Title: Generator Born from Classifier
Venue: NeurIPS 2023
Accepted: yes
Keywords: Generative Model
Abstract: In this paper, we make a bold attempt toward an ambitious task: given a pre-trained classifier, we aim to reconstruct an image generator, without relying on any data samples. From a black-box perspective, this challenge seems intractable, since it inevitably involves identifying the inverse function for a classifier, which is, by nature, an information extraction process. As such, we resort to leveraging the knowledge encapsulated within the parameters of the neural network. Grounded on the theory of Maximum-Margin Bias of gradient descent, we propose a novel learning paradigm, in which the generator is trained to ensure that the convergence conditions of the network parameters are satisfied over the generated distribution of the samples. Empirical validation from various image generation tasks substantiates the efficacy of our strategy.

Generator Born from Classifier

Abstract

In this paper, we make a bold attempt toward an ambitious task: given a pre-trained classifier, we aim to reconstruct an image generator, without relying on any data samples. From a black-box perspective, this challenge seems intractable, since it inevitably involves identifying the inverse function for a classifier, which is, by nature, an information extraction process. As such, we resort to leveraging the knowledge encapsulated within the parameters of the neural network. Grounded on the theory of Maximum-Margin Bias of gradient descent, we propose a novel learning paradigm, in which the generator is trained to ensure that the convergence conditions of the network parameters are satisfied over the generated distribution of the samples. Empirical validation from various image generation tasks substantiates the efficacy of our strategy.

1 Introduction

The majority of machine learning research bifurcates into two distinct branches of study: the predictive task and the generative task. Given the input x and the label y , the former one focuses on the training of a high-performing classifier or regressor, which approximates p p y | x q [Vaswani et al., 2023, Dosovitskiy et al., 2021, Jing et al., 2023], whereas the latter one aims to train a generative model capable of sampling from p p x | y q or p p x , y q [Goodfellow et al., 2014]. The gap between the predictive and the generative models, as a result, predominantly arises from the lack of information in the predictive models about the marginal distribution p p x q . In the realm of deep neural networks, however, the over-parameterization leads to the overfitting on the training distribution and the memorization of the training samples [Feldman and Zhang, 2020, Daniely, 2020, Arpit et al., 2017], which, in turn, make the network implicitly retain information about p p x q . With this component in hand, it prompts the question of whether it is feasible to derive a generative model from a predictive one.

In this paper, we explore this novel task, which attempts to learn a generator directly from a pretrained classifier, without the assistance of any training data. Unarguably, this is a highly ambitious task with substantial difficulty, as either explicitly extracting information about p p x q from a pretrained classifier or directly solving this inverse problem from classifier to generator poses significant challenges. Despite these challenges, the value of this task lies in its potential to offer a new approach to training generators that mitigates the direct dependence on large volumes of training data. This provides a possible solution for learning tasks in scenarios where data is scarce or unavailable. Moreover, this task presents a novel way to utilize and analyze the pre-trained predictive models, facilitating our understanding of the encoded information within the parameters.

To this end, we propose a novel learning scheme. Our approach is grounded in the theory of Maximum-Margin Bias of gradient descent, which demonstrates that the parameters of a neural network trained via gradient descent will converge to the solution of a specific optimization problem. This optimization problem minimizes the norm of the neural network parameters while maximizing the classification margin on the training dataset. The necessary condition for the solution of this

12379

01

23

79

四酒U香

Figure 1: Images produced by the generator trained only using pre-trained classifier. The generated images, positioned in the first row, are accompanied by their nearest neighbors from the original dataset, displayed in the second row.

optimization problem constructs a system of equations, describing the relationship between the pre-trained neural network parameters and the training data distribution.

Since our aim is to learn a generator from the pre-trained classifier parameters, the generator is therefore expected to approximate a distribution that satisfies the necessary condition of this optimization problem. To accomplish this, we design the loss function for training the generator and the corresponding training algorithm based on the necessary condition. The entire training process does not rely on any training data; all available information related to the pre-trained data is encapsulated within the parameters of the pre-trained classifier.

The intuition behind our design is twofold: on one hand, the generator should guarantee that the pre-trained classifier performs well under the data distribution it approximated, and on the other hand, the generator should ensure that the current classifier parameters are the convergence point of the gradient descent algorithm under the data distribution it approximated. It's noteworthy that the original data distribution naturally satisfies these conditions. Therefore, we anticipate that employing the proposed method will guide the generator to discover the original data distribution.

We conduct experiments on commonly used image datasets. Fig. 1 shows some generated images of the MNIST and CelebA datasets. Remarkably, even trained without access to the original data, the generator is able to perform conditional sampling and generate the digits and faces.

Our contribution is therefore a novel approach that, for the first time, attempts to train a generator from a pre-trained classifier without utilizing training data. The proposed approach produces encouraging results on synthetic and real-world images.

A list of symbols utilized in this paper and corresponding descriptions can be found in the Appendix.

2 Related Work

Generative Adversarial Networks. Generative Adversarial Network (GAN) consists of a generator and a discriminator collectively optimizing a minimax problem to learn and replicate the original data distribution [Goodfellow et al., 2014]. Numerous extensions of the original GAN have been investigated, including functionality enhancement [Chen et al., 2016, Mirza and Osindero, 2014, Odena et al., 2017, Donahue et al., 2017]; architecture optimization and scaling [Karras et al., 2018, Brock et al., 2019, Denton et al., 2015]; and training loss design [Nowozin et al., 2016, Arjovsky et al., 2017, Wei et al., 2018]. Owing to their superior generation quality, GANs have found wide-ranging applications in image synthesis [Yang et al., 2017b], blending [Wu et al., 2017], inpainting [Yeh et al., 2017, Yang et al., 2017a, Yu et al., 2018], super-resolution [Ledig et al., 2017], denoising [Linh et al., 2020]; image-to-image translation [Zhu et al., 2017, Isola et al., 2017]; 3D object generation [Wu et al., 2016]; video generation [Vondrick et al., 2016, Tulyakov et al., 2018]; etc.

Both our work and GAN require an additional classifier to guide the training of the generation and provide a measure of authenticity for generated data. However, in the GAN framework, the classifier is trained concurrently with the generator, with the explicit goal of discerning the quality of generated results. In contrast, our method utilizes a pre-trained classifier, which can be arbitrary, and its training objective is to maximize classification accuracy, not to judge the quality of generated results. This imbues our approach with considerable flexibility. Furthermore, during the training of GAN, the generator has access to training data. However, in our task, the training data is not available to the generator, which makes our task harder.

Feature Visualization and Model Inversion. Besides our task, neural network feature visualization and model inversion share the objective of extracting information relevant to the training data from

pre-trained classifiers. Neural network feature visualization is a technique aimed at identifying input data that maximally activates specific neurons or layers within the network, thereby providing insights into the patterns or features that the network is primed to recognize. [Engstrom et al., 2019, Olah et al., 2017, Nguyen et al., 2016] Model inversion in neural networks refers to the process of inferring or reconstructing input data given the trained model. [Yin et al., 2020] In the realm of adversarial attacks, model inversion is deployed to discover sensitive information about the training data from the model's outputs. [He et al., 2019, Zhao et al., 2021, Fredrikson et al., 2015]

Unlike these tasks, where an independent gradient optimization is required for each generation, our goal is to develop a generator capable of sampling from the training data distribution. While there is research in neural network feature visualization and model inversion that utilizes a generative model to assist in the restoration of specific training data, these works typically employ the generator more as a prior for the recovery process. [Nguyen et al., 2017, Jeon et al., 2021, Yang et al., 2019, Zhang et al., 2020] The training of such a generator necessitates additional training data, which should be similar to or encompass the original training data used for the classifier. In contrast, our approach directly derives a generator from the classifier without the utilization of extraneous training data.

Energy-Based Model. Within the framework of energy-based models, pre-trained classifiers have also been demonstrated to be capable of acting as a conditional probability distribution, generating data samples. [LeCun et al., 2006, Grathwohl et al., 2020, Guo et al., 2023] Although the energybased models theoretically bridge predictive and generative models, practical implementation for sample generation based on it still relies on an optimization target and executes a multi-step gradient optimization process, akin to model inversion. In contrast, our objective is to develop a generator with the ability for random or condition-based sampling, procuring data samples directly through the forward pass of the neural network.

Maximum-Margin Bias of Gradient Descent. Our work is based on the study of the MaximumMargin Bias of gradient descent. These investigations primarily seek to elucidate why gradient descent algorithms are capable of learning models with robust generalization capabilities, even in the absence of additional regularization constraints. It has been discovered that under the guidance of gradient descent, the parameters of a neural network converge to a solution to an optimization problem aiming to maximize the classification boundary while concurrently minimizing the norm of the network parameters. Initial studies focused on linear logistic regression models [Rosset et al., 2003, Soudry et al., 2018], which were subsequently extended to homogeneous neural networks [Wei et al., 2019, Xu et al., 2018, Nacson et al., 2019, Lyu and Li, 2020b, Ji and Telgarsky, 2020, Le and Jegelka, 2022] and, more recently, to a broader class of quasi-homogeneous neural networks [Kunin et al., 2023]. The theory of Maximum-Margin Bias has also been leveraged by Haim et al. [2022] to recover training data. However, their objective was the restoration of data rather than training a generator, and their work was exclusively confined to binary classification datasets and fully connected networks without bias terms.

3 Preliminary

To extract the information about the training dataset from the parameters of the pre-trained classification model, we leverage the theory of Maximum-Margin Bias.

Let Φ p¨ ; ζ q : R d Ñ Y denote the classifier parameterized by ζ and trained on multi-class classification dataset D ' tp x i , y i qu N i ' 1 with each p x i , y i q P R d ˆ Y . let L p ζ q : ' ř N i ' 1 l p Φ p x i ; ζ q , y i q denote the standard cross-entropy loss of Φ on D . To extend the applicability of Maximum-Margin Bias analysis to various neural network structures, the definition of the Λ -quasi-homogeneous model is introduced. For a (non-zero) positive semi-definite diagonal matrix Λ , a model Φ p¨ ; ζ q is Λ -quasi-homogeneous if the model output scales as Φ p x ; ψ α p ζ qq ' e α Φ p x ; ζ q for all α P R and input x , when the parameter scales as ψ α p ζ q : ' e α Λ ζ . Many commonly used neural network architectures satisfy the definition of Λ -quasi-homogeneous model, such as convolutional neural networks and fully connected networks with biases, residual connections, and normalization layers. The seminorm of ζ corresponding to Λ is defined as || ζ || 2 Λ : ' ζ T Λ ζ . Let λ max : ' max j Λ jj denote the maximal element in Λ , ˜ Λ is the matrix setting all elements less than λ max to 0 , i.e . , ˜ Λ jj ' λ max if Λ jj ' λ max , otherwise, ˜ Λ jj ' 0 . Accordingly, the seminorm of ζ corresponding to ˜ Λ is defined as || ζ || 2 ˜ Λ : ' ζ T ˜ Λ ζ . The

normalized parameters is defined as ¯ ζ : ' ψ τ p ζ q , such that } ¯ ζ } 2 Λ ' 1 . The Quasi-Homogeneous Maximum-Margin Theorem states as follows.

Theorem 1 (Paraphrased from [Kunin et al., 2023]) . Let Φ p¨ ; ζ q denote a Λ -quasi-homogeneous classifier trained on D with cross-entropy loss L . Assume that: (1) for any fixed x , Φ p x ; ζ q is locally Lipschitz and admits a chain rule [Davis et al., 2020, Lyu and Li, 2020a]; (2) the learning dynamic is described by a gradient flow [Lyu and Li, 2020a]; (3) lim t Ñ8 ¯ ζ p t q exists; (4) D κ ą 0 such that only ζ with || ζ || Λ max ě κ separates the training data; and (5) D t 0 such that L p ζ p t 0 qq ă N ´ 1 log 2 . D α P R such that ˜ ζ : ' ψ α p lim t Ñ8 ¯ ζ p t qq is a first-order stationary point of the following maximum-margin problem

where Φ c p¨ ; ζ 1 q is the prediction of Φ for the class c P Y .

4 Method

Theorem 1 implies that the neural network parameters converge to the first-order stationary point (or the Karush-Kuhn-Tucker point (KKT) point) of the optimization problem in Eq. (1). Let t µ ic u i Pr N s ,c P Y {t y i u denote the set of KKT multipliers, the KKT condition can be written as follows.

for all i P r N s , and c P Y {t y i u :

where the Eqs. (2a) to (2d) are known as the stationarity condition, primal feasibility condition, dual feasibility condition, and the complementary slackness condition, respectively.

The intuition behind the stationarity condition can be summarized as follows. According to the value of the corresponding element in Λ , the neural network parameters can be divided into two groups: the first group Z 1 : ' t ˜ ζ j | Λ jj ' λ max u includes all the parameters whose corresponding elements in Λ are equal to λ max , and the second set Z 2 : ' t ˜ ζ j | Λ jj ‰ λ max u contains all the parameters whose corresponding elements in Λ are not equal to λ max . The stationarity condition in Eq. (2a) evaluates the linear combination of the derivatives of the neural network output corresponding to the parameters, with KKT multipliers t µ ic u i Pr N s ,c P Y {t y i u as coefficients of the combination. Such a linear combination of the derivatives corresponding to the parameters in Z 1 is equal to the parameters in Z 1 . In contrast, such a linear combination of the derivatives corresponding to the parameters in Z 2 is equal to a zero vector.

The intuition behind other conditions can be summarized as follows. According to the complementary slackness condition in Eq. (2d), µ ic is nonzero only when Φ y i p x i ; ˜ ζ q´ Φ c p x i ; ˜ ζ q ' 1 . Two conditions are required for µ ic to be nonzero. First, for a pair of p i, c q , µ ic can only be nonzero when c is the class with the second largest predicted probability for the sample x i , i.e ., c P S i , where S i : ' t y | Φ y p x i ; ˜ ζ q ' max y 1 P Y {t y i u Φ y 1 p x i ; ˜ ζ qu . Second, according to primal feasibility in Eq. (2b), the minimum possible value of Φ y i p x i ; ˜ ζ q ´ Φ c p x i ; ˜ ζ q is 1 . Therefore, for a pair of p i, c q , µ ic can only be nonzero when the margin between the true class y i and the class with the second largest predicted probability for the sample x i is minimum.

The evaluation of ∇ ˜ ζ Φ p¨ ; ˜ ζ q and Φ p¨ ; ˜ ζ q requires to first scale all parameters of a pre-trained network. For the convenience of practical implementation and following derivation, we transform ˜ ζ back to ζ using the definition of the quasi-homogeneous function. The KKT conditions in Eq. (2) are rewritten

as:

for all i P r N s , and c P Y {t y i u :

where the new scaling parameter ¯ Λ : ' ˜ Λ e α p 2Λ ´ I q .

From KKT condition to loss function. Given only the pre-trained neural network Φ p¨ ; ζ q , the undetermined parts in the KKT conditions in Eq. (3) include the KKT multipliers, a set of p x, y q pairs, and constant α . Regarding the KKT multiplier a predictable objective, We use a neural network to learn it. Given an approximate distribution of the discrete random variable y , we sample y directly. Our goal is to train a conditional generator g parameterized by θ to generate input x ' g p ϵ, y ; θ q given the corresponding label y and random noise ϵ . We also treat α as a learnable parameter, which will be discussed in detail later. In the following para-

0.0

0.2

0.4

0.6

0.8

1.0

0.0

0.1

0.2

0.3

0.4

l

(

x

;

α, δ

)

α

controls the position

δ

controls the basin width

α

= 5

, δ

= 0

.

1

α

= 1

, δ

= 0

.

1

α

= 1

, δ

= 0

.

3

x

graphs, we first discuss how to design the loss function for learning these parameters and training the generator.

First, we discuss how to ensure that the generated samples satisfy the stationary condition in Eq. (3a). The evaluation of the right-hand side of Eq. (3a) requires generating a dataset with a fixed number of samples every time to calculate the summation. Alternatively, we divide both sides of Eq. (3a) by the number of training samples N , which converts the sum on the right-hand side to an expectation:

Thus, according to the law of large numbers, the expectation can be estimated by the empirical average over a batch of M random samples, where M is a hyper-parameter. To ensure that the rescaled stationary condition in Eq. (4) can be satisfied, we use the following L stationarity to minimize the norm of the difference between both sides of Eq. (4).

Conditions in Eqs. (3b) to (3d) constrain the valid values of the KKT multipliers. Accordingly, in order to satisfy the positivity condition of the KKT multipliers in dual feasibility, instead of directly optimizing the KKT multipliers, we use the proxy variables µ 1 ic , define µ ic : ' ReLU p µ 1 ic q . For each generated sample x i , we set up a µ 1 i P R | Y | with µ 1 ic is its c -th element. We learn µ 1 i ' h p x i , y i ; η q by network h parameterized by η . To approximate primal feasibility and complementary slackness, we require each generated sample x i to satisfy 0 ď Φ y i p x i ; ζ q ´ Φ c p x i ; ζ q ´ e ´ α ď δ , where 0 ă δ ! 1 is a hyper-parameter to ensure numerical stability. We minimize L duality to approximate this constraint. Fig. 2 illustrates the shape of L duality .

Final loss is the combination of L lagrange and L duality balanced by hyper-parameter β :

Determine Λ . To compute L stationarity , it is necessary to determine the Λ of the quasihomogeneous function Φ p¨ ; ζ q . Here, we will introduce two properties of quasi-homogeneous functions and demonstrate how to construct a system of linear equations based on these properties to efficiently solve for Λ . First, taking the derivative of Φ p x ; ψ α p ζ qq corresponding to ζ , we have

This indicates that, for any parameter ζ i whose corresponding Λ ii ‰ 1 , the derivative of Φ p x ; ζ q corresponding to ζ i , denoted by ∇ ζ i Φ p x ; ζ q , is a Λ 1 -quasi-homogeneous function with Λ 1 ' 1 1 ´ Λ ii at α ' 0 , we have:

e α

0

5

10

15

20

25

1

-100

-50

0

50

100

V alue

[

Original

Φ(

·

;

ζ

)]

Line Style

Ground Truth

:

e α

Φ(

x

;

ζ

)

Estimation

:

Φ(

x

;

e α

ˆ Λ

ζ

)

Color

Different

x

Λ . Second, taking the derivative ∇ α Φ p x ; ψ α p ζ qq

For clear notation, we refer to the above Eq. (9) as the derivative equation of Φ at x . which is a linear equation about Λ and the coefficients can be calculated conveniently given the pre-trained model.

As these properties of quasi-homogeneous function are independent of input x , we can establish a system of equations by evaluating the derivative equation of Φ and its higher order derivatives at a set of random samples t x i u i Pr K s , e.g .,

Then, the Λ can be calculated from it. As a proof of concept, the estimated results of a two-layer fully-connected network with ReLU activation are shown in Fig. 3. The architecture of the network is Linear p 2 , 10 q Ñ ReLU pq Ñ Linear p 10 , 1 q .

Determine α . To compute L duality , it is necessary to determine the α . Shown in the proof of Theorem 1 [Kunin et al., 2023], the value of α depends on the minimum classification margin q min of the (normalized) neural network on the training dataset, in the case of a multi-class problem:

Therefore, the value of α depends on the entire training dataset, which is not accessible. To avoid the accumulation of errors in estimating q min using generated samples during training, we directly optimize α as a trainable parameter.

Summary of the method. In short, the optimization problem used to train the generator g p¨ , ¨ ; θ q can be written as:

The training procedure is summarized in Alg. 1 in the Appendix.

An extension to multiple classifiers. We have previously discussed a method using a single classifier to train a generator. Here, we present an extension of our approach to employ multiple classifiers for training a single generator. Given T classifiers t Φ p t q u t Pr T s , we encode the training

0°

90°

180°

270°

0.0

0.5

0.8

1.0

1.2

1.5

(a) Training Data

0°

90°

180°

270°

0.0

0.5

0.8

1.0

1.2

1.5

(b) Prediction Landscape

0°

90°

180°

270°

0.0

0.5

0.8

1.0

1.2

1.5

(c) Generated Data

X

X

X

+

X

X

.0

X

X

O

:oX

X

X.

X

O'

O:

O.

X

O.

O.

data information from distinct classifiers into one generator by incorporating the classifier index t as an input of the generator. By providing random noise ϵ , label y , and classifier index t as inputs, x is generated as x ' g p ϵ, y, t ; θ q . During the training process, we compute the loss for each classifier, L p t q p θ, η, α p t q q , and aggregate them as the final optimization objective. For each classifier, we optimized a distinct α and use α p t q to denote the α for the t -th classifier. We utilize a unified network h : R d ˆ Y ˆr T s Ñ R | Y | to compute the KKT multipliers, which also includes the classifier index as an input. The optimization objective for the training process can be formulated as:

Upon completion of training, generating samples requires an additional step to sample a suitable classifier index. Let T y denote the set of classifier indices, where the indices in the set correspond to classifiers whose training set contains samples with label y . To generate a sample x with label y , we first sample a classifier index t from T y , and then utilize t , along with y and random noise ϵ , as inputs to the generator to produce the sample.

The algorithm for training a generator using multiple classifiers is summarized in Alg. 2 in the Appendix.

5 Experiments

5.1 An Example of 2D Synthetic Data

In this subsection, we employ a two-dimensional example to analyze the proposed approach. We evenly generate 18 data points on a unit circle, and categorize them into three classes to create our training dataset D . The distribution of D is plotted in Fig. 4a, with distinct colors representing different categories. Utilizing this data, we train a three-layer fully connected network Φ as the classifier. The prediction landscape of Φ is displayed in Fig. 4b. The color of the region represents the category predicted by the classifier for samples within that region. The white areas represent the classifier's decision boundary. Given Φ , we train a generator g using the proposed method. The samples generated by g are plotted in Fig. 4c. Despite the presence of certain noise, the distribution of the generated data aligns consistently with that of the classifier's training data.

Leveraging this two-dimensional example, we further analyze our proposed method of training a generator using multiple classifiers. We evenly split the previous training dataset into D 1 and D 2 , plotted in Figs. 5a and 5f, respectively. Using these two subsets of data, we train two classifiers, Φ 1 and Φ 2 , and subsequently train two generators, g 1 and g 2 . Figs. 5c and 5h display the data generated by g 1 and g 2 , respectively. Here, during the training of g 1 , we solely use Φ 1 , and during the training of g 2 , we solely use Φ 2 . Obviously in Figs. 4b and 5g, owing to the generalization ability of neural networks, Φ 1 and Φ 2 learn additional categorization capabilities beyond the training data, with prediction areas with the same color surpassing the region covered by the training data. Contrarily, the samples generated by training g 1 and g 2 congregate around the actual data points, effectively

0°

90°

180°

270°

0.0

0.5

0.8

1.0

1.2

1.5

(a)

0°

90°

180°

270°

0.0

0.5

0.8

1.0

1.2

1.5

(b)

0°

90°

180°

270°

0.0

0.5

0.8

1.0

1.2

1.5

(c)

0°

90°

180°

270°

0.0

0.5

0.8

1.0

1.2

1.5

(d)

0°

90°

180°

270°

0.0

0.5

0.8

1.0

1.2

1.5

(e)

0°

90°

180°

270°

0.0

0.5

0.8

1.0

1.2

1.5

(f)

0°

90°

180°

270°

0.0

0.5

0.8

1.0

1.2

1.5

(g)

0°

90°

180°

270°

0.0

0.5

0.8

1.0

1.2

1.5

(h)

0°

90°

180°

270°

0.0

0.5

0.8

1.0

1.2

1.5

(i)

0

?

口

Q

8

Q.

000117222333444

000111222333444

555666777771999

555666777888999

recovering the original distribution of the training data. Subsequently, by employing the extension of the proposed method, we train a generator g 1 ` 2 using Φ 1 and Φ 2 together. As shown in Fig. 5d, g 1 ` 2 possesses the generative capabilities of both g 1 and g 2 , capable of generating samples on the entire training data D . We further fix the classifier index of g 1 ` 2 to either 1 or 2 , randomly sample noise and category labels, and observe the data generated by g 1 ` 2 . As depicted in Figs. 5e and 5h, g 1 ` 2 is also capable of independently generating data belonging to either D 1 or D 2 .

5.2 Image Generation

In this subsection, we showcase the experimental results on the MNIST [Lecun et al., 1998] and CelebA [Liu et al., 2015] datasets. More results and implementation details are left in the appendix. For the MNIST dataset, we set up a classification task corresponding to the digits 0-9 with 500 training data (50 images per class) randomly sampled from the original training set. For the CelebA dataset, we utilized various binary attributes to construct binary classification tasks on facial images, for example, distinguishing between males and females. For each task, we randomly sampled 100 images (50 images per class) from the original training dataset and resize them to 32x32 to be our training dataset.

We employed a three-layer fully-connected network with a ReLU activation function and batch normalization as the classifier for the aforementioned classification tasks. The networks were trained until the classification loss converges using full batch gradient descent, which ensures the parameters are close to the convergence point required in the theory of Maximum-Margin Bias.

百

古

百

00011

1222333404

0007117

222333444

555666777188991

S55666777888999

We use generators composed of three fully-connected layers followed by three transposed convolution layers, with ReLU activation function and batch normalization. Network parameters were initialized using Kaiming initialization [He et al., 2015] and trained for 50 , 000 epochs. The batch size and learning rate were set as hyperparameters and optimized via random search. In order to control the noise in generated images, we also utilized total variation loss in pixel space as a regularization term.

The generated results on MNIST and CelebA are shown in Figs. 6 and 7. Odd rows present the generated images, and even rows present the images from the training dataset that are closest to the generated images. The distance between images is measured by the SSIM metric. As shown by the results, the generator trained using our method is capable of generating digits and facial images, even though it has never been exposed to images of digits or faces.

To validate the extended method we proposed for multiple classifiers, we partitioned the aforementioned digit classification dataset into two subsets including digits 0 ´ 4 and digits 5 ´ 9 , respectively, and trained two classifiers separately. We then employed our method to train a single generator using both classifiers. Fig. 8 showcases the final images generated. The trained generator successfully integrates information from both classifiers, being capable of generating all digits from 0-9.

6 Conclusion

In this research, we investigate a pioneering task: training a generator directly utilizing a pretrained classifier, devoid of training data. Based on the maximum margin bias theory, we present the relationship between pre-trained neural network parameters and the training data distribution. Consequently, we devise an innovative loss function to enable the generator's training. Essentially, our loss function requires the generator to guarantee the optimality of the parameters of the pre-trained classifier under its generated data distribution. From a broader perspective, the reuse and revision of pre-trained neural networks have been a widely studied direction. [Ma et al., 2023, Fang et al., 2023a,b, Yu et al., 2023, Yang et al., 2022a,b] Our method offers a novel direction for leveraging pre-trained models.

Acknowledgment

This project is supported by the National Research Foundation, Singapore under its AI Singapore Programme (AISG Award No: AISG2-RP-2021-023), and the Singapore Ministry of Education Academic Research Fund Tier 1 (WBS: A0009440-01-00).

References

Martín Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein generative adversarial networks. In International Conference on Machine Learning (ICML) , 2017. 2

Devansh Arpit, Stanislaw Jastrzebski, Nicolas Ballas, David Krueger, Emmanuel Bengio, Maxinder S. Kanwal, Tegan Maharaj, Asja Fischer, Aaron C. Courville, Yoshua Bengio, and Simon Lacoste-Julien. A closer look at memorization in deep networks. In International Conference on Machine Learning (ICML) , 2017. 1

Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale GAN training for high fidelity natural image synthesis. In International Conference on Learning Representations (ICLR) , 2019. 2

Xi Chen, Yan Duan, Rein Houthooft, John Schulman, Ilya Sutskever, and Pieter Abbeel. Infogan: Interpretable representation learning by information maximizing generative adversarial nets. In Conference on Neural Information Processing Systems (NeurlPS) , 2016. 2

Amit Daniely. Neural networks learning and memorization with (almost) no over-parameterization. In Conference on Neural Information Processing Systems (NeurlPS) , 2020. 1

Damek Davis, Dmitriy Drusvyatskiy, Sham M. Kakade, and Jason D. Lee. Stochastic subgradient method converges on tame functions. Found. Comput. Math. , 20(1):119-154, 2020. 4

Emily L. Denton, Soumith Chintala, Arthur Szlam, and Rob Fergus. Deep generative image models using a laplacian pyramid of adversarial networks. In Conference on Neural Information Processing Systems (NeurlPS) , 2015. 2

Jeff Donahue, Philipp Krähenbühl, and Trevor Darrell. Adversarial feature learning. In International Conference on Learning Representations (ICLR) , 2017. 2

Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations (ICLR) , 2021. 1

Logan Engstrom, Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Brandon Tran, and Aleksander Madry. Adversarial robustness as a prior for learned representations, 2019. 3

Gongfan Fang, Xinyin Ma, Mingli Song, Michael Bi Mi, and Xinchao Wang. Depgraph: Towards any structural pruning. In IEEE / CVF Computer Vision and Pattern Recognition Conference (CVPR) , 2023a. 9

Gongfan Fang, Xinyin Ma, and Xinchao Wang. Structural pruning for diffusion models. In Conference on Neural Information Processing Systems (NeurlPS) , 2023b. 9

Vitaly Feldman and Chiyuan Zhang. What neural networks memorize and why: Discovering the long tail via influence estimation. In Conference on Neural Information Processing Systems (NeurlPS) , 2020. 1

Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Conference on Computer and Communications Security , 2015. 3

Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron C. Courville, and Yoshua Bengio. Generative adversarial nets. In Conference on Neural Information Processing Systems (NeurlPS) , 2014. 1, 2

Will Grathwohl, Kuan-Chieh Wang, Jörn-Henrik Jacobsen, David Duvenaud, Mohammad Norouzi, and Kevin Swersky. Your classifier is secretly an energy based model and you should treat it like one. In International Conference on Learning Representations (ICLR) , 2020. 3

Qiushan Guo, Chuofan Ma, Yi Jiang, Zehuan Yuan, Yizhou Yu, and Ping Luo. Egc: Image generation and classification via a single energy-based model. arXiv , 2023. 3

Niv Haim, Gal Vardi, Gilad Yehudai, Ohad Shamir, and Michal Irani. Reconstructing training data from trained neural networks. In Conference on Neural Information Processing Systems (NeurlPS) , 2022. 3

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Delving deep into rectifiers: Surpassing human-level performance on imagenet classification. 2015. 9

Zecheng He, Tianwei Zhang, and Ruby B. Lee. Model inversion attacks against collaborative inference. In David Balenson, editor, Proceedings of the 35th Annual Computer Security Applications Conference, ACSAC , 2019. 3

Phillip Isola, Jun-Yan Zhu, Tinghui Zhou, and Alexei A. Efros. Image-to-image translation with conditional adversarial networks. In IEEE / CVF Computer Vision and Pattern Recognition Conference (CVPR) , 2017. 2

Jinwoo Jeon, Jaechang Kim, Kangwook Lee, Sewoong Oh, and Jungseul Ok. Gradient inversion with generative image prior. In Conference on Neural Information Processing Systems (NeurlPS) , 2021. 3

Ziwei Ji and Matus Telgarsky. Directional convergence and alignment in deep learning. In Conference on Neural Information Processing Systems (NeurlPS) , 2020. 3

Yongcheng Jing, Chongbin Yuan, Li Ju, Yiding Yang, Xinchao Wang, and Dacheng Tao. Deep graph reprogramming. In CVPR , 2023. 1

Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for improved quality, stability, and variation. In International Conference on Learning Representations (ICLR) , 2018. 2

Daniel Kunin, Atsushi Yamamura, Chao Ma, and Surya Ganguli. The asymmetric maximum margin bias of quasi-homogeneous neural networks. International Conference on Learning Representations (ICLR) , 2023. 3, 4, 6

Thien Le and Stefanie Jegelka. Training invariances and the low-rank phenomenon: beyond linear networks. In International Conference on Learning Representations (ICLR) , 2022. 3

Lecun, L. Bottou, Y. Bengio, and P. Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE , 1998. 8

Yann LeCun, Sumit Chopra, Raia Hadsell, M Ranzato, and Fujie Huang. A tutorial on energy-based learning. Predicting structured data , 1(0), 2006. 3

Christian Ledig, Lucas Theis, Ferenc Huszar, Jose Caballero, Andrew Cunningham, Alejandro Acosta, Andrew P. Aitken, Alykhan Tejani, Johannes Totz, Zehan Wang, and Wenzhe Shi. Photo-realistic single image superresolution using a generative adversarial network. In IEEE / CVF Computer Vision and Pattern Recognition Conference (CVPR) , 2017. 2

Tran Duy Linh, Son Minh Nguyen, and Masayuki Arai. Gan-based noise model for denoising real images. In Computer Vision - ACCV 2020 - 15th Asian Conference on Computer Vision, Kyoto, Japan, November 30 December 4, 2020, Revised Selected Papers, Part IV , 2020. 2

Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In International Conference on Computer Vision (ICCV) , December 2015. 8

Kaifeng Lyu and Jian Li. Gradient descent maximizes the margin of homogeneous neural networks. In International Conference on Learning Representations (ICLR) , 2020a. 4

Kaifeng Lyu and Jian Li. Gradient descent maximizes the margin of homogeneous neural networks. In International Conference on Learning Representations (ICLR) , 2020b. 3

Xinyin Ma, Gongfan Fang, and Xinchao Wang. LLM-Pruner: On the Structural Pruning of Large Language Models. In Conference on Neural Information Processing Systems (NeurlPS) , 2023. 9

Mehdi Mirza and Simon Osindero. Conditional generative adversarial nets. CoRR , 2014. 2

Mor Shpigel Nacson, Suriya Gunasekar, Jason D. Lee, Nathan Srebro, and Daniel Soudry. Lexicographic and depth-sensitive margins in homogeneous and non-homogeneous deep models. In International Conference on Machine Learning (ICML) , 2019. 3

Anh Nguyen, Jeff Clune, Yoshua Bengio, Alexey Dosovitskiy, and Jason Yosinski. Plug & play generative networks: Conditional iterative generation of images in latent space. In IEEE / CVF Computer Vision and Pattern Recognition Conference (CVPR) , 2017. 3

Anh Mai Nguyen, Jason Yosinski, and Jeff Clune. Multifaceted feature visualization: Uncovering the different types of features learned by each neuron in deep neural networks. CoRR , 2016. 3

Sebastian Nowozin, Botond Cseke, and Ryota Tomioka. f-gan: Training generative neural samplers using variational divergence minimization. In Conference on Neural Information Processing Systems (NeurlPS) , 2016. 2

Augustus Odena, Christopher Olah, and Jonathon Shlens. Conditional image synthesis with auxiliary classifier gans. In International Conference on Machine Learning (ICML) , 2017. 2

Chris Olah, Alexander Mordvintsev, and Ludwig Schubert. Feature visualization. Distill , 2(11):e7, 2017. 3

Saharon Rosset, Ji Zhu, and Trevor Hastie. Margin maximizing loss functions. In Conference on Neural Information Processing Systems (NeurlPS) , 2003. 3

Daniel Soudry, Elad Hoffer, Mor Shpigel Nacson, Suriya Gunasekar, and Nathan Srebro. The implicit bias of gradient descent on separable data. J. Mach. Learn. Res. , 2018. 3

Sergey Tulyakov, Ming-Yu Liu, Xiaodong Yang, and Jan Kautz. Mocogan: Decomposing motion and content for video generation. In IEEE / CVF Computer Vision and Pattern Recognition Conference (CVPR) , 2018. 2

Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need, 2023. 1

Carl Vondrick, Hamed Pirsiavash, and Antonio Torralba. Generating videos with scene dynamics. In Conference on Neural Information Processing Systems (NeurlPS) , 2016. 2

Colin Wei, Jason D. Lee, Qiang Liu, and Tengyu Ma. Regularization matters: Generalization and optimization of neural nets v.s. their induced kernel. In Conference on Neural Information Processing Systems (NeurlPS) , 2019. 3

Xiang Wei, Boqing Gong, Zixia Liu, Wei Lu, and Liqiang Wang. Improving the improved training of wasserstein gans: A consistency term and its dual effect. In International Conference on Learning Representations (ICLR) , 2018. 2

Huikai Wu, Shuai Zheng, Junge Zhang, and Kaiqi Huang. GP-GAN: towards realistic high-resolution image blending. CoRR , 2017. 2

Jiajun Wu, Chengkai Zhang, Tianfan Xue, Bill Freeman, and Josh Tenenbaum. Learning a probabilistic latent space of object shapes via 3d generative-adversarial modeling. In Conference on Neural Information Processing Systems (NeurlPS) , 2016. 2

Tengyu Xu, Yi Zhou, Kaiyi Ji, and Yingbin Liang. Convergence of SGD in learning relu models with separable data. CoRR , 2018. 3

Chao Yang, Xin Lu, Zhe Lin, Eli Shechtman, Oliver Wang, and Hao Li. High-resolution image inpainting using multi-scale neural patch synthesis. In IEEE / CVF Computer Vision and Pattern Recognition Conference (CVPR) , 2017a. 2

Jianwei Yang, Anitha Kannan, Dhruv Batra, and Devi Parikh. LR-GAN: layered recursive generative adversarial networks for image generation. In International Conference on Learning Representations (ICLR) , 2017b. 2

Xingyi Yang, Jingwen Ye, and Xinchao Wang. Factorizing knowledge in neural networks. In European Conference on Computer Vision (ECCV) , 2022a. 9

Xingyi Yang, Daquan Zhou, Songhua Liu, Jingwen Ye, and Xinchao Wang. Deep model reassembly. In Conference on Neural Information Processing Systems (NeurlPS) , 2022b. 9

Ziqi Yang, Jiyi Zhang, Ee-Chien Chang, and Zhenkai Liang. Neural network inversion in adversarial setting via background knowledge alignment. In Conference on Computer and Communications Security, CCS , 2019. 3

Raymond A. Yeh, Chen Chen, Teck-Yian Lim, Alexander G. Schwing, Mark Hasegawa-Johnson, and Minh N. Do. Semantic image inpainting with deep generative models. In IEEE / CVF Computer Vision and Pattern Recognition Conference (CVPR) , 2017. 2

Hongxu Yin, Pavlo Molchanov, Jose M. Alvarez, Zhizhong Li, Arun Mallya, Derek Hoiem, Niraj K. Jha, and Jan Kautz. Dreaming to distill: Data-free knowledge transfer via deepinversion. In IEEE / CVF Computer Vision and Pattern Recognition Conference (CVPR) , 2020. 3

Jiahui Yu, Zhe Lin, Jimei Yang, Xiaohui Shen, Xin Lu, and Thomas S. Huang. Generative image inpainting with contextual attention. In IEEE / CVF Computer Vision and Pattern Recognition Conference (CVPR) , 2018. 2

Runpeng Yu, Songhua Liu, Xingyi Yang, and Xinchao Wang. Distribution shift inversion for out-of-distribution prediction. In IEEE / CVF Computer Vision and Pattern Recognition Conference (CVPR) , 2023. 9

Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song. The secret revealer: Generative model-inversion attacks against deep neural networks. In IEEE / CVF Computer Vision and Pattern Recognition Conference (CVPR) , 2020. 3

Xuejun Zhao, Wencan Zhang, Xiaokui Xiao, and Brian Y. Lim. Exploiting explanations for model inversion attacks. In International Conference on Computer Vision (ICCV) , 2021. 3

Jun-Yan Zhu, Taesung Park, Phillip Isola, and Alexei A. Efros. Unpaired image-to-image translation using cycle-consistent adversarial networks. In International Conference on Computer Vision (ICCV) , 2017. 2

Peer reviews:
comments: SUMMARY:
This paper tackles the problem of reconstructing an image generator, without relying on any data. The authors propose a learning paradigm in which the generator is trained to ensure that the convergence conditions of the network parameters are satisfied over the generated distribution of the samples.

STRENGTHS:
1. The paper addresses an important and challenging problem.
2. The method appears to be novel.

WEAKNESSES:
1. The evaluation seems to be weak. the authors have performed the qualitative evaluation alone. The experimental section seems to be incomplete without quantitative evaluation using metrics such as precision, recall, and FID.
2. Related works on Data free knowledge distillation are missing.

QUESTIONS:
1. Why does the generator generate realistic-looking samples even though it could cheat by learning to generate adversarial examples?
2. Are there any experimental validations/theoretical justifications to confirm if the model is not just reconstructing the training data examples?
3. Can the generator capture all the modes of the training data distribution sufficiently well?

LIMITATIONS:
The authors haven't discussed the potential negative social impact of their work, in particular, these methods could be used to recover the training data which may cause privacy concerns.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 2
DATE: 2023-07-05

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper addresses a novel and intriguing issue, namely, training a generator reliant on a pre-trained classifier, rather than extensive training data. The authors propose an innovative solution, fundamentally aimed at enabling the generator's training process to continuously extract and leverage information about the dataset distribution from the classifier's parameters. Based on the theory of Maximum-Margin Bias of gradient descent, the authors design stationarity loss and duality loss to ensure that the distribution of data generated by the trained generator guarantee the optimality of the pre-trained classifier. As an expansion, the paper also proposes an algorithm to collectively train a generator using information from multiple pre-trained classifiers. The proposed learning paradigm is empirically validated through experiments in various image generation tasks.\n\nSTRENGTHS:\nThis paper investigates an intriguing and innovative task: training a generator using information from the parameters of pre-trained classifiers, rather than relying on training data. Given the vast number of pre-trained models our community has accumulated, I view this as a task of substantial value with potential impact.\n\nThe paper clearly outlines its motivation and problem definition, and offers a technically sound and concrete method, underpinned by the theory of Maximum-Margin Bias of gradient descent. The paper processes a clear logical structure and reasonable organization. The proposed method and the technical details is validated through several convincing proof-of-concept experiments, as shown in Fig. 3, 4 and 5. The experiments across multiple image generation tasks exhibit promising results.\n\nWEAKNESSES:\nConsidering that this is a new attempt in this task, the experimental setup is understandably simple. Both the generator and classifier architecture utilized are elementary compared to the practice today. Besides this, I have some minor comments, which I have listed as questions below.\n\nQUESTIONS:\n1.\tLn 226 mentions that the construction of the system of equations depends on certain random samples. Are these random samples drawn from the original training dataset? If the solution for \\Lambda relies on samples from the training dataset, does it imply that the method proposed in the paper intrinsically presumes \\Lambda to be known?\n2.\tThe dataset used for training the classifier in the paper is relatively small, consisting of only 500 samples. What is the reasoning behind this setup? How would increasing the size of the training dataset impact the results?\n3.\tTypo\na.\tLn. 241, the set of classifiers is missing {}\n\nLIMITATIONS:\nOwing to the theory of Maximum-Margin Bias, the proposed method has limitations regarding the architecture of the pre-trained classifier and the pre-computation of \\Lambda. However, the authors have adequately addressed these challenges.\nThe paper also points out potential privacy risks that may arise from the application of the proposed method, as well as outlining some potential applications.", "TITLE": "Official Review", "RECOMMENDATION": 8, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper propose a method to generate image samples from a trained neural classifier. It proposes a loss to train an image generator where the loss is based on recent results from the realm of the implicit bias of gradient descent of quasi-homogenous functions. It shows empirical results on 2D data and on models trained on MNIST and CELEBA datasets.\n\nSTRENGTHS:\n- Extension of reconstruction to quasi-homogenous neural networks\n\n- Trying to create a generator by using a fixed prior on top of the reconstruction scheme\n\nWEAKNESSES:\nI think that the main weakness is the novelty in the paper. The proposed paper seems like an extension of Haim et al. 2022 to multiclass quasi-homogenous network, using a \"generative\" prior. However:\n- Note that a multiclass extension to Haim et al was done in Buzaglo et al. 2023 ICLR workshops (https://openreview.net/forum?id=SBstNm4OajH), which is somewhat concurrent). \n- the extension of the reconstructoin loss to quasi-homogenous networks is very slim - technically speaking, the only difference is the introduction of $\\Lambda$ in the loss. If this is truly necessary it should be supported by some comparisons to Haim et al. which also showed results on non-homogenous networks. Such comparisons are not provided in the paper.\n- The generative prior is interesting, but there is no evaluation in the paper for a generative model. All in all, the results are quite similar to those of Haim et al. only it seems that they were not fully converged (what is the difference between a \"bad\" reconstruction and a \"generated sample\"?)\n\nThe paper is poorly written - terminology is cumbersome and hard to follow, which makes it difficult to understand key components of the paper. Many important technical details are missing from the paper.\n\nSome comments in introduction and related section are unclear or irrelevant.\n\nQUESTIONS:\nEvaluation is lacking:\n- the main claim of the paper is the proposed generator that is being born from a classifier. But there are no evaluation whatsoever of generative models. Many common metrics for evaluating generative models exists like FID or IS (for GM that models a classified datasets), but non of these are provided. \n- There are only very few visual examples in the paper, and no further analysis\n- The method proposes creating a generative model -  what is the point in comparing the outputs of the model to their nearest neighbors (Fig. 6,7,8)? (there are established methods for evaluating generative models, see above)\n- No comparison to baselines: basically, the results look like a lesser version of the Haim et al. results. What happens if the paper uses Haim et al. reconstruction loss on their trained models? The only concern may be of the multiclass models - such an extension is shown in Buzaglo et al. 2023, which is somewhat concurrent to this submission. However, the current submission can show a comparison of their proposed method to that of Haim et al. only on binary classifiers.\n- Some other baselines could be other works that try to \"turn\" a classifier to generator:\n1) Use Classifier as Generator, Li 2022\n 2) Traditional Classification Neural Networks are Good Generators: They are Competitive with DDPMs and GANs, Wang and Torr, 2022\n\n\nPaper is poorly written. Main parts of the paper are difficult to follow and understand:\n- The main contribution in the paper is the training of a generator (as assumed from the title). However, the discussion of the generator itself is somewhat hidden in lines 185-186. It took me a while to figure out that this is the so called generator that the paper discusses. I suggest emphasising this element much more. \n- the discussion of determininig $\\Lambda$ (in lines 209-229) - I can't say that I understood the derivation. why is $\\Lambda' = \\frac{1}{1-\\Lambda_{ii}}\\Lambda$? I could not understand the two properties. I also did not understand the plot showni in Fig. 3 \n- discussion in lines 201-205 - why is this network h and ReLU is necessary? this part is very cryptic and not clear (not the mechanism itself, nor the motivation or intuition behind this design choice).\n- What is the difference between Eq. (7) and Eq. (12) - it seems like the exact same equation\n- Why is the extension to multiple classifiers (lines 239seqq.) necessary? what is the motivation for that? I also could not understand the mechanism in this paragraph.\n\n\nMany important technical details are missing from the paper:\n- what is the architectures of the trained models? said to be quasi-homogenous\n- what is the architecture of the generator g?\n- what is the architecture of the network h? (in line 202)\n\n\nSome comments in introduction and related section are unclear or irrelevant:\n- \"training process does not rely on any training data\" (line 44 and 56) is a bit misleading - it relies on the data on which the classifier was trained. (also it seems from eq.4 that the number of training samples N is assumed to be known).\n- \"GAN require an additional classifier\" (line 71) - what is the meaning here? unconditional GANs do not require additional classifiers\n- \"the classifier is trained concurrently with the generator\" (line 73) - is this referring to the discriminator? because this is not the classifiers in the sense that are used in the paper. The current paper submission discuss \"usual\" classifiers (that solve the classification problem of a supervised classification dataset) and discriminators are classifying between true and fake samples.\n- References in line 85 - \"model inversion... given the output and the trained model\" - Yin et al. 2020 do not assume the outputs but rather infer training samples from the trained batchnorm statistics. Gal et al. 2022 is really irrelevant here (textual \"inversion\" tries to find a token in the input of the text encoder that corresponds to a given set of images. It has nothing to do with training samples reconstruction).\n\n\nMinor:\n- line 207 and supplementary 68 - L_{lagrange} should be L_{stationarity}?\n\nLIMITATIONS:\nn/a", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe work extends the dataset reconstruction (DR) method [1] of reconstructing the dataset from a classifier to the generative scenario. It provides several extensions to it:\n- Instead of reconstructing particular data points, it aims to build a generator for the original dataset.\n- Extends to the multi-class setting (from a binary classifier). \n- Moves from homogeneous to $\\Lambda$-quasi-homogenous assumptions for the NN classifier.\n\nThe method is tested on MNIST and CelebA and is able to generate samples which resemble the real ones.\n\n[1] Haim et al. \"Reconstructing Training Data from Trained Neural Networks\"\n\nSTRENGTHS:\n- The overall idea of obtaining a generator from a classifier is very interesting and potentially very influential.\n- The work is genuine and open about its strengths and limitations. It feels like one of the rare works which is \"what you see is what you get\".\n- The method is quite novel and shows some promise to be working. I guess, the current ideas might be extendable to GAN training (or at least Auxilliary Classifier GAN training).\n- The source code was provided, which should improve the reproducibility.\n- Table 1 with the notations in the appendix was quite helpful.\n\nWEAKNESSES:\n- The paper is not self-sufficient and not possible to understand without reading the DR paper [1] first (at least, I failed to). It lacks intuitive exposition for the general audience who do not have vast background on the related work. Also, there are some confusing formulations on their own — e.g., Eq 5 and 6 define the loss term over $\\theta$ and $\\eta$, but they do not explicitly appear in the equation itself (only implicitly through $x_i$). And at the same, $x_i$ is not uniquely defined — it denotes both real and fake data. Also, sometimes it appears in bold (L123), and sometimes in normal font (e.g., Eq 1b). Also, Equation 12 is more or less a tautological repetition of Equation 7.\n- The experimental results do not seem to be strong.  E.g., checking the images in Figure 1b, they are hardly recognizable. While for [1], some restored images look quite reasonable, even considering it's CIFAR10 (a more difficult dataset than CelebA).\n- There should be a comparison with standard approaches of generating samples from a classifier (e.g., DeepDream or DeepDream from an adversarially robust classifier [3]). After checking some random DeepDream implementation on github [2] (probably untuned), it's hard to tell which samples are really better.\n- Limitations are not discussed\n\nTypos:\n- L181: \"objective, We\" => \"objective, we\"\n- L234: \"during the training\" => \"during training\"\n\n[2] https://github.com/ianscottknight/deep-dream-implementation-on-mnist-using-pytorch-hooks/blob/main/1.0-deep-dream.ipynb\n\n[3] https://arxiv.org/abs/1906.09453\n\nQUESTIONS:\nMy two biggest concerns are the writing quality and the scalability of the method, but I'm unsure how they could be addressed during the short rebuttal period. Another interesting direction would be exploring adversarially robust classifiers [3] (I guess, adversarially robust training should prevent the landscape from covering spurious minima and hence help the generation quality).\n\nLIMITATIONS:\nLimitations are not discussed at all.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-06"}