Question: Represent the text to find a very short summary (1-2 sentences max)

Question: This paper presents a novel two-step approach for the fundamental problem of learning an optimal map from one distribution to another. First, we learn an optimal transport (OT) plan, which can be thought as a one-to-many map between the two distributions. To that end, we propose a stochastic dual approach of regularized OT, and show empirically that it scales better than a recent related approach when the amount of samples is very large. Second, we estimate a Monge map as a deep neural network learned by approximating the barycentric projection of the previously-obtained OT plan. This parameterization allows generalization of the mapping outside the support of the input measure. We prove two theoretical stability of regularized OT which show that our estimations converge to the OT and Monge map between the underlying continuous measures. We showcase our proposed approach on two applications: domain adaptation and generative modeling. Mapping one distribution to another Given two random variables X and Y taking values in X and Y respectively, the problem of finding a map f such that f (X) and Y have the same distribution, denoted f (X) ∼ Y henceforth, finds applications in many areas. For instance, in domain adaptation, given a source dataset and a target dataset with different distributions, the use of a mapping to align the source and target distributions is a natural formulation BID22 since theory has shown that generalization depends on the similarity between the two distributions BID2. Current state-of-the-art methods for computing generative models such as generative adversarial networks BID21, generative moments matching networks BID26 or variational auto encoders BID24 ) also rely on finding f such that f (X) ∼ Y. In this setting, the latent variable X is often chosen as a continuous random variable, such as a Gaussian distribution, and Y is a discrete distribution of real data, e.g. the ImageNet dataset. By learning a map f, sampling from the generative model boils down to simply drawing a sample from X and then applying f to that sample. Mapping with optimality Among the potentially many maps f verifying f (X) ∼ Y, it may be of interest to find a map which satisfies some optimality criterion. Given a cost of moving mass from one point to another, one would naturally look for a map which minimizes the total cost of transporting the mass from X to Y. This is the original formulation of Monge, which initiated the development of the optimal transport (OT) theory. Such optimal maps can be useful in numerous applications such as color transfer BID17, shape matching BID46, data assimilation BID37, or Bayesian inference BID31. In small dimension and for some specific costs, multi-scale approaches BID28 or dynamic formulations BID16 BID3 BID44 can be used to compute optimal maps, but these approaches become intractable in higher dimension as they are based on space discretization. Furthermore, maps veryfiying f (X) ∼ Y might not exist, for instance when X is a constant but not Y. Still, one would like to find optimal maps between distributions at least approximately. The modern approach to OT relaxes the Monge problem by optimizing over plans, i.e. distributions over the product space X × Y, rather than maps, casting the OT problem as a linear program which is always feasible and easier to solve. However, even with specialized algorithms such as the network simplex, solving that linear program takes O(n 3 log n) time, where n is the size of the discrete distribution (measure) support. Large-scale OT Recently, BID14 showed that introducing entropic regularization into the OT problem turns its dual into an easier optimization problem which can be solved using the Sinkhorn algorithm. However, the Sinkhorn algorithm does not scale well to measures supported on a large number of samples, since each of its iterations has an O(n 2) complexity. In addition, the Sinkhorn algorithm cannot handle continuous probability measures. To address these issues, two recent works proposed to optimize variations of the dual OT problem through stochastic gradient methods. BID20 proposed to optimize a "semi-dual" objective function. However, their approach still requires O(n) operations per iteration and hence only scales moderately w.r.t. the size of the input measures. BID1 proposed a formulation that is specific to the so-called 1-Wasserstein distance (unregularized OT using the Euclidean distance as a cost function). This formulation has a simpler dual form with a single variable which can be parameterized as a neural network. This approach scales better to very large datasets and handles continuous measures, enabling the use of OT as a loss for learning a generative model. However, a drawback of that formulation is that the dual variable has to satisfy the non-trivial constraint of being a Lipschitz function. As a workaround, BID1 proposed to use weight clipping between updates of the neural network parameters. However, this makes unclear whether the learned generative model is truly optimized in an OT sense. Besides these limitations, these works only focus on the computation of the OT objective and do not address the problem of finding an optimal map between two distributions. We present a novel two-step approach for learning an optimal map f that satisfies f (X) ∼ Y. First, we compute an optimal transport plan, which can be thought as a one-to-many map between the two distributions. To that end, we propose a new simple dual stochastic gradient algorithm for solving regularized OT which scales well with the size of the input measures. We provide numerical evidence that our approach converges faster than semi-dual approaches considered in BID20. Second, we learn an optimal map (also referred to as a Monge map) as a neural network by approximating the barycentric projection of the OT plan obtained in the first step. Parameterization of this map with a neural network allows efficient learning and provides generalization outside the support of the input measure. FIG0 example showing the computed map between a Gaussian measure and a discrete measure and the ing density estimation. On the theoretical side, we prove the convergence of regularized optimal plans (resp. barycentric projections of regularized optimal plans) to the optimal plan (resp. Monge map) between the underlying continuous measures from which data are sampled. We demonstrate our approach on domain adaptation and generative modeling. We denote X and Y some complete metric spaces. In most applications, these are Euclidean spaces. We denote random variables such as X or Y as capital letters. We use X ∼ Y to say that X and Y have the same distribution, and also X ∼ µ to say that X is distributed according to the probability measure µ. Supp(µ) refers to the support of µ, a subset of X, which is also the set of values which X ∼ µ can take. Given X ∼ µ and a map f defined on Supp(µ), f #µ is the probability distribution of f (X). We say that a measure is continuous when it admits a density w.r.t. the Lebesgues measure. We denote id the identity map. The Monge Problem Consider a cost function c: (x, y) ∈ X × Y → c(x, y) ∈ R +, and two random variables X ∼ µ and Y ∼ ν taking values in X and Y respectively. The Monge problem (Monge, 1781) consists in finding a map f: X → Y which transports the mass from µ to ν while minimizing the mass transportation cost, DISPLAYFORM0 Monge originally considered the cost c(x, y) = ||x − y|| 2, but in the present article we refer to the Monge problem as Problem for any cost c. When µ is a discrete measure, a map f satisfying the constraint may not exist: if µ is supported on a single point, no such map exists as soon as ν is not supported on a single point. In that case, the Monge problem is not feasible. However, when X = Y = R d, µ admits a density and c is the squared Euclidean distance, an important by BID8 states that the Monge problem is feasible and that the infinum of Problem FORMULA0 is attained. The existence and uniqueness of Monge maps, also referred to as optimal maps, was later generalized to more general costs (e.g. strictly convex and super-linear) by several authors. With the notable exception of the Gaussian to Gaussian case which has a close form affine solution, computation of Monge maps remains an open problem for measures supported on high-dimensional spaces. Kantorovich Relaxation In order to make Problem always feasible, BID23 relaxed the Monge problem by casting Problem into a minimization over couplings (X, Y) ∼ π rather than the set of maps, where π should have marginals equals to µ and ν, DISPLAYFORM1 Concretely, this relaxation allows mass at a given point x ∈ Supp(µ) to be transported to several locations y ∈ Supp(ν), while the Monge problem would send the whole mass at x to a unique location f (x). This relaxed formulation is a linear program, which can be solved by specialized algorithms such as the network simplex when considering discrete measures. However, current implementations of this algorithm have a super-cubic complexity in the size of the support of µ and ν, preventing wider use of OT in large-scale settings. Regularized OT OT regularization was introduced by BID14 in order to speed up the computation of OT. Regularization is achieved by adding a negative-entropy penalty R (defined in Eq.) to the primal variable π of Problem, DISPLAYFORM2 Besides efficient computation through the Sinkhorn algorithm, regularization also makes the OT distance differentiable everywhere w.r.t. the weights of the input measures, whereas OT is differentiable only almost everywhere. We also consider the L 2 regularization introduced by BID15, whose computation is found to be more stable since there is no exponential term causing overflow. As highlighted by, adding an entropy or squared L 2 norm regularization term to the primal problem makes the dual problem an unconstrained maximization problem. We use this dual formulation in the next section to propose an efficient stochastic gradient algorithm. By considering the dual of the regularized OT problem, we first show that stochastic gradient ascent can be used to maximize the ing concave objective. A close form for the primal solution π of Problem can then be obtained by using first-order optimality conditions. OT dual Let X ∼ µ and Y ∼ ν. The Kantorovich duality provides the following dual of the OT problem, DISPLAYFORM0 This dual formulation suggests that stochastic gradient methods can be used to maximize the objective of Problem by sampling batches from the independant coupling µ × ν. However there is no easy way to fulfill the constraint on u and v along gradient iterations. This motivates considering regularized optimal transport. Regularized OT dual The hard constraint in Eq. can be relaxed by regularizing the primal problem with a strictly convex regularizer R as detailed in. In the present paper, we consider both entropy regularization R e used in BID14 BID20 and DISPLAYFORM1 where dπ(x,y) dµ(x)dν(y) is the density, i.e. the Radon-Nikodym derivative, of π w.r.t. µ × ν. When µ and ν are discrete, and so is π, the integrals are replaced by sums. The dual of the regularized OT problems can be obtained through the Fenchel-Rockafellar's duality theorem, DISPLAYFORM2 where DISPLAYFORM3 Compared to Problem, the constraint u(x) + v(y) c(x, y) has been relaxed and is now enforced smoothly through a penalty term F ε (u(x), v(y)) which is concave w.r.t. (u, v). Although we derive formula and perform experiments w.r.t. entropy and L 2 regularizations, any strictly convex regularizer which is decomposable, i.e. which can be written R(π) = ij R ij (π ij) (in the discrete case), gives rise to a dual problem of the form Eq., and the proposed algorithms can be adapted. In order to recover the solution π ε of the regularized primal problem, we can use the first-order optimality conditions of the Fenchel-Rockafellar's duality theorem, DISPLAYFORM0 Algorithm The relaxed dual is an unconstrained concave problem which can be maximized through stochastic gradient methods by sampling batches from µ × ν. When µ is discrete, i.e. µ = n i=1 a i δ xi, the dual variable u is a n-dimensional vector over which we carry the optimization, where u(x i) def.= u i. When µ has a density, u is a function on X which has to be parameterized in order to carry optimization. We thus consider deep neural networks for their ability to approximate DISPLAYFORM1 sample a batch (y 1, · · ·, y p) from ν 7: DISPLAYFORM2 end while general functions. BID20 used the same stochastic dual maximization approach to compute the regularized OT objective in the continuous-continuous setting. The difference lies in their pamaterization of the dual variables as kernel expansions, while we decide to use deep neural networks. Using a neural network for parameterizing a continuous dual variable was done also by BID1. The same discussion also stands for the second dual variable v. Our stochastic gradient algorithm is detailed in Alg. 1.Convergence rates and computational cost comparison. We first discuss convergence rates in the discrete-discrete setting (i.e. both measures are discrete), where the problem is convex, while parameterization of dual variables as neural networks in the semi-discrete or continuous-continuous settings make the problem non-convex. Because the dual is not strongly convex, full-gradient descent converges at a rate of O(1/k), where k is the iteration number. SGD with a decreasing step size converges at the inferior rate of O(1/ √ k) BID32 ), but with a O cost per iteration. The two rates can be interpolated when using mini-batches, at the cost of O(p 2) per iteration, where p is the mini-batch size. In contrast, BID20 considered a semi-dual objective of the form E X∼µ [u(X) + G ε (u(X))], with a cost per iteration which is now O(n) due to the computation of the gradient of G ε. Because that objective is not strongly convex either, SGD converges at the same O(1/ √ k) rate, up to problem-specific constants. As noted by BID20, this rate can be improved to O(1/k) while maintaining the same iteration cost, by using stochastic average gradient (SAG) method BID42. However, SAG requires to store past stochastic gradients, which can be problematic in a large-scale setting. In the semi-discrete setting (i.e. one measure is discrete and the other is continuous), SGD on the semi-dual objective proposed by BID20 also converges at a rate of O(1/ √ k), whereas we only know that Alg. 1 converges to a stationary point in this non-convex case. In the continuous-continuous setting (i.e. both measures are continuous), BID20 proposed to represent the dual variables as kernel expansions. A disadvantage of their approach, however, is the O(k 2) cost per iteration. In contrast, our approach represents dual variables as neural networks. While non-convex, our approach preserves a O(p 2) cost per iteration. This parameterization with neural networks was also used by BID1 who maximized the 1-Wasserstein dual-objective function DISPLAYFORM3. Their algorithm is hence very similar to ours, with the same complexity O(p 2) per iteration. The main difference is that they had to constrain u to be a Lipschitz function and hence relied of weight clipping in-between gradient updates. The proposed algorithm is capable of computing the regularized OT objective and optimal plans between empirical measures supported on arbitrary large numbers of samples. In statistical machine learning, one aims at estimating the underlying continuous distribution from which empirical observations have been sampled. In the context of optimal transport, one would like to approximate the true (non-regularized) optimal plan between the underlying measures. The next section states theoretical guarantees regarding this problem. Consider discrete probability measures µ n = n i=1 a i δ xi ∈ P (X) and ν n = n j=1 b j δ yj ∈ P (Y). Analysis of entropy-regularized linear programs BID10 shows that the solution π ε n of the entropy-regularized problem converges exponentially fast to a solution π n of the non-regularized OT problem. Also, a about stability of optimal transport BID47 [Theorem 5.20] states that, if µ n → µ and ν n → ν weakly, then a sequence (π n) of optimal transport plans between µ n and ν n converges weakly to a solution π of the OT problem between µ and ν. We can thus write, lim DISPLAYFORM0 A more refined consists in establishing the weak convergence of π ε n to π when (n, ε) jointly converge to (∞, 0). This is the of the following theorem which states a stability property of entropy-regularized plans (proof in the Appendix). Theorem 1. Let µ ∈ P (X) and ν ∈ P (Y) where X and Y are complete metric spaces. Let µ n = n i=1 a i δ xi and ν n = n j=1 b j δ yj be discrete probability measures which converge weakly to µ and ν respectively, and let (ε n) a sequence of non-negative real numbers converging to 0 sufficiently fast. Assume the cost c is continuous on X × Y and finite. Let π εn n the solution of the entropy-regularized OT problem between µ n and ν n. Then, up to extraction of a subsequence, (π εn n) converges weakly to the solution π of the OT problem between µ and ν, π εn n → π weakly. Keeping the analogy with statistical machine learning, this is an analog to the universal consistency property of a learning method. In most applications, we consider empirical measures and n is fixed, so that regularization, besides enabling dual stochastic approach, may also help learn the optimal plan between the underlying continuous measures. So far, we have derived an algorithm for computing the regularized OT objective and regularized optimal plans regardless of µ and ν being discrete or continuous. The OT objective has been used successfully as a loss in machine learning BID30 BID19 BID40 BID1 BID12, whereas the use of optimal plans has straightforward applications in logistics, as well as economy BID23 ) or computer graphics BID7. In numerous applications however, we often need mappings rather than joint distributions. This is all the more motivated since BID8 proved that when the source measure is continuous, the optimal transport plan is actually induced by a map. Assuming that available data samples are sampled from some underlying continuous distributions, finding the Monge map between these continuous measures rather than a discrete optimal plan between discrete measures is essential in machine learning applications. Hence in the next section, we investigate how to recover an optimal map, i.e. find an approximate solution to the Monge problem, from regularized optimal plans. A map can be obtained from a solution to the OT problem or regularized OT problem through the computation of its barycentric projection. Indeed, a solution π of Problem or between a source measure µ and a target measure ν is, identifying the plan π with its density w.r.t. a reference measure, a function π: (x, y) ∈ X × Y → R + which can be seen as a weighted one-to-many map, i.e. π sends x to each location y ∈ Supp(ν) where π(x, y) > 0. A map can then be obtained by simply averaging over these y according to the weights π(x, y). Definition 1. (Barycentric projection) Let π be a solution of the OT problem or regularized OT problem. The barycentric projectionπ w.r.t. a convex cost d: Y × Y → R + is defined as, DISPLAYFORM0 In the special case d(x, y) = ||x − y|| 2 2, Eq. has the close form solutionπ(x) = E Y ∼π(·|x) [Y], which is equal toπ = πy t a in a discrete setting with y = (y 1, · · ·, y n) and a the weights of µ. Moreover, for the specific squared Euclidean cost c(x, y) = ||x − y|| 2 2, the barycentric projectionπ is an optimal map BID0 [Theorem 12.4 .4], i.e.π is a solution to the Monge problem between the source measure µ and the target measureπ#µ. Hence the barycentric projection w.r.t. the squared Euclidean cost is often used as a simple way to recover optimal maps from optimal transport plans BID38 BID17 BID43. Inputs: input measures µ, ν; cost function c; dual optimal variables u and v; map f θ parameterized as a deep NN; batch size n; learning rate γ. while not converged do sample a batch (DISPLAYFORM0 Formula provides a pointwise value of the barycentric projection. When µ is discrete, this means that we only have mapping estimations for a finite number of points. In order to define a map which is defined everywhere, we parameterize the barycentric projection as a deep neural network. We show in the next paragraph how to efficiently learn its parameters. Optimal map learning An estimation f of the barycentric projection of a regularized plan π ε which generalizes outside the support of µ can be obtained by learning a deep neural network which minimizes the following objective w.r.t. the parameters θ, DISPLAYFORM1 When d(x, y) = ||x − y|| 2, the last term in Eq. FORMULA0 is simply a weighted sum of squared errors, with possibly an infinite number of terms whenever µ or ν are continuous. We propose to minimize the objective by stochastic gradient descent, which provides the simple Algorithm 2. The OT problem being symmetric, we can also compute the opposite barycentric projection g w.r.t. a cost DISPLAYFORM2 However, unless the plan π is induced by a map, the averaging process in having the image of the source measure byπ only approximately equal to the target measure ν. Still, when the size of discrete measure is large and the regularization is small, we show in the next paragraph that 1) the barycentric projection of a regularized OT plan is close to the Monge map between the underlying continuous measures (Theorem 2) and 2) the image of the source measure by this barycentric projection should be close to the target measure ν (Corollary 1).Theoretical guarantees As stated earlier, when X = Y and c(x, y) = ||x − y|| 2 2, proved that when the source measure µ is continuous, there exists a solution to the Monge problem. This was generalized to more general cost functions, see BID47 [Corollary 9 .3] for details. In that case, the plan π between µ and ν is written as (id, f)#µ where f is the Monge map. Now considering discrete measures µ n and ν n which converge to µ (continuous) and ν respectively, we have proved in Theorem 1 that π ε n converges weakly to π = (id, f)#µ when (n, ε) → (∞, 0). The next theorem, proved in the Appendix, shows that the barycentric projectionπ ε n also converges weakly to the true Monge map between µ and ν, justifying our approach. Theorem 2. Let µ be a continuous probability measure on R d, and ν an arbitrary probability measure on R d and c a cost function satisfying BID47 [Corollary 9.3]. Let µ n = 1 n n i=1 δ xi and ν n = 1 n n j=1 δ yj converging weakly to µ and ν respectively. Assume that the OT solution π n of Problem between µ n and ν n is unique for all n. Let (ε n) a sequence of non-negative real numbers converging sufficiently fast to 0 andπ This theorem shows that our estimated barycentric projection is close to an optimal map between the underlying continuous measures for n big and ε small. The following corollary confirms the intuition that the image of the source measure by this map converges to the underlying target measure. Corollary 1. With the same assumptions as above,π εn n #µ n → ν weakly. In terms of random variables, the last equation states that if X n ∼ µ n and Y ∼ ν, thenπ εn n (X n) converges in distribution to Y. BID20: we use SGD instead of SAG), for several entropy-regularization values. Learning rates are {5., 20., 20.} and batch sizes {1024, 500, 100} respectively and are taken the same for the dual and semi-dual methods. These theoretical show that our estimated Monge map can thus be used to perform domain adaptation by mapping a source dataset to a target dataset, as well as perform generative modeling by mapping a continuous measure to a target discrete dataset. We demontrate this in the following section. We start by evaluating the training time of our dual stochastic algorithm 1 against a stochastic semidual approach similar to BID20. In the semi-dual approach, one of the dual variable is eliminated and is computed in close form. However, this computation has O(n) complexity where n is the size of the target measure ν. We compute the regularized OT objective with both methods on a spectral transfer problem, which is related to the color transfer problem BID39 BID36, but where images are multispectral, i.e. they share a finer sampling of the light wavelength. We take two 500 × 500 images from the CAVE dataset BID49 that have 31 spectral bands. As such, the optimal transport problem is computed on two empirical distributions of 250000 samples in R 31 on which we consider the squared Euclidean ground cost c. The timing evolution of train losses are reported in FIG2 for three different regularization values ε = {0.025, 0.1, 1.}. In the three cases, one can observe that convergence of our proposed dual algorithm is much faster. We apply here our computation framework on an unsupervised domain adaptation (DA) task, for which optimal transport has shown to perform well on small scale datasets BID13 BID35 BID11. This restriction is mainly due to the fact that those works only consider the primal formulation of the OT problem. Our goal here is not to compete with the state-of-the-art methods in domain adaptation but to assess that our formulation allows to scale optimal transport based domain adaptation (OTDA) to large datasets. OTDA is illustrated in FIG3 and follows two steps: 1) learn an optimal map between the source and target distribution, 2) map the source samples and train a classifier on them in the target domain. Our formulation also allows to use any differentiable ground cost c while BID13 ) was limited to the squared Euclidean distance. Datasets We consider the three cross-domain digit image datasets MNIST BID25, USPS, and SVHN BID33, which have 10 classes each. For the adaptation between MNIST and USPS, we use 60000 samples in the MNIST domain and 9298 samples in USPS domain. MNIST images are resized to the same resolution as USPS ones (16 × 16). For the adaptation between SVHN and MNIST, we use 73212 samples in the SVHN domain and 60000 samples in the MNIST domain. MNIST images are zero-padded to reach the same resolution as SVHN (32 × 32) and extended to three channels to match SVHN image sizes. The labels in the target domain are BID13. Source samples are mapped to the target set through the barycentric projectionπ ε. A classifier is then learned on the mapped source samples. withheld during the adaptation. In the experiment, we consider the adaptation in three directions: MNIST → USPS, USPS → MNIST, and SVHN → MNIST. Our goal is to demonstrate the potential of the proposed method in large-scale settings. Adaptation performance is evaluated using a 1-nearest neighbor (1-NN) classifier, since it has the advantage of being parameter free and allows better assessment of the quality of the adapted representation, as discussed in BID13. In all experiments, we consider the 1-NN classification as a baseline, where labeled neighbors are searched in the source domain and the accuracy is computed on target data. We compare our approach to previous OTDA methods where an optimal map is obtained through the discrete barycentric projection of either an optimal plan (computed with the network simplex algorithm 1) or an entropy-regularized optimal plan (computed with the Sinkhorn algorithm BID14), whenever their computation is tractable. Note that these methods do not provide out-of-sample mapping. In all experiments, the ground cost c is the squared Euclidean distance and the barycentric projection is computed w.r.t. that cost. We learn the Monge map of our proposed approach with either entropy or L2 regularizations. Regarding the adaptation between SVHN and MNIST, we extract deep features by learning a modified LeNet architecture on the source data and extracting the 100-dimensional features output by the top hidden layer. Adaptation is performed on those features. We report for all the methods the best accuracy over the hyperparameters on the target dataset. While this setting is unrealistic in a practical DA application, it is widely used in the DA community BID27 and our goal is here to investigate the relative performances of large-scale OTDA in a fair setting. Hyper-parameters and learning rate The value for the regularization parameter is set in {5, 2, 0.9, 0.5, 0.1, 0.05, 0.01}. Adam optimizer with batch size 1000 is used to optimize the network. The learning rate is varied in {2, 0.9, 0.1, 0.01, 0.001, 0.0001}. The learned Monge map f in Alg. 2 is parameterized as a neural network with two fully-connected hidden layers (d → 200 → 500 → d) and ReLU activations, and the weights are optimized using the Adam optimizer with learning rate equal to 10 −4 and batch size equal to 1000. For the Sinkhorn algorithm, regularization value is chosen from {0.01, 0.1, 0.5, 0.9, 2.0, 5.0, 10.0}. Results Results are reported in TAB1. In all cases, our proposed approach outperforms previous OTDA algorithms. On MNIST→USPS, previous OTDA methods perform worse than using directly source labels, whereas our method leads to successful adaptation with 20% and 10% accuracy points over OT and regularized OT methods respectively. On USPS→MNIST, all three algorithms lead to successful adaptation , but our method achieves the highest adaptation . Finally, on the challenging large-scale adaptation task SVHN→MNIST, only our method is able to handle the whole datasets, and outperforms the source only . Comparing the between the barycentric projection and estimated Monge map illustrates that learning a parametric mapping provides some kind of regularization, and improves the performance. Approach Corollary 1 shows that when the support of the discrete measures µ and ν is large and the regularization ε is small, then we have approximatelyπ ε #µ = ν. This observation motivates the use of our Monge map estimation as a generator between an arbitrary continuous measure µ and a discrete measure ν representing the discrete distribution of some dataset. We can thus obtain a generative model by first computing regularized OT through Alg. 1 between a Gaussian measure µ and a discrete dataset ν and then compute our generator with Alg. 2. This requires to have a cost function between the latent variable X ∼ µ and the discrete variable Y ∼ ν. The property we gain compared to other generative models is that our generator is, at least approximately, an optimal map w.r.t. this cost. In our case, the Gaussian is taken with the same dimensionality as the discrete data and the squared Euclidean distance is used as ground cost c. Permutation-invariant MNIST We preprocess MNIST data by rescaling grayscale values in [−1, 1]. We run Alg. 1 and Alg. 2 where µ is a Gaussian whose mean and covariance are taken equal to the empirical mean and covariance of the preprocessed MNIST dataset; we have observed that this makes the learning easier. The target discrete measure ν is the preprocessed MNIST dataset. Permutation invariance means that we consider each grayscale 28 × 28 images as a 784-dimensional vector and do not rely on convolutional architectures. In Alg. 1 the dual potential u is parameterized as a (d → 1024 → 1024 → 1) fully-connected NN with ReLU activations for each hidden layer, and the L 2 regularization is considered as it produced experimentally less blurring. The barycentric projection f of Alg. 2 is parameterized as a (d → 1024 → 1024 → d) fully-connected NN with ReLU activation for each hidden layer and a tanh activation on the output layer. We display some generated samples in FIG4 We proposed two original algorithms that allow for i) large-scale computation of regularized optimal transport ii) learning an optimal map that moves one probability distribution onto another (the so-called Monge map). To our knowledge, our approach introduces the first tractable algorithms for computing both the regularized OT objective and optimal maps in large-scale or continuous settings. We believe that these two contributions enable a wider use of optimal transport strategies in machine learning applications. Notably, we have shown how it can be used in an unsupervised domain adaptation setting, or in generative modeling, where a Monge map acts directly as a generator. Our consistency show that our approach is theoretically well-grounded. An interesting direction for future work is to investigate the corresponding convergence rates of the empirical regularized optimal plans. We believe this is a very complex problem since technical proofs regarding convergence rates of the empirical OT objective used e.g. in BID45 BID6 BID18 do not extend simply to the optimal transport plans.that we have π n = (id, T n)#µ n. This also impliesπ n = T n so that (id,π n)#µ n = (id, T n)#µ n. Hence, the second term in the right-hand side of converges to 0 as a of the stability of optimal transport BID47 [Theorem 5.20]. Now, we show that the first term also converges to 0 for ε n converging sufficiently fast to 0. By definition of the pushforward operator, DISPLAYFORM0 g(x, T n (x))dµ n (x) and we can bound, DISPLAYFORM1 where Y n = (y 1, · · ·, y n) t and K g is the Lipschitz constant of g. The first inequality follows from g being Lipschitz. The next equality follows from the discrete close form of the barycentric projection. The last inequality is obtained through Cauchy-Schwartz. We can now use the same arguments as in the previous proof. A convergence by BID10 shows that there exists positive constants (w.r.t. ε n) M cn,µn,νn and λ cn,µn,νn such that, where c n = (c(x 1, y 1), · · ·, c(x n, y n)). The subscript indices indicate the dependences of each constant. Hence, we see that choosing any (ε n) such that tends to 0 provides the . In particular, we can take ε n = λ cn,µn,νn ln(n 2 ||Y n || 1/2 R n×d,2 M cn,µn,νn)which suffices to have the convergence of to 0 for Lipschitz function g ∈ C l (R d × R d). This proves the weak convergence of (id,π εn n)#µ n to (id, f)#µ. Proof. Let h ∈ C b (R d) a bounded continuous function. Let g ∈ C b (R d × R d) defined as g: (x, y) → h(y). We have, DISPLAYFORM0 which converges to 0 by Theorem. Since f #µ = ν, this proves the corollary.

Represent the TLDR for finding the corresponding scientific article

Learning optimal mapping with deepNN between distributions along with theoretical guarantees.

Represent this text to find a much much longer article about it with say hundreds-thousands of words

Using linear programming we show that the computational complexity of approximate Deep Neural Network training depends polynomially on the data size for several architectures


Question: Represent the article for finding a single-sentence TLDR

Question: Learning effective text representations is a key foundation for numerous machine learning and NLP applications. While the celebrated Word2Vec technique yields semantically rich word representations, it is less clear whether sentence or document representations should be built upon word representations or from scratch. Recent work has demonstrated that a distance measure between documents called \emph{Word Mover's Distance} (WMD) that aligns semantically similar words, yields unprecedented KNN classification accuracy. However, WMD is very expensive to compute, and is harder to apply beyond simple KNN than feature embeddings. In this paper, we propose the \emph{Word Mover's Embedding} (WME), a novel approach to building an unsupervised document (sentence) embedding from pre-trained word embeddings. Our technique extends the theory of \emph{Random Features} to show convergence of the inner product between WMEs to a positive-definite kernel that can be interpreted as a soft version of (inverse) WMD. The proposed embedding is more efficient and flexible than WMD in many situations. As an example, WME with a simple linear classifier reduces the computational cost of WMD-based KNN \emph{from cubic to linear} in document length and \emph{from quadratic to linear} in number of samples, while simultaneously improving accuracy. In experiments on 9 benchmark text classification datasets and 22 textual similarity tasks the proposed technique consistently matches or outperforms state-of-the-art techniques, with significantly higher accuracy on problems of short length.

Represent the short summary for finding the corresponding scientific article (long)

A novel approach to building an unsupervised document (sentence) embeddings from pre-trainedword embeddings

Represent the TLDR for finding the corresponding scientific article.

A new method for unsupervised representation learning on graphs, relying on maximizing mutual information between local and global representations in a graph. State-of-the-art results, competitive with supervised learning.


Question: Represent the scientific article to find a short TLDR

Question: We present a new approach to assessing the robustness of neural networks based on estimating the proportion of inputs for which a property is violated. Specifically, we estimate the probability of the event that the property is violated under an input model. Our approach critically varies from the formal verification framework in that when the property can be violated, it provides an informative notion of how robust the network is, rather than just the conventional assertion that the network is not verifiable. Furthermore, it provides an ability to scale to larger networks than formal verification approaches. Though the framework still provides a formal guarantee of satisfiability whenever it successfully finds one or more violations, these advantages do come at the cost of only providing a statistical estimate of unsatisfiability whenever no violation is found. Key to the practical success of our approach is an adaptation of multi-level splitting, a Monte Carlo approach for estimating the probability of rare events, to our statistical robustness framework. We demonstrate that our approach is able to emulate formal verification procedures on benchmark problems, while scaling to larger networks and providing reliable additional information in the form of accurate estimates of the violation probability. The robustness of deep neural networks must be guaranteed in mission-critical applications where their failure could have severe real-world implications. This motivates the study of neural network verification, in which one wishes to assert whether certain inputs in a given subdomain of the network might lead to important properties being violated BID29 BID1. For example, in a classification task, one might want to ensure that small perturbations of the inputs do not lead to incorrect class labels being predicted BID23 BID8.The classic approach to such verification has focused on answering the binary question of whether there exist any counterexamples that violate the property of interest. We argue that this approach has two major drawbacks. Firstly, it provides no notion of how robust a network is whenever a counterexample can be found. Secondly, it creates a computational problem whenever no counterexamples exist, as formally verifying this can be very costly and does not currently scale to the size of networks used in many applications. To give a demonstrative example, consider a neural network for classifying objects in the path of an autonomous vehicle. It will almost certainly be infeasible to train such a network that is perfectly robust to misclassification. Furthermore, because the network will most likely need to be of significant size to be effective, it is unlikely to be tractable to formally verify the network is perfectly robust, even if such a network exists. Despite this, it is still critically important to assess the robustness of the network, so that manufacturers can decide whether it is safe to deploy. To address the shortfalls of the classic approach, we develop a new measure of intrinsic robustness of neural networks based on the probability that a property is violated under an input distribution model. Our measure is based on two key insights. The first is that for many, if not most, applications, full formal verification is neither necessary nor realistically achievable, such that one actually desires a notion of how robust a network is to a set of inputs, not just a binary answer as to whether it is robust or not. The second is that most practical applications have some acceptable level of risk, such that it is sufficient to show that the probability of a violation is below a certain threshold, rather than confirm that this probability is exactly zero. By providing a probability of violation, our approach is able to address the needs of applications such as our autonomous vehicle example. If the network is not perfectly robust, it provides an explicit measure of exactly how robust the network is. If the network is perfectly robust, it is still able to tractability assert that a violation event is "probably-unsatisfiable". That is it is able to statistically conclude that the violation probability is below some tolerance threshold to true zero, even for large networks for which formal verification would not be possible. Calculating the probability of violation is still itself a computationally challenging task, corresponding to estimating the value of an intractable integral. In particular, in most cases, violations of the target property constitute (potentially extremely) rare events. Consequently, the simple approach of constructing a direct Monte Carlo estimate by sampling from the input model and evaluating the property will be expensive and only viable when the event is relatively common. To address this, we adapt an algorithm from the Monte Carlo literature, adaptive multi-level splitting (AMLS) BID9 BID18, to our network verification setting. AMLS is explicitly designed for prediction of rare events and our adaptation means that we are able to reliably estimate the probability of violation, even when the true value is extremely small. Our ing framework is easy to implement, scales linearly in the cost of the forward operation of the neural network, and is agnostic both to the network architecture and input model. Assumptions such as piecewise linearity, Lipschitz continuity, or a specific network form are not required. Furthermore, it produces a diversity of samples which violate the property as a side-product. To summarize, our main contributions are:• Reframing neural network verification as the estimation of the probability of a violation, thereby providing a more informative robustness metric for non-verifiable networks; • Adaptation of the AMLS method to our verification framework to allow the tractable estimation of our metric for large networks and rare events; • Validation of our approach on several models and datasets from the literature. The literature on neural network robustness follows two main threads. In the optimization community, researchers seek to formally prove that a property holds for a neural network by framing it as a satisfiability problem BID29 ), which we refer to as the classical approach to verification. Such methods have only been successfully scaled beyond one hidden layer networks for piecewise linear networks BID2 BID14, and even then these solutions do not scale to, for example, common image classification architectures with input dimensions in the hundreds, or apply to networks with nonlinear activation functions BID1. Other work has sought approximate solutions in the same general framework but still does not scale to larger networks BID19 BID28 BID12. As the problem is NP-hard BID14, it is unlikely that an algorithm exists with runtime scaling polynomially in the number of network nodes. In the deep learning community, research has focused on constructing and defending against adversarial attacks, and by estimating the robustness of networks to such attacks. BID26 recently constructed a measure for robustness to adversarial attacks estimating a lower bound on the minimum adversarial distortion, that is the smallest perturbation required to create an adversarial example. Though the approach scales to large networks, the estimate of the lower bound is often demonstratively incorrect: it is often higher than an upper bound on the minimum adversarial distortion BID7. Other drawbacks of the method are that it cannot be applied to networks that are not Lipschitz continuous, it requires an expensive gradient computation for each class per sample, does not produce adversarial examples, and cannot be applied to non-adversarial proper-ties. The minimum adversarial distortion is also itself a somewhat unsatisfying metric for many applications, as it conveys little information about the prevalence of adversarial examples. In other work spanning both communities BID5 BID25 BID27, researchers have relaxed the satisfiability problem of classical verification, and are able to produce certificates-of-robustness for some samples (but not all that are robust) by giving a lowerbound on the minimal adversarial distortion. Despite these methods scaling beyond formal verification, we note that this is still a binary measure of robustness with limited informativeness. An orthogonal track of research investigates the robustness of reinforcement learning agents to failure BID11 BID15. For instance, concurrent work to ours BID24 takes a continuation approach to efficiently estimating the probability that an agent fails when this may be a rare event. To help elucidate our problem setting, we consider the ACASXU dataset BID14 from the formal verification literature. A neural network is trained to predict one of five correct steering decisions, such as "hard left," "soft left," etc., for an unmanned aircraft to avoid collision with a second aircraft. The inputs x describe the positions, orientations, velocities, etc. of the two aircraft. Ten interpretable properties are specified along with corresponding constraints on the inputs, for which violations correspond to events causing collisions. Each of these properties is encoded in a function, s, such that it is violated when s(x) ≥ 0. The formal verification problem asks the question, "Does there exist an input x ∈ E ⊆ X in a constrained subset, E, of the domain such that the property is violated?" If there exists a counterexample violating the property, we say that the property is satisfiable (SAT), and otherwise, unsatisfiable (UNSAT).Another example is provided by adversarial properties from the deep learning literature on datasets such as MNIST. Consider a neural network f θ (x) = Softmax(z(x)) that classifies images, x, into C classes, where the output of f gives the probability of each class. Let δ be a small perturbation in an l p -ball of radius, that is, δ p <. Then x = x + δ is an adversarial example for x if arg max i z(x) i = arg max i z(x) i, i.e. the perturbation changes the prediction. Here, the property function is s(x) = max i =c (z(x) i − z(x) c ), where c = arg max j z(x) j and s(x) ≥ 0 indicates that x is an adversarial example. Our approach subsumes adversarial properties as a specific case. The framework for our robustness metric is very general, requiring only a) a neural network f θ, b) a property function s(x; f, φ), and c) an input model p(x). Together these define an integration problem, with the main practical challenge being the estimation of this integral. Consequently, the method can be used for any neural network. The only requirement is that we can evaluate the property function, which typically involves a forward pass of the neural network. The property function, s(x; f θ, φ), is a deterministic function of the input x, the trained network f θ, and problem specific parameters φ. For instance, in the MNIST example, φ = arg max i f θ (x) i is the true output of the unperturbed input. Informally, the property reflects how badly the network is performing with respect to a particular property. More precisely, the event DISPLAYFORM0 represents the property being violated. Predicting the occurrence of these, typically rare, events will be the focus of our work. We will omit the dependency on f θ and φ from here on for notional conciseness, noting that these are assumed to be fixed and known for verification problems. The input model, p(x), is a distribution over the subset of the input domain that we are considering for counterexamples. For instance, for the MNIST example we could use p(x; x) ∝ 1 (x − x p ≤) to consider uniform perturbations to the input around an l p -norm ball with radius. More generally, the input model can be used to place restrictions on the input domain and potentially also to reflect that certain violations might be more damaging than others. Together, the property function and input model specify the probability of failure through the integral DISPLAYFORM1 This integral forms our measure of robustness. The integral being equal to exactly zero corresponds to the classical notion of a formally verifiable network. Critically though, it also provides a measure for how robust a non-formally-verifiable network is. Our primary goal is to estimate in order to obtain a measure of robustness. Ideally, we also wish to generate example inputs which violate the property. Unfortunately, the event E is typically very rare in verification scenarios. Consequently, the estimating the integral directly using Monte Carlo, DISPLAYFORM0 is typically not feasible for real problems, requiring an impractically large number of samples to achieve a reasonable accuracy. Even when E is not a rare event, we desire to estimate the probability using as few forward passes of the neural network as possible to reduce computation. Furthermore, the dimensionality of x is typically large for practical problems, such that it is essential to employ a method that scales well in dimensionality. Consequently many of the methods commonly employed for such problems, such as the cross-entropy method BID22 BID3, are inappropriate due to relying on importance sampling, which is well known to scale poorly. As we will demonstrate empirically, a less well known but highly effective method from the statistics literature, adaptive multi-level splitting (AMLS) BID13 BID9, can be readily adapted to address all the aforementioned computational challenges. Specifically, AMLS is explicitly designed for estimating the probability of rare events and our adaptation is able to give highly accurate estimates even when the E is very rare. Furthermore, as will be explained later, AMLS also allows the use of MCMC transitions, meaning that our approach is able to scale effectively in the dimensionality of x. A further desirable property of AMLS is that it produces property-violating examples as a side product, namely, it produces samples from the distribution DISPLAYFORM1 Such samples could, in theory, be used to perform robust learning, in a similar spirit to BID8 and BID16. Multi-level splitting BID13 divides the problem of predicting the probability of a rare event into several simpler ones. Specifically, we construct a sequence of intermediate targets, DISPLAYFORM0, to bridge the gap between the input model p(x) and the target π(x). For any choice of the intermediate levels, we can now represent equation FORMULA1 through the following factorization, DISPLAYFORM1 Provided consecutive levels are sufficiently close, we will be able to reliably estimate each P k by making use of the samples from one level to initialize the estimation of the next. Our approach starts by first drawing N samples, {x DISPLAYFORM2, from π 0 (·) = p(·), noting that this can be done exactly because the perturbation model is known. These samples can then be used to estimate P 1 using simple Monte Carlo, DISPLAYFORM3 where DISPLAYFORM4 In other words, P 1 is the fraction of these samples whose property is greater than L 1. Critically, by ensuring the value of L 1 is sufficiently small for {s(x n) ≥ L 1 } to be a common event, we can ensureP 1 is a reliable estimate for moderate numbers of samples N. Adaptive multi-level splitting with termination criterion DISPLAYFORM0 Evaluate and sort {s(x DISPLAYFORM1 log(I) ← log(I) + log(P k) Updating integral estimate 10:if log(I) < log(Pmin) then return (∅, −∞) end if Final estimate will be less than log(Pmin) 11:Initialize {x DISPLAYFORM2 by resampling with replacement N times from {x DISPLAYFORM3 Apply M MH updates separately to each x (k) n using g(x |x) 13:[Optional] Adapt g(x |x) based on MH acceptance rates 14: end while 15: return ({x DISPLAYFORM4 To estimate the other P k, we need to be able to draw samples from π k−1 (·). For this we note that if {x DISPLAYFORM5 are distributed according to π k−2 (·), then the subset of these samples for which DISPLAYFORM6 Furthermore, setting L k−1 up to ensure this event is not rare means a significant proportion of the samples will satisfy this property. To avoid our set of samples shrinking from one level to the next, it is necessary to carry out a rejuvenation step to convert this smaller set of starting samples to a full set of size N for the next level. To do this, we first carry out a uniform resampling with replacement from the set of samples satisfying s(x (k−1) n ) ≥ L k to generate a new set of N samples which are distributed according to π k (·), but with a large number of duplicated samples. Starting with these samples, we then successively apply M Metropolis-Hastings (MH) transitions targeting π k (·) separately to each sample to produce a fresh new set of samples {x DISPLAYFORM7 (see Appendix A for full details). These samples can then in turn be used to form a Monte Carlo estimate for P k, DISPLAYFORM8 along with providing the initializations for the next level. Running more MH transitions decreases the correlations between the set of samples, improving the performance of the estimator. We have thus far omitted to discuss how the levels L k are set, other than asserting the need for the levels to be sufficiently close to allow reliable estimation of each P k. Presuming that we are also free to choose the number of levels K, there is inevitably a trade-off between ensuring that each {s(X) ≥ L k } is not rare given {s(X) ≥ L k−1 }, and keeping the number of levels small to reduce computational costs and avoid the build-up of errors. AMLS BID9 builds on the basic multi-level splitting process, providing an elegant way of controlling this trade-off by adaptively selecting the level to be the minimum of 0 and some quantile of the property under the current samples. The approach terminates when the level reaches zero, such that L K = 0 and K is a dynamic parameter chosen implicitly by the adaptive process. Choosing the ρth quantile of the values of the property in discarding a fraction (1 − ρ) of the chains at each step of the algorithm. This allows explicit control of the rarity of the events to keep them at a manageable level. We note that if all the sample property values are distinct, then this approach gives P k = ρ, ∀k < K. To give intuition to this, we can think about splitting up log(I) into chunks of size log(ρ). For any value of log(I), there is always a unique pair of values {K, P K} such that log(I) = K log(ρ) + log(P K), K ≥ 0 and P K < ρ. Therefore the problem of estimating I is equivalent to that of estimating K and P K. The application of AMLS to our verification problem presents a significant complicating factor in that the true probability of our rare event might be exactly zero. Whenever this is the case, the basic AMLS approach outlined in BID9 will never terminate as the quantile of the property will never rise above zero; the algorithm simply produces closer and closer intermediate levels as it waits for the event to occur. To deal with this, we introduce a termination criterion based on the observation that AMLS's running estimate for I monotonically decreases during running. Namely, we introduce a threshold probability, P min, below which the estimates will be treated as being numerically zero. We then terminate the algorithm if I < P min and return I = 0, safe in the knowledge that even if the algorithm would eventually generate a finite estimate for I, this estimate is guaranteed to be less than P min.Putting everything together, gives the complete method as shown in Algorithm 1. See Appendix B for low-level implementation details. In our first experiment 1, we aim to test whether our robustness estimation framework is able to effectively emulate formal verification approaches, while providing additional robustness information for SAT properties. In particular, we want to test whether it reliably identifies properties as being UNSAT, for which I = 0, or SAT, for which I > 0. We note that the method still provides a formal demonstration for SAT properties because having a non-zero estimate for I indicates that at least one counterexample has been found. Critically, it further provides a measure for how robust SAT properties are, through its estimate for I.We used the COLLISIONDETECTION dataset introduced in the formal verification literature by BID4. It consists of a neural network with six inputs that has been trained to classify two car trajectories as colliding or non-colliding. The architecture has 40 linear nodes in the first layer, followed by a layer of max pooling, a ReLU layer with 19 hidden units, and an output layer with 2 hidden units. Along with the dataset, 500 properties are specified for verification, of which 172 are SAT and 328 UNSAT. This dataset was chosen because the model is small enough so that the properties can be formally verified. These formal verification methods do not calculate the value of I, but rather confirm the existence of a counterexample for which s(x) > 0.We ran our approach on all 500 properties, setting ρ = 0.1, N = 10 4, M = 1000 (the choice of these hyperparameters will be justified in the next subsection), and using a uniform distribution over the input constraints as the perturbation model, along with a uniform random walk proposal. We compared our metric estimation approach against the naive Monte Carlo estimate using 10 10 samples. The generated estimates of I for all SAT properties are shown in FIG0.Both our approach and the naive MC baseline correctly identified all of the UNSAT properties by estimating I as exactly zero. However, despite using substantially more samples, naive MC failed to find a counterexample for 8 of the rarest SAT properties, thereby identifying them as UNSAT, whereas our approach found a counterexample for all the SAT properties. As shown in FIG0, the variances in the estimates for I of our approach were also very low and matched the unbiased MC baseline estimates for the more commonly violated properties, for which the latter approach still gives reliable, albeit less efficient, estimates. Along with the improved ability to predict rare events, our approach was also significantly faster than naive MC throughout, with a speed up of several orders of magnitude for properties where the event is not rare-a single run with naive MC took about 3 minutes, whereas a typical run of ours took around 3 seconds. As demonstrated by BID0, AMLS is unbiased under the assumption that perfect sampling from the targets, {π k} K−1 k=1, is possible, and that the cumulative distribution function of s(X) is continuous. In practice, finite mixing rates of the Markov chains and the dependence between the Error bars indicating ± three standard errors from 30 runs are included here and throughout, but the variance of the estimates was so small that these are barely visible. We can further conclude low bias of our method for the properties where naive MC estimation was feasible, due to the fact that naive MC produces unbiased (but potentially high variance) estimates. (b) Mean AMLS estimate relative to naive MC estimate for different ρ holding M = 1000 fixed, for those properties with log 10 I > −6.5 such that they could be estimated accurately. The bias decreases both as ρ and the rareness of the event decrease. (c) As per (b) but with varying M and holding ρ = 0.1 fixed.initialization points for each target means that sampling is less than perfect, but improves with larger values of M and N. The variance, on the other hand, theoretically strictly decreases with larger values of N and ρ BID0. In practice, we found that while larger values of M and N were always beneficial, setting ρ too high introduced biases into the estimate, with ρ = 0.1 empirically providing a good trade-off between bias and variance. Furthermore, this provides faster run times than large values of ρ, noting that the smaller values of ρ lead to larger gaps in the levels. To investigate the effect of the parameters more formally, we further ran AMLS on the SAT properties of COLLISIONDETECTION, varying ρ ∈ {0.1, 0.25, 0.5}, N ∈ {10 3, 10 4, 10 5} and M ∈ {100, 250, 1000}, again comparing to the naive MC estimate for 10 10 samples. We found that the value of N did not make a discernible difference in this range regardless of the values for ρ and M, and thus all presented correspond to setting N = 10 4. As shown in FIG0, we found that the setting of ρ made a noticeable difference to the estimates for the relatively rarer events. All the same, these differences were small relative to the differences between properties. As shown in FIG0, the value of M made little difference when ρ = 0.1,. Interesting though, we found that the value of M was important for different values of ρ, as shown in Appendix C.1, with larger values of M giving better as expected. To validate the algorithm on a higher-dimensional problem, we first tested adversarial properties on the MNIST and CIFAR-10 datasets using a dense ReLU network with two hidden-layer of size 256. An l ∞ -norm ball perturbation around the data point with width was used as the uniform input model, with = 1 representing an l ∞ -ball filling the entire space (the pixels are scaled to), together with a uniform random walk MH proposal. After training the classifiers, multilevel splitting was run on ten samples from the test set at multiple values of, with N = 10000 and ρ = 0.1, and M ∈ {100, 250, 1000} for MNIST and M ∈ {100, 250, 500, 1000, 2000} for CIFAR-10. The for naive MC were also evaluated using 5 × 10 9 samples-less than the previous experiment as the larger network made estimation more expensive-in the cases where the event was not too rare. This took around twenty minutes per naive MC estimate, versus a few minutes for each AMLS estimate. As the were similar across datapoints, we present the for a single example in the top two rows of FIG1. As desired, a smooth curve is traced out as decreases, for which the event E becomes rarer. For MNIST, acceptable accuracy is obtained for M = 250 and high accuracy for M = 1000. For CIFAR-10, which has about four times the input dimension of MNIST, larger values of M were required to achieve comparable accuracy. The magnitude of required to give a certain value of log(I) is smaller for CIFAR-10 than MNIST, reflecting that adversarial examples for the former are typically more perceptually similar to the datapoint. Estimates for I on adversarial properties of a single datapoint with ρ = 0.1, and N ∈ {10000, 10000, 300} for MNIST/CIFAR-10/CIFAR-100 respectively. As in FIG0, the error bars from 30 runs are barely visible, highlighting a very low variance in the estimates, while the close matching to the naive MC estimates when is large enough to make the latter viable, indicate a very low bias. For CIFAR-100 the error bars are shown for the naive estimates, as well, from 10 runs.[Right] The difference in the estimate for the other values of M from M ∈ {1000, 2000, 2000} for MNIST/CIFAR-10/CIFAR-100, respectively. The estimate steadily converges as M increases, with larger M more important for rarer events. To demonstrate that our approach can be employed on large networks, we tested adversarial properties on the CIFAR-100 dataset and a much larger DenseNet architecture BID10, with depth and growth-rate 40 (approximately 2 × 10 6 parameters). Due to the larger model size, we set N = 300, the largest minibatch that could be held in memory (a larger N could be used by looping over minibatches). The naive Monte Carlo estimates used 5 × 10 6 samples for about an hour of computation time per estimate, compared to between five to fifteen minutes for each AMLS estimate. The are presented in the bottom row of FIG1, showing that our algorithm agrees with the naive Monte Carlo estimate. We now examine how our robustness metric varies for a ReLU network as that network is trained to be more robust against norm bounded perturbations to the inputs using the method of BID27. Roughly speaking, their method works by approximating the set of outputs ing from perturbations to an input with a convex outer bound, and minimizing the worst case loss over this FORMULA0 produces a certificate-of-robustness for = 0.1 ("W&K"), versus the fraction of those samples for which I = P min for ∈ {0.1, 0.2, 0.3} ("AMLS"). Due to very heavy memory requirements, it was computationally infeasible to calculate certificates-of-robustness for = {0.2, 0.3}, and = 0.1 before epoch 32 with the method of BID27. Our metric, however, suffers no such memory issues.set. The motivation for this experiment is twofold. Firstly, this training provides a series of networks with ostensibly increasing robustness, allowing us to check if our approach produces robustness estimates consistent with this improvement. Secondly, it allows us to investigate whether the training to improve robustness for one type of adversarial attack helps to protect against others. Specifically, whether training for small perturbation sizes improves robustness to larger perturbations. We train a CNN model on MNIST for 100 epochs with the standard cross-entropy loss, then train the network for a further 100 epochs using the robust loss of BID27, saving a snapshot of the model at each epoch. The architecture is the same as in BID27, containing two strided convolutional layers with 16 and 32 channels, followed by two fully connected layers with 100 and 10 hidden units, and ReLU activations throughout. The robustification phase trains the classifier to be robust in an l ∞ -ball around the inputs, where is annealed from 0.01 to 0.1 over the first 50 epochs. At a number of epochs during the robust training, we calculate our robustness metric with ∈ {0.1, 0.2, 0.3} on 50 samples from the test set. The are summarized in FIG2 with additional per-sample in Appendix C.2. We see that our approach is able to capture variations in the robustnesses of the network. As the method of BID27 returns the maximum value of the property for each sample over a convex outer bound on the perturbations, it is able to produce certificates-of-robustness for some datapoints. If the returned is less than 0 then no adversarial examples exist in an l ∞ ball of radius around that datapoint. If the returned is greater than 0, then the datapoint may or may not be robust in that l ∞ ball, due to fact that it optimizes over an outer bound. Though we emphasize that the core aim of our approach is in providing richer information for SAT properties, this provides an opportunity to see how well it performs at establishing UNSAT properties relative to a more classical approach. To this end, we compared the fraction of the 50 samples from the test set that are verified by the method of BID27, to the fraction that have a negligible volume of adversarial examples, I = P min, in their l ∞ -ball neighbourhood. The are presented in FIG2.Our method forms an upper bound on the fraction of robust samples, which can be made arbitrarily tighter by taking P min → 0. BID27, on the other hand, forms a lower bound on the fraction of robust samples, where the tightness of the bound depends on the tightness of the convex outer bound, which is unknown and cannot be controlled. Though the true value must lie somewhere between the two bounds, our bound still holds physical meaning it its own right in a way that BID27 does not: it is the proportion of samples for which the prevalence of violations is less than an a given acceptable threshold P min.This experiment also highlights an important shortcoming of BID27. The memory usage of their procedure depends on how many ReLU activations cross their threshold over perturbations. This is high during initial training for = 0.1 and indeed the reason why the training procedure starts from = 0.01 and gradually anneals to = 0.1. The is that it is infeasible (the GPU memory is exhausted)-even for this relatively small model-to calculate the maximum value of the property on the convex outer bound for ∈ {0.2, 0.3} at all epochs, and = 0.1 for epochs before 32. Even in this restricted setting where our metric has been reduced to a binary one, it appears to be more informative than that of BID27 for this reason. We have introduced a new measure for the intrinsic robustness of a neural network, and have validated its utility on several datasets from the formal verification and deep learning literatures. Our approach was able to exactly emulate formal verification approaches for satisfiable properties and provide high confidence, accurate predictions for properties which were not. The two key advantages it provides over previous approaches are: a) providing an explicit and intuitive measure for how robust networks are to satisfiable properties; and b) providing improved scaling over classical approaches for identifying unsatisfiable properties. Despite providing a more informative measure of how robust a neural network is, our approach may not be appropriate in all circumstances. In situations where there is an explicit and effective adversary, instead of inputs being generated by chance, we may care more about how far away the single closest counterexample is to the input, rather than the general prevalence of counterexamples. Here our method may fail to find counterexamples because they reside on a subset with probability less than P min; the counterexamples may even reside on a subset of the input space with measure zero with respect to the input distribution. On the other hand, there are many practical scenarios, such as those discussed in the introduction, where either it is unrealistic for there to be no counterexamples close to the input, the network (or input space) is too large to realistically permit formal verification, or where potential counterexamples are generated by chance rather than by an adversary. We believe that for these scenarios our approach offers significant advantages to formal verification approaches. Going forward, one way the efficiency of our approach could be improved further is by using a more efficient base MCMC kernel in our AMLS estimator, that is, replace line 12 in Algorithm 1 with a more efficient base inference scheme. The current MH scheme was chosen on the basis of simplicity and the fact it already gave effective empirical performance. However, using more advanced inference approaches, such as gradient-based approaches like Langevin Monte Carlo (LMC) BID21 Hamiltonian Monte Carlo , could provide significant speedups by improving the mixing of the Markov chains, thereby reducing the number of required MCMC transitions. We gratefully acknowledge Sebastian Nowozin for suggesting to us to apply multilevel splitting to the problem of estimating neural network robustness. We also thank Rudy Bunel for his help with the COLLISIONDETECTION dataset, and Leonard Berrada for supplying a pretrained DenseNet model. Metropolis-Hastings (MH) is an MCMC method that allows for sampling when one only has access to an unnormalized version of the target distribution BID6. At a high-level, one attempts iteratively proposes local moves from the current location of a sampler and then accepts or rejects this move based on the unnormalized density. Each iteration of this process is known as a MH transition. The unnormalized targets distributions of interest for our problem are γ k (x) where DISPLAYFORM0 A MH transition now consists of proposing a new sample using a proposal x ∼ g(x | x), where x indicates the current state of the sampler and x the proposed state, calculating an acceptance probability, DISPLAYFORM1 and accepting the new sample with probability A k (x | x), returning the old sample if the new one is rejected. The proposal, g(x | x), is a conditional distribution, such as a normal distribution centred at x with fixed covariance matrix. Successive applications of this transition process generates samples which converge in distribution to the target π k (x) and whose correlation with the starting sample diminishes to zero. In our approach, these MH steps are applied independently to each sample in the set, while the only samples used for the AMLS algorithm are the final samples produced from the ing Markov chains. Algorithm 1 has computational cost O(N M K), where the number of levels K will depend on the rareness of the event, with more computation required for rarer ones. Parallelization over N is possible provided that the batches fit into memory, whereas the loops over M and K must be performed sequentially. One additional change we make from the approach outlined by BID9 is that we perform MH updates on all chains in Lines 12, rather than only those that were previously killed off. This helps reduce the build up of correlations over multiple levels, improving performance. Another is that we used an adaptive scheme for g(x |x) to aid efficiency. Specifically, our proposal takes the form of a random walk, the radius of which,, is adapted to keep the acceptance ratio roughly around 0.234 (see BID20). Each chain has a separate acceptance ratio that is average across MH steps, and after M MH steps, for those chains whose acceptance ratio is below 0.234 it is halved, and conversely for those above 0.234, multiplied by 1.02. DISPLAYFORM0 Whereas the exact value of M within the range considered proved to not be especially important when ρ = 0.1, it transpires to have a large impact in the quality of the for larger values of ρ as shown in Figure 4.C.2 PER-SAMPLE ROBUSTNESS MEASURE DURING ROBUST TRAINING FIG5 illustrates the diverse forms that the per-sample robustness measure can take on the 40 datapoints averaged over in Experiment §5.3. We see that different datapoints have quite varying initial levels of robustness, and that the training helps with some points more than others. In one case, the datapoint was still not robust add the end of training for the target perturbation size = 0.1. Figure 4: Mean AMLS estimate relative to naive (unbiased) MC estimate for different M = holding ρ fixed to 0.25 (left) and 0.5 (right), for those properties whose naive MC estimate was greater than log 10 I = −6.5 such that they could be estimated accurately.

We introduce a statistical approach to assessing neural network robustness that provides an informative notion of how robust a network is, rather than just the conventional binary assertion of whether or not of property is violated.

Represent the short summary for finding the corresponding scientific article (long)

We show that a relatively simple black-box adversarial attack scheme using Bayesian optimization and dimension upsampling  is preferable to existing methods when the number of available queries is very low.