Original: V ISUALIZING R EPRESENTATIONS BY P ERCEPTUAL R EGULARIZATION
Revised: V ISUALIZING R EPRESENTATIONS BY P ERCEPTUAL R EGULARIZATION

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: A deployable machine learning model relies on a good representation.
Revised: A deployable machine learning model relies on a good representation.

Original: A desirable criteria for a good representation is to be interpretable by humans.
Revised: A desirable criteria for a good representation is to be interpretable by humans.

Original: We propose a technique termed perceptual regularization that enables visualization of the latent representation.
Revised: We propose a technique termed perceptual regularization that enables visualization of the latent representation.

Original: By visualizing the learned representation, we are also able to understand the attention of a model, obtaining visual evidence that supervised networks learn task-speciﬁc representations.
Revised: By visualizing the learned representation, we are also able to understand the attention of a model, obtaining visual evidence that supervised networks learn task-speciﬁc representations.

Original: Moreover our method provides a direct visualization of the effect that adversarial attacks have on the internal representation of a deep network.
Revised: Moreover our method provides a direct visualization of the effect that adversarial attacks have on the internal representation of a deep network.

Original: We show how this can be used to systematically perform latent space interpolation to modify semantic features
Revised: We show how this can be used to systematically perform latent space interpolation to modify semantic features

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Deep neural networks are known to be vulnerable, small changes known as adversarial attacks can completely change the model’s prediction (Szegedy et al., 2014; Nguyen et al., 2015; Kurakin et al., 2017).
Revised: Deep neural networks are known to be vulnerable, small changes known as adversarial attacks can completely change the model’s prediction (Szegedy et al., 2014; Nguyen et al., 2015; Kurakin et al., 2017).

Original: There is a rapidly growing body of work on how to perform effective adversarial attacks, and how to defend against them (Papernot et al., 2017; Madry et al., 2017; Athalye et al., 2018).
Revised: There is a rapidly growing body of work on how to perform effective adversarial attacks, and how to defend against them (Papernot et al., 2017; Madry et al., 2017; Athalye et al., 2018).

Original: On the one hand, adversarial examples are named as such because they as able to trick a deep network using changes imperceptible to humans.
Revised: On the one hand, adversarial examples are named as such because they as able to trick a deep network using changes imperceptible to humans.

Original: On the other hand, the model makes predictions based on its internal representation (i.e. what the model perceives) which may be very different from human perception.
Revised: On the other hand, the model makes predictions based on its internal representation (i.e. what the model perceives) which may be very different from human perception.

Original: Indeed, the existence of adversarial examples is evidence that human perception and machine perception are misaligned, and the internal representation of a model and a human differ signiﬁcantly.
Revised: Indeed, the existence of adversarial examples is evidence that human perception and machine perception are misaligned, and the internal representation of a model and a human differ signiﬁcantly.

Original: The motivating question we would like to address is: are adversarial examples really adversarial examples from the model’s perspective?
Revised: The motivating question we would like to address is: are adversarial examples really adversarial examples from the model’s perspective?

Original: In order to get insight of this question, we extend an existing visualization technique from Dosovitskiy & Brox (2016b); Johnson et al.
Revised: In order to get insight of this question, we extend an existing visualization technique from Dosovitskiy & Brox (2016b); Johnson et al.

Original: ; Dosovitskiy & Brox (2016a), stacking a decoder head on top of the model’s latent representation with the aim of providing a human interpretable reconstruction, see Figure 1.
Revised: ; Dosovitskiy & Brox (2016a), stacking a decoder head on top of the model’s latent representation with the aim of providing a human interpretable reconstruction, see Figure 1.

Original: In particular, we train the decoder jointly with the network, terming the resultant objective function perceptual regularization .
Revised: In particular, we train the decoder jointly with the network, terming the resultant objective function perceptual regularization .

Original: A similar strategy has also been explored in Sabour et al.
Revised: A similar strategy has also been explored in Sabour et al.

Original: ; Qin et al.
Revised: ; Qin et al.

Original: for Capsule networks, and exploiting semi-supervised (unlabeled) data in Lasserre et al.
Revised: for Capsule networks, and exploiting semi-supervised (unlabeled) data in Lasserre et al.

Original: ; Grabner et al.
Revised: ; Grabner et al.

Original: ; Larochelle & Bengio (2008); Le et al.
Revised: ; Larochelle & Bengio (2008); Le et al.

Original: One of the key insights we bring in our work is that a simple decoder head term is all that is needed to yield signiﬁcant visual insight into a range of questions about the representations learned by deep networks.
Revised: One of the key insights we bring in our work is that a simple decoder head term is all that is needed to yield signiﬁcant visual insight into a range of questions about the representations learned by deep networks.

Original: Visualization is an active research area, with various standard techniques such as saliency maps
Revised: Visualization is an active research area, with various standard techniques such as saliency maps

Original: Simonyan et al.
Revised: Simonyan et al.

Original: (2014) among others Zeiler & Fergus (2014); Mahendran & Vedaldi (2015);
Revised: (2014) among others Zeiler & Fergus (2014); Mahendran & Vedaldi (2015);

Original: Springenberg et al.
Revised: Springenberg et al.

Original: ; Zhou et al.
Revised: ; Zhou et al.

Original: (2016) being used to visualize representations by inverting them.
Revised: (2016) being used to visualize representations by inverting them.

Original: However, reconstructing the original input from the representation is computationally expensive.
Revised: However, reconstructing the original input from the representation is computationally expensive.

Original: An alternative way is to introduce a forward decoder from latent space to image space, aiming to globally invert the representation.
Revised: An alternative way is to introduce a forward decoder from latent space to image space, aiming to globally invert the representation.

Original: This technique has been used in Dosovitskiy & Brox (2016b); Johnson et al.
Revised: This technique has been used in Dosovitskiy & Brox (2016b); Johnson et al.

Original: (2016); Dosovitskiy & Brox (2016a) and our method follows this line of work.
Revised: (2016); Dosovitskiy & Brox (2016a) and our method follows this line of work.

Original: The main contributions of this paper are:
Revised: The main contributions of this paper are:

Original: • Extending the existing visualization method as a regularization method for jointly learning a visualization for deep representations.
Revised: • Extending the existing visualization method as a regularization method for jointly learning a visualization for deep representations.

Original: • Using this method to visualize how the attention of a model focuses only on aspects that are relevant for prediction.
Revised: • Using this method to visualize how the attention of a model focuses only on aspects that are relevant for prediction.

Original: More generally we give promising evidence to suggest that our visualization method is of interest for model diagnostics and interpretability.
Revised: More generally we give promising evidence to suggest that our visualization method is of interest for model diagnostics and interpretability.

Original: • Using this visualization method to shed light on what effect adversarial attacks have on a model.
Revised: • Using this visualization method to shed light on what effect adversarial attacks have on a model.

Original: • Using adversarial attacks to identify direction vectors in the latent space that correspond to certain semantic features.
Revised: • Using adversarial attacks to identify direction vectors in the latent space that correspond to certain semantic features.

Original: We show that the decoder network can then be used to synthesize images with modiﬁed semantic features.
Revised: We show that the decoder network can then be used to synthesize images with modiﬁed semantic features.

Original:  P ERCEPTUAL REGULARIZATION
Revised:  P ERCEPTUAL REGULARIZATION

Original: We begin by introducing perceptual regularization.
Revised: We begin by introducing perceptual regularization.

Original: Consider a deep image classiﬁcation model such as AlexNet (Krizhevsky et al., 2012), VGG-Net (Simonyan & Zisserman, 2015), or ResNet (He et al., 2016).
Revised: Consider a deep image classiﬁcation model such as AlexNet (Krizhevsky et al., 2012), VGG-Net (Simonyan & Zisserman, 2015), or ResNet (He et al., 2016).

Original: It usually consists of two stages: several convolutional layers, followed by dense layers.
Revised: It usually consists of two stages: several convolutional layers, followed by dense layers.

Original: The convolution layers can be viewed as a feature extraction process which we denote by F , transforming images from the input space X into a latent space Z .
Revised: The convolution layers can be viewed as a feature extraction process which we denote by F , transforming images from the input space X into a latent space Z .

Original: The dense layers C :
Revised: The dense layers C :

Original: Z → Y act as a classiﬁer on the latent space.
Revised: Z → Y act as a classiﬁer on the latent space.

Original: In order to regularize and visualize the latent representation, we introduce a decoder D : Z → X on top of the latent space Z which we jointly train with the classiﬁcation model.
Revised: In order to regularize and visualize the latent representation, we introduce a decoder D : Z → X on top of the latent space Z which we jointly train with the classiﬁcation model.

Original: The architecture is shown in Figure 1.
Revised: The architecture is shown in Figure 1.

Original: More precisely, we denote the classiﬁcation model by H
Revised: More precisely, we denote the classiﬁcation model by H

Original: =
Revised: =

Original: C ◦ F and term the reconstruction
Revised: C ◦ F and term the reconstruction

Original: P =
Revised: P =

Original: D ◦ F a perception of the model.
Revised: D ◦ F a perception of the model.

Original: The regularization strategy we introduce is to jointly train H and P together by minimizing
Revised: The regularization strategy we introduce is to jointly train H and P together by minimizing

Original: [Equation]
Revised: [Equation]

Original: [Table]
Revised: [Table]

Original: The ﬁrst term is the standard classiﬁcation loss and we take (cid:96) to be the cross-entropy loss throughout the paper.
Revised: The ﬁrst term is the standard classiﬁcation loss and we take (cid:96) to be the cross-entropy loss throughout the paper.

Original: The regularization term is the (cid:96) 2 reconstruction loss scaled by a hyper-parameter λ > 0 .
Revised: The regularization term is the (cid:96) 2 reconstruction loss scaled by a hyper-parameter λ > 0 .

Original: Intuitively, the decoder tries to reconstruct the original image based on the same information the classiﬁer uses for prediction.
Revised: Intuitively, the decoder tries to reconstruct the original image based on the same information the classiﬁer uses for prediction.

Original: In particular, if the feature map F preserves all the information from the input, the perception should be able to perfectly recover X .
Revised: In particular, if the feature map F preserves all the information from the input, the perception should be able to perfectly recover X .

Original: Conversely, if a lot of information has been thrown away, then we will get a poor reconstruction and the regularization loss will be high.
Revised: Conversely, if a lot of information has been thrown away, then we will get a poor reconstruction and the regularization loss will be high.

Original: Therefore, our regularization biases the learned representation to maintain more information about the input compared to vanilla supervised learning.
Revised: Therefore, our regularization biases the learned representation to maintain more information about the input compared to vanilla supervised learning.

Original: This will be useful if one would like to reuse the learned features later for other tasks.
Revised: This will be useful if one would like to reuse the learned features later for other tasks.

Original: Notice that the regularization term vanishes when P is the identity mapping, in which case the feature map F is bijective.
Revised: Notice that the regularization term vanishes when P is the identity mapping, in which case the feature map F is bijective.

Original: This can happen when the model is very powerful and therefore able to memorize any dataset.
Revised: This can happen when the model is very powerful and therefore able to memorize any dataset.

Original: However, this situation is less interesting in the sense that a good representation should efﬁciently compress the information.
Revised: However, this situation is less interesting in the sense that a good representation should efﬁciently compress the information.

Original: This idea has been clearly understood with the information bottleneck objective, for which it is known that F ( X ) approximates the minimal sufﬁcient statistic for Y given X (Shamir et al., 2010).
Revised: This idea has been clearly understood with the information bottleneck objective, for which it is known that F ( X ) approximates the minimal sufﬁcient statistic for Y given X (Shamir et al., 2010).

Original: Therefore, to constrain the expressiveness of the feature map, we impose a bottleneck structure in the network architecture.
Revised: Therefore, to constrain the expressiveness of the feature map, we impose a bottleneck structure in the network architecture.

Original: More precisely, the dimension of the latent space Z is made signiﬁcantly smaller than the dimension of the input space X .
Revised: More precisely, the dimension of the latent space Z is made signiﬁcantly smaller than the dimension of the input space X .

Original: This enforces the feature map to compress information and makes it very unlikely to be bijective.
Revised: This enforces the feature map to compress information and makes it very unlikely to be bijective.

Original: As well as regularizing the model, perceptual regularization also provides a natural way to visualize the latent space.
Revised: As well as regularizing the model, perceptual regularization also provides a natural way to visualize the latent space.

Original: In particular, the perception P is designed to decode the feature map F , which is very useful for model understanding.
Revised: In particular, the perception P is designed to decode the feature map F , which is very useful for model understanding.

Original: In the next three sections we begin to explore the insights that can be drawn using perceptual regularization.
Revised: In the next three sections we begin to explore the insights that can be drawn using perceptual regularization.

Original:  V ISUALIZING FEATURES LEARNED BY A DEEP NETWORK
Revised:  V ISUALIZING FEATURES LEARNED BY A DEEP NETWORK

Original: Extensive research have been conducted on attention-based models in object recognition and image captioning Bahdanau et al.
Revised: Extensive research have been conducted on attention-based models in object recognition and image captioning Bahdanau et al.

Original: ; Karpathy & Fei-Fei (2015); Ba et al.
Revised: ; Karpathy & Fei-Fei (2015); Ba et al.

Original: ; Gregor et al.
Revised: ; Gregor et al.

Original: ; Xu et al. (2015); Jaderberg et al. (2015); He et al.
Revised: ; Xu et al. (2015); Jaderberg et al. (2015); He et al.

Original: (2017), where the attention mechanism is explicitly introduced as a spatial map highlighting image regions.
Revised: (2017), where the attention mechanism is explicitly introduced as a spatial map highlighting image regions.

Original: A second application of perceptual regularization is to visualize what a classiﬁer’s attention focuses on.
Revised: A second application of perceptual regularization is to visualize what a classiﬁer’s attention focuses on.

Original: In particular, if a model is trained to predict the object in the middle of an image, it is commonly believed that the learned representation “overﬁts” to the training task by focusing only on the central part of the image.
Revised: In particular, if a model is trained to predict the object in the middle of an image, it is commonly believed that the learned representation “overﬁts” to the training task by focusing only on the central part of the image.

Original: This can be a cause of negative transfer - when reusing a learned representation for a new task actually hurts performance (Pan & Yang, 2009; Kuzborskij & Orabona, 2013).
Revised: This can be a cause of negative transfer - when reusing a learned representation for a new task actually hurts performance (Pan & Yang, 2009; Kuzborskij & Orabona, 2013).

Original: We show our visualization method can help understand when a representation will cause negative transfer.
Revised: We show our visualization method can help understand when a representation will cause negative transfer.

Original: All experimental details, including architecture and hyper-parameters are given in full in the appendix.
Revised: All experimental details, including architecture and hyper-parameters are given in full in the appendix.

Original: 3. T HE ATTENTION PROBLEM
Revised: 3. T HE ATTENTION PROBLEM

Original: It has long been intuitively understood that the representations in the ﬁnal layers of a supervised deep network will only focus on aspects of the data relevant to its prediction task (Long et al., 2015;
Revised: It has long been intuitively understood that the representations in the ﬁnal layers of a supervised deep network will only focus on aspects of the data relevant to its prediction task (Long et al., 2015;

Original: Yosinski et al., 2014; Alain & Bengio, 2017).
Revised: Yosinski et al., 2014; Alain & Bengio, 2017).

Original: In this section we demonstrate on the SVHN dataset (Netzer et al., 2011) that this phenomenon of focused attention can be visualized using perceptual regularization.
Revised: In this section we demonstrate on the SVHN dataset (Netzer et al., 2011) that this phenomenon of focused attention can be visualized using perceptual regularization.

Original: The SVHN dataset consists of images of house numbers and the task is to predict the number in the center of the image.
Revised: The SVHN dataset consists of images of house numbers and the task is to predict the number in the center of the image.

Original: In particular, an image could contain multiple numbers but the label is given according to the middle one.
Revised: In particular, an image could contain multiple numbers but the label is given according to the middle one.

Original: A natural question is: will a supervised model learn a representation that remembers numbers that are not in the center?
Revised: A natural question is: will a supervised model learn a representation that remembers numbers that are not in the center?

Original: To answer this question, we train a CNN with perceptual regularization and then use perception to visualize the attention of the model, i.e. given any input X , we visualize P ( X ) .
Revised: To answer this question, we train a CNN with perceptual regularization and then use perception to visualize the attention of the model, i.e. given any input X , we visualize P ( X ) .

Original: As shown in Figure 2, our visualization technique shows that the model learns a representation that focuses on the middle of the image, and forgets what is at the edges of the image.
Revised: As shown in Figure 2, our visualization technique shows that the model learns a representation that focuses on the middle of the image, and forgets what is at the edges of the image.

Original: This provides additional evidence to support the observation that a supervised model learns a representation speciﬁc to its prediction task.
Revised: This provides additional evidence to support the observation that a supervised model learns a representation speciﬁc to its prediction task.

Original: This is ﬁne if there is only one task of interest, but makes transferring features between tasks problematic.
Revised: This is ﬁne if there is only one task of interest, but makes transferring features between tasks problematic.

Original: For example, in our case, the representation would be completely ineffective for identifying the digit on the left or right hand sides.
Revised: For example, in our case, the representation would be completely ineffective for identifying the digit on the left or right hand sides.

Original: 3. PERCEPTUAL REGULARIZATION TO CONTROL ATTENTION
Revised: 3. PERCEPTUAL REGULARIZATION TO CONTROL ATTENTION

Original: The cause of this restricted attention problem is the guidance given by the labels.
Revised: The cause of this restricted attention problem is the guidance given by the labels.

Original: In this section, we demonstrate that perceptual regularization can be useful to reduce the problem of overﬁtting learned features to the training task.
Revised: In this section, we demonstrate that perceptual regularization can be useful to reduce the problem of overﬁtting learned features to the training task.

Original: In particular, our method allows for a smooth interpolation between supervised learning and unsupervised learning.
Revised: In particular, our method allows for a smooth interpolation between supervised learning and unsupervised learning.

Original: In the extreme case, when λ → 0 , we recover
Revised: In the extreme case, when λ → 0 , we recover

Original: [Figure]
Revised: [Figure]

Original: the standard supervised learning setting, and when λ → ∞ we recover the classical auto-encoder objective.
Revised: the standard supervised learning setting, and when λ → ∞ we recover the classical auto-encoder objective.

Original: Hence, the parameter λ can control how much information we would like our model’s representation to keep.
Revised: Hence, the parameter λ can control how much information we would like our model’s representation to keep.

Original: We run experiments on the SVHN dataset by varying the regularization parameter λ .
Revised: We run experiments on the SVHN dataset by varying the regularization parameter λ .

Original: We keep the architecture ﬁxed (see Appendix B.3 for more details).
Revised: We keep the architecture ﬁxed (see Appendix B.3 for more details).

Original: Figure 3 shows different regimes of features for different values of λ .
Revised: Figure 3 shows different regimes of features for different values of λ .

Original: There are four main regimes:
Revised: There are four main regimes:

Original: • Tiny ( λ < 10 − 4 , Figure 3(a)): Since λ is extremely small the contribution to the loss from the decoder branch is so negligible that there is not much incentive to learn a good decoder and the visualization breaks down.
Revised: • Tiny ( λ < 10 − 4 , Figure 3(a)): Since λ is extremely small the contribution to the loss from the decoder branch is so negligible that there is not much incentive to learn a good decoder and the visualization breaks down.

Original: • Delicate ( 10 − 4 < λ <
Revised: • Delicate ( 10 − 4 < λ <

Original: 10 − 2 , Figure 3(b)):
Revised: 10 − 2 , Figure 3(b)):

Original: A good decoder is learned and the bias injected into the learned feature map by the regularization term is small.
Revised: A good decoder is learned and the bias injected into the learned feature map by the regularization term is small.

Original: The number in the center is well reconstructed, but the edges of the image are not and the colors are missing.
Revised: The number in the center is well reconstructed, but the edges of the image are not and the colors are missing.

Original: It is in this regime that we are able to see the restricted attention of a classiﬁer.
Revised: It is in this regime that we are able to see the restricted attention of a classiﬁer.

Original: • Intermediate ( 10 − 2 < λ < 1 , Figure 3(c)): We obtain more faithful reconstructions compared to the “delicate” regime.
Revised: • Intermediate ( 10 − 2 < λ < 1 , Figure 3(c)): We obtain more faithful reconstructions compared to the “delicate” regime.

Original: In particular, the numbers at the edges are reasonably reconstructed but colors are still not well captured.
Revised: In particular, the numbers at the edges are reasonably reconstructed but colors are still not well captured.

Original: • Large ( λ > 1 , Figure 3(d)):
Revised: • Large ( λ > 1 , Figure 3(d)):

Original: The decoder is very good, both numbers and colors are recovered.
Revised: The decoder is very good, both numbers and colors are recovered.

Original: The regularization has had a signiﬁcant effect on the nature of the learned features.
Revised: The regularization has had a signiﬁcant effect on the nature of the learned features.

Original: Since these features retain much more information than for smaller λ they are more likely to transfer well to new unseen tasks.
Revised: Since these features retain much more information than for smaller λ they are more likely to transfer well to new unseen tasks.

Original: Clearly the choice of λ heavily affects the features learned by the model.
Revised: Clearly the choice of λ heavily affects the features learned by the model.

Original: The larger λ is, the more information is preserved in the features: small values of λ only preserve the number in the middle of the image, intermediate values can also reconstruct the boundary of the image, and only for large λ is the input’s precise color correctly reconstructed.
Revised: The larger λ is, the more information is preserved in the features: small values of λ only preserve the number in the middle of the image, intermediate values can also reconstruct the boundary of the image, and only for large λ is the input’s precise color correctly reconstructed.

Original: It is also important to note that the accuracy on the supervised task decreases as λ increases, but at a relatively slow rate.
Revised: It is also important to note that the accuracy on the supervised task decreases as λ increases, but at a relatively slow rate.

Original: This is to be expected.
Revised: This is to be expected.

Original: In the limit λ → ∞ there is no longer any incentive to perform good classiﬁcation, only reconstruction.
Revised: In the limit λ → ∞ there is no longer any incentive to perform good classiﬁcation, only reconstruction.

Original: An interesting future direction will be to understand why certain features are harder to learn than others, for instance, in our example why the color is recovered later than numbers along the edges.
Revised: An interesting future direction will be to understand why certain features are harder to learn than others, for instance, in our example why the color is recovered later than numbers along the edges.

Original: It is important to note that perceptual regularization introduces an inductive bias towards learning representations that retain a lot of information about the original input, which are different from what is learned without it.
Revised: It is important to note that perceptual regularization introduces an inductive bias towards learning representations that retain a lot of information about the original input, which are different from what is learned without it.

Original: If one wanted to avoid this bias then one idea is to learn the feature map ﬁrst, then learn the visualization decoder separately, with the feature map frozen.
Revised: If one wanted to avoid this bias then one idea is to learn the feature map ﬁrst, then learn the visualization decoder separately, with the feature map frozen.

Original: This strategy works reasonably well when the network’s size is small.
Revised: This strategy works reasonably well when the network’s size is small.

Original: But, as the network gets more complicated it becomes computationally difﬁcult to decode the feature map.
Revised: But, as the network gets more complicated it becomes computationally difﬁcult to decode the feature map.

Original: Hence, as an alternative solution, we train the decoder jointly with the feature map.
Revised: Hence, as an alternative solution, we train the decoder jointly with the feature map.

Original: What we have shown is that although the bias induced by the regularization is an apparent drawback, it can in fact be turned into a strength by using λ to control the behavior of the feature map.
Revised: What we have shown is that although the bias induced by the regularization is an apparent drawback, it can in fact be turned into a strength by using λ to control the behavior of the feature map.

Original: Finally, the speciﬁc values of λ quoted are meant only to serve as a very rough guide about trends.
Revised: Finally, the speciﬁc values of λ quoted are meant only to serve as a very rough guide about trends.

Original: Making the magnitude of the reconstruction loss and classiﬁcation loss comparable is often effective to locate the “delicate” λ .
Revised: Making the magnitude of the reconstruction loss and classiﬁcation loss comparable is often effective to locate the “delicate” λ .

Original:  H OW DO ADVERSARIAL ATTACKS AFFECT A CLASSIFIER ’ S PERCEPTION ?
Revised:  H OW DO ADVERSARIAL ATTACKS AFFECT A CLASSIFIER ’ S PERCEPTION ?

Original: Having illustrated how the decoder network can be used to study the information content of a learned representation, we now turn our attention to adversarial examples.
Revised: Having illustrated how the decoder network can be used to study the information content of a learned representation, we now turn our attention to adversarial examples.

Original: Adversarial examples can seem quite mysterious, and point to a way in which human and machine perceptions are misaligned (Han et al., 2019; Engstrom et al., 2019).
Revised: Adversarial examples can seem quite mysterious, and point to a way in which human and machine perceptions are misaligned (Han et al., 2019; Engstrom et al., 2019).

Original: While intuitively reasonable, understanding of this phenomenon has been limited by the difﬁculty of observing the effect of adversarial attacks on the internal representation of a model (Zhang & Zhu, 2018;
Revised: While intuitively reasonable, understanding of this phenomenon has been limited by the difﬁculty of observing the effect of adversarial attacks on the internal representation of a model (Zhang & Zhu, 2018;

Original: Olah et al., 2018).
Revised: Olah et al., 2018).

Original: In this section we explore the ﬁrst application of our perceptual regularization: to provide human understandable visualizations of a model’s internal representation of adversarial examples.
Revised: In this section we explore the ﬁrst application of our perceptual regularization: to provide human understandable visualizations of a model’s internal representation of adversarial examples.

Original: First, we brieﬂy recap how adversarial examples are obtained.
Revised: First, we brieﬂy recap how adversarial examples are obtained.

Original: Given a classiﬁcation model H and a sample ( X, Y ) , we aim to fool the model’s prediction by slightly perturbing the input X .
Revised: Given a classiﬁcation model H and a sample ( X, Y ) , we aim to fool the model’s prediction by slightly perturbing the input X .

Original: We constrain the perturbation to be in a small neighborhood ∆( X ) of X , which is usually deﬁned as an (cid:96) p ball.
Revised: We constrain the perturbation to be in a small neighborhood ∆( X ) of X , which is usually deﬁned as an (cid:96) p ball.

Original: Speciﬁcally, we look for
Revised: Speciﬁcally, we look for

Original: [Equation]
Revised: [Equation]

Original: While many different strategies have been proposed to adversarially attack the model (Goodfellow et al., 2015; Moosavi-Dezfooli et al., 2016; Kurakin et al., 2017; Athalye et al., 2018), we focus on the projected gradient descent (PGD) attack (Madry et al., 2017) throughout this paper.
Revised: While many different strategies have been proposed to adversarially attack the model (Goodfellow et al., 2015; Moosavi-Dezfooli et al., 2016; Kurakin et al., 2017; Athalye et al., 2018), we focus on the projected gradient descent (PGD) attack (Madry et al., 2017) throughout this paper.

Original: Speciﬁcally, we set ∆( X ) to be an (cid:96) ∞ ball and the adversarial example X adv is obtained by performing 100 iterations of PGD attack.
Revised: Speciﬁcally, we set ∆( X ) to be an (cid:96) ∞ ball and the adversarial example X adv is obtained by performing 100 iterations of PGD attack.

Original: An example of an adversarial attacks can be found in the ﬁrst row of Figures 4.
Revised: An example of an adversarial attacks can be found in the ﬁrst row of Figures 4.

Original: All experimental details, including architecture and hyper-parameters are given in full in the appendix.
Revised: All experimental details, including architecture and hyper-parameters are given in full in the appendix.

Original: [Figure]
Revised: [Figure]

Original: By design, adversarial examples are hard to distinguish from the original image with human perception.
Revised: By design, adversarial examples are hard to distinguish from the original image with human perception.

Original: The perceptual regularization architecture gives a classiﬁer, and a separate branch that reconstructs the original image.
Revised: The perceptual regularization architecture gives a classiﬁer, and a separate branch that reconstructs the original image.

Original: We adversarially attack the classiﬁcation branch H
Revised: We adversarially attack the classiﬁcation branch H

Original: =
Revised: =

Original: C ◦ F using (1) to obtain X adv .
Revised: C ◦ F using (1) to obtain X adv .

Original: If, instead of viewing X and X adv , we look at the model’s perception of each image P ( X ) and P ( X adv ) , a clear disparity emerges between how the model understands the two examples.
Revised: If, instead of viewing X and X adv , we look at the model’s perception of each image P ( X ) and P ( X adv ) , a clear disparity emerges between how the model understands the two examples.

Original: What is extremely striking is that the model’s perception and incorrect classiﬁcation are semantically consistent to the human eye.
Revised: What is extremely striking is that the model’s perception and incorrect classiﬁcation are semantically consistent to the human eye.

Original: Put simply: when the model misclassiﬁes an image of a female as male, the perception of the adversarial image really looks like a male to a human , as shown in Figure 4; when the model misclassiﬁes an image of a smiling face as not smiling, the perception of the adversarial image really looks like it is not smiling , as shown in Figure 5.
Revised: Put simply: when the model misclassiﬁes an image of a female as male, the perception of the adversarial image really looks like a male to a human , as shown in Figure 4; when the model misclassiﬁes an image of a smiling face as not smiling, the perception of the adversarial image really looks like it is not smiling , as shown in Figure 5.

Original: We provide further experiments of our method on the MNIST (LeCun et al., 1998) and CelebA (Liu et al., 2015) datasets.
Revised: We provide further experiments of our method on the MNIST (LeCun et al., 1998) and CelebA (Liu et al., 2015) datasets.

Original: Our perception decoder allows one to visualize the effect of an adversarial attack on a deep network’s representation.
Revised: Our perception decoder allows one to visualize the effect of an adversarial attack on a deep network’s representation.

Original: For CelebA we train three different classiﬁers for three different binary classiﬁcation tasks (Eyeglasses/Smiling/Gender).
Revised: For CelebA we train three different classiﬁers for three different binary classiﬁcation tasks (Eyeglasses/Smiling/Gender).

Original: All experiments support the same observations made in this section.
Revised: All experiments support the same observations made in this section.

Original: See the appendix for many more examples.
Revised: See the appendix for many more examples.

Original: [Figure]
Revised: [Figure]

Original: This shows that given the model’s feature representation, it is making a prediction that appears reasonable on adversarial images.
Revised: This shows that given the model’s feature representation, it is making a prediction that appears reasonable on adversarial images.

Original: In other words, the representation learned by the model is very different from human perception.
Revised: In other words, the representation learned by the model is very different from human perception.

Original: It is also interesting that the images obtained from perception (Figure 5, in the second row of Figure 4, ) are simultaneously close to each other and yet highly distinguishable in the characteristics most important for prediction.
Revised: It is also interesting that the images obtained from perception (Figure 5, in the second row of Figure 4, ) are simultaneously close to each other and yet highly distinguishable in the characteristics most important for prediction.

Original: This gives interesting visual insight into the way in which adversarial attacks ﬁnd a short path to a decision boundary.
Revised: This gives interesting visual insight into the way in which adversarial attacks ﬁnd a short path to a decision boundary.

Original: For example,
Revised: For example,

Original: Figure 4 has several subtle modiﬁcations: lighter eyes, squarer forehead and jaw, thicker nose.
Revised: Figure 4 has several subtle modiﬁcations: lighter eyes, squarer forehead and jaw, thicker nose.

Original: The changes are very targeted, capturing the essence of the global feature.
Revised: The changes are very targeted, capturing the essence of the global feature.

Original: This begs the question: can adversarial attacks be used to identify and modify high-level features?
Revised: This begs the question: can adversarial attacks be used to identify and modify high-level features?

Original: Global features are high level human-interpretable features such as, “wearing glasses”, “is smiling”, or “is female”).
Revised: Global features are high level human-interpretable features such as, “wearing glasses”, “is smiling”, or “is female”).

Original: There has been much previous work on learning disentangled representations for which the latent variables correspond to disentangled human-interpretable features (Tenenbaum &
Revised: There has been much previous work on learning disentangled representations for which the latent variables correspond to disentangled human-interpretable features (Tenenbaum &

Original: Freeman, 2000; Chen et al., 2016; Higgins et al., 2017).
Revised: Freeman, 2000; Chen et al., 2016; Higgins et al., 2017).

Original: To then modify a given global feature one needs to ﬁgure out which latent feature (or which combination) to adjust.
Revised: To then modify a given global feature one needs to ﬁgure out which latent feature (or which combination) to adjust.

Original: However, the task of ﬁnding the “correct” latent direction is non-trivial.
Revised: However, the task of ﬁnding the “correct” latent direction is non-trivial.

Original:  A DVERSARIAL ATTACKS FOR LATENT SPACE INTERPOLATION
Revised:  A DVERSARIAL ATTACKS FOR LATENT SPACE INTERPOLATION

Original: Our visualization method yields a novel way for ﬁnding directions in latent space corresponding to a given global feature.
Revised: Our visualization method yields a novel way for ﬁnding directions in latent space corresponding to a given global feature.

Original: Traditional approach applying generative adversarial network such as Radford et al.
Revised: Traditional approach applying generative adversarial network such as Radford et al.

Original: ; Karras et al.
Revised: ; Karras et al.

Original: (2019) involve signiﬁcant manual effort to identify which latent direction corresponds to a given semantic feature.
Revised: (2019) involve signiﬁcant manual effort to identify which latent direction corresponds to a given semantic feature.

Original: Our method provide a more straightforward way to obtain this direction by performing adversarial attacks.
Revised: Our method provide a more straightforward way to obtain this direction by performing adversarial attacks.

Original: The recipe is as follows:
Revised: The recipe is as follows:

Original: • Train a model with perceptual regularization, •
Revised: • Train a model with perceptual regularization, •

Original: Given X , obtain X adv by performing an adversarial attack toward the target label (e
Revised: Given X , obtain X adv by performing an adversarial attack toward the target label (e

Original: g. smiling/wear eyeglasses), • The latent space direction corresponding to this global feature is Z = F ( X adv ) − F ( X ) , • Synthesize images with adjusted global feature C ( F ( X ) + αZ ) for some α .
Revised: g. smiling/wear eyeglasses), • The latent space direction corresponding to this global feature is Z = F ( X adv ) − F ( X ) , • Synthesize images with adjusted global feature C ( F ( X ) + αZ ) for some α .

Original: Larger values of α will make larger adjustments to the global feature.
Revised: Larger values of α will make larger adjustments to the global feature.

Original: Figures 4 and 5 give simple examples of this for α = 1 .
Revised: Figures 4 and 5 give simple examples of this for α = 1 .

Original: Figure 6 shows images synthesized by following a linear path through latent space for a range of values of α ∈ [0 , 2] .
Revised: Figure 6 shows images synthesized by following a linear path through latent space for a range of values of α ∈ [0 , 2] .

Original: The results show that our technique allows precise modiﬁcation of the target global feature, leaving other aspects of the image unaltered.
Revised: The results show that our technique allows precise modiﬁcation of the target global feature, leaving other aspects of the image unaltered.

Original: We believe it is possible to obtain more realistic images using recent progress on GANs, but we leave this for future work.
Revised: We believe it is possible to obtain more realistic images using recent progress on GANs, but we leave this for future work.

Original: Finally, we stress that our method requires labeled data while GANs do not.
Revised: Finally, we stress that our method requires labeled data while GANs do not.

Original: However, in situations where one has labeled data, our method provides a promising alternative since it does not require human intervention.
Revised: However, in situations where one has labeled data, our method provides a promising alternative since it does not require human intervention.

Original:  D ISCUSSION AND CONCLUDING REMARKS
Revised:  D ISCUSSION AND CONCLUDING REMARKS

Original: In this paper we introduced perceptual regularization , a method for visualizing representations and show that it can be used for a variety of purposes including: assessing the informational content of a representation, visualizing the effect of adversarial attacks on the latent representation, and identifying semantically meaningful latent space direction vectors.
Revised: In this paper we introduced perceptual regularization , a method for visualizing representations and show that it can be used for a variety of purposes including: assessing the informational content of a representation, visualizing the effect of adversarial attacks on the latent representation, and identifying semantically meaningful latent space direction vectors.

Original: To achieve this, our method combines a generative and discriminative model.
Revised: To achieve this, our method combines a generative and discriminative model.

Original: There has been previous work on the idea of combining generative and discriminative models (Lasserre et al., 2006; Grabner et al., 2007; Larochelle &
Revised: There has been previous work on the idea of combining generative and discriminative models (Lasserre et al., 2006; Grabner et al., 2007; Larochelle &

Original: Bengio, 2008; Le et al., 2018), however these works have focused on the idea of using such a model to exploit semi-supervised (unlabeled) data.
Revised: Bengio, 2008; Le et al., 2018), however these works have focused on the idea of using such a model to exploit semi-supervised (unlabeled) data.

Original: To the best of our knowledge our work is the ﬁrst to identify the generative plus discriminative formulation as an effective method for practical, visual appraisal of the representation learned by a model.
Revised: To the best of our knowledge our work is the ﬁrst to identify the generative plus discriminative formulation as an effective method for practical, visual appraisal of the representation learned by a model.

Original: We use this visualization to understand adversarial examples and study the attention of a model.
Revised: We use this visualization to understand adversarial examples and study the attention of a model.

Original: We also identify this formulation as suitable for learning representations that are effective on previously unseen tasks.
Revised: We also identify this formulation as suitable for learning representations that are effective on previously unseen tasks.

Original: In this work we made the choice to consider the (cid:96) 2 loss as a metric between images.
Revised: In this work we made the choice to consider the (cid:96) 2 loss as a metric between images.

Original: However, the speciﬁc nature of the injected bias is particular to (cid:96) 2 : it permits lots of small errors, but penalizes large differences severely.
Revised: However, the speciﬁc nature of the injected bias is particular to (cid:96) 2 : it permits lots of small errors, but penalizes large differences severely.

Original: It would be an interesting future direction to consider different metrics and consider what kind of representations are learned by regularizing with different generative model objectives such as GANs, VAEs, or InfoMAX (Goodfellow et al., 2014; Kingma & Welling, 2014;
Revised: It would be an interesting future direction to consider different metrics and consider what kind of representations are learned by regularizing with different generative model objectives such as GANs, VAEs, or InfoMAX (Goodfellow et al., 2014; Kingma & Welling, 2014;

Original: Hjelm et al., 2019).
Revised: Hjelm et al., 2019).

Original: Another interesting question is to understand what conditions are necessary to obtain good visualizations.
Revised: Another interesting question is to understand what conditions are necessary to obtain good visualizations.

Original: We identify two possible factors.
Revised: We identify two possible factors.

Original: First: model complexity.
Revised: First: model complexity.

Original: As the task becomes more challenging we may need a more powerful decoder and reﬁned training strategy (e.g. applying methods from the GAN literature).
Revised: As the task becomes more challenging we may need a more powerful decoder and reﬁned training strategy (e.g. applying methods from the GAN literature).

Original: Second: human meaningful features.
Revised: Second: human meaningful features.

Original: There has been work suggesting that more complicated datasets have small but highly predictive features that humans do not notice (Tsipras et al., 2018).
Revised: There has been work suggesting that more complicated datasets have small but highly predictive features that humans do not notice (Tsipras et al., 2018).

Original: The model may learn to use these features for prediction.
Revised: The model may learn to use these features for prediction.

Original: In this case our visualizations may also not be human meaningful.
Revised: In this case our visualizations may also not be human meaningful.

Original: Nevertheless, our visualization method could be a useful certiﬁcate for whether the model learns human meaningful features.
Revised: Nevertheless, our visualization method could be a useful certiﬁcate for whether the model learns human meaningful features.

Original: This raises the question of how to learn robust features that generalize across multiple tasks.
Revised: This raises the question of how to learn robust features that generalize across multiple tasks.

Original: There is evidence suggesting adversarial training may help learn more “human-aligned” features.
Revised: There is evidence suggesting adversarial training may help learn more “human-aligned” features.

Original: But so far work on adversarial training has mainly focused on supervised learning.
Revised: But so far work on adversarial training has mainly focused on supervised learning.

Original: We suspect that this will not be sufﬁcient to learn transferrable features.
Revised: We suspect that this will not be sufﬁcient to learn transferrable features.

Original: It would be an interesting next step to combine perception regularization with adversarial training.
Revised: It would be an interesting next step to combine perception regularization with adversarial training.

Original: Our visualizations raise a broader point about the supervised learning paradigm: models insist on pigeon-holing every input into one of a ﬁxed number of classes, no matter how out of sample the input is.
Revised: Our visualizations raise a broader point about the supervised learning paradigm: models insist on pigeon-holing every input into one of a ﬁxed number of classes, no matter how out of sample the input is.

Original: Consider the following toy example: taking X to be random noise and computing the adversarial attack X adv for a model H trained on MNIST, then P ( X adv ) looks like a digit to the human eye (see
Revised: Consider the following toy example: taking X to be random noise and computing the adversarial attack X adv for a model H trained on MNIST, then P ( X adv ) looks like a digit to the human eye (see

Original: Figure 7).
Revised: Figure 7).

Original: This is undesirable and it is not sufﬁcient to simply add an 11 th “other” class.
Revised: This is undesirable and it is not sufﬁcient to simply add an 11 th “other” class.

Original: This is a long way from the dynamic way that humans create and learn new classes of objects.
Revised: This is a long way from the dynamic way that humans create and learn new classes of objects.

Original: To conclude, we have shown that perceptual regularization is a promising approach to answering many important questions in machine learning.
Revised: To conclude, we have shown that perceptual regularization is a promising approach to answering many important questions in machine learning.

Original: However we believe this is just the beginning, and view perceptual regularization as a broadly useful tool for model diagnostics with many more uses to be uncovered in the future.
Revised: However we believe this is just the beginning, and view perceptual regularization as a broadly useful tool for model diagnostics with many more uses to be uncovered in the future.

Original: A A DDITIONAL IMAGES ON ADVERSARIAL EXAMPLES
Revised: A A DDITIONAL IMAGES ON ADVERSARIAL EXAMPLES

Original: [Figure]
Revised: [Figure]

Original: [Figure] 
Revised: [Figure] [Figure] [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Revised: A.

Original: [Figure]
Revised: [Figure]

Revised: OME

Original: [Figure]
Revised: [Figure]

Revised: CASES

Original: [Figure]
Revised: [Figure]

Original: B A RCHITECTURE D ETAILS B. E XPERIMENTAL SETTING ON C ELEB A
Revised: B A RCHITECTURE D ETAILS B. E XPERIMENTAL SETTING ON C ELEB A

Original: For the CelebA experiments, we resize the images to 64 × 64 and we subsample the dataset to obtain a relatively balanced dataset on the labels we are considering : Eyeglasses/Smile/Gender.
Revised: For the CelebA experiments, we resize the images to 64 × 64 and we subsample the dataset to obtain a relatively balanced dataset on the labels we are considering : Eyeglasses/Smile/Gender.

Original: The statistics of the training set and testing set are as follows:
Revised: The statistics of the training set and testing set are as follows:

Original: Size
Revised: Size

Original: Eyeglasses
Revised: Eyeglasses

Original: Smile
Revised: Smile

Original: Gender
Revised: Gender

Original: Training Set 50% [Figure] [Figure]
Revised: Training Set 50% 44.72% 59.60%

Original: Test Set 
Revised: Test Set 50%

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: We use Adam optimizer (Kingma & Ba, 2015) with β = (0 . 9 , 0 . 999) , learning rate 10 − 3 in the ﬁrst 20 iterations and 10 − 4 for later iterations.
Revised: We use Adam optimizer (Kingma & Ba, 2015) with β = (0 . 9 , 0 . 999) , learning rate 10 − 3 in the ﬁrst 20 iterations and 10 − 4 for later iterations.

Original: No data augmentation is used.
Revised: No data augmentation is used.

Original: The architecture used in the perception regularization is similar to the one from DCGAN (Radford et al., 2016).
Revised: The architecture used in the perception regularization is similar to the one from DCGAN (Radford et al., 2016).

Original: The detailed architecture is as follows:
Revised: The detailed architecture is as follows:

Original: Input: RGB image x ∈ R 3 × 64 ×4 × 4 conv.
Revised: Input: RGB image x ∈ R 3 × 64 ×4 × 4 conv.

Original: 128 ch , ReLU, stride 2, padding4 × 4 conv.
Revised: 128 ch , ReLU, stride 2, padding4 × 4 conv.

Original: 256 ch , ReLU, stride 2, padding4 × 4 conv.
Revised: 256 ch , ReLU, stride 2, padding4 × 4 conv.

Original: 512 ch , ReLU, stride 2, padding4 × 4 conv.
Revised: 512 ch , ReLU, stride 2, padding 4 × 4 conv.

Original: 1024 ch , ReLU, stride 2, padding4 × 4 conv.
Revised: 1024 ch , ReLU, stride 2, padding4 × 4 conv.

Original: 128 ch , ReLU, stride 1, paddingOutput: latent vector z ∈ R
Revised: 128 ch , ReLU, stride 1, paddingOutput: latent vector z ∈ R

Original: (a)
Revised: (a)

Original: Feature
Revised: Feature

Original: Map F
Revised: Map F

Original: Input: latent vector z ∈ R4 × 4 deconv.
Revised: Input: latent vector z ∈ R 4 × 4 deconv.

Original: 128 ch → 1024 ch , ReLU, stride 1, padding4 × 4 deconv.
Revised: 128 ch → 1024 ch , ReLU, stride 1, padding4 × 4 deconv.

Original: 1024 ch → 512 ch , ReLU, stride 2, padding4 × 4 deconv. 512 ch → 256 ch , ReLU, stride 2, padding4 × 4 deconv.
Revised: 1024 ch → 512 ch , ReLU, stride 2, padding4 × 4 deconv. 512 ch → 256 ch , ReLU, stride 2, padding4 × 4 deconv.

Original: 256 ch → 128 ch , ReLU, stride 2, padding4 × 4 deconv.
Revised: 256 ch → 128 ch , ReLU, stride 2, padding4 × 4 deconv.

Original: 128 ch → 3 ch , ReLU, stride 2, padding
Revised: 128 ch → 3 ch , ReLU, stride 2, padding

Original: Sigmoid
Revised: Sigmoid

Original: Output: RGB image reconstruction x (cid:48)
Revised: Output: RGB image reconstruction x (cid:48)

Original: ∈ R 3 × 64 ×(b) Decode D
Revised: ∈ R 3 × 64 ×(b) Decode D

Original: Input: latent vector z ∈ R
Revised: Input: latent vector z ∈ R

Original: Fully connected 128 → 256 , ReLU,
Revised: Fully connected 128 → 256 , ReLU,

Original: Linear 256 →
Revised: Linear 256 →

Original: Output: prediction y ∈ R 2 .
Revised: Output: prediction y ∈ R 2 .

Original: (c) Classiﬁer C
Revised: (c) Classiﬁer C

Original: B. E XPERIMENTAL SETTING ON MNIST
Revised: B. E XPERIMENTAL SETTING ON MNIST

Original: For training the perceptual regularization, we perform 20 iterations of Adam optimizer (Kingma &
Revised: For training the perceptual regularization, we perform 20 iterations of Adam optimizer (Kingma &

Original: Ba, 2015) with β = (0 . 9 , 0 . 999) and learning rate 10 − 3 .
Revised: Ba, 2015) with β = (0 . 9 , 0 . 999) and learning rate 10 − 3 .

Original: No data augmentation is used.
Revised: No data augmentation is used.

Original: Input: Greyscale image x ∈ R [Table] × 28 ×4 × 4 conv.
Revised: Input: Greyscale image x ∈ R 1 × 28 ×4 × 4 conv.

Original: 16 ch , ReLU, stride 2, padding4 × 4 conv. 16 ch , ReLU, stride 2, padding4 × 4 conv.
Revised: 16 ch , ReLU, stride 2, padding4 × 4 conv. 16 ch , ReLU, stride 2, padding4 × 4 conv.

Original: 32 ch , ReLU, [Table] 1, padding4 × 4 conv.
Revised: 32 ch , ReLU, stride 1, padding4 × 4 conv.

Original: 32 ch , ReLU, stride 1, padding
Revised: 32 ch , ReLU, stride 1, padding

Original: [Table] [Table]
Revised: Output [Table]

Original: [Table]
Revised: [Table]

Original:  F
Revised: Feature Map F

Original: [Table] [Table]
Revised: [Table] [Table]

Original: padding
Revised: padding

Original: [Table] [Table]
Revised: [Table] [Table]

Revised: deconv.

Original: 32 ch
Revised: 32 ch

Original: [Table]
Revised: [Table]

Revised: 16 ch

Original: [Table]
Revised: [Table]

Original: padding
Revised: padding

Original: [Table]
Revised: [Table]

Revised: deconv

Revised: [Table]

Revised: [Table]

Original: Sigmoid
Revised: Sigmoid

Original: [Table]
Revised: [Table]

Original: Fully connected
Revised: Fully connected

Original: [Table] [Table]
Revised: [Table] [Table]

Original: ReLU,
Revised: ReLU,

Original: Linear 64 →
Revised: Linear 64 →

Revised: Output

Original: [Table]
Revised: [Table]

Original: prediction
Revised: prediction

Original: [Table]
Revised: [Table]

Original: [Table]

Original: ) Classiﬁer C
Revised: (f) Classiﬁer C

Original: B. E XPERIMENTAL SETTING ON SVHN
Revised: B. E XPERIMENTAL SETTING ON SVHN

Original: For the SVHN experiments, the inputs are RGB images of size 32 × 32 .
Revised: For the SVHN experiments, the inputs are RGB images of size 32 × 32 .

Original: No data augmentation is used.
Revised: No data augmentation is used.

Original: Our architecture for the perception regularization is as follows:
Revised: Our architecture for the perception regularization is as follows:

Original: Input
Revised: Input

Original: [Table]
Revised: [Table]

Original: x
Revised: x

Original: [Table]
Revised: [Table]

Original: 3 × 32 ×4 × 4 conv.
Revised: 3 × 32 ×4 × 4 conv.

Original: 16 ch , ReLU, stride 2, padding4 × 4 conv.
Revised: 16 ch , ReLU, stride 2, padding4 × 4 conv.

Original: 32 ch , ReLU, stride 2, padding4 × 4 conv.
Revised: 32 ch , ReLU, stride 2, padding4 × 4 conv.

Original: 64 ch , ReLU,
Revised: 64 ch , [Table]

Original: [Table]
Revised: [Table]

Original: 2, padding
Revised: 2, padding

Original: [Table]
Revised: [Table]

Original: 4 conv.
Revised: 4 conv.

Original: 64 ch
Revised: 64 ch

Original: [Table]
Revised: [Table]

Original: [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: 128 ch →
Revised: 128 ch →

Original: [Table]
Revised: [Table]

Original: 4 × 4 deconv.
Revised: 4 × 4 deconv.

Original: 64 ch →
Revised: 64 ch →

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table]
Revised: [Table]

Original: 4 × 4 deconv.
Revised: 4 × 4 deconv.

Original: 32 ch →
Revised: 32 ch →

Original: [Table]
Revised: [Table]

Original: ReLU
Revised: ReLU

Original: [Table] [Table]
Revised: [Table] [Table]

Original: 4 × 4 deconv.
Revised: 4 × 4 deconv.

Original: 16 ch → 3 ch
Revised: 16 ch → 3 ch

Original: [Table]
Revised: [Table]

Original: ReLU

Original: [Table]

Original: [Table]
Revised: [Table]

Original: padding
Revised: padding

Original: [Table]
Revised: [Table]

Original: Fully connected 64 →
Revised: Fully connected 64 →

Original: [Table]
Revised: [Table]

Original: ReLU,
Revised: ReLU,

Original: Linear
Revised: Linear

Original: [Table]
Revised: [Table]

Original: [Table] [Table]
Revised: [Table] [Table]