Question: represent the text to find a very short summary (1-2 sentences max)

Question: We introduce a model that learns to convert simple hand drawings into graphics programs written in a subset of \LaTeX.~ The model combines techniques from deep learning and program synthesis. We learn a convolutional neural network that proposes plausible drawing primitives that explain an image. These drawing primitives are like a trace of the set of primitive commands issued by a graphics program. We learn a model that uses program synthesis techniques to recover a graphics program from that trace. These programs have constructs like variable bindings, iterative loops, or simple kinds of conditionals. With a graphics program in hand, we can correct errors made by the deep network and extrapolate drawings. Taken together these are a step towards agents that induce useful, human-readable programs from perceptual input. How can an agent convert noisy, high-dimensional perceptual input to a symbolic, abstract object, such as a computer program? Here we consider this problem within a graphics program synthesis domain. We develop an approach for converting hand drawings into executable source code for drawing the original image. The graphics programs in our domain draw simple figures like those found in machine learning papers (see FIG0). The key observation behind our work is that generating a programmatic representation from an image of a diagram involves two distinct steps that require different technical approaches. The first step involves identifying the components such as rectangles, lines and arrows that make up the image. The second step involves identifying the high-level structure in how the components were drawn. In FIG0, it means identifying a pattern in how the circles and rectangles are being drawn that is best described with two nested loops, and which can easily be extrapolated to a bigger diagram. We present a hybrid architecture for inferring graphics programs that is structured around these two steps. For the first step, a deep network to infers a set of primitive shape-drawing commands. We refer FIG8: Both the paper and the system pipeline are structured around the trace hypothesisThe new contributions of this work are: The trace hypothesis: a framework for going from perception to programs, which connects this work to other trace-based models, like the Neural Program Interpreter BID17; BID26 A model based on the trace hypothesis that converts sketches to high-level programs: in contrast to converting images to vectors or low-level parses BID11 BID14 BID24 BID1 BID2. FORMULA8 A generic algorithm for learning a policy for efficiently searching for programs, building on Levin search BID13 and recent work like DeepCoder BID0. Even with the high-level idea of a trace set, going from hand drawings to programs remains difficult. We address these challenges: Inferring trace sets from images requires domain-specific design choices from the deep learning and computer vision toolkits (Sec. 2). FORMULA4 Generalizing to noisy hand drawings, we will show, requires learning a domain-specific noise model that is invariant to the variations across hand drawings (Sec. 2.1). Discovering good programs requires solving a difficult combinatorial search problem, because the programs are often long and complicated (e.g., 9 lines of code, with nested loops and conditionals). We give a domain-general framework for learning a search policy that quickly guides program synthesizers toward the target programs (Sec. 3.1). We developed a deep network architecture for efficiently inferring a trace set, T, from an image, I. Our model combines ideas from Neurally-Guided Procedural Models BID18 and Attend-Infer-Repeat . The network constructs the trace set one drawing command at a time, conditioned on what it has drawn so far. FIG1 illustrates this architecture. We first pass a 256 × 256 target image and a rendering of the trace set so far (encoded as a two-channel image) to a convolutional network. Given the features extracted by the convnet, a multilayer perceptron then predicts a distribution over the next drawing command to add to the trace set (see Tbl. 1). We also use a differentiable attention mechanism (Spatial Transformer Networks:) to let Blue: network inputs. Black: network operations. Red: samples from a multinomial. Typewriter font: network outputs. Renders snapped to a 16 × 16 grid, illustrated in gray. STN (spatial transformer network) is a differentiable attention mechanism. Table 1: Primitive drawing commands currently supported by our model. Circle at (x, y) rectangle(x 1, y 1, x 2, y 2)Rectangle with corners at (x 1, y 1) & (x 2, y 2) line(x 1, y 1, x 2, y 2, arrow ∈ {0, 1}, dashed ∈ {0, 1})Line from (x 1, y 1) to (x 2, y 2), optionally with an arrow and/or dashed STOP Finishes trace set inference the model attend to different regions of the image while predicting drawing commands. We currently constrain coordinates to lie on a discrete 16 × 16 grid, but the grid could be made arbitrarily fine. We train the network by sampling trace sets T and target images I for randomly generated scenes and maximizing the likelihood of T given I with respect to the model parameters, θ, by gradient ascent. We trained the network on 10 5 scenes, which takes a day on an Nvidia TitanX GPU. FIG10: Parsing L A T E X output after training on diagrams with ≤ 12 objects. Model generalizes to scenes with many more objects. Neither SMC nor the neural network are sufficient on their own. # particles varies by model: we compare the models with equal runtime (≈ 1 sec/object) Our network can "derender" random synthetic images by doing a beam search to recover trace sets maximizing DISPLAYFORM0 But, if the network predicts an incorrect drawing command, it has no way of recovering from that error. For added robustness we treat the network outputs as proposals for a Sequential Monte Carlo (SMC) sampling scheme . The SMC sampler is designed to sample from the distribution DISPLAYFORM1, where L(·|·) uses the pixel-wise distance between two images as a proxy for a likelihood. Here, the network is learning a proposal distribution in an amortized way BID15 and using it to invert a generative model (the renderer).Experiment 1: FIG10. To evaluate which components of the model are nec-essary to parse complicated scenes, we compared the neural network with SMC against the neural network by itself or SMC by itself. Only the combination of the two passes a critical test of generalization: when trained on images with ≤ 12 objects, it successfully parses scenes with many more objects than the training data. We compare with a baseline that produces the trace set in one shot by using the CNN to extract features of the input which are passed to an LSTM which finally predicts the trace set token-by-token (LSTM in FIG10). This architecture is used in several successful neural models of image captioning (e.g.,), but, for this domain, cannot parse cluttered scenes with many objects. We trained the model to generalize to hand drawings by introducing noise into the renderings of the training target images. We designed this noise process to introduce the kinds of variations found in hand drawings (see supplement for details).Our neurally-guided SMC procedure used pixel-wise distance as a surrogate for a likelihood function (L(·|·) in section 2). But pixel-wise distance fares poorly on hand drawings, which never exactly match the model's renders. So, for hand drawings, we learn a surrogate likelihood function, L learned (·|·).The density L learned (·|·) is predicted by a convolutional network that we train to predict the distance between two trace sets conditioned upon their renderings. We train our likelihood surrogate to approximate the symmetric difference, which is the number of drawing commands by which two trace sets differ: DISPLAYFORM0 Experiment 2: Figures 5-7. We evaluated, but did not train, our system on 100 real hand-drawn figures; see Fig. 5 -6. These were drawn carefully but not perfectly with the aid of graph paper. For each drawing we annotated a ground truth trace set and had the neurally guided SMC sampler produce 10 3 samples. For 63% of the drawings, the Top-1 most likely sample exactly matches the ground truth; with more samples, the model finds trace sets that are closer to the ground truth annotation FIG3. We will show that the program synthesizer corrects some of these small errors (Sec. 4.1). Although the trace set of a graphics program describes the contents of a scene, it does not encode higher-level features of the image, such as repeated motifs or symmetries. A graphics program better describes such structures. We seek to synthesize graphics programs from their trace sets. We constrain the space of programs by writing down a context free grammar over programs -what in the program languages community is called a Domain Specific Language (DSL) BID16. Our DSL (Tbl. 2) encodes prior knowledge of what graphics programs tend to look like. DISPLAYFORM0 Given the DSL and a trace set T, we want a program that both evaluates to T and, at the same time, is the "best" explanation of T. For example, we might prefer more general programs or, in the spirit of Occam's razor, prefer shorter programs. We wrap these intuitions up into a cost function over programs, and seek the minimum cost program consistent with T: DISPLAYFORM1 We define the cost of a program to be the number of Statement's it contains (Tbl. 2). We also penalize using many different numerical constants; see supplement. The constrained optimization problem in Eq. 2 is intractable in general, but there exist efficient-inpractice tools for finding exact solutions to such program synthesis problems. We use the state-ofthe-art Sketch tool BID20. Sketch takes as input a space of programs, along with a specification of the program's behavior and optionally a cost function. It translates the synthesis problem into a constraint satisfaction problem and then uses a SAT solver to find a minimum-cost program satisfying the specification. Sketch requires a finite program space, which here means that the depth of the program syntax tree is bounded (we set the bound to 3), but has the guarantee that it always eventually finds a globally optimal solution. In exchange for this optimality guarantee it comes with no guarantees on runtime. For our domain synthesis times vary from minutes to hours, with 27% of the drawings timing out the synthesizer after 1 hour. Tbl. 3 shows programs recovered by our system. A main impediment to our use of these general techniques is the prohibitively high cost of searching for programs. We next describe how to learn to synthesize programs much faster (Sec. 3.1), timing out on 2% of the drawings and solving 58% of problems within a minute. figure, and the complicated program in the second figure to bottom. Line BID26 15, BID28 15) Line BID28 9, BID28 13) Line BID27 11, BID27 14) Line BID26 13, BID26 15) Line BID27 14, 6, 14) Line BID28 13, 8, 13) for(i<3) DISPLAYFORM0 Circle BID29 8) Circle BID26 8) Circle Line Circle Line BID27 8, BID28 8) Line BID27 11, BID28 11)... etc....; 21 lines for(i<3) for FORMULA8 if (j>0) line(-3 * j+8,-3 * i+7, -3 * j+9,-3 * i+7) line(-3 * i+7,-3 * j+8, -3 * i+7,-3 * j+9) circle(-3 * j+7,-3 * i+7) 21 6 = 3.5xRectangle BID25 10, BID27 11) Rectangle BID25 12, BID27 13) Rectangle BID28 8, 6, 9) Rectangle BID28 10, 6, 11)... etc....; 16 lines for(i<4) for FORMULA9 rectangle(-3 * i+9,-2 * j+6, -3 * i+11,-2 * j+7) DISPLAYFORM1 Line (3,10,3,14,arrow) Rectangle Rectangle Line (13,10,13,14,arrow)... etc....; 16 lines for(i<3) line (7,1,5 * i+2,3,arrow) for(j<i+1) if(j>0) line(5 * j-1,9,5 * i,5,arrow) line(5 * j+2,5,5 * j+2,9,arrow) rectangle (5 * i,3,5 * i+4,5) rectangle(5 * i,9,5 * i+4,10) rectangle BID26 0, 12, BID25 16 9 = 1.8xCircle BID26 8) Rectangle Circle Rectangle Rectangle BID27 9, BID28 10)... etc....; 9 lines reflect(y=8) for FORMULA8 if (i>0) rectangle (3 * i-1,2,3 * i,3) circle(3 * i+1,3 * i+1) 9 5 = 1.8x We want to leverage powerful, domain-general techniques from the program synthesis community, but make them much faster by learning a domain-specific search policy. A search policy poses search problems like those in Eq. 2, but also offers additional constraints on the structure of the program (Tbl. 4). For example, a policy might decide to first try searching over small programs before searching over large programs, or decide to prioritize searching over programs that have loops. A search policy π θ (σ|T) takes as input a trace set T and predicts a distribution over synthesis problems, each of which is written σ and corresponds to a set of possible programs to search over (so σ ⊆ DSL). Good policies will prefer tractable program spaces, so that the search procedure will terminate early, but should also prefer program spaces likely to contain programs that concisely explain the data. These two desiderata are in tension: tractable synthesis problems involve searching over smaller spaces, but smaller spaces are less likely to contain good programs. Our goal now is to find the parameters of the policy, written θ, which best navigate this trade-off. Given a search policy, what is the best way of using it to quickly find minimum cost programs? We use a bias-optimal search algorithm BID19:Definition: Bias-optimality. A search algorithm is n-bias optimal with respect to a distribution P bias [·] if it is guaranteed to find a solution in σ after searching for at least time n × t(σ) DISPLAYFORM0, where t(σ) is the time it takes to verify that σ contains a solution to the search problem. An example of a 1-bias optimal search algorithm is a time-sharing system that allocates P bias [σ] of its time to trying σ. We construct a 1-bias optimal search algorithm by identifying P bias [σ] = π θ (σ|T) and t(σ) = t(σ|T), where t(σ|T) is how long the synthesizer takes to search σ for a program for T. This means that the search algorithm explores the entire program space, but spends most of its time in the regions of the space that the policy judges to be most promising. Now in theory any π θ (·|·) is a bias-optimal searcher. But the actual runtime of the algorithm depends strongly upon the bias P bias [·]. Our new approach is to learn P bias [·] by picking the policy minimizing the expected bias-optimal time to solve a training corpus, D, of graphics program synthesis problems: DISPLAYFORM1 where σ ∈ BEST(T) if a minimum cost program for T is in σ. Practically, bias optimality has now bought us the following: FORMULA10 a guarantee that the policy will always find the minimum cost program; and FORMULA4 a differentiable loss function for the policy parameters that takes into account the cost of searching, in contrast to e.g. DeepCoder BID0.To generate a training corpus for learning a policy which minimizes this loss, we synthesized minimum cost programs for each trace set of our hand drawings and for each σ. We locally minimize this loss using gradient descent. Because we want to learn a policy from only 100 hand-drawn diagrams, we chose a simple low-capacity, bilinear model for a policy: DISPLAYFORM2 where φ params (σ) is a one-hot encoding of the parameter settings of σ (see Tbl. 4) and φ trace (T) extracts a few simple features of the trace set T; see supplement for details. Experiment 3: Figure 8. We compare synthesis times for our learned search policy with two alternatives: Sketch, which poses the entire problem wholesale to the Sketch program synthesizer; and an Oracle, a policy which always picks the quickest to search σ also containing a minimum cost program. Our approach improves upon Sketch by itself, and comes close to the Oracle's performance. One could never construct this Oracle, because the agent does not know ahead of time which σ's contain minimum cost programs nor does it know how long each σ will take to search. With this learned policy in hand we can synthesize 58% of programs within a minute. Solve the problem piece-by-piece or all at once? {True, False} Maximum depth Bound on the depth of the program syntax tree {1, 2, 3} Why synthesize a graphics program, if the trace set already suffices to recover the objects in an image? Within our domain of hand-drawn figures, graphics program synthesis has several uses: The program synthesizer corrects errors made by the neural network by favoring trace sets which lead to more concise or general programs. For example, figures with perfectly aligned objects are preferable, and precise alignment lends itself to short programs. Concretely, we run the program synthesizer on the Top-k most likely trace sets output by the neurally guided sampler. Then, the system reranks the Top-k by the prior probability of their programs. The prior probability of a program is learned by picking the prior maximizing the likelihood of the ground truth trace sets; see supplement for details. But, this procedure can only correct errors when a correct trace set is in the Top-k. Our sampler could only do better on 7/100 drawings by looking at the Top-100 samples (see FIG3), precluding a statistically significant analysis of how much learning a prior over programs could help correct errors. But, learning this prior does sometimes help correct mistakes made by the neural network; see Fig. 9 for a representative example of the kinds of corrections that it makes. See supplement for details. Having access to the source code of a graphics program facilitates coherent, high-level image editing. For example we can extrapolate figures by increasing the number of times that loops are executed. Extrapolating repetitive visuals patterns comes naturally to humans, and is a practical application: imagine hand drawing a repetitive graphical model structure and having our system automatically induce and extend the pattern. FIG0 shows extrapolations produced by our system. Program Induction: Our approach to learning to search for programs draws theoretical underpinnings from Levin search BID13 BID21 ) and Schmidhuber's OOPS model . DeepCoder BID0 ) is a recent model which, like ours, learns to predict likely program components. Our work differs because we treat the problem as metareasoning, identifying and modeling the trade-off between tractability and probability of success. TerpreT systematically compares constraint-based program synthesis techniques against gradient-based search techniques, like those used to train Differentiable Neural Computers BID9. The TerpreT experiments motivate our use of constraint-based techniques. Deep Learning: Our neural network bears resemblance to the Attend-Infer-Repeat (AIR) system, which learns to decompose an image into its constituent objects BID5. AIR learns an iterative inference scheme which infers objects one by one and also decides when to stop inference. Our network differs in its architecture and training regime: AIR learns a recurrent auto-encoding model via variational inference, whereas our parsing stage learns an autoregressive-style model from randomly-generated (trace, image) pairs. IM2LATEX BID2 ) is a recent work that also converts images to L A T E X. Their goal is to derender L A T E X equations, which recovers a markup language representation. Our goal is to go from noisy input to a high-level program, which goes beyond markup languages by supporting programming constructs like loops and conditionals. Recovering a high-level program is more challenging than recovering markup because it is a highly under constrained symbolic reasoning problem. Our image-to-trace parsing architecture builds on prior work on controlling procedural graphics programs BID18. We adapt this method to a different visual domain (figures composed of multiple objects), using a broad prior over possible scenes as the initial program and viewing the trace through the guide program as a symbolic parse of the target image. We then show how to efficiently synthesize higher-level programs from these traces. In the computer graphics literature, there have been other systems which convert sketches into procedural representations. One uses a convolutional network to match a sketch to the output of a parametric 3D modeling system BID11. Another uses convolutional networks to support sketch-based instantiation of procedural primitives within an interactive architectural modeling system BID14. Both systems focus on inferring fixed-dimensional parameter vectors. In contrast, we seek to automatically infer a structured, programmatic representation of a sketch which captures higher-level visual patterns. Hand-drawn sketches: Prior work has also applied sketch-based program synthesis to authoring graphics programs. Sketch-n-Sketch is a bi-directional editing system in which direct manipulations to a program's output automatically propagate to the program source code BID10. We see this work as complementary to our own: programs produced by our method could be provided to a Sketch-n-Sketch-like system as a starting point for further editing. The CogSketch system BID6 ) also aims to have a high-level understanding of handdrawn figures. Their primary goal is cognitive modeling (they apply their system to solving IQ-test style visual reasoning problems), whereas we are interested in building an automated AI application (e.g. in our system the user need not annotate which strokes correspond to which shapes; our neural network produces something equivalent to the annotations).The Trace Hypothesis: The idea that an execution trace could assist in program learning goes back to the 1970's BID22 and has been applied in neural models of program induction, like Neural Program Interpreters BID17, or DeepCoder, which predicts what functions occur in the execution trace BID0. Our contribution to this idea is the trace hypothesis: that trace sets can be inferred from perceptual data, and that the trace set is a useful bridge between perception and symbolic representation. Our work is the first to articulate and explore this hypothesis by demonstrating how a trace could be inferred and how it can be used to synthesize a high-level program. We have presented a system for inferring graphics programs which generate L A T E X-style figures from hand-drawn images. The system uses a combination of deep neural networks and stochastic search to parse drawings into symbolic trace sets; it then feeds these traces to a general-purpose program synthesis engine to infer a structured graphics program. We evaluated our model's performance at parsing novel images, and we demonstrated its ability to extrapolate from provided drawings. In the near future, we believe it will be possible to produce professional-looking figures just by drawing them and then letting an artificially-intelligent agent write the code. More generally, we believe the trace hypothesis, as realized in our two-phase system-parsing into trace sets, then searching for a low-cost symbolic program which generates those traces-may be a useful paradigm for other domains in which agents must programmatically reason about noisy perceptual input. Concretely, we implemented the following scheme: for an image I, the neurally guided sampling scheme of section 3 of the main paper samples a set of candidate traces, written F(I). Instead of predicting the most likely trace in F(I) according to the neural network, we can take into account the programs that best explain the traces. WritingT (I) for the trace the model predicts for image I, DISPLAYFORM0 where P β [·] is a prior probability distribution over programs parameterized by β. This is equivalent to doing MAP inference in a generative model where the program is first drawn from P β [·], then the program is executed deterministically, and then we observe a noisy version of the program's output, where L learned (I|render(·)) × P θ [·|I] is our observation model. Given a corpus of graphics program synthesis problems with annotated ground truth traces (i.e. (I, T) pairs), we find a maximum likelihood estimate of β: DISPLAYFORM1 where the expectation is taken both over the model predictions and the (I, T) pairs in the training corpus. We define P β [·] to be a log linear distribution ∝ exp(β · φ(program)), where φ(·) is a feature extractor for programs. We extract a few basic features of a program, such as its size and how many loops it has, and use these features to help predict whether a trace is the correct explanation for an image. We synthesized programs for the top 10 traces output by the deep network. Learning this prior over programs can help correct mistakes made by the neural network, and also occasionally introduces mistakes of its own; see FIG0 for a representative example of the kinds of corrections that it makes. On the whole it modestly improves our Top-1 accuracy from 63% to 67%. Recall that from Fig. 6 of the main paper that the best improvement in accuracy we could possibly get is 70% by looking at the top 10 traces. We measure the similarity between two drawings by extracting features of the best programs that describe them. Our features are counts of the number of times that different components in the DSL were used. We project these features down to a 2-dimensional subspace using primary component analysis (PCA); see FIG8. One could use many alternative similarity metrics between drawings which would capture pixel-level similarities while missing high-level geometric similarities. We used our learned distance metric between traces, L learned (·|·), and projected to a 2-dimensional subspace using multidimensional scaling (MDS: FORMULA10). This reveals similarities between the objects in the drawings, while missing similarities at the level of the program. Recall from the main paper that our goal is to estimate the policy minimizing the following loss: DISPLAYFORM0 where σ ∈ BEST(T) if a minimum cost program for T is in σ. We make this optimization problem tractable by annealing our loss function during gradient descent: DISPLAYFORM1 where DISPLAYFORM2 Notice that SOFTMINIMUM β=∞ (·) is just min(·). We set the regularization coefficient λ = 0.1 and minimize equation 4 using Adam for 2000 steps, linearly increasing β from 1 to 2.We parameterize the space of policies as a simple log bilinear model: DISPLAYFORM3 where: DISPLAYFORM4 For the model in FIG10, the distribution over the next drawing command factorizes as: DISPLAYFORM0 where t 1 t 2 · · · t K are the tokens in the drawing command, I is the target image, T is a trace set, θ are the parameters of the neural network, f θ (·, ·) is the image feature extractor (convolutional network), and a θ (·|·) is an attention mechanism. The distribution over traces factorizes as: DISPLAYFORM1 where |T | is the length of trace T, the subscripts on T index drawing commands within the trace (so T n is a sequence of tokens: t 1 t 2 · · · t K), and the STOP token is emitted by the network to signal that the trace explains the image. The convolutional network takes as input 2 256 × 256 images represented as a 2 × 256 × 256 volume. These are passed through two layers of convolutions separated by ReLU nonlinearities and max pooling:• Layer 1: 20 8 × 8 convolutions, 2 16 × 4 convolutions, 2 4 × 16 convolutions. Followed by 8 × 8 pooling with a stride size of 4.• Layer 2: 10 8 × 8 convolutions. Followed by 4 × 4 pooling with a stride size of 4. Given the image features f, we predict the first token (i.e., the name of the drawing command: circle, rectangle, line, or STOP) using logistic regression: DISPLAYFORM0 where W t1 is a learned weight matrix and b t1 is a learned bias vector. Given an attention mechanism a(·|·), subsequent tokens are predicted as: DISPLAYFORM1 Thus each token of each drawing primitive has its own learned MLP. For predicting the coordinates of lines we found that using 32 hidden nodes with sigmoid activations worked well; for other tokens the MLP's are just logistic regression (no hidden nodes).We use Spatial Transformer Networks as our attention mechanism. The parameters of the spatial transform are predicted on the basis of previously predicted tokens. For example, in order to decide where to focus our attention when predicting the y coordinate of a circle, we condition upon both the identity of the drawing command (circle) and upon the value of the previously predicted x coordinate: DISPLAYFORM2 So, we learn a different network for predicting special transforms for each drawing command (value of t 1) and also for each token of the drawing command. These networks (MLP t1,n in equation 11) have no hidden layers and output the 6 entries of an affine transformation matrix; see FORMULA4 for more details. Training takes a little bit less than a day on a Nvidia TitanX GPU. The network was trained on 10 5 synthetic examples. We compared our deep network with a baseline that models the problem as a kind of image captioning. Given the target image, this baseline produces the program trace in one shot by using a CNN to extract features of the input which are passed to an LSTM which finally predicts the trace token-by-token. This general architecture is used in several successful neural models of image captioning (e.g., FORMULA9).Concretely, we kept the image feature extractor architecture (a CNN) as in our model, but only passed it one image as input (the target image to explain). Then, instead of using an autoregressive decoder to predict a single drawing command, we used an LSTM to predict a sequence of drawing commands token-by-token. This LSTM had 128 memory cells, and at each time step produced as output the next token in the sequence of drawing commands. It took as input both the image representation and its previously predicted token. Our architecture for L learned (render(T 1)|render(T 2)) has the same series of convolutions as the network that predicts the next drawing command. We train it to predict two scalars: |T 1 − T 2 | and |T 2 − T 1 |. These predictions are made using linear regression from the image features followed by a ReLU nonlinearity; this nonlinearity makes sense because the predictions can never be negative but could be arbitrarily large positive numbers. We train this network by sampling random synthetic scenes for T 1, and then perturbing them in small ways to produce T 2. We minimize the squared loss between the network's prediction and the ground truth symmetric differences. T 1 is rendered in a "simulated hand drawing" style which we describe next. We introduce noise into the L A T E X rendering process by:• Rescaling the image intensity by a factor chosen uniformly at random from [0. 5, 1.5] • Translating the image by ±3 pixels chosen uniformly random• Rendering the L A T E X using the pencildraw style, which adds random perturbations to the paths drawn by L A T E Xin a way designed to resemble a pencil.• Randomly perturbing the positions and sizes of primitive L A T E Xdrawing commands 6 LIKELIHOOD SURROGATE FOR SYNTHETIC DATA For synthetic data (e.g., L A T E X output) it is relatively straightforward to engineer an adequate distance measure between images, because it is possible for the system to discover drawing commands that Figure 5: Example synthetic training data exactly match the pixels in the target image. We use: DISPLAYFORM0 where α, β are constants that control the trade-off between preferring to explain the pixels in the image (at the expense of having extraneous pixels) and not predicting pixels where they don't exist (at the expense of leaving some pixels unexplained). Because our sampling procedure incrementally constructs the scene part-by-part, we want α > β. That is, it is preferable to leave some pixels unexplained; for once a particle in SMC adds a drawing primitive to its trace that is not actually in the latent scene, it can never recover from this error. In our experiments on synthetic data we used α = 0.8 and β = 0.04. We generated synthetic training data for the neural network by sampling L A T E X code according to the following generative process: First, the number of objects in the scene are sampled uniformly from 1 to 12. For each object we uniformly sample its identity (circle, rectangle, or line). Then we sample the parameters of the circles, than the parameters of the rectangles, and finally the parameters of the lines; this has the effect of teaching the network to first draw the circles in the scene, then the rectangles, and finally the lines. We furthermore put the circle (respectively, rectangle and line) drawing commands in order by left-to-right, bottom-to-top; thus the training data enforces a canonical order in which to draw any scene. To make the training data look more like naturally occurring figures, we put a Chinese restaurant process prior FORMULA14 over the values of the X and Y coordinates that occur in the execution trace. This encourages reuse of coordinate values, and so produces training data that tends to have parts that are nicely aligned. In the synthetic training data we excluded any sampled scenes that had overlapping drawing commands. As shown in the main paper, the network is then able to generalize to scenes with, for example, intersecting lines or lines that penetrate a rectangle. When sampling the endpoints of a line, we biased the sampling process so that it would be more likely to start an endpoint along one of the sides of a rectangle or at the boundary of a circle. If n is the number of points either along the side of a rectangle or at the boundary of a circle, we would sample an arbitrary endpoint with probability 2 2+n and sample one of the "attaching" endpoints with probability 1 2+n. See FIG3 for examples of the kinds of scenes that the network is trained on. For readers wishing to generate their own synthetic training sets, we refer them to our source code at: redactedForAnonymity.com. We seek the minimum cost program which evaluates to (produces the drawing primitives in) an execution trace T: DISPLAYFORM0 Programs incur a cost of 1 for each command (primitive drawing action, loop, or reflection). They incur a cost of 1 3 for each unique coefficient they use in a linear transformation beyond the first coefficient. This encourages reuse of coefficients, which leads to code that has translational symmetry; rather than provide a translational symmetry operator as we did with reflection, we modify what is effectively a prior over the space of program so that it tends to produce programs that have this symmetry. Programs also incur a cost of 1 for having loops of constant length 2; otherwise there is often no pressure from the cost function to explain a repetition of length 2 as being a reflection rather a loop. Below we show our full data set of drawings. The leftmost column is a hand drawing. The middle column is a rendering of the most likely trace discovered by the neurally guided SMC sampling scheme. The rightmost column is the program we synthesized from a ground truth execution trace of the drawing. Note that because the inference procedure is stochastic, the top one most likely sample can vary from run to run. Below we report a representative sample from a run with 2000 particles. line(6,2,6,3, arrow = False,solid = True); line(6,2,3,2, arrow = True,solid = True); reflect(y = 9){line BID27 7, BID29 BID29, arrow = True,solid = True); rectangle BID25 BID25 BID27 BID27; rectangle; rectangle } for (i < 2){line (8, 8, BID27 8, arrow = True,solid = False); line(-2 * i + 12,5,-2 * i + 13,5 arrow = True,solid = True); line (6, BID29 7, BID29, arrow = True,solid = True); line(3,-6 * i + 8,5,-2 * i + 6, arrow = True,solid = True); rectangle(-2 * i + 13,4,-2 * i + rectangle (1,-6 * i + 7,3,-6 * i}; circle; rectangle BID29 BID27 6, 7); rectangle; line (8, 6, 8, 8, arrow = False, solid = False) reflect(y = 7){line BID26 6, BID28 BID28, arrow = True,solid = True); rectangle }; rectangle BID28 BID26 6, BID29 line (7, BID29 9, BID29, arrow = True,solid = True); rectangle BID29 BID27 7, 7); rectangle; reflect(y = 10){circle; line BID27 BID26 BID29 BID28, arrow = True,solid = True); rectangle BID25 BID25 BID27 BID27 } line(10,1,2,1, arrow = True,solid = False); line(10,1,10,3, arrow = False,solid = False); line (7, BID28 9, BID28, arrow = True,solid = True); reflect(y = 8){circle; line BID26 BID25 BID28 BID27, arrow = True,solid = True); rectangle; rectangle } line(12,9,12,0, arrow = True,solid = True); rectangle (9, BID27 11, 9); rectangle (6, BID29 8, 9); rectangle; rectangle BID27 8, BID29 9) for (i < 3){for (j < (1 * i + 1)){if (j > 0){line(3 * j + -3,3 * i + -2,3 * j arrow = False,solid = True); line(0,3 * j + -2,3 * j + -3,4, arrow = False,solid = True) } rectangle (2,0,5, rectangle (0, 0, BID27 BID28 circle BID25 BID25 reflect(x = 7){circle; line(6,2,6,5, arrow = False,solid = True); rectangle BID29 BID29 7, 7) }; line BID26 6, BID29 6, arrow = False,solid = True); line BID26 BID25 BID29 BID25 arrow = False, solid = True) line (BID28 BID28 6, 6); rectangle(4 * i,0,4 * i + 2,2) }; rectangle (8, BID28 10, 6) for (BID29 7, BID29 6, arrow = True,solid = True); line BID27 BID27 BID27 BID26 arrow = True, solid = True); line BID25 7, BID25 6, arrow = True,solid = True); rectangle (0, BID27 6, 6); rectangle BID26 0, BID28 BID26; rectangle line (BID28 6, 6, 6, arrow = True,solid = True); line BID26 10, BID26 8, arrow = True,solid = True); rectangle BID25 0, BID27 BID26 }; rectangle (0, BID28 BID28 8) reflect(y = 9){reflect(x = 9){circle; line BID27 8, 6, 8, arrow = False,solid = True); line BID25 BID27 BID25 6, arrow = False,solid = True) } } reflect(x = 11){rectangle; reflect(y = 11){rectangle (8, 0, 11, BID27 ; rectangle } } for (i < 3){line(2 * i,-2 * i + 5,2 * i + 2, arrow = False,solid = True); line(2 * i + 1,-2 * i + 4,2 * i arrow = False,solid = True) } rectangle BID28 BID25 6, BID26; rectangle; reflect(y = 10){rectangle (0, 0, BID27 BID27 ; rectangle BID25 BID28 BID26 6) } line(7,4,9,4, arrow = True,solid = True); line (8, BID27 7, BID27, arrow = True,solid = True); reflect(y = 7){line BID26 BID25 BID28 BID27, arrow = True,solid = True); rectangle }; line(8,3,9,3, arrow = False,solid = True); rectangle; rectangle BID28 BID26 7, BID29 for (BID25 BID25 BID27 BID27 ; rectangle BID25 BID29 BID27 7) circle BID25 BID29 (0, BID28 BID29 6) circle BID27 BID25; reflect(x = 6){circle BID29 BID29 ; circle BID25 9); line BID29 BID28 BID27 BID26, arrow = True,solid = True); line BID29 8, BID26 BID29, arrow = True,solid = True); line BID25 8, BID25 6, arrow = True,solid = True) } for (i < 3){line(7,1,5 * i + 2,3, arrow = True,solid = True); for (j < (1 * i + 1)){if (j > 0){line(5 * j + -1,9,5 * i,5, arrow = True,solid = True) } line(5 * j + 2,5,5 * j + 2,9, arrow = True,solid = True) }; rectangle (5 * i,3,5 * i + 4,5); rectangle(5 * i,9,5 * i + 4,10) }; rectangle BID26 0, 12, BID25 reflect(y = 8){for (i < 3){circle(-3 * i + 7,-3 * i + 7) }; rectangle BID26 BID26 BID27 BID27; rectangle BID29 BID29 6, 6 BID25 8); reflect(x = 10){line(6,1,9,3, arrow = False,solid = True); line BID26 8, BID28 8, arrow = False,solid = True); line(9,5,9,7, arrow = False,solid = True); rectangle }; rectangle BID28 7, 6, 9) line BID27 BID26 BID29 BID28, arrow = True,solid = True); line(6,6,6,5, arrow = True,solid = True); line (8, BID27 7, BID28, arrow = True,solid = True); line BID28 0, 12, 8 BID25 8, BID28 BID29 arrow = True, solid = True) reflect(x = 14){circle; circle BID27 BID28; circle; reflect(y = 20){circle; circle }; line BID27 BID27 7, BID26, arrow = True,solid = True); line(10,10,5,8, arrow = True,solid = True); reflect(x = 6){line BID29 12, BID27 11, arrow = True,solid = True); line BID25 6, BID27 BID29, arrow = True,solid = True); line BID27 9, BID29 8, arrow = True,solid = True) } } circle FIG0; circle; rectangle (6, 0, 8, BID26 ; rectangle (9, 0, 11, BID26 Solver timeout reflect(x = 10){circle; circle BID26 BID28; line (2,3,5,2, BID26 BID28 BID28 6); rectangle BID25 0, 13, 9); line(9,6,9,8, arrow = False,solid = True); line(6,4,7,5, arrow = False,solid = True); line(10,5,12,5, arrow = False,solid = True); line BID27 BID25 BID27 BID28, arrow = False,solid = True) circle; for (i < 3){circle(5 * i + 1,7) }; line BID29 7, BID26 7, arrow = True,solid = True); line(6,6,6,3, arrow = True,solid = True); line(10,7,7,7, arrow = True,solid = True); rectangle BID28 0, 8, 9) reflect (BID25 9); for (i < 4){circle(-2 * i + 9,-2 * i + 9) } } for (i < 3){circle(1,-4 * i + 9); circle(5,-4 * i + 9); for (j < 3){if (j > 0){line(4 * i + -3,-4 * j + 10,4 * arrow = False,solid = True) } line(2,-4 * j + 9,4,-4 * j + 9, arrow = False,solid = True) } } circle; circle; circle BID26 11); line BID26 BID29 BID26 BID27, arrow = True,solid = True); line(2,10,2,7, arrow = True,solid = True); rectangle (0, 0, BID28 9) for (i < 2){circle(4,6 * i + 1); circle(1,6 * i + 4); rectangle(0,6 * i,2,6 * i + 2); rectangle (3,6 * i + 3,5,6 * i +}

Learn to convert a hand drawn sketch into a high-level program

Represent the short summary for finding the corresponding scientific article (long)

To understand the information stored in the latent space, we train a GAN-style decoder constrained to produce images that the VAE encoder will map to the same region of latent space.


Question: Represent the text to find a very short summary (1-2 sentences max)

Question: Adversarial examples remain an issue for contemporary neural networks. This paper draws on Background Check , a technique in model calibration, to assist two-class neural networks in detecting adversarial examples, using the one dimensional difference between logit values as the underlying measure. This method interestingly tends to achieve the highest average recall on image sets that are generated with large perturbation vectors, which is unlike the existing literature on adversarial attacks . The proposed method does not need knowledge of the attack parameters or methods at training time, unlike a great deal of the literature that uses deep learning based methods to detect adversarial examples, such as , imbuing the proposed method with additional flexibility. Adversarial examples are specially crafted input instances generated by adversarial attacks. The term was introduced by BID23 in the context of image classification. These attacks generate, or manipulate data, to achieve poor performance when classified by neural networks, which poses existential questions about their usage in high stakes security critical applications. Since they were introduced, there have been many papers that have introduced novel attack methods and other papers that attempt to combat those attacks. For instance, BID5 introduces the fast gradient sign method (FGSM), and BID20 proposes a method based on modifying the gradient of the softmax function as a defence. Adversarial attacks can be identified into various classes such as white box and black box, where in the former, the attack has full knowledge of all model parameters. Examples created by these attacks can be false positives or false negatives. In the case of images, they can be nonsensical data (e.g. noise classified as a road sign) or clear cut (e.g. a visually clear cat, classified as a road sign). These attacks can be non-targeted or targeted such that the classifier chooses a specific class for the adversarial example. Various adversarial defences exist, some based on deep learning techniques and others on purely distributional techniques. Similar work on adversarial defences has been done by BID6, in which the network is trained on specific attack types and parameters with an additional outlier class for adversarial examples. A multi-dimensional statistical test over the maximum mean discrepancy and the energy distance on input features is then used to classify instances as adversarial. Other work has been done by BID0, where Gaussian Processes are placed on top of conventional convolutional neural network architectures, with radial basis kernels, imbuing the neural network with a way of understanding its own perceptual limits. The authors find that the network becomes more resistant to adversarial attack. The work that follows continues in a similar vein to both of these methods. Some methods such as BID14 use sub-units of deep learning architectures to detect adversarial instances. Calibration is a technique of converting model scores, normally, through application of a post processing function, to probability estimates. Background Check is a method to yield probability estimates, via a set of explicit assumptions, in regions of space where no data has been observed. In this work, Background Check is useful in producing calibrated probabilities for adversarial data that often exists in regions where no training and test data has been seen. Reliable probability estimates can then be measured by calibration and refinement loss. Various calibrating procedures exist such as binning, logistic regression, isotonic regression and softmax. BID8 demonstrates the logistic function is optimal when the class-conditional densities are Gaussians with unit variance. Softmax extends this to multi-variate Gaussian densities with unit variance. Calibration of neural network models has been performed by BID7, using a method called Temperature Scaling, that modifies the gradient of the softmax function allowing softmax to calibrate densities with non-unit variance. The authors perform this calibration after noticing that calibration loss for neural networks has increased in recent years. When adversarial attacks against neural networks are brought into perspective, a problem arises for existing calibration techniques, which is the question of mapping adversarial logit scores to reliable probability estimates (which should be zero for a successful adversarial attack). In this work, a method is demonstrated that uses Background Check to identify adversarial attacks. A classifier is said to be well calibrated, if, as the number of predictions approaches infinity, the proportion of outcomes given probability p, occur p fraction of the time. Denoting x 1, x 2,..., x n as data-set instances and y 1, y 2,..., y n as their corresponding ground truth class labels, a scoring classifier s = f (x i) has a calibrating function µ applied to it yielding µ(f (x i)). Perfect calibration is defined as the expectation DISPLAYFORM0 where random variables X, Y denote the features and class label of a uniformly randomly drawn instance from the dataset respectively, such that Y = 1, Y = 0 represent an individual positive and negative instance, respectively. To visualize calibration performance of a classifier, BID17 plots the observed frequency of an event against the predicted frequency yielding calibration curves. Calibration curves plot the observed relative frequency against the predicted probability for all test data. Perfect calibration occurs if the calibration curve exactly fits the identity line. Refinement loss measures the difference between a probability estimate and zero or one. This can be combined with a frequency distribution, giving an indication of spread, which is useful if there are few events associated with a particular probability. The notion of refinement is also useful when considering calibration. By considering the crude constant classifier, which predicts the probability corresponding to the class distribution for all inputs, it is clear that this calibration estimate is perfectly calibrated. However, an intuitively more valuable calibration estimate, is one which predicts a value closer to either zero or one. For this reason, BID3 suggests measuring refinement loss, which measures the distance of the classifiers probability estimates to either zero or one. Together, calibration and refinement loss make up the Brier Score. BID10 defines calibration and refinement loss. DISPLAYFORM1 ] is the loss due to the expected difference between the model score S and the proportion of positives among instances (observed relative frequency) with the same score. ] is the loss due to the presence of instances from multiple classes among instances with the same estimate S. In the worst case, this clearly reduces to the crude constant classifier mentioned above. An instance of recent work related to calibration is Beta calibration. Beta calibration BID11 is based on the beta distribution which includes functions such as the logit, sigmoid and identity. This allows it to calibrate scores produced by models such as naive bayes, which biases its scores towards extremities when the assumption of feature independence is not met, using the inverse sigmoid or logit function, a function which is not in softmax's repertoire. In the context of adversarial attacks, the optimization problem that is often formulated to construct adversarial examples is shown. formed example, subject to the constraints above. Intuitively, these constraints coerce the network into mis-classifying each example with a minimal perturbation vector. Example distance metrics that measure the size of the perturbation include L p metrics, as well as the PASS score BID22, a metric designed to better reflect notions of psycho-physical similarity than L p metrics. Adversarial attack methods include L-BFGS from BID23, which uses linear trial and error to find a c for each data instance such that c multiplied by an arbitrary small perturbation vector mis-classifies the instance. FGSM builds on the L-BFGS method, replacing expensive linear search with gradient descent to find the perturbation vector. This uses the following optimization strategy to create the perturbation vector η, such that x is the input to the model, y is the predicted class, θ are the model parameters and J(θ, x, y) is the cost function. x indicates the derivative of the cost function is taken with respect to the input x. The sign function takes the sign of the ing derivative. The adversarial example is then constructed as x = x + η. DISPLAYFORM0 A momentum term can be added to the gradient descent process to yield the work of BID4. The BIM attack by BID12, uses a smaller noise vector produced by FGSM, applied iteratively, before a clip operation is applied to the ing image, keeping it within the maximum image pixel values after each iteration. JSMA is a forward derivative approach, by BID19, which uses a Jacobian matrix, to produce an adversarial saliency map, which indicate the features that when (positively or negatively) perturbed, most efficiently achieve a desired network output. DeepFool BID16 finds an image that is at a minimal distance to the decision boundary from the proposed example, to another target class which isn't the source class, treating multi-class classifiers as combinations of binary affine classifiers. Background Check, introduced by BID21, is the calibrating procedure that our proposed method uses to defend neural networks from adversarial attacks. Background Check takes as input, the scores from logit vectors and maps them to probabilities, replacing softmax after training. Background Check provides a framework to classify regions where no previous data has been seen as regions, that in the context of the proposed method will be classified as regions where adversarial data may lie. Background Check also provides a framework to resolve ambiguity inherent in a single value representing probability. More specifically, Background Check provides two values to represent a single probability value of a data instance. One value represents distance from the data density, and another represents the certainty of a particular class. This approach avoids overloading the meaning of a single number representing probability. More specifically, an uncertainty of 1 /n for all classes, could represent an instance very close to the decision boundary or very far away from training data. On the other hand, an output of zero, could represent a point very far away from training data or a classification that the data is definitely not that particular class. Background Check introduces an additional outlier class, b, representing regions of space where data is sparse or non-existent. Then, a foreground class is introduced, f. This represents regions of space where data is plentiful or dense, i.e. data from any class apart from the class, is abundant. b is introduced as an additional class whilst f is kept as a reference class. Every instance x necessarily belongs to either f or b. P (b|x) = 0 and P (f |x) = 1 refers to absolute certainty that the instance belongs to one of the classes with sufficient training data, where P (C|x) is a conditional probability measure. The ratio of the two conditional measures defines the reliability factor r(x). DISPLAYFORM0 If r(x) ≤ 1, the classification that the reliability factor indicates is b, else if r(x) > 1 then the classification is f. P (x, f) and P (x, b) are referred to as the foreground and densities. Furthermore, the relative foreground and densities can be defined, q f (x) and q b (x). DISPLAYFORM1 Intuitively, the relative density outputs the proportion of f or b, at the point in space corresponding to the instance x being evaluated. Simple dividing q f (x) by q b (x) yields r(x). DISPLAYFORM2 To construct q b (x), four inductive biases, in increasing strength, are given. This work only uses the third inductive bias.1. Inductive bias 1: q b (x) is a function of q f (x). This is justified, by the idea that with no other information, there is no reason to assign different densities to points with the same foreground density. The domain knowledge informs the function used µ: DISPLAYFORM3 2. Inductive bias 2: monotonicity of µ, that is, when moving to a region with higher foreground density the increases or decreases.3. Inductive bias 3: an affine bias, i.e. µ(x) = ax + b or by replacing a and b: DISPLAYFORM4 4. Inductive bias 4: constant ie µ, µ = 0.5. The key notion in Background Check is the implementation of the inductive bias that shapes q b. This implementation is provided in two different different ways.1. BCD: referred to as the discriminative approach, involves generating artificial instances around foreground data and then training a binary discriminative classifier to separate them. The instances are generated in a hypercube or a hypersphere, such that the is half as dense as max x P (x, f).2. BCF: referred to as the familiarity approach, this involves fitting a one class model on the foreground data to obtain q f, then using an inductive bias to obtain q b. The data, x, that is being fit must have an underlying measure. The familiarity factor r(x) can be found, allowing, the posterior probabilities P (b|x) and P (f |x) to be computed. The implementation that the proposed method in this work uses, is the BCF method for its speed in high dimensional spaces. The measure underlying the space was the one-dimensional L 1 difference between elements of the logit vector. For instance, given a two-class score vector [−5, 5], then the score difference is 10. This measure represents the distance of a data point to the softmax decision boundary. The one-class model used to fit q f (x) was a gamma function optimized using maximum likelihood estimation. To establish the link from q f (x) to q b (x), the third inductive bias was used with µ = 1 and µ = 0, with domain knowledge informing the use of a power value. This link manifests itself in the equation below. DISPLAYFORM0 One neural network for each attack type, parameter combination and dataset, is trained with the Adam optimizer . A batch size of 256 and a learning rate of 0.001 is employed. The biases of the neurons are set to 0 and the weights are sampled uniformly at random Figure 1: Background Check applied to the score difference of two, two class neural network logit vectors (one network each for the top and bottom figures). The training, test and adversarial images, in blue, orange and green, respectively, are organised into ten bins each. The adversarial data for the top figure was generated by the momentum attack, with very large perturbations applied. The bottom figure has adversarial data crafted by the JSMA attack with a moderate perturbation vector applied. The green line represents q f, the foreground relative density and q b represents the relative density. It is clear, that the adversarial images in both cases are distinctly separated from the training and test data, which overlap to the point of in-distinguishability. In the top figure, the adversarial images have logit differences much larger than the training/test data compared to much smaller logit differences for the bottom figure. from the interval. Each neural network is tasked with classifying a variety of paired class combinations from the CIFAR10 dataset. These pairs were: dog versus plane (DVP), fish vs ship (FVS) and airplane vs horse (AVH). Regularization techniques such as L 2 regularization and dropout, with p = 0.5 were applied to the networks. The training vs test ratio is 5:1, such that each class has exactly 1000 test images and 5000 training images. The images were pre-processed such that all image pixel values were floating point values between zero and one, rather than values between 0 and 255. Seven different adversarial attacks, from the cleverhans API BID18, were tested against the networks with a variety of parameter combinations. The adversarial images were generated from test data. The attacks were all white-box attacks and performed on the network which included a final softmax layer in its structure. The final two-class average recall of each network on the validation set of the network was always above 80% after only 300 iterations over the training data. The attacks had different effects on each image, for identical parameter settings and as such, the parameters were subjectively chosen based on whether the image fell into one of four classes. Some attacks, due to a mixture of constraints and difficulty in searching the adversarial image space, only had images in one or two of the available classes.1. Large -Image consists entirely of noise.2. Typical -Moderate noise levels, underlying image recognizable.3. Small -Recognizable noise, but clear image.4. Very Small -No noticeable noise, clear image. For instance, BIM an iterative method had 10 iterations, with: 0.8 and i: 0.05, for a large perturbation vector, yet the method from BID15, a non-iterative method had: 12.0. The full parameter settings are listed in the appendix. The average recall, defined in the equation below, rather than accuracy, is evaluated due to the presence of varying class proportions. The 2-class average recall is on the two classes in CIFAR-10. The 3-class average recall includes the adversarial class. DISPLAYFORM0 The table of demonstrates that large perturbation vectors, associate with a mean reduction in average recall of 11.6, whereas for very small perturbation vectors, the mean reduction in average recall is 35.7. Typical perturbation vectors have a mean reduction in average recall of 6.9. In all cases except for two, the average recall decreases. It is clear that the adversarial TPR generally increases as the size of the perturbation vector increases. In particular, three out of the five large perturbation vectors achieve a TPR on the adversarial class of 100%. All models achieve higher average recall than the baseline, which was simply a strategy that with uniform randomness guesses the class. In order to visualize areas where Background Check assigns foreground and densities, it is helpful to construct histograms. When constructing histograms of the test, training and adversarial L 1 logit differences, three categories were established over the space.1. Adversarial examples in a distinct cluster, closer to the decision boundary, than the training and test data.2. Adversarial examples scattered amongst the training/test data.3. Adversarial examples in a distinct cluster, further from the decision boundary, than the training and test data. The JSMA and DeepFool attacks found logit differences smaller than the test and training logits, yet still high enough to yield a significant confidence level when applied to the softmax function. The Madry, Momentum and BIM attacks produced logit differences far higher than the test and training logit differences. However, some attacks found logit differences within the test and training distributions. Figure 2: Madry attack from BID13 in category 3, with a large perturbation vector applied. The differences between the per-class logit values are large, at least 70, albeit less than some of the other attacks which have score differences in the hundreds. The adversarial images with scores represented by the green histogram are very far away from the training and test data, which means that Background Check will separate them well. The central example successful adversarial image is noise, due to the large perturbation applied. The top left confusion matrix is that of the neural network without Background Check. The top right confusion matrix is that of the neural network with Background Check applied to it. The confusion matrices are relatively coloured with the true labels on the vertical axis and the predicted labels on the horizontal axis. The histogram in the bottom of each image uses ten bins, whose size is chosen by scipy, relative to the spread of the data. The y-axis or height of each bar of the blue, orange and green histograms represent the relative frequency of examples in the training, test and adversarial classes, respectively. The x-axis represents the score difference between the logit vectors. The left hand confusion matrix, on the bottom row, shows the attack had equivalent ease generating adversarial images from either class. The right hand confusion matrix shows a reduction in average recall due to the many, 198/1000 false negatives, for the first class, and 136/1000 for the second, which, because the classifier is evaluated on the average recall, will make a large difference to the final average recall. For the histograms of all of the methods, please see the appendix. Figure b) shows the trend of the pairwise differences as the attack parameters increase for the attack from BID13 7 DISCUSSIONBackground check models the data density over the logit differences. It is clear from the figures in the appendix that the adversarial attacks find examples in regions where the test and training data do not exist. Thus, Background Check improves the discriminative performance of the classifier when dealing with adversarial examples with large perturbation vectors. These ing images are noisy and hard to allocate a non-ambiguous class, though we argue that these images can occur and be just as damaging in the real world and as such need to be defended against. It would be useful to follow on from this method with an analysis of generative probability estimation and a corresponding measure of calibration and refinement loss. Promising future research would scale up the logit difference metric underlying Background Check to higher dimensional spaces to deal with a full ten classes to allow for comparability to mainstream literature on adversarial defences. Possible metrics that can underlie Background Check could use the energy distance. In addition, Background Check could be applied to each layer of a neural network. However, this must be setup such that it does not interfere with the ability of the neural network to generalize. The performance of Background Check can be measured in different ways. For example, BID1 proposes performance measures for classification systems with the rejection option. These measures consist of metrics such as the non-rejected accuracy, which measures the ability of the classifier to accurately classify non-rejected samples. The classification quality, which measures the correct decision making of the classifier with the rejector and finally, the rejection quality, which measures the ability to concentrate all mis-classified samples onto the set of rejected samples. A novel approach to defending neural networks against adversarial attacks has been established. This approach intersects two previously unrelated fields of machine learning, calibration and adversarial defences, using the principles underlying Background Check. This work demonstrates that adversarial attacks, produced as a of large perturbations of various forms, can be detected and assigned to an adversarial class. The larger the perturbation, the easier it was for the attacks to be detected.

Represent the TLDR for finding the corresponding scientific article

This paper uses principles from the field of calibration in machine learning on the logits of a neural network to defend against adversarial attacks

We propose a framework for modifying the latent space operations such that the distribution mismatch between the resulting outputs and the prior distribution the generative model was trained on is fully eliminated.


Question: Represent the article for finding a single-sentence TLDR

Question: We present a novel multi-task training approach to learning multilingual distributed representations of text. Our system learns word and sentence embeddings jointly by training a multilingual skip-gram model together with a cross-lingual sentence similarity model. We construct sentence embeddings by processing word embeddings with an LSTM and by taking an average of the outputs. Our architecture can transparently use both monolingual and sentence aligned bilingual corpora to learn multilingual embeddings, thus covering a vocabulary significantly larger than the vocabulary of the bilingual corpora alone. Our model shows competitive performance in a standard cross-lingual document classification task. We also show the effectiveness of our method in a low-resource scenario. Learning distributed representations of text, whether it be at the level of words BID26; BID28, phrases BID32; BID30, sentences BID18 or documents BID22, has been one of the most widely researched subjects in natural language processing in recent years. Word/sentence/document embeddings, as they are now commonly referred to, have quickly become essential ingredients of larger and more complex NLP systems BID4; BID25 BID8; BID1; BID6 looking to leverage the rich semantic and linguistic information present in distributed representations. One of the exciting avenues of research that has been taking place in the context of distributed text representations, which is also the subject of this paper, is learning multilingual text representations shared across languages BID11; BID3; BID24. Multilingual embeddings open up the possibility of transferring knowledge across languages and building complex NLP systems even for languages with limited amount of supervised resources BID0; BID17. By far the most popular approach to learning multilingual embeddings is to train a multilingual word embedding model that is then used to derive representations for sentences and documents by composition BID14. These models are typically trained solely on word or sentence aligned corpora and the composition models are usually simple predefined functions like averages over word embeddings BID14; BID27 or parametric coposition models learned along with the word embeddings. In this work we learn word and sentence embeddings jointly by training a multilingual skip-gram model BID24 together with a cross-lingual sentence similarity model. The multilingual skip-gram model transparently consumes (word, context word) pairs constructed from monolingual as well as sentence aligned bilingual corpora. We use a parametric composition model to construct sentence embeddings from word embeddings. We process word embeddings with a Bi-directional LSTM and then take an average of the LSTM outputs, which can be viewed as context dependent word embeddings. Since our multilingual skip-gram and cross-lingual sentence similarity models are trained jointly, they can inform each other through the shared word embedding layer and promote the compositionality of learned word embeddings at training time. Further, the gradients flowing back from the sentence similarity model can affect the embeddings learned for words outside the vocabulary of the parallel corpora. We hypothesize these two aspects of our model lead to more robust sentence embeddings. Our contributions are as follows:• Scalable approach: We show that our approach performs better as more languages are added, since represent the extended lexicon in a suitable manner.• Ability to perform well in low-resource scenario: Our approach produces representations comparable with the state-of-art multilingual sentence embeddings using a limited amount of parallel data. Our sentence embedding model is trained end-to-end on a vocabulary significantly larger than the vocabulary of the parallel corpora used for learning crosslingual sentence similarity.• Amenable to Multi-task modeling: Our model can be trained jointly with proxy tasks, such as sentiment classification, to produce more robust embeddings for downstream tasks. This section gives a brief survey of relevant literature. For a through survey of cross-lingual text embedding models, please refer to BID31. BID33 and 4. joint optimization: using both parallel and monolingual corpora BID19; BID24; BID36; BID9. We adopt the skip-gram architecture of BID24 and train a single multilingual model using monolingual data from each language as well as any sentence aligned bilingual data available for any language pair. Cross-lingual Sentence Embeddings: Some works dealing with cross-lingual word embeddings have considered the problem of constructing sentence embeddings including BID34; BID29 BID14. In general, it is not trivial to construct crosslingual sentence embeddings by composing word embeddings as the semantics of a sentence is a complex language-dependent function of its component words as well as their ordering. BID29 addresses this difficulty by extending the paragraph vector model of BID22 to the bilingual context which models the sentence embedding as a separate context vector used for predicting the n-grams from both sides of the parallel sentence pair. At test time, the sentence vector is randomly initialized and trained as part of an otherwise fixed model to predict the n-grams of the given sentence. Our sentence embedding model is closer to the approach taken in BID14. They construct sentence embeddings by taking average of word or bi-gram embeddings and use a noise-contrastive loss based on euclidean distance between parallel sentence embeddings to learn these embeddings. Multi-task Learning: Multi-task learning has been employed in various NLP applications where the parameters are shared among tasks BID7; BID23; BID12. BID23 show the effectiveness of multi-task learning in multiple sentiment classification tasks by sharing an RNN layer across tasks while learning separate prediction layers for each task. BID37 recently showed benefits of learning a common semantic space for multiple tasks which share a low level feature dictionary. Our multi-task architecture treats training multilingual word embeddings as a separate task with a separate objective as opposed to training them beforehand or training them only as part of a larger model. Our model is trained to optimize two separate objectives: multilingual skip-gram BID24 and cross-lingual sentence similarity. These two tasks are trained jointly with a shared word embedding layer in an end-to-end fashion. Overview of the architecture that we use for computing sentence representations R S and R T for input word sequences S and T. Multilingual skip-gram model BID24 extends the traditional skip-gram model by predicting words from both the monolingual and the cross-lingual context. The monolingual context consists of words neighboring a given word as in the case of the traditional skip-gram model. The cross-lingual context, on the other hand, consists of words neighboring the target word aligned with a given source word in a parallel sentence pair. FIG0, shows an example alignment, where an aligned pair of words are attached to both their monolingual and bilingual contexts. For a pair of languages L1 and L2, the word embeddings are learned by optimizing the traditional skip-gram objective with (word, context word) pairs sampled from monolingual neighbors in L1 → L1 and L2 → L2 directions as well as cross-lingual neighbors in L1 → L2 and L2 → L1 directions. In our setup, cross-lingual pairs are sampled from parallel corpora while monolingual pairs are sampled from both parallel and monolingual corpora. We use a parametric composition model to construct sentence embeddings from word embeddings. We process word embeddings with a bi-directional; BID15 and then take an average of the LSTM outputs. There are various implementations of LSTMs available; in this work we use an implementation based on BID40. The LSTM outputs (hidden states) contextualize input word embeddings by encoding the history of each word into its representation. We hypothesize that this is better than averaging word embeddings as sentences generally have complex semantic structure and two sentences with different meanings can have exactly the same words. In FIG1, the word embeddings x i are processed with a bi-directional LSTM layer to produce h i. Bi-directional LSTM outputs are then averaged to get a sentence representation. Learning Method: Let R: S → R d denote our sentence encoder mapping a given sequence of words S to a continuous vector in R d. Given a pair of parallel sentences (S, T), we define the loss L of our cross-lingual sentence encoder model as: DISPLAYFORM0 Therefore, for similar sentences (S ≈ T), we minimize the loss L ST between their embeddings. We also use a noise-constrastive large-margin update to ensure that the representations of non-aligned sentences observe a certain margin from each other. For every parallel sentence pair (S, T) we randomly sample k negative sentences N i, i = 1... k. With high probability N i is not semantically equivalent to S or T.We define our loss for a parallel sentence pair as follows: DISPLAYFORM1 Without the LSTM layer, this sentence encoder is similar to the except that we use also the reversed sample (T, S) to train the model, therefore showing each pair of sentences to the model two times per epoch. Following the literature, we use The Europarl corpus v71 BID20 for initial development and testing of our approach. We use the first 500K parallel sentences for each of the EnglishGerman (en-de), English-Spanish (en-es) and English-French (en-fr) language pairs. We keep the first 90% for training and the remaining 10% for development purposes. We also use additional 500K monolingual sentences from the Europarl corpus for each language. These sentences do not overlap with the sentences in parallel data. Words which have a frequency less than 5 for a language are replaced with the <unk> symbol. In the joint multi-task setting, the word frequencies are counted using the combined monolingual and parallel corpora. When using just the parallel data for the en-de pair, the vocabulary sizes are 39K for German (de) and 21K for English (en). Vocabulary sizes are 120K for German and 68K for English when both the parallel and the monolingual data are used. We evaluate our model on the RCV1/RCV2 cross-lingual document classification task where for each language we use 1K documents for training and 5K documents for testing. A. Multilingual Skip-gram: We use stochastic gradient descent with a learning rate of 0.01 and exponential decay of 0.98 after 10k steps (1 step = 256 word pairs), negative sampling with 128 samples, skip-gram context window of size 5. Reducing the learning rate of the skip-gram model helps in the multi-task scenario by allowing skip-gram objective to converge in parallel with the sentence similarity objective. We do this modification to make sure that shared word embeddings receive enough supervision from the multilingual sentence similarity objective. At every step, we sample equal number of monolingual and cross-lingual word pairs to make a mini-batch. We keep the batch size to be 50 sentence pairs. LSTM hidden dimension P is one of 100, 128, 512 depending on the model. We use dropout at the embedding layer with drop probability 0.3. Hinge-loss margin m is always kept to be sentence embedding size. We sample 5 negative samples for the noise-contrastive loss. The model is trained using the Adam optimizer with a learning rate of 0.001 and an exponential decay of 0.98 after 10k steps (1 step = 50 sentence pairs = 1 mini-batch).The system is optimized by alternating between mini-batches of these two tasks. All of our models project words from all input languages to a shared vector space. We train four types of models.• Sent-Avg: This model simply averages word embeddings to get a sentence embedding. It is similar to BiCVM-add model from Hermann & Blunsom FORMULA0, but we also add sentence pairs in the opposite direction, so that the model performs well in both directions.• Sent-LSTM: Represents words in context using the bidirectional LSTM layer, which are then averaged to get sentence embeddings.• JMT-Sent-Avg: Multilingual skip-gram jointly trained with Sent-add. In this setting, the model is optimized by alternating between mini-batches for the two models. JMT refers to Joint Multi-task.• JMT-Sent-LSTM: Multilingual skip-gram jointly trained with Sent-LSTM. We report on the Reuters RCV1/RCV2 cross-lingual document classification (CLDC) task BID19 using the same experimental setup. We learn the distributed representations on the Europarl corpus. We construct document embeddings by averaging sentence embeddings. Sentence representations are fixed vectors determined by a sentence encoder trained on parallel and monolingual Europarl corpora. For a language pair L1-L2, a document classifier (single layer average perceptron) is trained using the document representations from L1, and tested on documents from L2. Due to lack of supervision on the test side, CLDC setup relies on documents with similar meaning having similar representations. Table 1, shows the for our systems and compares it to some state-of-the-art approaches. When the sentence embedding dimension is 128, we outperform most of the systems compared. When the sentence embedding dimension is increased to 512, our are close to the best obtained for this task. Our models with an LSTM layer (Sent-LSTM and JMT-Sent-LSTM) are significantly better than those without one. There are also significant gains when the document embeddings are obtained from sentence encoders trained in the multi-task setting. The ablation experiments where we just use parallel corpora suggest that these gains are mostly due to additional monolingual data that we can exploit in the multi-task setting. Table 2: We compare our JMT-Sent-LSTM model trained on three languages to one trained on two languages. Table 2 compares models trained on data from four languages (en, es, de, fr) to models trained on data from two languages. The suggest that models trained on multiple languages perform better when English is the source language used to train the CLDC system. The multilingual systems also show promising for es-de pair, for which there was no direct parallel data available. Validation loss for JMT-sent-add model shows more stability and achieves a lower value than the one for Sent-add model in the low-resource scenario. At every training step, the validation set is created by randomly choosing 50 sentences from the development set. The main motivation behind the multi-task architecture is to create high quality multilingual embeddings for languages which have limited amount of parallel data available. Therefore, we compare the effectiveness of our Joint multi-task models in the low resource scenario, where for each language pair we use 100k parallel sentences and 1 million monolingual sentences for training the sentence encoder. We evaluate on the RCV1/RCV2 document classification task. Like before, we keep the first 90% (90k parallel sentences) of parallel data for training and 10% (10k parallel sentences) for development purposes. FIG2 shows the loss curves for sent-add and JMT-Sent-add models. On the validation set, JMTSent-add model gives a smoother and lower loss curve. Our suggest that using a parametric composition model to derive sentence embeddings from word embeddings and joint multi-task learning of multilingual word and sentence embeddings are promising directions. This paper is a snapshot of our current efforts and w e believe that our sentence embedding models can be improved further with straightforward modifications to the model architecture, for instance by using stacked LSTMs, and we plan to explore these directions in future work. In our exploration of architectures for the sentence encoding model, we also tried using a selfattention layer following the intuition that not all words are equally important for the meaning of a sentence. However, we later realized that the cross lingual sentence similarity objective is at odds with what we want the attention layer to learn. When we used self attention instead of simple averaging of word embeddings, the attention layer learns to give the entire weight to a single word in both the source and the target language since that makes optimizing cross lingual sentence similarity objective easier. Even though they are related tasks, multilingual skip-gram and cross-lingual sentence similarity models are always in a conflict to modify the shared word embeddings according to their objectives. This conflict, to some extent, can be eased by careful choice of hyper-parameters. This dependency on hyper-parameters suggests that better hyper-parameters can lead to better in the multi-task learning scenario. We have not yet tried a full sweep of the hyperparameters of our current models but we believe there may be easy gains to be had from such a sweep especially in the multi-task learning scenario.

We jointly train a multilingual skip-gram model and a cross-lingual sentence similarity model to learn high quality multilingual text embeddings that perform well in the low resource scenario.

Represent the TLDR for finding the corresponding scientific article

The choice of the hub (target) language affects the quality of cross-lingual embeddings, which shouldn't be evaluated only  on English-centric dictionaries.