launch/ampere huggingface dataset:
This paper presents a method to cope with adversarial examples in classification tasks, leveraging a generative model of the inputs. Given an accurate generative model of the input, this approach first projects the input onto the manifold learned by the generative model (the idea being that inputs on this manifold reflect the non-adversarial input distribution). This projected input is then used to produce the classification probabilities. The authors test their method on various adversarially constructed inputs (with varying degrees of noise). Questions/Comments: - I am interested in unpacking the improvement of Defense-GAN over the MagNet auto-encoder based method. Is the MagNet auto-encoder suffering lower accuracy because the projection of an adversarial image is based on an encoding function that is learned only on true data? If the decoder from the MagNet approach were treated purely as a generative model, and the same optimization-based projection approach (proposed in this work) was followed, would the results be comparable? - Is there anything special about the GAN approach, versus other generative approaches? - In the black-box vs. white-box scenarios, can the attacker know the GAN parameters? Is that what is meant by the "defense network" (in experiments bullet 2)? - How computationally expensive is this approach take compared to MagNet or other adversarial approaches? Quality: The method appears to be technically correct. Clarity: This paper clearly written; both method and experiments are presented well. Originality: I am not familiar enough with adversarial learning to assess the novelty of this approach. Significance: I believe the main contribution of this method is the optimization-based approach to project onto a generative model's manifold. I think this kernel has the potential to be explored further (e.g. computational speed-up, projection metrics).
The article "Do GANs Learn the Distribution? Some Theory and Empirics" considers the important problem of quantifying whether the distributions obtained from generative adversarial networks come close to the actual distribution of images. The authors argue that GANs in fact generate the distributions with fairly low support. The proposed approach relies on so-called birthday paradox which allows to estimate the number of objects in the support by counting number of matching (or very similar) pairs in the generated sample. This test is expected to experimentally support the previous theoretical analysis by Arora et al. (2017). The further theoretical analysis is also performed showing that for encoder-decoder GAN architectures the distributions with low support can be very close to the optimum of the specific (BiGAN) objective. The experimental part of the paper considers the CelebA and CIFAR-10 datasets. We definitely see many very similar images in fairly small sample generated. So, the general claim is supported. However, if you look closely at some pictures, you can see that they are very different though reported as similar. For example, some deer or truck pictures. That's why I would recommend to reevaluate the results visually, which may lead to some change in the number of near duplicates and consequently the final support estimates. To sum up, I think that the general idea looks very natural and the results are supportive. On theoretical side, the results seem fair (though I didn't check the proofs) and, being partly based on the previous results of Arora et al. (2017), clearly make a step further.
The proposed method is a classifier that is fair and works in collaboration with an unfair (but presumably accurate model).  The novel classifier is the result of the optimisation of a loss function  (composed of a part similar to a logistic regression model and a part being the disparate impact).  Hence, it can be interpreted as a logistic loss with a fairness regularisation. The results are promising and the applications are very important for the acceptance of ML approaches in the society.  However, I believe that the model could be made more general (than a fairness regularized logistic loss) and its theoretical properties studied. Finally, this paper used uncommon vocabulary (for the machine learning community)  and it make is difficult to follow sometimes (for example, the use of a Decision-Maker entity). When reading the submitted paper, it was unclear (until section 6) how deferring could help fairness.  Hence, the structure of the paper could maybe be improved by introducing the cost function earlier in the manuscript (as a fairness regularised loss). To conclude, although the application is of high interest and the numerical results encouraging,  the methodological approach does not seem to be very novel. Minor comment : - The list of authors of the reference “Machine bias : theres software…” apperars incorrectly (some comma may be missing in the .bib file)  and there is a small typo in the title. Possible extensions :- The proposed fairness aware loss could be made more general (and not only in the case of a logistic model)  - It could also be generalised to a mixture of biased classifier (more than on DM).
This paper proposes to use RGANs and RCGANS to generate synthetic sequences of actual data.  They demonstrate the quality of the sequences on sine waves, MNIST, and ICU telemetry data. The authors demonstrate novel approaches for generating real-valued sequences using adversarial training, a train on synthetic, test of real and vice versa method for evaluating GANS, generating synthetic medical time series data, and an empirical privacy analysis.  Major - the medical use case is not motivating.  de-identifying the 4 telemetry measures is extremely easy  and there is little evidence to show that it is even possible to reidentify individuals using these 4 measures.  our institutional review board would certainly allow self-certification of the data (i.e. removing the patient identifiers and publishing the first 4 hours of sequences). - the labels selected by the authors for the icu example are to forecast the next 15 minutes and whether a critical value is reached.  Please add information about how this critical value was generated.  Also it would be very useful to say that a physician was consulted and that the critical values were "clinically" useful. - the changes in performance of TSTR are large enough that I would have difficulty trusting any experiments using the synthetic data.  If I optimized a method using this synthetic data, I would still need to assess the result on real data. - In addition it is unclear whether this synthetic process would actually generate results that are clinically useful.  The authors certainly make a convincing statement about the internal validity of the method.  An externally valid measure would strengthen the results.  I'm not quite sure how the authors could externally validate the synthetic data  as this would also require generating synthetic outcome measures.  I think it would be possible for the synthetic sequence to also generate an outcome measure (i.e. death) based on the first 4 hours of stay. Minor- write in the description for table 1 what task the accuracies correspond. Summary The authors present methods for generating synthetic sequences.  The MNIST example is compelling.  However the ICU example has some pitfalls which need to be addressed.
The authors describe a new defense mechanism against adversarial attacks on classifiers (e.g., FGSM). They propose utilizing Generative Adversarial Networks (GAN), which are usually used for training generative models for an unknown distribution, but have a natural adversarial interpretation. In particular, a GAN consists of a generator NN G which maps a random vector z to an example x, and a discriminator NN D which seeks to discriminate between an examples produced by G and examples drawn from the true distribution. The GAN is trained to minimize the max min loss of D on this discrimination task, thereby producing a G (in the limit) whose outputs are indistinguishable from the true distribution by the best discriminator. Utilizing a trained GAN, the authors propose the following defense at inference time. Given a sample x (which has been adversarially perturbed), first project x onto the range of G by solving the minimization problem z* = argmin_z ||G(z) - x||_2. This is done by SGD. Then apply any classifier trained on the true distribution on the resulting x* = G(z*). In the case of existing black-box attacks, the authors argue (convincingly) that the method is both flexible and empirically effective. In particular, the defense can be applied in conjunction with any classifier (including already hardened classifiers), and does not assume any specific attack model. Nevertheless, it appears to be effective against FGSM attacks, and competitive with adversarial training specifically to defend against FGSM. The authors provide less-convincing evidence that the defense is effective against white-box attacks. In particular, the method is shown to be robust against FGSM, RAND+FGSM, and CW white-box attacks. However, it is not clear to me that the method is invulnerable to novel white-box attacks. In particular, it seems that the attacker can design an x which projects onto some desired x* (using some other method entirely), which then fools the classifier downstream. Nevertheless, the method is shown to be an effective tool for hardening any classifier against existing black-box attacks (which is arguably of great practical value). It is novel and should generate further research with respect to understanding its vulnerabilities more completely. Minor Comments: The sentence starting “Unless otherwise specified…” at the top of page 7 is confusing given the actual contents of Tables 1 and 2, which are clarified only by looking at Table 5 in the appendix. This should be fixed.
This paper describes computationally efficient methods for training adversarially robust deep neural networks for image classification. (These methods may extend to other machine learning models and domains as well, but that's beyond the scope of this paper.) The former standard method for generating adversarially images quickly and using them in training was to do a single gradient step to increase the loss of the true label or decrease the loss of an alternate label. This paper shows that such training methods only lead to robustness against these "weak" adversarial examples, leaving the adversarially-trained models vulnerable to multi-step white-box attacks and black-box attacks (adversarial examples generated to attack alternate models). There are two proposed solutions. The first is to generate additional adversarial examples from other models and use them in training. This seems to yield robustness against black-box attacks from held-out models as well. Of course, it requires that you have a somewhat diverse group of models to choose from. If that's the case, why not directly build an ensemble of all the models? An ensemble of neural networks can still be represented as a neural network, although a more computationally costly one. Thus, while this heuristic appears to be useful with current models against current attacks, I don't know how well it will hold up in the future. The second solution is to add random noise before taking the gradient step. This yields more effective adversarial examples, both for attacking models and for training, because it relies less on the local gradient. This is another simple idea that appears to be effective. However, I would be interested to see a comparison to a 2-step gradient-based attack. R+Step-LL can be viewed as a 2-step attack: a random step followed by a gradient step. What if both steps were gradient steps instead? This interpolates between Step-LL and I-Step-LL, with an intermediate computational cost. It would be very interesting to know if R+Step-LL is more or less effective than 2+Step-LL, and how large the difference is. I like that this paper demonstrates the weakness of previous methods, including extensive experiments and a very nice visualization of the loss landscape in two adversarial dimensions. The proposed heuristics seem effective in practice, but they're somewhat ad hoc and there is no analysis of how these heuristics might or might not be vulnerable to future attacks.
Authors describe a procedure of building their production recommender system from scratch, begining with formulating the recommendation problem, label data formation, model construction and learning.  They use several different evaluation techniques to show how successful their model is (offline metrics, A/B test results, etc.) Most of the originality comes from integrating time decay of purchases into the learning framework.  Rest of presented work is more or less standard. Paper may be useful to practitioners who are looking to implement something like this in production.
The paper proposes a novel approach on estimating the parameters  \nof Mean field games (MFG). The key of the method is a reduction of the unknown parameter MFG to an  unknown parameter Markov Decision Process (MDP).\n\n This is an important class of models and I recommend the acceptance of the paper.\n\n I think that the general discussion about the collective behavior application should be more carefully presented and some better examples of applications should be easy to provide. In addition the authors may want to enrich their literature review and give references to alternative work on unknown MDP estimation methods cf. [1], [2] below. \n\n [1] Burnetas, A. N., & Katehakis, M. N. (1997). Optimal adaptive policies for Markov decision processes. Mathematics of Operations Research, 22(1), 222-255.\n\n [2] Budhiraja, A., Liu, X., & Shwartz, A. (2012). Action time sharing policies for ergodic control of Markov chains. SIAM Journal on Control and Optimization, 50(1), 171-195.
This paper proposes to use 3D conditional GAN models to generate fMRI scans.  Using the generated images, paper reports improvement in classification accuracy on various tasks. One claim of the paper is that a generative model of fMRI data can help to caracterize and understand variability of scans across subjects. Article is based on recent works such as Wasserstein GANs and AC-GANs by (Odena et al., 2016). Despite the rich literature of this recent topic  the related work section is rather convincing. Model presented extends IW-GAN by using 3D convolution and also by supervising the generator using sample labels. Major: - The size of the generated images is up to 26x31x22  which is limited (about half the size of the actual resolution of fMRI data).  As a consequence results on decoding learning task using low resolution images can end up worse than with the actual data (as pointed out). What it means is that the actual impact of the work is probably limited. - Generating high resolution images with GANs even on faces for which there is almost infinite data is still a challenge.  Here a few thousand data points are used.  So it raises too concerns: First is it enough? Using so-called learning curves is a good way to answer this.  Second is what are the contributions to the state-of-the-art of the 2 methods introduced?  Said differently, as there is no classification results using images produced by an another GAN architecture  it is hard to say that the extra complexity proposed here (which is a bit contribution of the work) is actually necessary. Minor: - Fonts in figure 4 are too small.
The authors build on the work of Tang et al. (2017),  who made a minor change to the skip-thought model by decoding only the next sentence, rather than the previous one also.  The additional minor change in this paper is to use a CNN, rather than RNN, decoder. I am sympathetic to the goals of the work, and believe this sort of work should be carried out,  but I see the contribution as too minor to constitute a paper at the conference track of a leading international conference such as ICLR.  Given the incremental nature of the work, I think this would be a good fit for something like a short paper at *ACL. I found the more theoretical motivation of the CNN decoder not terribly convincing, and somewhat post-hoc.  I feel as though analogous arguments could just as easily be made for an RNN decoder.  Ultimately I see these questions - such as CNN vs. RNN for the decoder - as empirical ones. Finally, the authors have admirably attempted a thorough comparison with existing work, in the related work section,  but this section takes up a large chunk of the paper at the end,  and again I would have preferred this section to be much shorter and more concise. Summary: worthwhile empirical goal,  but the paper could have been easily written using half as much space.
This paper presents a reparametrization of the perturbation applied to features in adversarial examples based attacks.  It tests this attack variation on against Inception-family classifiers on ImageNet.  It shows some experimental robustness to JPEG encoding defense. Specifically about the method: Instead of perturbating a feature x_i by delta_i, as in other attacks, with delta_i in range [-Delta_i, Delta_i], they propose to perturbate x_i^*, which is recentered in the domain of x_i through a heuristic ((x_i ± Delta_i + domain boundary that would be clipped)/2), and have a similar heuristic for computing a Delta_i^*.  Instead of perturbating x_i^* directly by delta_i, they compute the perturbed x by x_i^* + Delta_i^* * g(r_i),  so they follow the gradient of loss to misclassify w.r.t. r (instead of delta).  +/-: + The presentation of the method is clear. + ImageNet is a good dataset to benchmark on. - (!) The (ensemble) white-box attack is effective  but the results are not compared to anything else, e.g. it could be compared to (vanilla) FGSM nor C&W. - The other attack demonstrated is actually a grey-box attack,  as 4 out of the 5 classifiers are known, they are attacking the 5th,  but in particular all the 5 classifiers are Inception-family models. - The experimental section is a bit sloppy at times (e.g. enumerating more than what is actually done, starting at 3.1.1.). - The results on their JPEG approximation scheme seem too explorative (early in their development) to be properly compared. I think that the paper need some more work, in particular to make more convincing experiments that the benefit lies in CIA (baselines comparison), and that it really is robust across these defenses shown in the paper.
Summary: The paper proposes to learn new priors for latent codes z  for GAN training. for this the paper shows that there is a mismatch between the gaussian prior and an estimated of the latent codes of real data by reversal of the generator . To fix this the paper proposes to learn a second GAN to learn the prior distributions of "real latent code" of the first GAN. The first GAN then uses the second GAN as prior to generate the z codes. Quality/clarity: The paper is well written and easy to follow. Originality:pros: -The paper while simple sheds some light on important problem with the prior distribution used in GAN. - the second GAN solution trained on reverse codes from real data is interesting - In general the topic is interesting, the solution presented is simple but needs more study cons: - It related to adversarial learned inference and BiGAN, in term of learning the mapping  z ->x, x->z and seeking the agreement. - The solution presented is not end to end (learning a prior generator on learned models have been done in many previous works on encoder/decoder) General Review: More experimentation with the latent codes will be interesting: - Have you looked at the decay of the singular values of the latent codes obtained from reversing the generator? Is this data low rank? how does this change depending on the dimensionality of the latent codes? Maybe adding plots to the paper can help. - the prior agreement score is interesting but assuming gaussian prior also for the learned latent codes from real data is maybe not adequate. Maybe computing the entropy of the codes using a nearest neighbor estimate of the entropy  can help understanding the entropy difference wrt to the isotropic gaussian prior? - Have you tried to multiply the isotropic normal noise with the learned singular values and generate images from  this new prior  and compute inceptions scores etc? Maybe also rotating the codes with the singular vector matrix V or \Sigma^{0.5} V? - What architecture did you use for the prior generator GAN? - Have you thought of an end to end way to learn the prior generator GAN?
Paper studies an interesting phenomenon of overparameterised models being able to learn well-generalising solutions. It focuses on a setting with three crucial simplifications: - data is linearly separable - model is 1-hidden layer feed forward network with homogenous activations - **only input-hidden layer weights** are trained, while the hidden-output layer's weights are fixed to be (v, v, v, ..., v, -v, -v, -v, ..., -v) (in particular -- (1,1,...,1,-1,-1,...,-1)) While the last assumption does not limit the expressiveness of the model in any way, as homogenous activations have the property of f(ax)=af(x) (for positive a) and so for any unconstrained model in the second layer, we can "propagate" its weights back into first layer and obtain functionally equivalent network. However, learning dynamics of a model of form  z(x) = SUM( g(Wx+b) ) - SUM( g(Vx+c) ) + d and "standard" neural model  z(x) = Vg(Wx+b)+c can be completely different. Consequently, while the results are very interesting, claiming their applicability to the deep models is (at this point) far fetched. In particular, abstract suggests no simplifications are being made, which does not correspond to actual result in the paper. The results themselves are interesting, but due to the above restriction it is not clear whether it sheds any light on neural nets, or simply described a behaviour of very specific, non-standard shallow model. I am happy to revisit my current rating given authors rephrase the paper so that the simplifications being made are clear both in abstract and in the text, and that (at least empirically) it does not affect learning in practice. In other words - all the experiments in the paper follow the assumption made, if authors claim is that the restriction introduced does not matter,but make proofs too technical - at least experimental section should show this. If the claims do not hold empirically without the assumptions made, then the assumptions are not realistic and cannot be used for explaining the behaviour of models we are interested in. Pros: - tackling a hard problem of overparametrised models, without introducing common unrealistic assumptions of activations independence - very nice result of "phase change" dependend on the size of hidden layer in section 7 Cons: - simplification with non-trainable second layer is currently not well studied in the paper; and while not affecting expressive power - it is something that can change learning dynamics completely