PIXAR: Auto-Regressive Language Modeling in Pixel Space (2024)

Abstract: Recent work showed the possibility of building open-vocabulary large language models (LLMs) that directly operate on pixel representations. These models are implemented as autoencoders that reconstruct masked patches of rendered text. However, these pixel-based LLMs are limited to discriminative tasks (e.g., classification) and, similar to BERT, cannot be used to generate text. Therefore, they cannot be used for generative tasks such as free-form question answering. In this work, we introduce PIXAR, the first pixel-based autoregressive LLM that performs text generation. Consisting of only a decoder, PIXAR can perform freeform generative tasks while keeping the number of parameters on par with previous encoderdecoder models. Furthermore, we highlight the challenges of generating text as non-noisy images and show this is due to using a maximum likelihood objective. To overcome this problem, we propose an adversarial pretraining stage that improves the readability and accuracy of PIXAR by 8.1 on LAMBADA and 8.5 on bAbI— making it comparable to GPT-2 on text generation tasks. This paves the way to build open-vocabulary LLMs that operate on perceptual input only and calls into question the necessity of the usual symbolic input representation, i.e., text as (sub)tokens. Code is available at https://github.com/april-tools/pixar.

heading: 1 Introduction
text: In natural language processing (NLP) pipelines, tokenizers are an essential ingredient used to divide the raw text into a sequence of sub-units, such as sub-words (Wu et al., 2016), characters (Cui et al., 2020), sentence pieces (Kudo and Richardson, 2018), and bytes (Sennrich et al., 2016). Nor-
*Equal contribution †Joint supervision, correspondence to: Alessandro Suglia <a.suglia@hw.ac.uk>, Antonio Vergari <avergari@ed.ac.uk>
mally, NLP models represent these sub-units as symbols within an ID-based categorical vocabulary.
This categorical representation highlights the following weaknesses of traditional NLP systems. First, to encode each item in the vocabulary, NLP systems have to allocate an embedding matrix that grows linearly with vocabulary size. Modern large language models (LLMs) allocate millions of parameters just for this.1 Additionally, fixing a vocabulary a priori can lead to performance degradation due to unseen out-of-vocabulary (OOV) words (Kaddour et al., 2023). Tokenizers with smaller granularities, such as characters and bytes, can alleviate the OOV issue but are still brittle as they can suffer from orthographic attacks (Eger et al., 2020). On the other hand, humans are incredibly robust to a variety of text permutations (Rayner et al., 2006) because they leverage the graphical information in text (Sun et al., 2021).
To tackle these problems, Rust et al. (2023) proposed PIXEL, a pixel-based LLM that treats text as images. Pixel-based embeddings remove the need
1The embedding matrix of Vicuna-7B (∼130M) is comparable to the size of bert-base-uncased (∼109M).
14673
for a finite vocabulary and keep the visual information of text, questioning whether we need symbolic representations of text as input at all, or if a pixelbased LLM can learn symbols implicitly. PIXEL achieved comparable performance with BERT (Devlin et al., 2019) in a range of downstream classification and regression NLP tasks while being robust to character-level visual attacks (Eger et al., 2020). However, because of its close architectural similarities with BERT, PIXEL cannot deal with free-form generative tasks, such as generative question answering (Lawrence et al., 2019).
To fill this gap, we present PIXAR, the first pixelbased autoregressive LLM that can generate short sequences of text as images. PIXAR is to GPT-like architectures as PIXEL is to BERT-like architectures: it consists of a Transformer decoder (Radford et al., 2019) that autoregressively generates text image patches as output. Generating new text as pixels starting from pixels only is, however, more challenging than selecting symbolic tokens from a vocabulary (as GPT-like models) or reconstructing masked image patches (as in PIXEL). This is because the model has to learn to generate longer sequences of pixels. To this end, we introduce a two-stage pretraining strategy for PIXAR. First, following previous work on autoregressive LLMs (Radford et al., 2019) and image generation models (Chen et al., 2020a), PIXAR is trained by reconstructing the next patch of pixels derived from a large-scale corpus of rendered text using teacherforcing. This maximum-likelihood approach, however, can generate image patches containing noisy text. To mitigate this problem, we proposed a second pretraining stage, where PIXAR is trained with an additional adversarial loss.
Our experiments in Section 4 show that 200 steps of stage 2 pretraining improve the readability of generated text significantly and achieve comparable performance with GPT-2 (Radford et al., 2019) on open-answer short generative tasks such as bAbI (Weston et al., 2015) and LAMBADA (Paperno et al., 2016). Additionally, PIXAR achieves better performance than PIXEL on the GLUE benchmark (Wang et al., 2018) while using a computational budget and a number of model parameters equivalent to the encoder part of PIXEL.

heading: 2 Beyond token-based LLMs
text: The idea of using pixel-based representations of text has been applied in various NLP tasks. For
instance, Liu et al. (2017) used a CNN-based block to extract character-level visual representations of Chinese writing and similarly, Sun et al. (2018) for text classification. Graphical features of Chinese characters are a good example where canonical symbolic tokenizers miss important information, as highlighted in Meng et al. (2020) exploiting the Tianzige feature of Chinese characters or Dai and Cai (2017) and ChineseBERT (Sun et al., 2021) integrating character-level visual features into embedding vectors for BERT-like models.
Sub-word tokenization as in character-level or byte-level tokens is possible and partially solves some issues.2 However, these approaches still struggle with a medium that is inherently visual. This is the case if we consider certain writing systems that are (partially) logographic such as in Chinese, or when text contains emojis.
Pixel-based representations mitigate these issues. Salesky et al. (2021) built machine translation models using visual information as input. However, their output layers still rely on embeddings over a fixed vocabulary. Inspired by Salesky et al. (2021), PIXEL (Rust et al., 2023) pretrained a Masked AutoEncoder (MAE) (He et al., 2021) with a large corpus of rendered text using a masked reconstruction objective. This can be considered the first purely pixel-based LLM that can be applied to a variety of downstream tasks such as POS tagging and extractive question answering. This approach was extended by Salesky et al. (2023) to deal with multiple languages as well. Moreover, visual text representation can be utilized in multimodal models to build a unified representation for both image and text modalities. Specifically, CLIPPO (Tschannen et al., 2023b) replaces the ID-based text encoder of CLIP (Radford et al., 2021) with a single pixelbased encoder to process both regular images and rendered text for visual QA. Due to the encoderonly architecture of PIXEL and CLIPPO, they still cannot be used to generate text. GlyphDiffusion (Li et al., 2023a) made attempts to use a diffusion model to generate new texts as images from noise and conditioned on encoded text features. However, its encoder still relies on symbolic embeddings. On top of the benefits of purely pixel-based LLMs, we are interested in understanding if a deep learning model can learn symbolic representation from perceptual information only, a very challenging task, as discussed next.
2We discuss more related works in Appendix A.

heading: 3 PIXAR
text: In contrast with the aforementioned approaches, we design PIXAR as a PIXel-based AutoRegressive LLM whose inputs and outputs are only pixels representing textual information. PIXAR abandons the MAE architecture of PIXEL and instead applies the design choices of other generative LLMs like GPT-2 and LLaMA-2 (Touvron et al., 2023a,b). PIXAR is pretrained to predict the next patches of pixels, conditioning only on the previous patches of rendered text. While this allows PIXAR to tackle free-form generative tasks, it presents several challenges. We start by reviewing its architecture.

heading: 3.1 Model Architecture
text: We design PIXAR as a decoder-only model with a stack of N = 12 Transformer layers. Specifically, we extend the Transformer (Vaswani et al., 2017) by applying some of the improvements introduced with LLaMA-2: pre-normalization using RMSNorm (Zhang and Sennrich, 2019), SwiGLU activation functions (Shazeer, 2020), and rotary positional embeddings (Su et al., 2023). Each Transformer layer in PIXAR generates hout ∈ Rd hidden states as output. Further details are in Appendix F.
Similarly to PIXEL, we represent the input text as a single (long) image containing several nonoverlapping patches (Figure 1). Following He et al. (2021), each image patch x ∈ RH×W×C—where H and W are the patch height and width and C the number of channels—is then flattened into a vector, and then projected into a hidden embedding hin ∈ Rd. The resulting sequence of patch embeddings {hin1 , . . . , hineos} is used as input to the Transformer backbone. We experiment with both RGB images (i.e., x ∈ [0, 1]H×W×3) and binary images (C = 1 and x ∈ {0, 1}H×W ), finding the latter to provide equivalently good downstream performance while simplifying the learning problem (Section 4).
A linear layer after the last Transformer layer projects the embedding houtN back to pixel space as a vector x̃ representing a linearized H ×W × C patch (with C = 1 for binary images). We interpret x̃ in the following way: for text rendered as binary images, x̃ are the logits that then are squashed by an element-wise sigmoid with temperature T (T = 1). To recover a hard binary vector from these probabilities, we apply a threshold θ (θ = 0.5).
When dealing with RGB images, we first clip x̃ element-wise to be within [0, 1], then linearly map each channel to {0-255} to construct RGB patches.

heading: 3.2 Stage 1 training: MLE
text: We train PIXAR by maximum likelihood estimation (MLE) by minimizing the negative loglikelihood of L ground truth pixel patches xi:i+L−1 conditioned on a sequence of observed (gold) patches x1:i−1 which is known as “teacher forcing" (Williams and Zipser, 1989). We assume every pixel in xi:i+L to be conditionally independent given the last layer embedding houtN . This yields to minimize a reconstruction loss Lrec over xi:i+L−1 that ends up being the usual pixel-wise binary crossentropy loss for binary images, and the MSE loss for RGB images under our assumptions (Kingma and Welling, 2013; Ghosh et al., 2020).
This sequential prediction task is quite challenging, as we will need to predict H×W×C×L variables 3. Having text rendered as binary images simplifies learning, but we observed that PIXAR can easily get stuck in local optima that yield noisy generation: especially for L > 1, see Figure 2. This is somehow expected and linked to the tendency of MLE to put probability mass among possible modes (Theis et al., 2015) i.e., readable patch configurations in our case. In Section 3.3 we introduce a way to quantify “readability” of the generated patches, while we discuss next a practical solution to avoid the pitfalls of MLE training.

heading: 3.3 Stage 2 training: Adversarial
text: Our solution to the noisy generated patches is an adversarial loss to be used in conjunction with Lrec in a second stage training. We name it patch-wise context-aware adversarial (PCAA) loss, and no-
3It is worth noting that predicting pixels is less computationally demanding because in our case it requires predicting an 8x8 patch which results in an MLP with an output layer of 64 logits. This is substantially smaller than the output of a tokenizer-based LLM which has to predict 760M logits (considering the Gemma-7B model as reference).
ticed that only 200 steps of minimizing it in our experiments (Section 4.3) can greatly boost the readability and generation performance of PIXAR.
Context-aware adversarial loss. Following previous work on GANs (Goodfellow et al., 2014), an adversarial training regime consists of a generator and a discriminator. We consider PIXAR as our generator. When designing our discriminator, we tried to follow previous work that uses patchwise discriminators (Esser et al., 2021; Rombach et al., 2021). However, in preliminary experiments, we find that these solutions lead to catastrophic mode collapse because they only consider the predicted patch as input and ignore previously predicted patches, i.e., the “context".
Our solution is the PCAA loss: LPCAA = Ex̃i:i+L−1 [− log(D(x̃i:i+L−1|x1:i−1))], which represents how much the generator can “fool" the discriminator a generated patch x̃i is real. To compute the PCAA loss, we use a context-aware discriminator implemented by appending a patch-wise classification head to a copy of the pretrained PIXAR (stage 1). Then, for a sequence, the discriminator is trained to decide whether a patch xi is real or fake (i.e., “readable text” vs “noisy” one) given real previous patches x1:i−1.
Due to the computational overhead of the Transformer layers in PIXAR, we developed a patchsampling algorithm to effectively calculate the PCAA loss. For a sequence of patches, we first generate fake patches and calculate the reconstruction loss using the generator. Then we use the discriminator to calculate key and value vectors for each real patch and calculate the PCAA loss of fake patches. To accelerate the training, we only calculate the PCAA loss of 30 uniformly sampled fake patches for one sequence. We report additional implementation details in the Appendix J.
Balancing MLE and PCAA. To mitigate the notorious instability of training a GAN, we follow Esser et al. (2021) and mix both the MLE loss Lrec and our PCAA loss LPCAA. We do so by computing
Lstage2 = Lrec + λm · λauto · LPCAA,
where λm is a tunable hyperparameter, and λauto is a value automatically computed as λauto = ∇GL [Lrec]/(∇GL [LPCAA] + δ) where ∇GL [·] represents the scale of gradients4 of the generator w.r.t.
4The scale is the mean of the element-wise absolute gradients of the output linear projection layer. Because we accumulate the gradients of a batch from mini-batches, we calculate the scale of every mini-batch and then average them.
its last layer N , and δ = 1e−8 is added to avoid division by zero.

heading: 3.4 PIXAR in action
text: As previously mentioned, PIXAR is able to tackle generative tasks that are out of the scope of PIXEL. At the same time, it can handle the discriminative tasks used in Rust et al. (2023). Depending on the task, we use PIXAR’s learned representations in different ways, as discussed next.
Discriminative tasks. Following previous work on downstream discriminative tasks (e.g., Devlin et al. (2019)), we add a lightweight prediction head to PIXAR to make it output classification labels or regression scores. Because of the causal masking strategy of PIXAR (conditioning on patches from left to right), only the last hidden state houteos associated with the EOS patch can attend over all the patches in the input sequence. Therefore, our added head linearly projects houteos to logits then followed by a softmax to output the probability of each class, or used as is for regression tasks.
Generative tasks. PIXAR generates L image patches at a time, containing newly rendered words that complete a given prompt. We can use PIXAR in generative tasks such as language modeling where, given a text passage rendered as a sequence of image patches, the model generates the next word (Paperno et al., 2016). Similarly, we can also perform few-shot learning experiments for QA by providing pairs of examples and solutions as rendered prompts (Weston et al., 2015). We use rendered pipe characters as visual delimiters to separate prompts and generated text (see Figure 3 and Section 4.3). Note that common generative NLP benchmarks expect predictions as (sequences of) symbolic tokens. We discuss next how we can extract text from generated pixel patches, and quantify the readability issue linked to MLE.
Text recognition. We concatenate the generated patches into one image and use OCR software to recognize the text within it. We found, however, that common OCR tools expect higher resolution images to be accurate, and furthermore, they do not work well with binary images, which leads to incorrect recognition even if they are readable by humans. To improve the OCR accuracy, we scale the generated image patches by a factor of 3 and place them in the middle of a square white image background. Also, we combine the results of Pad-
dleOCR5 and Tesseract OCR6. If the recognized word from any of the OCRs matches the target word, we count it as a correct prediction.
Readability metric. As discussed in Section 3.3, some of the generated patches can be noisy and unreadable by both humans and OCR tools. To quantify the quality of the generated text by PIXAR, we define readability as the ratio of generated image patches that contain at least one leading “legal” English word, i.e., a word that could be recognized by the OCR software and that appears in a reference vocabulary built by using 333k most common words from the English Word Frequency dataset7. As expected, this metric is correlated to higher prediction accuracy (Table 2).

heading: 4 Experiments
text: We aim to answer the following research questions: RQ1) how does PIXAR compare w.r.t., PIXEL on discriminative tasks? RQ2) how does it perform as a generative model? RQ3) how robust is generated text to orthographic attacks? and RQ4) what does PIXAR attend to in a prompt if no symbolic tokens are provided to it as in classical LLMs?

heading: 4.1 Experimental setup
text: Data. PIXAR is trained using the same pretraining dataset as PIXEL, consisting of Bookcorpus (Zhu et al., 2015) and English Wikipedia (see details in Rust et al. (2023)). We follow their preprocessing as described in Appendix B.
Text rendering. We use the same PangoCairo render of PIXEL, but using H = W = 8 for the division in patches. For better readability under this low resolution, we use the pixel-style font “Pixeloid
5PaddleOCR is available here 6Tesseract OCR is available here 7The vocabulary file could be downloaded here
Sans”.8 In initial experiments, we found this to be performance-neutral compared with Noto font used by PIXEL. For binary images, we render each pixel to a gray-scale value first and then binarize each pixel value by applying a threshold θ = 0.5. For RGB images, we map each pixel value to the [0, 1] interval. We follow PIXEL’s implementation that uses a black patch to represent special EOS tokens, which we use also for delimiting pairs of sentences.
Design choices and ablations. Due to computational constraints, we run preliminary experiments to determine a) the number L of patches to predict during training, b) whether to use a linear projection layer to map from and to pixel space or perform inference in latent space (Rombach et al., 2022), and c) RGB or binary encoding for images. We found that L = 2 in binary (linear) pixel space yields the best results and we adopt it for the rest of the experiments. Appendix D details this process.
Stage 1 pretraining. In stage 1, PIXAR is optimized by the AdamW optimizer (Loshchilov and Hutter, 2019) for 1M steps with batch size set to 384. We linearly warmed up the learning rate to 3e-4 in the first 2000 steps and then annealed it to 3e-6 using a cosine scheduler (Loshchilov and Hutter, 2017). For discriminative tasks, we pretrained a PIXAR with 85M parameters, which is equivalent to the size of the encoder of the PIXEL. For generative tasks, we used a PIXAR with 113M parameters instead to have a comparable size with GPT-2. We report details of pretraining and model architecture hyperparameters in Appendix F.
Stage 2. We experimented with different values of λm. Specifically, we trained the stage 1 model for 200 steps using different λm from 0.1 to 15, selecting the one with best validation performance.
8The font file is available at the following link.

heading: 4.2 RQ1) Discriminative Tasks
text: We follow Rust et al. (2023) and evaluate the language understanding ability of PIXAR using the GLUE benchmark. GLUE consists of 8 classification tasks and 1 regression task. For each task, we finetune the pretrained PIXAR with a newly initialized prediction head using rendered data. The rendering configuration is the same as the pretraining. In some tasks, an example consists of a pair of sentences. To delimit the two sentences, we inserted a black patch between them. As discussed in Section 3.4, we used the embedding from the last black patch as the input of the task head.
We adopt the same hyperparameters for finetuning used by Rust et al. (2023). Additionally, during training, we use an early-stopping strategy based on the validation set of each corresponding dataset. For tasks with more than 300k samples, e.g. MNLI and QQP, we set the maximum training step as 8000 and batch size as 256. We found that PIXAR is robust to hyperparameters on tasks with more data and sensitive to batch size or learning rate for smaller datasets (see Appendix G).
As shown in Table 1, PIXAR achieves on-par average performance with PIXEL (74.0 vs 74.1) with a substantially simpler architecture, and scores very closely to GPT-2 (75.6). Note that PIXEL is a 112M encoder-decoder model but only the 86M encoder is used in this experiment and GPT-2 uses even more parameters (126M). We also highlight the stark improvement of 5.4 points on WNLI compared to PIXEL. Considering that WNLI is based on fictional books, the improvement in performance on WNLI might be associated with PIXAR’s ability to learn better representations from the pretraining dataset that includes books (i.e., BookCorpus). We also note that stage-2 pretraining slightly increases performance for discriminative tasks. According to our intuition, the adversarial training improves PIXAR’s hidden states representations making them more suitable for discriminative tasks.

heading: 4.3 RQ2) Generative Tasks
text: For generative tasks, we render the prompt into an image and insert a white space patch of 3 pixels long to start the generation—intended as a reasonable space to delimit the beginning of a new word. Then PIXAR generates the next image patches autoregressively from there. We use two datasets for the generative tasks evaluation: LAMBADA, a benchmark designed to evaluate
the text-understanding capability of LLMs where models have to predict the last word of a sentence in a given context, and bAbI a QA task that evaluates the model’s reading comprehension ability on some given facts. For bAbI, since PIXAR and GPT2 are not directly trained on QA data, we show each model 4 examples in the prompt and split the question and answer using the “|" symbol (see Figure 3 and Section 3.4).
In LAMBADA the model needs to capture longrange dependencies in a context that is exposed only to the models during evaluation. From Table 2, we can observe that after only 200 steps of the second stage of pretraining, we can boost the performance of PIXAR and its overall generation readability (Section 3.4) by 8.1 points. Although PIXAR cannot beat GPT-2, it is almost in the same ballpark (13.8 versus 17.1), but it is 27% smaller than GPT-2 and our automatic OCR pipeline might not perfectly recognize some differently rendered words. For bAbI, we confirm the benefit of stage 2 pretraining (as we can also generate 77% of “readable” answers), but PIXAR’s final performance is a bit further away from GPT-2 (19.6 vs 26.8), hinting that it is a more challenging task than LAMBADA. Nevertheless, our results on bAbI provide a promising signal that few-shot learning is also possible with pixel-based generative models such as PIXAR. We complement this experiment by showing more generation examples in Figures 3 and 8 and in our analysis of attention in Section 4.5.

heading: 4.4 RQ3) Robustness to orthographic attacks
text: Following Rust et al. (2023), we use the procedure used in Eger and Benz (2020) to evaluate whether PIXAR can be more robust to “visual attacks" than GPT-2 when performing generative tasks such as LAMBADA and bAbI. First, we manually select a subset of look-alike characters for every English letter from the visually confusable characters of
Unicode Technical Standard #39 set 9. In this way, we make sure that the characters used in the visual attacks can be displayed with the “Pixeloid Sans” font. During the evaluation, we randomly replaced a ratio of letters in a prompt with a random lookalike character and measured the accuracy of the generated word. The results in Figure 4 demonstrate that although both models suffer from the visual attack, PIXAR showcased higher robustness under higher visual attack ratios. We report details of the performance under visual attack in Table 7.

heading: 4.5 RQ4) What is PIXAR looking at?
text: Modeling text purely from perceptual information raises the question of how PIXAR processes such information to generate configurations of pixels that resemble symbolic information (words), some of which might not have been seen during training. This question is vast (and challenging!) and, in this work, we attempt to answer it by looking at which parts of the rendered pixels PIXAR attends to. To do so, we take inspiration from the attention map analysis of Rust et al. (2023), and inspect RQ4.1) how attention changes through the Transformers layers, RQ4.2), what PIXAR is looking at
9Confusables characters can be found here.
when generating one patch at a time, and RQ4.3) if there is any correlation with (sub-)words that are semantically meaningful for the generative task at hand. For all the above questions, we examine the attention weights when generating image patches given prompts from the LAMBADA task. For each generated image patch, we calculate the average attention weights across all attention heads of all layers (RQ4.1) or just the last layer (RQ4.2,3). We then plot these averaged weights as heatmaps, which allow us to observe the areas of focus during the generation process. We provide some examples in Figures 5 to 7, and more in Appendix I.
RQ4.1) We visualize the attention weights of all layers when generating the first image patch (Figure 5). A consistent pattern we observe is that the bottom layers (e.g. first and third layers) tend to focus on many parts of the input prompt at once. Layers closer to the final one instead attend more intensely to sub-words, filtering out irrelevant information. This hints at a possible refinement process in PIXAR’s attention mechanism as the information propagates throughout layers and focuses on patches representing potentially meaningful words.
RQ4.2) Similarly, looking at attended pixels before and after generating the first patch of a word (Figure 6), suggests that PIXAR has two distinct modes when generating a long word spanning multiple patches, and it distributes attention differently depending on the stage of generation. Specifically, when generating the first patch of a long word, PIXAR tends to focus its attention on previous patches, suggesting a reliance on contextual information to decide which word to generate. Then, after it commits to that word, long contexts become less relevant and PIXAR systematically looks more at patches closer to the generated word. This second mode suggests a tendency of PIXAR to pre-
serve consistency and coherence within the ongoing word generation process.
RQ4.3) Finally, we visualize attention when PIXAR generates the correct or incorrect answer. We notice that when the answer is present in the prompt, PIXAR correctly attends to it with higher importance. This is the case for correctly predicted and highlighted “rope” and “Leo”, but also the not predicted but still highlighted “bob” in Figure 7. Even when wrongly predicting “water” (the correct answer is “coffee”), the model attends to “water” and other properties related to it in the prompt. More examples in Figure 10 showcase similar patterns. While not easy to quantify, this hints at the promising ability of PIXAR to be able to extract, perhaps not correct but still semantically meaningful, symbolic information from perceptual one.

heading: 5 Conclusion
text: We introduced PIXAR, an autoregressive pixelbased LLM that inherits the benefits of the first purely pixel-based LLM PIXEL but, differently from it, can support generative language tasks. We showcased the capabilities of PIXAR on discriminative tasks such as GLUE where it achieves comparable (or superior in some cases) performance w.r.t. PIXEL, and on generative free-text QA tasks, such as LAMBADA and bAbI, where it gets closer to GPT-2 while being more robust to orthographic attacks. While these results are encouraging, PIXAR performance is still behind more sophisticated LLMs that operate on symbolic tokens. This is expected, as reading and generating text as pure pixels is a much more challenging task, and we expect to improve on PIXAR’s architecture
and performance in future work, e.g., by training larger variants of PIXAR, on more text data rendered as images, and with more language variants. Furthermore, we highlighted how an adversarial loss can greatly improve the quality and accuracy of generated text.
We consider pixel-based language models as a promising avenue for several reasons: 1) they represent a more naturalistic way of “accessing” language data which can facilitate fusion with other visual inputs such as images; 2) when developing personal assistant for real-world use cases such as VQA systems for visually impaired users (Bigham et al., 2010), it is essential to be able to understand language that is embedded in the visual input (e.g., reading labels on cans or medicines). Overall, our work shed light on the possibility of treating texts as image-domain data paving the way towards more expressive language models that can efficiently generalise across languages and cultures (Liu et al., 2021) and derive language representations in a fully multimodal way (Barsalou, 1999).

heading: 6 Limitations & Risks
text: In this paper, we train and evaluate PIXAR on English language data only to compare with other well-known autoregressive language models like GPT-2. Salesky et al. (2023) showed promising results for encoder-only models applied to multilingual data. Additionally, it is worth noting that since we followed the same patch encoding as in PIXEL (Rust et al., 2023), we expect similar performance in discriminative tasks. Additionally, our work introduces the first fully generative pixel-based LLM, which represents a non-trivial contribution on its own. Due to the simplicity of PIXAR design, we foresee that it can be pretrained using multilingual data following previous work. In this paper, we explore the training regime for autoregressive pixelbased language models and find that a simple maximum likelihood regime is suboptimal for these models. Although the short stage 2 adversarial pretraining improved the generation readability and accuracy, PIXAR still has limitations in generating long sentences due to the readability issue. The notorious instability of adversarial training also makes the result of stage 2 pretraining hard to optimise even with the help of automatic GAN ratio balancing. Therefore, we believe that future work should explore more stable pertaining methods as an important research direction. Because experi-
ments with PIXAR cover only the English language, we acknowledge that there might be challenges to be solved when tackling different writing systems.
Another important research avenue that we foresee is to investigate pixel-based models’ robustness to different fonts and stylistic variations. In fact, all the pixel-based models trained so far have been trained and tested only with a single font without any perturbations. Creating a new set of “attacks" and employing more fonts is interesting but poses several challenges that are worth investigating to build truly generalist pixel-based models.

heading: Acknowledgements
text: AV was supported by the "UNREAL: Unified Reasoning Layer for Trustworthy ML" project (EP/Y023838/1) selected by the ERC and funded by UKRI EPSRC. This work also used the Cirrus UK National Tier-2 HPC Service at EPCC funded by the University of Edinburgh and EPSRC (EP/P020267/1).

heading: A More related works
text: A.1 Generative Language Models
Language models learn to predict probability distributions over a sequence of input elements which can have different granularity including words, tokens, characters, or pixels, which is the approach we follow in this work. This task is generally referred to as next token prediction and it represents a crucial problem in natural language processing (Shannon, 1948). The advent of transformers brought about a huge improvement in this field, especially in parallel training and capturing longrange dependencies (Vaswani et al., 2017). Surprisingly, the family of generative pre-trained transformers (Radford et al., 2019; Brown et al., 2020; Workshop et al., 2023; Touvron et al., 2023a,b; Penedo et al., 2023) demonstrated their strong ability to understand and generate natural language.
A.2 Transformer-based Image Generative Models
The task of image generation can be formulated as pixel-based autoregressive modeling. In the literature, this task was attempted using different architectures such as CNNs (Salimans et al., 2017), RNNs (van den Oord et al., 2016) and Transformers (Chen et al., 2020b; Menick and Kalchbrenner, 2018). However, the method of generating only 1 pixel at each step is limited to low-resolution images but not high-resolution images due to long sequence lengths and poor fidelity. Also, the sequential generative modeling and teacher-forcing training of generative transformers are not suitable for flattened image vectors since they learn to predict the probability distribution over a fixed finite vocabulary instead of image patches.
To mitigate this issue, a two-stage approach is proposed to learn a Vector-Quantized Variational Autoencoder(VQ-VAE) (van den Oord et al., 2018) to map continuous pixel values into a sequence of discrete tokens and then use a transformer decoder to model the distribution of the latent image tokens. This two-stage image tokenization approach not only contributes to generative modeling for highfidelity images (Chang et al., 2023, 2022; Ramesh et al., 2022; Tschannen et al., 2023a) but also shed the way for interleaved multimodal generation by simply concatenating the vocabularies for both text and images (Aghajanyan et al., 2022, 2023). Learning from the discrete latent space of VQ-VAE becomes a popular way for models to improve image
generation quality and enable language-inspired self-supervised learning (Bao et al., 2022; Li et al., 2023b).
A.3 Byte-level tokenizers The idea of using character-level visual features is not limited to pixel-based models. For instance, MacBERT (Cui et al., 2020) and Jozefowicz et al. (2016) also used character-level encodings. However, they still relied on traditional ID-based embeddings and thus suffered from the vocabulary bottleneck problem.
Alternatively, byte-level tokenization is also capable of encoding any code sequence. Xue et al. (2021) trained mT5 on UTF-8 byte sequence to adapt to different languages. Perceiver (Jaegle et al., 2021) proposed an iterative transformer structure which attended information directly through raw byte arrays. The increased sequence length poses challenges for Transformer-based architectures. For this reason, MEGABYTE (Yu et al., 2023) proposes a hierarchical architecture where a low-level patch decoder is conditioned on a globallevel learned patch representations. Another line of research uses recent state space models to extrapolate over extremely long sequence lengths. This is the case for Mamba byte (Wang et al., 2024) which pretrains a Mamba model (Gu and Dao, 2023) using byte representations.

heading: B Data Preprocessing
text: Because the length of Wikipedia articles and books is usually longer than PIXAR’s context window. We segment each article or book into several samples using the algorithm 1. In particular, we use the “PunktSentenceTokenizer" from the Natural Language Toolkit (NLTK) (Bird et al., 2009) to segment each article or book into sentences. Then, we concatenate short sentences to training samples within a character limit. Finally, we filter out samples with less than 100 characters. Table 3 demonstrates the length statistics of processed data.
During the pretraining, due to computational constraints, we fix the window size of PIXAR as
Algorithm 1 Text Segmentation Input: text s, maximum length lmax, minimum length lmin Initialize sentList = SentTokenize(s), sampleList = EmptyList(), sample = EmptyString() for i = 1 to ||sentList|| do
if len(sample) + len(sentListi) > lmax then if len(sample) ≥ lmin then Append(sampleList, sample)
end if sample = sentListi
else sample = Concat(sample, sentListi)
end if end for if len(sample) ≥ lmin then Append(sampleList, sample) end if Output: sampleList
360 patches. Thus, the model trained with a longer patch length can process more texts in each forward pass. We manually selected 1180 as the character limit for patch length 2.

heading: C Computational budget
text: The PIXAR’s pretraining stage was completed in ∼4 days using 16 NVIDIA V100 GPUs on an HPC computing cluster by extending the codebase originally released by Rust et al. (2023). Finetuning experiments are shorter and use the same computing infrastructure.

heading: D Hyperparameter Ablations
text: In our preliminary experiments, we explored several design choices for a PIXAR with 113M parameters, including different patch lengths, CNN-based projection layers, and the different formats of data. Because of our limited computational budget, we experimented with a selected number of variants that could allow us to make informed decisions about our model design. For each setting, we conducted 0.1M stage 1 pretraining steps and evaluated their performance on the GLUE benchmark (Wang et al., 2018).
Patch Length Selection In this ablation, the height of image patches is fixed at 8 pixels and we render all texts as a long image with 8 pixels high. Thus, the length of each patch defines how many characters or words a patch can hold and also determines the complexity of predicting the next patch.
We pretrained models on images with patch length [2, 5] for 0.1M stage 1 steps. The results in Table 5 show that in all combinations, patch length 2 achieved the highest average score. Thus, we used patch length 2 as our reference value for all the experiments.
Linear Projection vs CNN We experimented with two different strategies to convert image patches to vectors: 1) linear projection of the patches; and 2) a CNN auto-encoder as the input and output layers (Rombach et al., 2022). We first trained a lightweight CNN auto-encoder with a bottleneck layer of dimension 8 on the pretraining data. Then we take the encoder part as the model input layer, and the decoder as the output layer. During the pretraining, the PIXAR backbone is trained in the latent space of the auto-encoder (Rombach et al., 2022). We freeze parameters from the auto-encoder and train PIXAR to minimize the MSE of the next latent vector rather than the next image patch. However, as results shown in Table 5, the extra auto-encoder did not bring significant improvement compared with the simple linear projection layer. Therefore, we opted for the simpler linear projection instead.
RGB vs binary images As detailed in Section 3, we explored training with both continuous RGB images and binary images. When we use linear projection layers, we flatten the values of each channel of the RGB image into a vector as the input and calculate the MSE between the predicted vector and the ground truth vector as the loss. When using the CNN auto-
encoder as input and output layers, RGB image patches are converted to latent vectors with CNN layers with corresponding layers.
The results in Table 5 indicate that models trained with continuous RGB images have ∼1.4 points lower than their binary counterparts. We therefore used binary rendering in further pretraining experiments.

heading: E Licensing
text: As mentioned before, the starting point for our work was the PIXEL codebase released on GitHub under Apache 2.0 license. We also used the same pretraining datasets that was released on Huggingface. Upon acceptance, we will release our codebase on GitHub following the same approach and license.

heading: F Pretraining Details & Model
text: Configurations
Table 4 demonstrates the stage 1 pretraining hyperparameters, render configuration, and model architecture details of PIXAR.

heading: G GLUE Finetuning Details
text: Table 6 displays the hyperparameter details of GLUE finetuning.

heading: H Generation Samples
text: Figure 8 shows more generation samples from LAMBADA and bAbI datasets. Images are visualized using a 0.5 threshold and reshaped to a more square size for a better representation.

heading: I Attention Heatmap Samples
text: Figure 9, Figure 10 and Figure 11 show more attention heatmaps from LAMBADA datasets. The first generated image patches are marked by red rectangles. Samples are drawn using the attention weights from the last transformer layer of the first generated image patch to the given prompt.

heading: J Adversarial Training
text: PIXAR is trained using a second stage of pretraining using an adversarial training regime that resembles the one used in GANs (Goodfellow et al., 2014). Figure 12 exemplifies how PIXAR is used for the stage 2 pretraining. Each adversarial step can be divided into 3 stages:
1) Calculate the Reconstruction Loss
we fist sample a batch of sequences x from the pretraining dataset and generate the fake sequences x̃ using the generator. Then we calculate the reconstruction loss Lrec as well as generator’s gradients w.r.t. Lrec. Because we need to reuse the computational graph later for the PCAA loss, we thus set “retain_graph = True" while doing backward propagation using Pytorch. We record the current gradients of the last generator layer as g1 and calculate the scale of it ∇GL [Lrec] = |g1|.
2) Calculate the balanced PCAA and update the generator
First, we calculate key and value vectors for every real patch using the discriminator and cache them for the PCAA calculation. To accelerate the calculation, we randomly sample 30 fake patches for each generated sequence and calculate the PCAA loss with the cached key and value vectors using the discriminator. Then we multiply the PCAA loss with λm and λauto which is calculated from the previous step, and backpropagate all the way to the generator. Because Pytorch accumulates gradients of multiple backwards steps, to attain the gradients of the last generator layer w.r.t. the PCAA loss, we subtract the previously recorded gradients g1 and calculate the scale ∇GL [LPCAA] = |g2 − g1|/λm/λauto. Because the PCAA is balanced, we re-scale it to get the true gradients scale. The scale is recorded for the next batch. During the first step, because we initialize λauto as 1. Now gradients w.r.t. PCAA and reconstruction loss are ready and we can update the parameters of the generator using the specified optimizer.

heading: 3) Update the discriminator
text: Finally, we calculate the classification loss using the cross entropy loss of the discriminator and update its parameters. The procedure is similar to the PCAA calculation, we calculate the loss on real patches and cache key and value vectors, then calculate the loss on 30 randomly sampled fake patches for each sequence.

heading: K Performance under Visual Attack
text: Table 7 records the accuracy details of GPT-2 and LAMBADA under different visual attack ratios. While evaluating the accuracy, we randomly select a ratio of letters from the prompt and replace them with random look-alike symbols. If the first word the model predicts matches the target word regardless of its casing, we count it as a correct
prediction.
Prompt Generated LAMBADA
Target

heading: Future Work
text: Therefore, we believe that future work should explore more stable pertaining methods as an important research direction. Because experi-
ments with PIXAR cover only the English language, we acknowledge that there might be challenges to be solved when tackling different writing systems. Another important research avenue that we foresee is to investigate pixel-based models’ robustness to different fonts and stylistic variations. In fact, all the pixel-based models trained so far have been trained and tested only with a single font without any perturbations. Creating a new set of “attacks" and employing more fonts is interesting but poses several challenges that are worth investigating to build truly generalist pixel-based models