random and adversarial conditions. A handful of research undertakings have been made in the classical machine learning literature to combine hidden state
2

---

Published in Transactions on Machine Learning Research (06/2024)
estimation techniques with NN & Wu 1988
Puskorius & Feldkamp 1991 de Freitas et al 2000;
Halimeh et al., 2019 Li et al. 2010 Titensky et al. 2018 Carannante et al. 2021a). Most of these early attempts were focused on developing an alternative to the backpropagation algorithm for model training. These early efforts were hindered by the curse of dimensionality (the hidden state is used to represent the NN model parameters), and the applicability of these approaches remained limited to small NN models.
In this work, we propose a SIS framework and derive the mathematical formulation for estimating the predictive pdf of DL model. We propose using set of weighted particles to track and estimate the posterior pdf of the network's parameters it evolves during model training. At the inference time, we estimate the complete prodictive distribution of the unscen test data points, and the second central moment to determine the model's predictive uncertainly. The contributions of our work are:
We introduce the SIS framework and PF method to propagate and learn the posterior pdf of the network's parameters. To address the issue of the curse of dimensionality, we employ multiple PFs along with resourceful transition model that reduces the number of needed particles to achieve a reasonable estimate. At inference time, the learned particles are used as an approximation to the parameter's posterior pdf, and no additional post-hoc sampling is required to compule the model uncertainty.
We conduct comprehensive robustness analysis using random noise and adversarial attacks. We compare the performance of our approach, named BaSIS-Net, with other state-of-the-art frame- works under various noisy conditions. We demonstrate the advantages of propagating higher-order moments, i.e., propagating and learning the full distribution with no constrraint on the form of the posterior pdf.
We propose and formalize an uncertainty metric to evaluate the consistency and meaningfulness of the obtained uncertainty estimates. Specifically, we propose a monotonic property, iee, uncertainty monotonically increasing with the increasing levels of noise or severity of the attacks. We follow the general idea that a useful uncertainty estimate should convey lower confidence for the unknown, perturbed data.
The rest of the paper is organized as follows. Section 2 provides an in-depth literature review of Bayesian DL, uncertainty estimation approaches, and the use of PF and density estimation techniques for NN. In Section we begin by providing a general overview of Bayesian learning and the SIS framework before proceeding to derive the proposed BaSTS framework for DL models, referred to as BaSTS-Net. Section 4 outlines the experimental setup, and Section presents the results, followed by elaborate discussion of the findings in
Sention i
We conclude the paper with Section 7
2
Related Work
2.1 Bayesian Neural Networks
Bayesian learning for NNs has seen renewed interest in recent years due to the shifting interest in developing NNs capable of assessing their confidence along with their predictions. However, the exact Bayesian inference problem in NNs is intractable, so various approximation techniques have been developed to address this issue
(MacKay] 1992
Neal
2012 Jordan et al.
1999 Graves 2011 Blundell et al.
2015 Gal & Ghahramani 2016
Kendall & Gal
2017 Gal & Ghahramani
2015
Lakshminarayanan et al.
2017 Roth & Pernkopf 2016
Carannante et al.
2020
2021a Dera et al.
2021
Among these, VI gained popularity and several variants
have been proposed (Jordan et al. 1999
Graves
2011 Blundell et al. 2015 Kendall & Gal 2017 7 Gal
& Ghahramani 2015 Roth & Pernkopf 2016
Posch & Pilz 2020 [arannante et al.] 2020 Dera et al.
2021). VI builds upon the idea of casting Bayesian inference as an optimization problem that can be solved with classical optimization techniques, such as gradient descent. A parameterized variational distribution is defined over the network's parameters, and the KL divergence between the defined distribution (variational distribution) and the unknown posterior distribution is minimized with respect to the parameters of the variational distribution. To compute the loss function, most approximating distributions chosen from
3

---

Published in Transactions on Machine Learning Research (06/2024)
simple family of distributions, such as exponential. Early attempts at VI computed the Evidence Lower Bound (EIBO), which is equivalent to the KT, divergence analytically (Jordan et al. 1999). However, this approach required conditionally conjugate distributions. To avoid this restriction, some researchers evaluated the ELBO with noisy estimates of the gradient, obtained by averaging Monte Carlo (MC) samples (Blundell et al. 2015). For recent review of VI, we refer the reader to (Zhang el al. 2018
In parallel with the development of VI, several researchers have focused on providing simple and scalable approximate Bayesian frameworks where little to no change is made to point-cstimate networks (Gal &
Ghahramani 2016 Kendall & Gal 2017 Gal & Ghahramani 2015 Lakshminarayanan et al. 2017 Hoffmann
& Elster 2021). For instance, in MC Dropout, the dropout operation is re-formulated to approximate the variational distribution. by posing a Bernoulli prior distribution on the networks' weights or, in later work,
as a mixture of multiple Gaussian pdfs (Gal & Ghahramani] 2016 2015 Kendall & Gal 2017) 7 A similar approach is implemented with the model ensembling technique where a collection of models is obtained by training multiple NN models with distinet paramcter initialization or training on separate mini-batches of the data (Lakshminarayanan et al. 2017). Some authors have tried to re-interpret model ensembling technique
Bayesian approximation in the same way MC Dropout [Lashmmnarayanan et al. 2017 Hoffmann &
Elster 2021 )
Prior Networks MMalinin & Gales 2018 2019) offer an alternative to modeling uncertainty by allowing for data, distributional, and model uncertainty to be treated separately within a consistent, bilitiills interpretable framework. Prior Networks train a network to generate uncertainty estimates that differentiate between in-distribution and out-of-distribution (OOD) data. This differentiation is achieved by training the network on both in-distribution and OOD data. However, as highlighted in (Malinin & Gales 2018), OOD samples are often not readily available, leading to the suggestion that one should either synthetically generate OOD data using a generative model or employ an alternate dataset (e.g., using FashionMNIST (Xiao et al. 2017) for MNIST (Deng 2012) )
Most approaches built on VI and approximate Bayesian methods use a sampling technique to avoid propa- gating the entire pdf. Specifically, at each forward pass, only one sample is drawn from the approximating distribution. Instead, at the inference time, uncertainty is obtained by drawing multiple MC samples and performing multiple forward passes through the network, or by averaging the predictions of different net- works.
2.2 Density Propagation Methods for Neural Networks (NNs)
Estimating the posterior distribution of the model parameters can also be cast from dynamical system perspective. The problem of estimating the hidden state of a stochastic dynamical system based on noisy measurements is a fundamental problem in hidden-stale tracking and estimation. The state-space formu- lation can describe several, and NN training can be modeled as a non-linear discrete-time system. Several authors have used tracking methods, c.g., Kalman filters (KFs) PFs, to explore alternative training ap- proaches for NNs (Singhal & Wu 1988 Puskorius & Feldkamp 1991 de Freitas et al., 2000 Halimeh et al.
2019 Li et al. 2010: Titensky et al. 2018 Carannante et al., 2021a Russell & Reale 2021 J. However, these approaches have not gained popularity due to their limited applicability to small and simple (fully-connected)
NNs, and their evaluation has primarily focused on small, clean datasets with little study on related uncer- tainty quantification. Only two studies, (Titensky et al., 2018 Carannante et al. 2021a), have applied these techniques to quantify uncertainty in small fully-connectedd (FC) networks trained on the MNIST datasct (Deng) 2012), while Russell & Reale 2021 focuses on multivariate uncertainty in the context of Bayes filtering systems.
Recent works adopted the VI framework to track the first two postcrior moments, i.c., mcan and covariance, across the non-linear layers of a network, levereging key techniques from extended, ensemble and unscented KF (Dera et al.) 2021 Carannante et al.] (020) Unlike other VI approaches, the moments propagation approach allows for the learning of uncertainty information during model training. We refer to these tracking approaches that attempt to track the moments of the posterior pdf across the model layers and rely on the Vi framework as Varialional Densily Propagation (VDP). It is important to note that. VDP is limited to Tensor
4

---

Published in Transactions on Machine Learning Research (06/2024)
Normal distributions due to the use of VI and the KL divergence, resulting in closed-form expression for the loss function (Dera et al. 2021
This paper goes beyond the VDP approach, ie., beyond the first two moments and the VI approximation, by utilizing the Sequential Importance Sampling (SIS) and Particle Filtering (PF) techniques, which provide asymptotic convergence guarantees, to estimate the posterior pdf of the parameters and measure the predic- tion uncertainty of the model. Unlike previous work that leveraged the state-space model in NNs, our focus is not on finding an alternative to backpropagation but estimating the posterior and predictive pdfs of the network's parameters for the test dataset. We refine these pdfs in sequential manner training progresses using weighted particles. Unlike the Variational Inference (VT) framework, which typically constrains the posterior and predictive pdfs to a predefined family of distributions, our approach employs a particle-based representation that offers a more flexible empirical approximation of these distributions. However, it is im- portant to note that this flexibility is contextual and operates within the confines of the chosen transition and observation models. Additionally, we utilize the learned particles to derive and analyze uncertainty information.
3
Mathematical Formulation
3.1 Bayesian Framework
In the Bayesian setting, the model parameters W are defined random variables with prior distribution p(W). In the Bayesian framework, all information about the (unknown) parameters is contained in the i.e., p(W[D). In particular, we can derive
posterior distribution given the training data, D = {(X, the predictive distribution of any unseen input X, with output y, as follows:
{(X,)) J.M
P( p(y)X, W) PWW(D) dW.
(1)
In equation [ the predictive distribution's mean corresponds to a point estimate prediction, whereas the second-order moment can be utilized to assess the model's confidence. Note that the predictive distribution depends on the evaluation of the posterior pdf of the model parameters p(W[D). Using Bayes rule, the posterior derived as:
P(W = P(D(W)p(W)
(2)
J (P(D)W))(W)aW
Where p(D(W) is the likelihood of the data given the parameters. However, as we will show in the sequel, a closed form solution of Eq. (2) is only possible in few simple cases.
3.2 Space Formulation
We consider the following state-space model for the model paramcters:
W -( + Thk
(3)
Y& = f(W,, Xx)) + tk,
where X the 6th input training sample with label yk: Me and Ug are zero-mean process and measurement noise, respectively, with known pdfs. The non-linear maps G and F represent the stale-transition and measurement models, respectively.
The Bayesian solution requires finding the posterior pdf of the state given the noisy measurements, p(Wxlyk), al every time step kt Using Bayes rule, we can derive the two-step Bayesian recursion formulas to recursively estimate the posterior as follows:
p(Walyk-1)- p(Wx(We-))
dWR-1,
(4)
p(Welyk) P(Y) p(WAlyk-1)
(P(YN(WK) P(WAYY--))
5

---

Published in Transactions on Machine Learning Research (06/2024)
The recursive relations given in Eq. (1) are only conceptual solution due to the fact that these integrals are generally intractable. For the linear Gaussian model, the posterior is also a Gaussian distribution whose mean and covariance can be computed using the Kalman filter (KF) (Li et al. 2015a). In other cases, several approximations can be used, such as the extended Kalman filter (EKF) (Kalman 1960p. the unscented Kalman filter (UKF) (Julier Uhlmann 1997), and the ensemble Kalman filter (EnKF) (Evensen
1994). However, the EKF, UKF, and EnKF all make different assumptions about the nature of the nonlincar models and all assume that the process and measurement noise are Gaussian.
3.3 Sequential Importance Sampling (SIS) and the Particle Filter (PF)
In non-linear and non-Gaussian state-space models, PF represents a powerful class of sequential MC al- gorithms that numerically solve the optimal estimation problem without making any assumptions about the pdfs or the linearity of the system model (Gordon et al., [993] Doucet al.) 2001). PF approximates the unknown posterior pdf by set of weighted samples, called particles. PF builds upon the importance sampling technique, which is used to approximate the expectation of function with respect to pdf that is difficult or impossible to sample from directly. The basic idea behind importance sampling is to transform the target distribution into an easier-to-sample distribution, called the importance distribution, and use this importance distribution to generate samples that are used to approximate the desired expectation. Theo- retically, the only condition on the importance distribution that support includes the support of the postcrior distribution.
Put in context, given the unknown posterior distribution, p(Welys), from which it is difficult to sample from, introduce "easy to sample from" importance distribution yWW.(Wee-.. We draw samples from the importance distribution, w(() ~ g(Wx/We-1,, associate an importance weight u(9) make up the difference between the importance distribution and the posterior and find discrete approximation of the posterior pdf as follows:
D(Walyu) = Σ doWW w(()) )
where 8 represents the Dirac function and N is the number of particles. w denotes the i-th particle at time step k. The importance weights "calibrate" the particles, i.e., they carry information about how likely the particles- drawn from the importance distribution - are actually coming from the true target distribution. The posterior distribution is approximated by a set of Dirac-delta masses (particles) that evolve randomly in time according to the state-space model (3) Additionally, can be seen from Eq. ( that the PF enables the computation of the expectation E(-) of any test function ø as:
N
E(o(W)) ~ Σ 0 ((W)))
(6)
Throughout the rest of this manuscript, we refer the weights ( associated with particles as importance ratios, or simply ratios, to avoid any confusion with the weights of the DL model.
In the PF framework, the posterior is approximated sequentially by alternating importance step, i.e., drawing particles from the importance distribution, w ([W//W--.ya). followed by an update step where the particles are adjusted by taking into account their likelihood, ic., computing the importance ratios. Specifically, the ralios are computed as:
Myslwy (o ( ((W (W
(7)
where denotes a proportionality relation. The importance ratios are then normalized to sum up to unity. The choice of the importance distribution can impact the rate of convergence of the filter (Doucet et al. 2000). The optimal importance pdf, which minimizes the variance of the importance ratios, is usually not accessible. A commonly used alternative, for its simplicity, is the state transition pdf (/ k-1), which
6

---

Published in Transactions on Machine Learning Research (06/2024)
reduces the computation of the ratios to:
4 plyx/W)).
(8)
Equation ( indicates that if the importance distribution is selected as the prior transition, the importance ratios become directly proportional to the likelihood.
The power of the PF stems not only from its simple implementation but also from its powerful convergence and optimality properties. Under weak assumptions, we can ensure (almost sure) convergence of the empirical distribution toward the truc one (as the number of particles increases). Some bounds on the mean square errors and some large deviation results were elegantly and concisely presented in (Crisan & Doucet 2002).
In practical implementations, the number of particles N is finite, and the PF provides estimates whose variance increases with time. However, resampling largely solves this problem (Li et al. 2015b). Resampling is very intuitive idea, which has major practical and theoretical benefits (Doucet et al.) 2001]. An important advantage of resampling is that it allows us to remove particles with low weights and thus save on the computational cost of propagating them. A systematic resampling technique consists in replicating particles with larger weights while eliminating those with smaller weights. Many resampling schemes have been proposed in the literature. However, the systematic resampling is the most widely-used algorithm as is extremely casy to implement and outperforms other rosampling techniques in most scenarios (Doucet et al. 2001).
As with any scheme for numerical integration, be it deterministic or stochastic, the characterization of the distribution with a fixed number of samples deteriorates in sufficiently high-dimensional spaces and with sulficiently complex distributions (Bengtsson et al. 2008). The nunber of samples required increases expo- nentially with the dimensionality of the problem. Efficintt high-dimensions importance sampling techniques and conditions were investigated in the literature Bengtsson et al. 2008 Richard & Zhang 2007 Beck 2003).
As previously mentioned, the choice of importance distribution can significantly impact the convergence of the PF. Some authors have proposed including likelihood terms in the importance dist.ribution to reduce the number of required particles (Ades & Leeuwen 2013). Alternatively, others have proposed performing multiple PFs by partitioning the nigh-dimensional state into sub-states (Djuric et al. 2007 Closas & Bugallo, 2012). For a complete and detailed treatment of PF algorithms, importance density choice, mathematical convergence derivation and different resampling schemes proposed in the literature, we refer the reader to
the surveys and tutorials in (Arulampalam et al., 2002: Doucet & Johansen, 2009 Crisan & Doucet 2002
Li et al. 2015b).
3.4 BaSIS-Net
The DL model is modeled as a discrete-time dynamical system with the hidden state represented by the network's parameters W. Consequently, the terms "state" and "parameters' are used interchangeably. We let N denote the number of particles, k = 1, K represent the time-step, where K is typically determined by the number of epochs multúplied by the number of batches. I refers to the layer, with L being the total number of layers in the network. The posterior distribution of the weights is approximated by a set of Dirac-delta masses (samples) that evolve across the layers according to the dynamics of the training data. The sequential derivation of the posterior requires us to determine the transition distribution of the weights P(Wx|Wa-1) and the likelihood p(y&(We).
First, break the high-dimensional system into smaller-dimensional systems (subsystems) by partitioning the state at time k into L components, each corresponding to layer as follows: W [Wpjk.... W[rjs). The exponent will be reserved to denote sample. We subsequently adopt the concept of multiple or parallel particle filters as in Djuric et al. (007))
We introduce a well-crafted transition model where the evolution of the state is guided by the gradient descent update rule. Specifically, the map g in 3 defined as:
W = W -Vw,,,
(9)
where W is the gradient of the network loss function with respect to the parameters, and is the learning rate. As described in the Section 3.3. we use the transition density our importance density.
7

---

Published in Transactions on Machine Learning Research (06/2024)
An intuitive example of a likelihood function is given by the "distance" between the network prediction, given the current sample weights, and the target output. Given the subsystem or layer-wise state calculations, the output of the network is calculated using the current sample particles for the considered layer while all other layers are frozen at their most recent estimates. Formally, we have
ply & exp (-1()(())
(10)
where
Mijk = f(WW))) ,X), and
W ( (Wiju Wi-1 W (e/ke W0+1)/-1>"" ""rpii-""""""""-"-
(11)
A Algorithm 1 Toutlines the specific steps for implementing ing the learning of the posterior pdf and the estimation of the predictive pdf. To reduce computational complexity, we compute the gradient of the loss with respect the previous time step weighted mcan estimate rather than for each individual particle. Furthermore, a simple resampling technique is utilized in which particles survive in proportion to their likelihood, and off- spring particles are assigned importance ratio of L/N. As result, it is not necessary to store importance ratios.
Algorithm BaSIS
Let Wo [Wijo.... Wizoo be the partitioned state at time k 0.
2: For k = 0, draw particles from the prior pdf: wp(i) ~ p(Wpjo): e.g., Gaussian or Uniform, and assign [ijo uniform importance ratios: "i00 1/N for all I= 1, 1, and =1,",, N.
(i)
for k 1,2....,4 K do
for 1,,,..., L do
Sample Wi() Will
[]} [1]--1 Vw wwwpga/WWWWWWa..... ,,) 7/() N'0, TT i 1-,,,....
S[[W>] (),,,, where [Wa](1) = (Wija,.... W1-1JR, W(G W W1+1]e-1--.. W 11
6: Evaluate y i11..
1,2, .,,,....NN.
Compute Iij x (6) (p)
7:
-
2(1
Normalize importance ratios u (i) Iijk
4/1 Σ,
= 1,2,......
a0T [i]k
Resample and associate weight of 1/N with each offspring sample
Calculate WigJe E, w(8) (
10:
11:
end for
12:
Update W₁ - [Wiikr ". W[(
13:
end for
3.4.1
Basis Inference Mechanism
After learning the optimal particles, directly compute the full predictive distribution for any given input without needing further sampling. From this distribution, its associated moments, such the mean for point-cstimate classification and the variance for predictive uncertainty, can be calculated without additional post-hoc sampling.
Without loss of generality, we demonstrate the propagation for a two-layer network. Let (2(W (Wij: X)) be the output of the network, where X is the input, WIj, W(2) are the parameters for the two layers and fi, /2 denote the network output at layers and 2, respectively. Let (We(i) w-(1) N pik ( 1 1=
8

---

Published in Transactions on Machine Learning Research (06/2024)
be the N learned particles, ie., obtained at the final training step K. To simplify the notation, we will drop the step notation K.
At perrence/tesl time and given an input X, we first propagate the particles through the first layer fi:
A (WW X), i= i= N,
(12)
where |,= is the obtained probability distribution after the first layer. Then, we compute the sample mean, A, of this distribution, using Eq. and feed it to the next layer f2:
y = f2(W .A), i i=
(13)
where (y(0) Ji=1 is an empirical approximation of the predictive distribution. The first-order moment corre- sponds to the point-estimate prediction, and the second-order moment quantifies the associated predictive uncertainty.
3.4.2 BaSIS-Net Hyperparameters
PF methods' performance is linked to the number of particles N used. Theoretically, PF approaches converge to the optimal filter as N + oo (Crisan & Doucet, 2002). At time = 0, Basis-Net initialized by drawing particles from prior pdf: W p(W)) e.g., Gaussian or Uniform. The parameters of this distribution, e.g.: for Gaussian distributions, should be treated other hyperparameters of NN model. Hence, they should be optimized.
In the general context of state space models, the noise values in the transition model govern the search space for particles at the subsequent time step. As has been well-established since the advent of the Kalman filter, the selection of on impacts the algorithm's convergence behavior (Gordon al., 1993 Park et all, 2013). When selecting the sigma parameter for the noise in the transition model of the PF, it crucial to consider the trade-off between exploration and exploitation (or convergence). Given that in practice, we have finile number of particles, using a large sigma encourages exploration of the state space but may hinder convergence. Conversely, small sigma restricts the search space, reducing particle diversity and potentially compromising the effectivencss the iltering/tracking process.
When starting our experiments, for each datasel, we performed a grid-search over a set of values for on starting from large to small, identify value that guarantees convergence with a good test accuracy. In the Appendix [ we also report the accuracy of BaSIS-Net versus on on the MNIST and CIFAR-10 dataset proof of concept. Additionally, with varying on- Figure 11 shows test accuracy and predictive variance under Gaussian noise applied to MNIST test data, with several BaSIS-Net models using different o, values.
investigated the robustness and uncertainty calibration of the model
4 Experimental Setup
4.1 Datasets and Model Architectures
The performance of the proposed BaSIS-Net framework is tested and evaluated on four distinct datasets. We start our experiments with two standard image classification benchmark datasets, MNIST and CIFAR-10 (Deng 2012 Krizhevsky & Hinton 2009p. Subscquently, we test the proposed framework on two medical image datasets. The first medical task involves image classification using the Malaria dataset, (Rajarmman et al. 2018), which is publicly accessible via the Tensorflow Datasets Catalog) The dataset consists of 27, 558 thin blood smear slide images of both infected (parasitized) and uninfected cells. The images in this dataset are highly diverse and heterogeneous, captured using various microscopic scanners. As a pre-processing step, images are zero-padded to achieve a uniform input dimension of 200 x 200 when required.
In the second medical task, the focus on image segmentation using the Hippocampus datasct from the Med- ical Segmentation Decathlon (Simpson et al. 2019 Antonelli & et al. (002).. The task consists of segmenting two adjacent structures of the hippocampus, i.e., anterior and posterior regions. The Hippocampus dataset
9

---

Published in Transactions on Machine Learning Research (06/2024)
includes 394 single-modality MRI scans of varying sizes. As pre-processing step, scans are standardized to a uniform input size of 64 x 64 pixels through zero-padding, if necessary. Additionally, to minimize the bias inherent in MRI scans, all pixel values are normalized between 0 and 1.
MNIST: We use a small neural network comprising a single convolutional layer followed by Rectified Linear Units (ReLU) activation, max-pooling, a single fully-connected (FC) layer, and a final softmax operator. The convolutional layer consists of 32 kernels with size of 5 x 5, while the FC layer comprises 10 neurons.
CIFAR-10: We use an architecture comprising 11 layers, consisting of 10 convolutional layers and one FC layer with 10 units. The convolutional layers contain 32, 32, 32, 32, 64, 64, 64, 128, 128, 128 kernels, respectively. The first block of operations is composed of convolutional kernels of size 5 x 5 followed by balch-normallizttion, Exponential Linear Unit (eLU) activation function, and max-pooling. The subsequent 4 blocks of operations consist of two convolution operations, each followed by eLU activation and batch- normalization, one max-pooling, and one dropout layer with a rate of 0.2. Convolutions are performed using kernels of size 3 x 3. The final block of operations comprises single activation, batch-normallizttion, final FC layer, and the softmax function.
convolution operation, eLU
We use NN architecture consisting of seven convolutional layers and one FC layer. The first block of operations comprises a convolutional operation, followed by eLU activation, batch-normalizationn, and max-pooling. The subsequent three blocks are composed of a sequence of oper- ations that include convolution, eLU activation, nateh-normallizttion, another convolution operation, eLU activation, batch- nonaalioomlli,,,inn,, max-pooling, and a dropout operation with a rate of 0.2. The number of kernels in each convolutional layer is set to 16, 16, 16, 16, 32, 32, and 32. The kernels in all layers have size of 3 x 3. Finally, the architecture concludes with FC layer with softmax activation function.
Malaria Classification Datasct:
Hippocampus: We use U-Net, an encoder-decoder architecture designed for segmentation tasks Ron- neberger et al.] (2015). The encoder path consists of three encoder block, each consisting of two convolu- tional layers followed by a ReLU activation and a max-pooling operation. The bottom encoder block does not perform max-pooling. The encoder has six layers, with the number of kernels set. to 32, 32, 64, 64, 128, and 128 from top to bottom. All kernels have a size of 3 x 3. The decoder path is composed of two decoder blocks. Each decoder block performs an upsampling operation followed by a learnable 2 x 2 convolution, two consecutive convolutions 3 3 kernels, each followed by a ReLU activation and padding operations. The decoder has six layers, with the number of kernels set to 64, 64, 64, 128, 128, and 128 from bottom to top. The output is obtained by applying a 1 x 1 convolutionn and softmax to the decoded feature maps to obtain a sogmentation mask of the same shape as the input. Similar to the original U-Net implementation, we concatenate the data from each encoder block with the corresponding decoder block.
4.2 DL Models
Deterministic (Det): Det is a neural network model trained deterministically. This model generates deterministic predictions, meaning it produces single prediction for each input without providing any indication of uncertainty.
MC Dropout (MC Drop): MC Drop is a neural network model that applies dropout not only during training but also during inference. It involves obtaining multiple predictions by performing several forward passes through the network during inference. These predictions are interpreted as samples from the approx- imate posterior distribution, and their average is used as the estimate. In all datasets and experiments, we use 20 samples. For classification tasks, the dropout probability is set to p = 0.2. For the segmentation dataset, we follow the specification in (Kendall et al., 2015) and apply dropout only at the bottom layers of the encoder-decoder network with dropout probability of p 0.5.
Bayes Convolutional NN (BCNN): BCNN is the extension of Baoos-By-Bacprop (BBB) to Convolu- tional Neural Networks (CNNs) Blundell et al. 2015 Shridhar et al. 2018). The model is trained within the Variational Inference (VI) framework using a Gaussian variational distribution. A single set of param- eters is sampled at each forward pass during training. At inference time, the final prediction is obtained as the average of multiple forward passes through the NN, treated as samples drawn from the approximated posterior pdf. Similar to MC Drop, we consider 20 samples for all datasets and experiments.
10

---

Published in Transactions on Machine Learning Research (06/2024)
For each dataset, we train a set of five standard NNs with the same architecture. The diversity among the ensemble members is achieved by considering different initialization schemes for the learnable parameters. At inference time, we feed the same input to all five trained NNs and obtain the ensemble model output as the average across all NNs Lakshminarayanan et al. 2017).
Ensemble Model:
Variational Density Propagation (VDP) Models: We consider three VDP frameworks, namely, (1) extended VI (exVI), (2) ensemble VI (enVI), and (3) unscented VI (unVI) (Dera et al.) 2021 Carannante et al.] 2020). Model training is performed by propagating the first two moments of the variational pdf, L.e, the mean and covariance. Depending on the approach employed (exVI, enVI or unVI), the propagation through activation functions is performed using either first-order Taylor series, ensembles, or unscented transformation. For all three approaches, we define a Tensor Normal Distribution over the parameters of the model. To reduce computational burden, for the segmentation task, we only propagate diagonal values of the covariance matrices (Carannante et al. 2021b). Due to the nature of VDP, no sampling is required at inference time.
Bayesian Sequential Importance Sampling (BaSIS-Net): We use BaSIS-Net to refer to DL models that employ the BaSIS framework. The number of particles utilized in a BaSIS model is indicated at the end, such as BaSIS 100, which is a BaSIS-Ne Best with 100 particles. In all simulations, we set the prior pdf to a Gaussian distribution with Ginit = 0.001 for all detests. To generate particles, we set og = 0.0001 for MNIST and Malaria datasets, on = 0.00001 for CIFAR-10, and on = 0.00005 for the Hippocampus dataset. Different numbers of particles are employed for each dataset. For MNIST, we use N = 100, 500, and 1000, for CIFAR-10, we use N 100, and 500, and for the Hippocampus and Malaria datasets, we use N 100. We adopt the cross-entropy loss function for & in Eq. (10) for all experiments. In all BaSTS-Net models, the particles are learned during training, and no post-hoc sampling is needed at inference time.
4.3 Performance Metrics and Robustness Analysis
We conducted a comprehensive robustness analysis for all models by evaluating their performance on datasets perturbed with various types of additive natural and adversarial noises. We computed the average accuracy for classification tasks and the Dice Similarity Coefficient (DSC) values for the segmentation task, with DSC values reported separately for both anterior and posterior structures for the Hippocampus dataset (eezz et al. 2014). The level of additive noise or perturbation was measured using Signal-to-Noise Ratio (SNR) in decibels (dB), with high SNR values indicating low noise/ potse/perturbation levels and vice versa. In the Results Section f we reported the average accuracy or DSC values for each model for the noise-free cases, i.e., model performance on the standard test datasets, and for different levels of additive noise and adversarial attacks. The best-performing modcl(s) were indicated in bold notation. In all tables and plots, we constructed the 95% Confidence Intervals for our results.
To generate adversarial noise, we used two well-known techniques, Fast Gradient Sign Method (FSGM) and Projected Gradient Descent (PGD) (Liu et al. 2016 Madry et al. 2017). We reported the attack type, targeted or untargeted, and the fooling class for each targeted experiment. For PGD attacks, we also reported the step-size and maximum number of iterations (Max-iter). Specifically, for the MNIST dataset, we generated targeted and untargeted FGSM attacks and used class label 3 as the fooling class for targeted attacks. For the CIFAR-10 dataset, we generated both targeted and untargeted FGSM and PGD attacks. For targeted FGSM, we set the fooling class to label 3, and for PGD, we considered two different fooling classes, i.c., label and label 3, and changed the number of iterations to 10 and 40. For untargetod attacks, we changed the number of iterations only. For the Malaria dataset, we generated untargeted FGSM and PGD attacks, with the number of iterations set to 10 and the step size to 1 for PGD attacks. For the Hippocampus dataset, we only considered PGD attacks, with class label 2 as the fooling class and the number of iterations set to 5 for targeted attacks.
The study aims to showcase various attacks (FGSM and PGD targeted and untargeted) across diverse datasots (MNIST, CIFAR-10, Malaria, and Hippocampus), recognizing that attack effectiveness depends on the power of attack as well as inherent dataset characteristics. Experiments varied the attack intensity (measured by SNR) from high to low to comprehensively assess model resilience. We systematically explored
11

---

Published in Transactions on Machine Learning Research (06/2024)
1.0
0.9
0.9
TestAourayy
TostAcouray
0.8
0.5
Det
0.7
MC Drop
0.7
mV
BaSIS 500
BCNN
DCNN
Essemble
BaSIS 1000
0.6
eXV1
BuSES
0.5
10
20
High Noise
(dB)
Law Noise
High
SNR
SNR(dB) (dB)
Low Notse
(a) MNIST
(b) Malaria
Figure 1: Performance of different models under various levels of Gaussian noise applied to (a) MNIST and (b) Malaria test dataset. The y-axis displays the accuracy at test time and r-axis represents the level of additive Gaussian noise measured as Signal to Noise Ratio (SNR) in units of dB. We note that at high noise levels, BaSTS-Net performs better than other models.
Table 1: Performance comparison using average test accuracy of different models under additive Gaussian Noise for CIFAR-10.
Model
Det
MC Drop
BONN
V/
Ensemable
Ba818 100
BaSES so0
Nojac Free
.85 .007
.44 .07
.58 # J07
.50 007
.85m .007
.844 .007
.44m .007
BNN
Gatasann Notee
28 low noise
.82 E .008
.82 1 .008
.81 :: .008
.85 E .007
.80 4 .007
88. 4: .007
.83 d: .007
mediian nolse
.80 E .010
-70 4 .000
.61 # .010
.61 # 010
.85 4 .009
.72 4: .000
.72 .009
Iieh bosee
.25 + .010
.27 + .008
.25 + .008
.26 + .007
.25 + .007
.30 + .007
.31 .007
a variety of attack scenarios by employing a mix of targeted and untargeted attacks across different datasets. This approach allowed us to showcase a broad range of adversarial situations.
4.4 Training Hyperparameters and Settings
We employ different loss functions for various DL models. Specifically, we use cross-entropy loss function with 7.2 regularization for Det. MC Drop, Ensemble, and BaSTS, while employing ELBO loss function for VI variants. In the case of MNIST, we train all models for 10 epochs with learning rate of 0.01. For CIFAR-10, train models for 300 epochs with an initial learning rate of 0.01, apply polynomial decay, and early stopping to avoid overfitting. We use batch size of 50 for both MNIST and CIFAR-10. For the Malaria datasct, we train all models for 20 epochs with polynomial decay and an initial lcarning rate of 0.01, with a batch size of 20. Similarly, for the Hippocampus dataset, we train all models for 150 epochs with Adam optimizer, a learning rate of 0.001, and batch size of 10. We perform all simulations on an NVIDIA RTX A6000 GPU, For Malaria and Hippocampus datasets, we cannot train BaSIS using higher number of particles due to GPU memory constraints.
Table 2: Performance comparison using average DSC of different models under additive Gaussian Noise for Hippocampus Dataset.
Anterioe Struciure of Hippocampus
Fosterior Structure of Hippotampar
Drop
Drop
Noiue
Fren
74 0008
000
76 008
.008
.76 .008
.70 .009
.70 .008
.72 1 .008
.72 1: .008
771 4: .008
SNR
Gamestan Nolen
.7
.008
.76
.70
.71 + .000
+ .008
medium
.59 .010
.01 .010
.6 .009
.62 + .010
.e8 + .009
.54 + .010
.66 .010
.0 .010
53 + .010
.62 + .010
unise
higia
.22 è .008
.22 0088
.8 .009
.20 .068
.87 + .009
.18 + .008
.20 + .008
.3 + .008
.16 + .007
.27 .009
noise
12

---

Published in Transactions on Machine Learning Research (06/2024)
Table 3: Performance comparison using average test accuracy of different models under FGSM Adversarial Attacks for MNIST.
Noise
Frox
.99 + .004
.9 + .004
.9T + .008
.97 003
.003
.97 + .003
.98 .006
.97 # .008
.97 .003
.005
SNR
FGBM Targesed Attack Pooling Clase Digit 3
T6
low
.85 + .007
.90 + .008
.99 + .008
.92 + .006
.90 .008
.90 000
.86 .007
.94 .005
.95 .004
.95 + .004
noine
Light noise
.14 + .007
.23 è: .008
30 è .009
.8G + .007
.94 + 0007
.80 007
.20 .008
866 à: .007
.87 0007
.87 0007
PGSM Untargeted Astack
15 low
.85 + .007
90 + .006
.TO # .008
.78 + .006
.70 + .000
.72 000
.87 .007
994 .00G
.95 .004
.95 0004
noten
high noise
.14 + 0007
22 4 .008
.10 d: .006
.41 4: .010
.42 de .010
.42 01.0
.20 .009
866 1: .00
.90 4: 007
.87 007
Ensemble
100
1.0
1.0
MC Drop
eVVT
BaSIS 500
BCNN
Test Accuray
Test Test Accuracy
0.6
0.5
0.4
0.4
0.2
0.2
0.0
High Noise
SNR (dB)
Low Noise
High Noise
SNR (dB)
Low Noise-
(a) Untargeted Attacks
(b) Targeted Attacks with fooling class label
Figure 2: Performance of different models under various levels of FGSM Adversarial noise applied CIFAR- 10 test data. The y-axis displays the average test accuracy and z-axis represents the strength of the attack measured using Signal to Noise Ratio (SNR) in units of dB. We note the performance benefits of using NaSIS-Net at low SNR. values (high noise) for both attack types.
5 Results
We present the results of our study, which demonstrate the superior performance of BaSIS-Net in com- parison other tta Bayesian and approximate- Bayessin methods, on two classical benchmark datasets, namely MNIST digits and CIFAR-10, and two medical imaging datasets, Malaria classification, and Hippocampus segmentation datasets (Deng) 2012 Krizhevsky & Hinton, 2009 Simpson et al. 2019 Rajaraman et al. 2018). We evaluate BaSIS-Net against other state-of thettrtt-rrt Bayesian and approximate- Bayesian approaches including BCNN, MC Drop, Ensemble, and three variants of VDP (exVI, enV1, unV1). For reference, we include results for a deterministic network (Det).
5.1 Performance Analysis Under Gaussian Noise
Figure I and Tables I and display the average test accuracy of various models when Gaussian noise is added to the test dataset samples. Figure La shows the average test accuracy plotted against various levels of Gaussian noise, measured using SNR, added to the test datasct of MNIST. The performance of Det. MC Drop, BCNN, VI, enVI, unVI, Ensemble, and BaSIS-Net are shown. In Figure [b] the same plot is presented for the Malaria dataset with Det, MC Drop, BCNN, Ensemble, and BaSIS-Nee Table reports the performance of Det, MC Drop, BCNN, exVI, Ensemble, and BaSIS-Net for three levels of Gaussian noise added to the CIFAR-10 10 test dataset. Similarly, Table provides the same results for the Hippocampus test dataset.
13

---

Published in Transactions on Machine Learning Research (06/2024)
Table 4: Performance comparison using average test accuracy of different models under PGD Adversarial Attacks for CIFAR-10.
Drop
Noue Free
E. .007
54 4 0007
.81 007
.80
0007
.80 0007
84 0007
34 + .007
SNI
FGD Targeted
Astack: Fooling clase Label
Step-rise:
Max-iter:
20
moise
.100
.010
.41 010
.10
.58
.57
.58 1: .010
high motes
2 .000
0100
009
010
46
.47 4: .010
PGD Targeted
Rooling
Step-slee:
Mox-iter:
20
noise
.010
.010
.010
0000
.68
high molee
.000
.010
009
000
.66
.47 4: .010
PGD
molse
+ .006
.008
.010
.67
.68 + .010
.006
-007
.44 010
010
.009
.40 4:
.40 4: .010
PCD
.006
.007
.010
0010
+ .009
.68 +
.68 + .010
avise
.010
.010
Table 5: Performance comparison using average test accuracy of different models under Adversarial Atackk for Malaria Dataset
Drop
Eusemble
Ba218
.066
Step-size:
5.2 Performance Analysis Under Adversarial Noise
Tables and Fig. present a comprehensive evaluation of the robustness of several models, including Det, MC Drop, BCNN, exVI, enVI, unVI, Ensemble, and BaSIS-Net, under various adversarial attacks. Table 3 shows the performance of these models against FGSM attacks MNIST. Similarly, Table 4 reports results for targeted and untargeted PGD attacks CIFAR-10 for Det, MC Drop, BCNN, exVI, Ensemble and BaSIs-Net. Fig. 2 depicts the performance of these models under FGSM attacks CIFAR-10. Table provides the performance comparison for untargeted FGSM and PGD attacks on the Malaria dataset for Det, MC Drop, BCNN, Ensemble, and BaSIS-Net. Finally, Table b reports the results of targeted PGD attacks on the Hippocampus dataset for Det, MC Drop, exVT, Ensemble, and BaSTS-Net.
Table 6: Performance comparison using average DSC of different models under PGD Adversarial Attacks for Hippocampus Dataset.
Auterior
Fosturion
Drop
Drop
Noiue
Pren
74 .155
014
76 014
.014
.66 .014
.70 1: .015
.70 .015
.72 1. .015
.72 1: 00.5
.71 4: .015
SNR
PGD
Thrgeted Attaok
Pooling clase:
Label Step-sise: Maxsiter:
66
.016
66
.65
.66
.63 4
.016
medium
18 .013
.15 .012
23 .014
.21 .014
.24 + .009
.08 + .015
.31 .015
28 .018
.26 + .018
.34 .021
unise
higia
0
02 .005
.02 .065
.05 + .007
.01 + .003
.03 + .006
.8 + .006
.02 + .006
.00 .008
noise
14

---

Published in Transactions on Machine Learning Research (06/2024)
5.3 Predictive Uncertainty
The model uncertainty is captured by the variance or the second central moment of the predictive probability density function (pdf). The "predictive uncertainty' is defined as the (sample) variance of the predictive distribution. The predicted class corresponds to the mcan of the predictive distribution. We investigate the behavior of the predictive variance when perturbations, such as Gaussian noise or adversarial attacks, are added to the test. datasets. We present the average predictive variance under various levels of (1) Gaussian noise, (2) untargeted FSGM attacks and (3) targeted FGSM attacks on MNIST and CIFAR-10 datasets in Figs. aand 4 The average predictive variance values are normalized between 0 and 1. We show the results for BaSIS-Net models with 100 and 500 particles in Figs. 3 and | respectively, and compare with other Bayesian approaches. For characterization of the calibrateness of the model, we computed the Brier score. Fig. 5 shows the Brier score when various levels of (1) Gaussian noise, (2) untargeted FSGM attacks and (3) targeted FGSM attacks are applied to MNIST test data. We note that at high levels noise (both Gaussian and adversarial), the model test. accuracy drops (as expected), and the Brier score increases.
For the segmentation task, we introduce pixel-level "Uncertainty Maps" that associate predictive variance to each pixel in the model output. We demonstrate representative case from the Hippocampus dataset in Fig. 6 Each row refers to method: (1) Basis 100, (2) MC Drop, (3) exVI, (4) Ensemble. From left to right: (a) imput image, (b) ground-truth segmentation, (c) noise-free segmentation prediction with (d) associated uncertainty map, (e) additive Gaussian noise prediction and (f) associated uncertainty map, and (g) a targeted adversarial attack prediction and (h) associated uncertainty map. We normalize all uncertainty maps between and for better visual comparison. For the Gaussian noise case, we use a perturbation with SNR & 15, and for the adversarial attack, we use SNR A 20. The solid arrows in Fig. G point to pixels that are incorrectly classified in the prediction segmentation maps and their corresponding spots on the uncertainty maps. We note that the pixels in the uncertainty maps that correspond to the incorrect segmentation reflect low confidence (higher variance values). The dashed arrows point to regions with inconsistent uncertainty estimates, i.e., high variance with no incorrect predictions.
5.4 Predictive Distribution
We investigate the effect of perturbations on the predictive pdf of BaSIS-Net. Specifically, we examine the changes in the pdf when perturbations, such as Gaussian noise and adversarial attacks, are applied to the input test samples. To this end, we randomly select two samples from the MNIST test dataset and feed noise-free and perturbed images BaSIS-500 model. We plot the number of individual particles on the y-axis against softmax scores on the axixi.. We consider two levels of additive Gaussian noise and two different adversarial attacks, with perturbation strengths quantified by signal-to-noise ratios (SNRs) of R 13 and 3 for Gaussian noise, and se 15 and 5 for FGSM adversarial attacks with a fooling class label of 3. These perturbations affect the pdf and modify the distribution of individual particles as shown in Fig. 7
6 Discussion
Our objective was to design resilient models capable of producing predictions while also providing confidence estimates. To achieve this, we utilized the Sequential Importance Sampling (SIS) method as our primary tool to build DL models that generate samples from the approximate predictive distribution. We computed the second moment of this distribution and referred to it as the predictive uncertainty. To evaluate the robustness of our models, we exposed them to different types of noise and compared their performance with that of other cutting-edge Bayesian and approximale Bayesian models.
6.1 Increased Robustness
Based on our findings presented in Tables 1 and Figs. la 1b and 2 we can observe that our proposed BaSIS models exhibit enhanced robustness to noise and adversarial attacks. Specifically, at lower SNRs (high noise levels) the BaSIS models achieve a higher prediction accuracy as compared to other models. It noteworthy that our approach does not require sampling at inference time. The BaSIS framework is comparable to VDP at low noise levels and outperforms it at higher noise levels and adversarial attacks. We
15

---

Published in Transactions on Machine Learning Research (06/2024)
141 MC. Drap
(1) BENN
10 Excemblle
(4) Rands 390
SSR (dB)
(50m Nik.-
(-
SNR (2)
(-33gh Molen
5KH (18)
C- No06
SKR (EB)
Line 1600000001
900 (4h)
(30)
00
(24
9X0 (4B)
Azueao
Vaclane
Figure 3: Average test accuracy (red color line) and average predictive variance (black color line) are presented at various levels (1) Gaussian noise, (2) Untargeted FGSM adversarial noise, and (3) Targeted FGSM adversarial noise applied MNIST test dataset. The a-axis reports Signal Noise Ratio (SNR), measured in dB. We note that at high levels of noise (both Gaussian and adversarial), the Basis model test accuracy drops (as expected), and predictive variance increases (d). Other approaches do not offer the same decreasing monotonic behavior (a c). We use the predictive variance to quantify BaSIS-Net's 's confidence in its output.
MC Drep
BGNN
0d Frsembble
All Bodi 501
(E))
SNR
SNR
12
135
(30)
Maloo
SVK
S4E "ioe Now
SXi or
Areage
Figure 4: Average predictive variance (y-axis) are presented at various levels of (1) Gaussian noisc, (2) Untargeted FGSM adversarial noise, and (3) Targeted FGSM adversarial noise applied to CIFAR-10 test data. x a-axis reports Signal to Noise Ratio (SNR), measured in dB. Dotted lines show the average predictive variance across all test inputs, solid lines represent correctly classified, and dashed lines incorrectly classified inputs. Basis-Net (d) shows monotonic increasing behavior at decreasing SNR while exhibiting lower confidence (or higher uncertainty) when their output is incorrect unlike other compared approaches Nguyen et al. 2015).
16

---

Published in Transactions on Machine Learning Research (06/2024)
Accunxyy
Riter Scor
TestA ocuncs
033
099
Brler Scorr
059
025
023
000
High
(dB)
Night
(dB))
(dR)
Untingetd
Targeted
Figure 5: BaSIS 100 average test accuracy and Brier values are presented at various levels of Gaussian and adversarial noise. Left y-axis (red color line) represents average test accuracy and right y-axis (black color line) represents Brier scores calculated for (a) Gaussian noise, (b) Untargeted FGSM adversarial noise, and (c) Targeted FGSM adversarial noise applied to MNIST test dataset. The r-axis reports Signal to Noise Ratio (SNR), measured in dB. We note that at high levels of noise (both Gaussian and adversarial), the model test accuracy drops (as expected), and the Brier score increases.
Imput
Gruund Truth
Noise Free:
Uncortainty Map
Gaussian Noise SNR x: 15
Uncertairry Map
Targeted PGD allack SNB Predhction
Unoertarryy Map
[(a)
1/b]
1(c)
1(d)
1(a)
1ifi
1(g)
1(h)
Benis 1OD
Class 1: nlerior
20d)
Class Postanior
NCC
Norrelizee Predictive D
3(-)
30m)
3(g)
INVI
46c3
4ic]
QLD)
d(g)
40kg
Erwerble
Figure Representative segmentation results for the Hippocampus datasot. Each row refers to method: (1) Basis 100, (2) MC Drop, (3) exVI, (4) Ensemble. From left to right: (a) input image, (b) ground-
truth segmentation, (c) noise-free segmentation prediction with (d) associated uncertainty map, (e) additive Gaussian noise prediction and (f) associated uncertainty map, and (g) targeted adversarial attack prediction and (h) associated uncertainty map. The solid arrows point to regions incorreetly classified by the models that correspond to low confidence (higher variance values). The dashed arrows point to regions with inconsistent uncertainty estimates, i.e. high variance with no incorrect predictions.
17

---

Published in Transactions on Machine Learning Research (06/2024)
Nniso Froe
Gareaam Noks
Guzvámn Noise-NN
bogydrl RRSM SNR
RGSM SNR
Labe
140
169
175
120
103
07
60
40
50
8.0
0.2
8.0
0.2
0.4
8.0
0.4
0.6
0.8
1.0
8.2
175
Truel albee 7
100
.50-
150
125
Puticia
90
20
25
8.0
0.2
8.5
0.4
2.6
0.6
0.0
8.0
8.0
12bdl 0
1.beel
Tabel 2
Tabel 3
12b0 4
5
Tabel 6
Tabel 1a 1,20el
Figure 7: BaSIS 500 predictive distributions for two randomly selected images from MNIST test dataset. For each example, we show (left to right) the prediction for the noise-free case, two Gaussian noise cases with SNRs s 13, 3, and two FGSM attacks with fooling class digit 3 and SNRs se 15, 5. z-axes show the particles' predictions, i.c., softmax scores, while y-axes represent particles' count. We observe that the variances of the predictive distributions increase with increasing noise levels, reflecting higher uncertainty (lower confidence) in the predictions at. high noise levels. As increase the perturbations, the spread and the number of modes of the distributions increase.
TestAmmaary
Tosl Accuraty
Test:Amrrary
8:30
aue
0.5
Se315 13
Sel
0.0
000
053
Se1t 53)
Sedtd
6.5
Notio
To
(dD)
025
SXR (dB)
033
(N
(a) Gaussian Noise
(b) Untargeted FGSM Attacks
(c) Targeted FGSM Attacks
Figure 8: The effect of the number of particles N BaSTS-Net performance presented various levels of Gaussian and adversarial noise. y-axis shows the average test accuracy calculated for (a) Gaussian noise, (b) Untargeted FGSM adversarial noise, and (c) Targeted FGSM adversarial noise applied to MNIST test dataset. axisxis reports Signal-to-Noise Ratio (SNR) values, measured in units of decibels (dB). For Gaussian noise, the box shows the lower SNR values zoomed. We note that at high levels of noise (both Gaussian and adversarial), BaSIS models with a higher number of particles have higher average test accuracy.
18

---

Published in Transactions on Machine Learning Research (06/2024)
Infermnc Thme parinage (10
200
400
600
800
1000
Number of particles (N)
Figure 9: BaSIS computational complexity at inference time for MNIST data, y y-axis shows the inference time per image (10-3s) and z-axis reports the number of particles N used in BaSIS-Net.
Table 7: Training Time for all Datasets and Models
spoch (man)
Det
MC Drop
RCNN
exVT
enVT
unVI
ensemble
RaS1S 100
Rs818 500
RASIS 1000
MNIST
1.36
1.39
2.53
31.11
76.41
79.94
1:38
N2
4.50
26.21 21
Malaria
8.17
10.44
13.47
9.17 Ng
58.90
Hippocempus
10:55
11.36
34.69
10.56
N2
32.71
number
postulate that propagating higher-order moments, thanks to the use of particles, and frecing the postcrior from functional constraints contribute to the increased performance and robustness to noise and adversarial attacks exhibited by BaSIS models.
6.2 The Effect of Number of Particles
The impact of the number of particles N on the robustness of BaSTS models was investigated. The results presented in Fig. & indicate that incrcasing the number of particles leads to improved performance, partic- ularly al lower SNR values (i.e., high noise levels). This observation is consistent with the mathematical convergence guarantees for SIS and PFs. Specifically, under mild conditions, PFs are guaranteed to converge asymptotically to the true posterior pdf (almost surely and the mcan square error sense) as N increasos. While our empirical results demonstrate promising classification performance, the direct correlation to the quality of PF predictive inference, given the methodological modifications we' ve employed in evaluating like- lihood llss instead of per-particle basis (step 5 in Algorithm 1), warrants further investigation (Izmailov
ct al. 2021
6.3
Evaluation of the Predictive Uncertainty
Our experimental findings indicate that the predictive uncertainty estimated by BaSIS models exhibits a monotonic trend. Specifically, the levels of noise and adversarial attacks increase, the average predictive variance also increases. This behavior is illustrated in Fig. 3 where we observe that the Basis average predictive variance decreases monotonically with incrcasing SNR. In other words, BaSIS models tend to exhibit reduced accuracy and higher uncertainty under higher levels of noise. On the contrary, the other approaches do not show the same ability. Furthermore, Fig. reveals that: i) the average predictive variance (dotted line) increases monotonically for decreasing SNRs, and ii) the predictive variance of incorrectly classified samples (dashed lines) is consistently higher than correctly classified ones (solid lines). This suggests
Table 8: Inference Time for all Datascts and Models
per (a (a-3)
Drop
exV1
enV1
unV1
ensemble
100
MNNIST
M1
0.05 N;
N2
C-0AR-10
0.13
0.13
81
0.16 N.
4.45
0.13 N2
2.47
12.16
Malaria
0.07
0.09 N
0.08 N2
0.83
Hippocampus
0.76
N1 representt the number of samples, i..,, forward rume through the worw xi inference Lime.
N2 in the number of networks in the onsemble.
19

---

Published in Transactions on Machine Learning Research (06/2024)
that BaSIS models are capable of detecting perturbations in the imput data and distinguishing between correct and incorrect predictions (Carannante et al. 2022 McCrindle et al. 2021
In addition, Fig. G shows that BaSIS models tend to be uncertain near the borders of the structures of interest and for misclassified pixels. The black arrows placed on the predictions near the misclassified pixels correspond to regions of high uncertainty on the uncertainty maps. This self-aware behavior could increase user trust in the model, as a human user would be able to determine whether the BaSIS model is performing reliably. Overall, our results indicate that BaSIS models are capable of producing predictions with high accuracy and reliable estimates of predictive uncertainty, even in the presence of noise and adversarial attacks.
6.4 Computational Complexity
The computational demand of STS and PFs algorithms can be substantial, particularly when the number of particles, N, increases. In particular, if the model has d parameters, PF requires storage d N particles. For instance, in the MNIST architecture we used, a deterministic model and MC Drop would need 183.13 KB of storage using 4 d/1024 with d = 46880. Bayesian methods, such as BCNN or VDP, would require roughly twice that amount because they have twice the number of parameters, ie.,, means and variances. The storage requirement of Ensemble and Basis scales with the number of models and particles, respectively. This can lead to trade-off between the number of particles and the performance of BaSTS.
The interplay between the performance of BaSTS model, the number of particles N, and computational demands is illustrated in Figs. Ia and g as well as Tables g and 7 The average inference time per image is plotted against the number of particles N of BaSTS-Net for MNIST in Fig. 8. It is observed that the test time approximately scales linearly with the number of particles N. We present a comparison of the training time and inference time for all approaches in Tables 7 and [ respectively. Depending on the number of particles N and the specific dataset, the computational complexity of training BaSIS may be lower compared to VDP frameworks (exVI, enVI, unVT), which propagate Taylor-series approximation of the mean and variance of the variational distribution. In general, other approaches, including MC Drop, BCNN, and Ensemble, are less computationally demanding. This difference arises from these models using point-estimate methods, where a single sample is propagated through the model layers. However, when employing these models as approximate Bayesian methods, multiple samples need to be considered at inference time to estimate uncertainly. For instance, the inference time Basis with 10 particles 0.10 (10-3s), whereas an ensemble of 10 models would require 0.04- 10 31)"
Training is conducted offiin, which allows for flexibility in managing computational resources. Notably, 7 that the inference time for BaSIS with 100 particles is comparable to that of MC Dropout and ensemble methods involving approximately 10 to 20 models. This equivalency in inference time efficiency underscores an important tradc-off: the computational complexity incurred during BaSIS's training phase is offset by several key advantages. Firstly, BaSIS demonstrates significant improved robustness in noisy and adversarial conditions, showcasing its resilience and reliability. Secondly, its design facilitates sels-assessment capabilities through the utilization of the second moment of the predictive distribution, providing a deeper insight into the model's uncertainty. Lastly, BaSIS opens the door to exploring the impact and effects of higher-order moments on accuracy, robustness, and self-assessment. Although the exploration of higher-order moments falls beyond the scope of this paper, it highlights the promising potential of BaSIS for pioneering research in this domain. This upfront computational investment during training could be a worthwhile exchange for the gains achieved in model performance and analytical depth.
7 Conclusion
In this work, we proposed a novel framework, BaSIS-Net, for learning posterior and predictive probability distribution functions through a set of weighted samples or particles. The proposed BaSIS-Net is more robust to noise and adversarial attacks than other approaches, as demonstrated through extensive simulations. The SIS framework enables the approximation of the full predictive distribution, which provides a better picture and assists in evaluating the reliability of the model's predictions. We presented the monotonie property of
20

---

Published in Transactions on Machine Learning Research (06/2024)
0.950
0.900
Test
0.875
0.850
0.825
Nale
(CB)
Figure 10: Average BaSIS test accuracy along with the standard deviation (shaded region) obtained with 10 random initializations. We consider different levels Gaussian noise applied to the MNIST test data measured as SNRs in dB.
the uncertainty estimated by BaSIS-Net, where the average uncertainty increases with decreasing SNR (or increasing noise). Additionally, we noted that the average predictive variance associated with the incorrect predictions is higher than the correctly classified ones. This information can be used to introduce self- awareness in BaSTS models, making these suitable for deployment in critical application areas, such medical diagnosis. Overall, our proposed BaSIS-Net framework provides promising avenue for developing more robust and reliable machine learning models.
Acknowledgment
This work was supported by the National Science Foundation awards ECCS-1903466, OAC-2234836, and PFI-2234468. We acknowledge the support from the UK's Engineering and Physical Sciences Research Coun- cil (EPSRC) through EP RP/T013265/1 project NSF-EPSRC: "ShiRAS. Towards Safe and Reliable Autonomy in Sensor Driven Systems", the support for ShiRAS by the USA National Science Foundation under Grant NSF ECCS 1903466.
Table 9: Test Accuracy for different Initializations of Basis for MNIST data
Basiay
Basiag
Basiag
Baiia
Basing
Basing
Basisy
Baxing
Bastag
Baxisjo
Average
Accuracy
0.988
0.9877
0.968
0.968
0.967
0.908
0.965
0.965
0.0007
Table 10: Test Accuracy for different on of Basis for MNIST data
0.01
0.000
0.001
0,0001
Table 11: Test Accuracy for different o, of Basis for CIFAR-10 data
Bty Accuracy
A
Appendix
In this study, we investigate the robustness of the proposed BaSIS-Net by initializing it randomly multiple times. We find that different seeds lead to roughly equivalent accuracy, with consistent results observed across various random initializations. The test accuracics on the noise-frce MNIST test data for the BaSIS- 100 model obtained with random initializations are reported in Table g The average test accuracy is 0.97 with standard deviation of 0.0007. Furthermore, replicated this experiment across different levels of
21

---

Published in Transactions on Machine Learning Research (06/2024)
0.001
4, C.0001
%, 0.00001
Oy 0.000001
Conrect
Incorrect
0.95
Preductiv Vartancce
0.8
0.90
Nomollzzd
0.6
0.85
0.4
0.80
0.75
High Nosse
SNR (dB)
Low Notso
H.g. Notso
SNR (dB)
Figure 11: Impact of transition noise on on test accuracy and predictive variance in MNIST test data. Av- crage BaSIS test accuracy versus Signal-to-Nois--Rane Ratio (SNR) in dB (left). Average normalized predictive variance versus SNR (right). The different on selections are represented by the various colors. For the nor- malized predictive variance, solid lines represent correct classifications, and dashed lines represent incorrect ones. Note that for the lowest on in green, there is no difference in variance between correct and incorrect classification.
Gaussian noise. We observed that the accuracics of the different BaSTS-Net models only showed variation within the second decimal place at the lowest SNR of = 0, further validating the reliability of Basis-Net under noisy conditions as well (Fig. 10
We evaluated the impact of the transition noise oy on the accuracy of BaSIS-Net (i.e., the mean of the predictive distribution). Tables 10 and 11 present the accuracy of BaSIS-Net versus oy on the MNIST and CIFAR-10 dataset a proof of concept. Observe that the model accuracy remains robust across large range of sigma values, specifically for on < 0.005 (Table 10 Accuracy begins to decline beyond this value, and the model diverges for o, = 0.01.
We evaluated the impact of the transition noise parameter on on the robustness of BaSTS-Net to noisy conditions and assessed the predictive uncertainty the resulting models. Our findings indicate that smaller oy values are associated with higher accuracy on clean noiseless data. However, at higher noise levels, models with larger on exhibit more robust performance. Additionally, for low on values, the uncertainty estimates are not informative in models trained with larger values.
In Fig. 11 we rllustrate how test accuracy and variance information vary with different on selections under noisy conditions applied to the MNIST test data. We observe that models trained with a small d, are less robust at low SNR, and their variance is unable to distinguish between correctly and incorrectly classified inputs. This undermines one of the key features of our BaSIS-Net framework, which the ability to provide meaningful uncertainty estimates that differentiate between correct and incorrect classifications.
References
M. Abdar, F. Pourpanah, S. Hussain, D. Rezazadegan, L. Liu, M. Ghavamzadeh, P. Fieguth, X. Cao, A. Khosravi, U. R. Acharya, et al. A review of uncertainty quantification in deep learning: Techniques, applications and challenges. Inf. Fusion, 76:243-291 297, 2021.
M. Ades and P. J. Van Leeuwen. An exploration of the equivalent weights particle filter. Quart. J. Royal Meteorological Soc., (29) 840, 2013.
S. Ahmed, D. Dera, S. U. Hassan, N. C. Bouaynaya, and G. Rasool. Failure detection in deep neural networks for medical imaging. Frontiers Med. Technol, 4, 2022.
M. Antonelli and et al. The medical segmentation decathlon. Nature Commun. 13(1):1-13, 2022.
M. S. Arulampalam, S. Maskell, N. Gordon, and T. Clapp. A tutorial on particle filters for online bayesian tracking. IEFF Trans. Signal Process, 50(2):174-188, 2002.
conlinear/non-ganeee
J. T.. Beck. Important Sampling in High Dimensions. Structural Safely, 25(2):139 163, 2003.
22

---

Published in Transactions on Machine Learning Research (06/2024)
E. Begoli, T. Bhattacharya, and D. Kusnezov. The need for uncertainty quantification in machine-assisted medical decision making. Nature Mach. Intell., (11):00 2019.
T. Bengtsson, P. Bickel, and B. Li. Curse-of dimensioonn revisited: Collapse of the particle filter in very large scale systems. Probability Statist., 2:316-334 2008.
B. Biggio and F. Roli. Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recognil., 84:317 331, 2018.
C. Blundell, J. Cornebise, K. Kavukeuoglu, and D. Wierstra. Weight uncortainty in noural network. In Int. Conf. Mach. Learn., pp. 1613-1622. PMLR, 2015.
G. Carannante and N. C. Bouaynaya. Bayesian deep learning detection of anomalies and failure: Application to medical images. In 2023 IEEE 33rd International Workshop Machine Learning for Signal Processing (MLSP), pp. 1-6. IEEE, 2023.
G. Carannante, D. Dera, G. Rasool, N. C. Bouaynaya, and L. Mihaylova. Robust learning via ensemble density propagation in deep neural networks. In 2020 IEEE 30th Inl. Workshop Mach. Learn. Signal Process. (MLSP), pp. 1-6. IEEE, 2020.
G. Carannante, N. C. Bouaynaya, and L. Mihaylova. An enhanced particle filter for uncertainty quantification in neural networks. In 2021 IEEE 24th Int. Conf. Inf. Fusion (FUSION), pp. 1-7. IEEE, 2021a.
G. Carannante, D. Dera, N. C. Bouaynaya, H. M. Fathallah-Shaykk, and G. Rasool. Super-net: Trustworthy medical image segmentation with uncertainty propagation in encoder-decoder networks. arXiv preprint arXiv:211100097 2021b.
G. Carannante, D. Dera, O. Aminul, N.C. Bouaynaya, and G. Rasool. Self-assessment and robust anomaly detection with bayesian deep learning. In 2022 25th International Conference on Information Fusion (FUSION), pp. 1-8. IEEE, 2022.
P. Closas and M. F. Bugallo. Improving accuracy by iterated multiple particle filtering. IEEE Signal Process. Letters, 19(8):531 534, 2012.
D. Crisan and A. Doucet. A survey of convergence results on particle filtering methods for practitioners. JEEE Trans. Signal Process., (0(3):36-746, 2002.
Y. Cui, W. Yao, Q. Li, A. Chan, and C. J. Xue. Accelerating monte carlo bayesian prediction via approximating predictive uncertainty over the simplex. IEEE Trans. Neural Netw. Learn. Syst., 33(4): 1492-1506, 2020.
J. F. G. de Freitas, M. Niranjan, A. H. Gee, and A. Doucet. Sequential Monte Carlo methods to train neural network models. Neural Computat., (2(4):955-95) 2000.
L. Deng. The mnist database of handwritten digit images for machine learning research [best of the web). IEEE Signal Process. Mag., 114 2012.
D. Dera, N. C. Bouaynaya, G. Rasool, R. Shterenberg, and H. M. Fathallab-Shaykh. Premium-cnn: Prop- agating uncertainly lowards robust. convolutional neural networks. IEEE Trans. Signal Process., 69: 4669 4684, 2021.
P. M. Djuric, T. Lu, and M. F. Bugallo. Multiple particle filtering. In 2007 IEEE Int. Conf. Acoust, Speech Signal Process. (ICASSP107), volume 3, pp. II1-1881. IEFE, 2007.
A. Doucet and A. M. Johansen. A tutorial on particle filtering and smoothing: Fifteen years later. Handbook Nonlin. Filtering, 12(656):3, 2009.
A. Doucet, S. Godsill, and C. Andrieu. On sequential monte carlo sampling methods for bayesian filtering. Slatist. Compul., 10(3):197-22) -08, 2000.
23

---

Published in Transactions on Machine Learning Research (06/2024)
A. Doucet, N. de Freitas, and N. Gordon. An introduction to sequential monte carlo methods, In Sequential Monte Carlo methods in practice, pp. 3-14. Springer, 2001.
G. Evensen. Sequential data assimilation with nonlinear quasi-geostrophic model using monte carlo methods to forecast error statistics. Journal of Geophysicnl Research: Oceans, (9(55:100143-100 1994.
Y. Gal and Z. Ghahramani. Bayesian convolutional neural networks with bernoulli approximate variational inference, arviv preprint arXix:1566, 02158, 2015.
Y. Gal and Z. Ghahramani. Dropout as bayesian approximation: Representing model uncertainty in deep lcarning. In Int. Conf. Mach. Learn., pp. 1050-1059. PMLR, 2016.
J. Gordon, D. J. Salmond, and A. F. M.Smith. Novel approach to nonlinear/nons Gaussainn Bayesian state estimation. In IEE Proc. F (Radar and Signal Process.), volume 140, pp. 107-113. IET, 1993.
A. Graves. Practical variational inference for neural networks. Advances Neural Inf. Process. Syst., 24, 2011.
M. M. Halimeh, A. Brendel, and W. Kellermann. Neural networks sequential training using variational gaussian particle filter. In 2019 IEEE Int. Conf. Acoust., Speech Signal Process. (ICASS),,, pp. 3002-3006. IEFE, 2019.
L. Hoffmann and C. Elster. Deep ensembles from bayesian perspective. aiv preprind 0rXiv:2105.13283 2021.
P. Izmailov, S. Vikram, M. D. Hoffman, and A. G. Wilson. What are bayesian neural network posteriors really like? In International conference on machine learning, pp. 4629-4640. PMLR, 2021.
M. I. Jordan, Z. Ghahramani, T. S. Jaakkola, and L. K. Saul. An introduction to variational methods for graphical models. Mach. Learn., 37(2):183-25) -33,, 1999.
S. J. Julier and J. K. Uhlmann. New Extension of the Kalman Filter to Nonlincar Systems. In Signal Process., Sensor Fusion, Torgel Recognil. VI, volume 3068, pp. 182 193. Spie, 1997.
H. M. D. Kabir, A. Khosravi, M. A. Hosen, and S. Nahavandi. Neural network-based uncertainty quan- tification: A survey of methodologies and applications. IEEE Access, 186218-362343 2018. doi: 10.1109/ACCFSS, 2018.28368111111
R. E. Kalman. A New Approach to Linear Filtering and Prediction Problems. pp. 35 35-45, 1960.
A. Kendall and Y. Gal. What uncertainties do need in bayesian deep learning for computer vision? Adv. Newral Inf. Process. Syst., 30, 2017.
A. Kendall, V. Badrinarayanan, and R. Cipolla. Bayesian segnet: Model uncertainty in deep convolutional encoder-decoder architectures for scene understanding. arXiv preprint arXiv:1511.0268) 2015.
A. Krizhevsky and G. Hinton. Learning multiple layers of features from tiny images. 2009.
B. Lakshminarayanan, A. Pritzel, and C. Blundell. Simple and scalable predictive uncertainty estimation using deep ensembles. Adv. Neural Inf. Process. Syst., 30, 2017.
H. Li, J. Wang, Y. Che, H. Wang, and Y. Chen. On neural network training algorithm based on the unscented kalman filter. In Proc. 29th Chinese Control Conf., pp. 1447 1450. IEEE, 2010.
Q Li, R. Li, K. Ji, and W. Dai. Kalman filter and its application. In 2015 8th Int. Conf. Intell. Netu. Intell. Syst. (ICINIS), pp. 74-77. IEEE, 2015a.
T. Li, M. Bolic, and P. M. Djuric. Resampling methods for particle filtering: classification, implementation, and strategies. IEEE Signal Process. Mag., 32(3):70-86, 2015b.
Y. Liu, X. Chen, C. Liu, and D. Song. Delving into transferable adversarial examples and black-bor box attacks. Xiv preprint or X 1611 02770, 2016.
24

---

Published in Transactions on Machine Learning Research (06/2024)
D. J. C MacKay. A practical bayesian framework for backpropagation networks. Neural Comput., 4(3): 448-444 448-472, 1992.
Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant adversarial attacks. arXiv preprint arXiv:1706. 06083, 2017.
A. Malinin and M. Gales. Predictive uncertainty estimation via prior networks. Advances in neural infor- mation processing systems, 31, 2018.
A. Malinin and M. Gales. Reverse kl-divergence training of prior networks: Improved uncertainty and adversarial robustness. Advances in Neural Information Processing Systems, 32, 2019.
B. McCrindle, K. Zukotynski, T. E. Doyle, and M. D. Noscworthy. A radiology-focusel review of predictive uncertainty for ai interpretability in computer-assisted segmentation. Radiology: Artificial Intelligence, 3 (6):e210031, 2021.
B. H. Menze, A. Jakab, S. Bauer, J. Kalpathy-Cramer, K. Farahani, J. Kirby, Y. Burren, N. Porz, J. Slot- boom, R. Wiest, et al. The multimodal brain tumor image sogmentation benchmark (brats). IEEE Trans. Med. Imaging, 34(10):1993 2024, 2014.
S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard. Universal adversarial perturbations. In Proc. IEEE Conf. Compul. Vision Pallern Recognil., pp. 1765-174 2017.
R. M. Neal. Bayesion learning for neural networks, volume 118. Springer Science & Business Media, 2012.
A. Nguyen, J. Yosinski, and J. Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Proc. IEEE Conf. Comput. Vision Pattern Recognit., pp. 427-436, 2015.
D. H. Park, S. Porter, S. WARKENTIN, E. BYRNE, and R. LEVY. Sensitivity to Noise in Particle Filters for 2-D Tracking Algorithms. Nursing, 6:58-65, 65,8-55,44 2013.
K. Posch and Pilz. Correlated parameters to accurately measure uncertainty in deep neural networks. IEEE Trans. Neural Netw. Learn. Syst., 32(3):1037 1051, 2020.
G. V. Puskorius and L. A. Feldkamp. Decoupled extended kalman filter training of feedforward layered networks. In Proc. of the IJCNN-91-Seallle Int. Joint Conf. Neural Netw., volume 1, pp. 771 777. IEEE, 1991.
S. Rajaraman, S. K. Antani, M. Poostchi, K. Silamut, M. Hossain, R. J. Mande, S. Jaeger, and G. R. Thoma. Pre-trained convolutional neural networks as feature extractors toward improved malaria parasite detection in thin blood smear images. PeerJ, 6:e4568, 2018.
J. F. Richard and W. Zhang. Efficient High-Dimensional Importance Sampling. Econometrics, 141(2): 1385-1411, 2007.
O. Ronneberger, P. Fischer, and T. Brox. U-net: Convolutional networks for biomedical image segmentation. In Int. Conf. Med. Image Comput. Computer-Assistee Intervention, pp. 234-241. Springer, 2015.
W. Roth and F. Pernkopf. Variational inference in neural networks using an approximate closed-form objective. 2016.
R. L. Russell and C. Reale. Multivariate uncertainty in deep learning. IEFE Trans. Neural Netu. Learn. Syst., (3)):77993 7943,,7747, 2021.
K. Shridhar, F. Laumann, A. Maurin, and M. Liwicki. Bayesian convolutional neural networks. preprint arXiv: 05978, 2018.
anXiv
A. Simpson, M. Antonelli, Bakas, M. Bilello, K. Farahani, B. Van Ginneken, A. Kopp-Schncider, B. A. Landman, G. Litjens, B. Menze, et al. A large annotated medical image dataset for the development and evaluation of segmentation algorithms. arXiv preprint ar Xxx: 1906.09009, 2019.
25

---

Published in Transactions on Machine Learning Research (06/2024)
S. Singhal and L. Wu. Training multilayer perceptrons with the extended Kalman algorithm. Adu. Neural. Inf. Process. Syst. 1, 1988.
P. Tabarisaadi, A. Khosravi, Nahavandi, M. Shafie- Khah, and J. P. S. Catalão. An optimized uncertainty- aware training framework for neural networks. IEEE Trans. Newral Netu. Learn. Syst., pp- 1-8, 2022. doi:
Q. Tan, M. Ye, A. J. Ma, B. Yang, T. C. Yip, G. L. Wong, and P. C. Yuen. Explainable uncertainty-awwaee convolutional recurrent neural network for irregular medical time scries. IEEE Transactions on Neural Networks and Learning Systems, 32(10):4665-467, 2020.
J. S. Titensky, H. Janant and J. Kepner. Uncertainly propagation in deep neural networks using extended kalman filtering. In 2018 IEEE MIT Undergraduate Res. Technol. Conf. (URTC), pp. 1-4. IEEE, 2018
H. Xiao, K. Rasul, and R. Vollgraf. Fashion-mnist: novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXin:1708.07747, 2017.
X. Yuan, P. He, Q. Zhu, and X. Li. Adversarial examples: Attacks and defenses for deep learning. 1EEE Trans. Neural Netw. Learn. Syst., 20(9):2805-282) 2019. doi: 20000/NNNNS.....2228...2
C. Zhang, Bütepage, H. Kjellström, and S. Mandt. Advances variational inference. IEEE Trans. Pattern Anal. Mach. Intell,, 41(8))2008 2026, 2018.
J. Zhang and C. Li. Adversarial examples: Opportumitics and challenges. IEEE Trans. Newral Netw. Learn Syst. 31(7):2578 2593, 2019.
26


Reviews:
[{"review_id": "5xZj7fxAhi", "reviewer": "Reviewer_X46h", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Overall, the paper is well written, and the Sequential Importance Sampling (SIS) / Particle Filter (PF) discussion presents a sufficient overview for the rest of the paper. In general, I appreciate the simplicity of the approach and the primarily clear motivation from a SIS/PF perspective. The results in the experimental section demonstrate that the proposed approach leads to comparable or better results in robustness against (adversarial) noise. Finally, Figures 3 and 4 show a promising calibrated behavior of predictive uncertainty.\n\nHaving highlighted the paper's strengths, I want to list aspects in which the paper can improve. Starting with the experimental section, I see the following issues:\n  * The figures and tables in the paper lack uncertainty intervals and, furthermore, information about how many seeds the authors averaged in the results.\n  * The authors do not motivate why they do not attack all models with all schemes (i.e. (un-)targeted FSGM and PGD attacks) in Section 5.2\n  * BaSIS-Net sed different noise values sigma_{eta} for different datasets and network architectures. However, the authors do not discuss the sensitivity of the method to this hyperparameter or how to choose it\n  * Although the authors present evidence for the calibrated uncertainty of their method, they do not compare the \"calibratedness\" with the baseline approaches.\n  * While interesting, Figures 5 and 6 are rather qualitative and lack a quantitative aspect that enables a comparison with baseline methods.\n  * The authors use a custom architecture for the CIFAR-10 task instead of more standard architectures like ResNet-18, leading to significantly worse performance on noise-free images than already shown in the context of Bayesian NNs (see Table 11 of [1]).\n  * The authors provide an ablation over different numbers of particles. However, the number of models is still relatively high compared to standard ensemble methods.\n  * The y-labels in Figure 3 have an error.\n\nIn terms of the method itself, I have the following questions:\n  * Eq. (9) introduces the gradient descent update rule as the transition model, which introduces a dependency of the transition model (Eq. 3) from W_k to W_{k+1} on the data y. Isn't this a problem for applying the SIS/PF model since the data is then essentially used twice - once in the transition- and once in the observation model? \n  * On Page 7, the authors say that \"to reduce computational complexity, [they] compute the gradient of the loss with respect to the previous time step weighted mean estimate rather than for each individual particle.\" This way of computing the gradient moves individual particles in a correlated manner. Does this break the underlying assumptions of the SIS/PF model?\n\nFinally, I'd like to point out some sentences/claims that I suggest the authors to tone down a bit:\n  * Page 4: \"The network is not explicitly trained to learn uncertainty during the deterministic model training process.\" I would disagree with this statement since, e.g., [1] presents a method that combines ensemble methods with a VI loss that explicitly enforces a notion of diversity of model predictions on OOD data via a prior matching term in the loss.\n  * Page 4: \"Unlike the Variational Inference (VI) framework, our approach frees the posterior and predictive pdfs from any constraints on their form.\" I do not know if this claim can be made. Given that, technically speaking, SIS/PFs require a transition and observation model, the posterior (stationary) state distribution is restricted by precisely these assumptions.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper presents an ensemble approach to Bayesian neural networks motivated by a particle filtering perspective. The presented approach is conceptually straightforward and nonetheless shows convincing performance in various experiments, demonstrating calibrated uncertainty estimation and solid performance.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "* In terms of the experiments, I would like to see the following changes:\n  * Addition of statistical uncertainty measures (e.g. standard deviation or -error, quantiles, ...) to the Figures and Tables. If the current data resulted from only one seed, I suggest running at least five seeds per dataset and method.\n  * Application of all attack schemes to all methods and datasets or an explanation of why a particular attack method does not apply to a specific model and dataset combination.\n  * Ideally, an ablation over the sigma_{eta} parameter of the BaSIS-Net on one dataset. At least, a discussion of choosing the parameter and the observed sensitivity.\n  * CIFAR-10 experiments with a more standard network architecture (e.g., the one presented in [1]).\n  * An ablation of BaSIS-Net with only 5, 10, and 20 parameters.\n  * Comparison of uncertainty \"calibratedness\" (Figures 3, 4, 5, and 6) to baseline methods.\n* On a methodological level, I would like to see a discussion of the two questions on the instantiation of the SIS/PF framework. Such a discussion in Section 3.4 helps to avoid questions/misconceptions by readers.\n* A revision of the two sentences I have highlighted above.\n\nWith these changes made, the paper is a solid contribution to the literature on approximate Bayesian neural networks that can motivate future research in applying the SIS/PF framework to this problem setting.", "broader_impact_concerns": "None", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "rhQOTV7TIW", "reviewer": "Reviewer_5b5L", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:  \nS1. have never seen SMC applied to Bayesian Deep Learning (BDL) inference, and so I consider it novel. What is more, if someone asked me apriori whether this approach is going to work, I’d seriously doubt the inference done this way would succeed in reasonably approximating to the posterior (and I still have those doubts as that is not directly evaluated by the authors, see W1), so it is interesting to see that it results in competitive performance on a set of tasks the authors evaluate on (classification performance under distribution shift).  \nS2. The paper is mostly well written and easy to read, however I am missing several important pieces of information, see W2 & W3.\n\nWeaknesses:  \nW1. By referencing the asymptotic convergence of Monte Carlo methods (among others at the end of Section 6.2), I think that in the current form the paper seems to be implying that the empirical success claimed in the Experiments section (in terms of classification performance under distribution shift) stems from the fact the inference method performs inference successfully. In my opinion, as it currently stands, with the current empirical evidence, that conclusion is not warranted. This is particularly true, e.g., due to some approximations are being made such as evaluating likelihood/loss not on per-particle basis but using a weighted mean estimate of the parameters at a given step in training, which seems to me like a significant modification of the SMC algorithm, and I’m not sure/I doubt the convergence guarantees apply in that case. I see two solutions: A) evaluate the quality of the approximate Bayesian inference achieved by evaluating against a benchmark such as [1], or B) make it explicit that the quality of Bayesian inference has not been assessed. [2]  suggests that samples from a reasonably-converged Hamiltonian Monte Carlo chain, (supposedly) approximating the posterior better than other benchmarked approximate inference methods, exhibits lower distribution shift robustness than those other methods. Hence, I have doubts whether using the empirical success in the evaluation suite used can be used as an argument in support of the quality of the posterior approximation.  \nW2. The inference-time mechanism of BaSIS-Net is not well presented (unlike the training time algorithm), and I conclude I don’t understand it. Authors say “BaSIS [...] unlike many post-hoc  methods that necessitate multiple forward passes at inference time to calculate uncertainty” implying that at inference time BaSIS doesn’t require multiple forward passes, but Figure 8 shows linear complexity with the number of particles. Isn’t that somewhat contradictory?  \nW3. Unlike the inference-time comparison (Table 7), the training-time comparison is not reported. I’d like to see it reported because I think it’s as important to provide a full-picture of the method as inference-time comparison. I’d also like to see memory-cost comparison, because I think that’s a criterium where BaSIS incurs a particularly large cost. I’d like to see all of these in a single section.  \nW4. There exist more suitable metrics for investigating uncertainty quantification than accuracy (which doesn’t capture it at all) - see Section 3 of [3]. For the sake of better characterization of the proposed method, could you computation of Brier score for all of the existing results, please?  \n\nIf you disagree with some of my assessments/comments, I hold my opinions not very strongly, and given evidence I am reasonably open to be convinced otherwise.\n\nQuestions:  \nQ1. How is the second moment for the predictions in the classification context computed? The NN returns a vector of logits - what happens next?\n\n[1] Wilson et al., Evaluating Approximate Inference in Bayesian Deep Learning, 2022  \n[2] Izmailov et al., What Are Bayesian Neural Network Posteriors Really Like?, 2021  \n[3] Ovadia et al., Can You Trust Your Model’s Uncertainty? Evaluating Predictive Uncertainty Under Dataset Shift, 2019", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The authors propose a new method for uncertainty quantification for neural networks (NN) based on Sequential Monte Carlo (SMC) named BaSIS-Net.\nThe “final” posterior over the model’s weights is approximated by a set of weighted particles, as typical for SMC, in contrast to unweighted samples (e.g. using some form of MCMC inference) or a parametric distribution when using variational inference.\nThe problem of posterior inference in NN is casted as a problem of inference in a state-space model - the posterior over the state at time $t$ corresponds to the posterior over the weights after $t$ gradient updates of the NN - and the particles approximating the posterior are updated and resampled at each gradient step over the course of training.\nOn the set of evaluations the authors chosen, the method they propose yields competitive performance wrt several baseline methods from the field of Bayesian Deep Learning literature.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Critical for securing my recommendation for acceptance: W1, W2, W3, W4, adding a baseline of the standard SGD-trained model on the tasks evaluated.\n\nNice to haves: SGLD baseline (according to [2] one of the strongest methods for distribution shift robustness)\n\nTypos:\n* page 3: “density estimation techniques NN training”, “estimates f the gradient”\n* Figure 8: instead of $s^-3$ maybe $10^-3 s$ or simply $ms$?", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "7p65tRs5ht", "reviewer": "Reviewer_jWLm", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "* Weaknesses\n* * Section 3.1-3.3 are known to the community, and I believe the main novelty is at Section 3.4. However, Section 3.4 is not well-organized.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This manuscript proposed a method for Bayesian neural networks using a sequential importance sampling based method.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "* I'm confused about the algorithm. Specifically, I’m not sure how to combine the importance ratio from each layer.\n* I’m also confused about the motivation of using the loss to define the likelihood. For certain cases like cross-entropy loss and $L_2$ loss, there are clear probabilistic interpretations. But for general cases, it is weird.\n* I’m also confused about the gradient in the algorithm box. Specifically, what are the other layers’ weights when take the gradient for certain layer.\n* I would like to ask for the specific form of the predictive distribution, and the consistency of it.", "broader_impact_concerns": "No.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The author made a detailed response as well as updated significantly the manuscript to address most points from the reviewers. After their revision, reviewer 5b5L thought that the problematic claims had been addressed and recommended acceptance of the updated manuscript. On the other hand, both reviewers X46h and jWLm recommended rejection. Reviewer jWLm did not provide much explanation to justify to reject. Reviewer X46h still had unaddressed concerns about the manuscript; in particular, they stated they wanted all attacks on all datasets be included in the paper, as well as a more SOTA architecture employed on the CIFAR dataset. While these changes would improve the significance of the paper, I don't think they are required to ensure that the claims made by the authors are sufficiently supported, and thus I still recommend acceptance. The authors are encouraged to include these changes in the minor revision of the paper if they want to strengthen it, though it is not required.

What is required for the minor revision is to address the following other point made by reviewer X46h in their recommendation:
> The new tables 10 and 11 in the appendix provide valuable insights into the hyperparameter of BasisNet. However, the provided data raises a substantial new question: The model performance continuously increases with a decrease in $\sigma_n$. For the limit $\sigma_n=0$, the gradient computation via the particle mean would, however, raise questions about the importance of the PF framework for the performance of BasisNet. Interestingly, the authors did not choose the smallest investigated for the MNIST dataset. Is this because of a worse uncertainty calibration for lower values of $\sigma_n$? A thorough investigation of uncertainty calibration in dependence of $\sigma_n$ seems necessary to clarify these questions.
Decision: Accept (poster)