Question: Represent the scientific article to find a short TLDR

Question: An important type of question that arises in Explainable Planning is a contrastive question, of the form "Why action A instead of action B?". These kinds of questions can be answered with a contrastive explanation that compares properties of the original plan containing A against the contrastive plan containing B. An effective explanation of this type serves to highlight the differences between the decisions that have been made by the planner and what the user would expect, as well as to provide further insight into the model and the planning process. Producing this kind of explanation requires the generation of the contrastive plan. This paper introduces domain-independent compilations of user questions into constraints. These constraints are added to the planning model, so that a solution to the new model represents the contrastive plan. We introduce a formal description of the compilation from user question to constraints in a temporal and numeric PDDL2.1 planning setting. Explainable AI (XAI) is an emerging and important research area within AI. Recent work has shown that AI Planning is an important tool in XAI, as its decision-making mechanisms are model-based and so in principle more transparent. This recent work includes many approaches towards providing explanations in AI planning. BID3 gives an in-depth overview of this work and different terms used within the XAI landscape. In particular, BID16 shows that if an AI system behaves "explicably" there is less of a need for explanations. However, this is not always possible and explanation is sometimes required. BID2 tackles explanation as a model reconciliation problem, arguing that the explanation must be a difference between the human model and AI model. BID14 show that by representing plans as first order logic formulae generating explanations is feasible in real time. In contrast, in this paper we focus on contrastive "why" questions. BID4 highlight some important questions in XAIP and discuss possible answers, and also describe how these "why" questions are especially important. BID15 outlines the approach to planning as an iterative process for bet- ter modelling preferences and providing explanations. We propose to follow this same approach. The aim of explanations is to improve the user's levels of understanding and trust in the system they are using. These explanations can be local (regarding a specific plan) or global (concerning how the planning system works in general). In this paper we focus on local explanations of temporal and numeric planning problems, introducing an approach for explaining why a planner has made a certain decision. Through active exploration of these specific cases, the user may also gain global insight into the way in which the planner makes decisions. (See BID9 BID10 Ribeiro, Singh, and Guestrin 2016) ).To achieve an understanding of a decision, it is important that explanations adapt to the specific context and mental model of the user. One step towards this is to support the user iteratively asking different questions suitable for their context. BID6 identify ten question types that a user might have about an intelligent system, also described by BID13. BID8 show in a grounded study that of these, the questions why and why not provided the most benefit in terms of objective understanding and feelings of trust. In the context of planning why not questions are contrastive questions, because the user is asking why some action was selected rather than some other action that was not. Instead, Miller argues that all such questions can be asked as contrastive questions of the form "Why action A rather than action B?" BID11. Contrastive questions capture the context of the question; they more precisely identify the gaps in the user's understanding of a plan that needs to be explained BID7. A contrastive question about a plan can be answered by a contrastive explanation. Contrastive explanations will compare the original plan against a contrastive plan that accounts for the user expectation. Providing contrastive explanations is not only effective in improving understanding, but is simpler than providing a full causal analysis BID12.Following the approach of we propose an approach to contrastive explanations through a dialogue with the user. The proposed approach consists of an iterative four-stage process illustrated in FIG0. First the user asks a contrastive question in natural language. Second, a constraint is derived from the user question, in the following we refer to this constraint as the formal question. Third a hypothetical model (HModel) is generated which encapsulates this constraint. A solution to this model is the hypothetical plan (HPlan) that can be compared to the original plan to show the consequence of the user suggestion. The user can compare plans and iterate the process by asking further questions, and refining the HModel. This allows the user to combine different compilations to create a more constrained HModel, producing more meaningful explanations, until the explanation is satisfactory. Each stage of this process represents a vital research challenge. This paper describes and formalises the third stage of this process: compiling the formal question into a hypothetical model for temporal and numeric planning. We are interested in temporal and numeric planning problems, for which optimal solutions are difficult to find. Therefore, while the process described above serves for explanation, the insight of the user can also in guiding the planning process to a more efficient solution. As noted by BID15, the explanations could also give the user the opportunity to improve the plan with respect to their own preferences. The user could have hidden preferences which have not been captured in the model. The user could ask questions which enforce constraints that favour these preferences. The new plan could be sub-optimal, but more preferable to the user. The contribution of this paper is a formalisation of domain-independent and planner-agnostic compilations from formal contrastive questions to PDDL2.1 (Fox and Long 2003), necessary for providing contrastive explanations. The compilations shown are not exhaustive. However, they do cover an interesting set of questions which users would commonly have about both classical and temporal plans. The paper is organised as follows. The next section describes the planning definitions we will use throughout the paper. In Section 3 we describe the running example that we use to demonstrate our compilations throughout the paper. In Section 4 we list the set of formal questions that we are interested in, and formalise the compilations of each of these into constraints. Finally, we conclude the paper in Section 5 whilst touching on some interesting future work. Our definition of a planning model follows the definition of PDDL2.1 given by (Fox and Long 2003), extended by a set of time windows as follows. Definition 1 A planning model is a pair Π = D, P rob. The domain D = P s, V s, As, arity is a tuple where P s is a finite set of predicate symbols, V s is a finite set of function symbols, As is a set of action schemas, called operators, and arity is a function mapping all of these symbols to their respective arity. The problem P rob = Os, I, G, W is a tuple where Os is the set of objects in the planning instance, I is the initial state, G is the goal condition, and W is a set of time windows. A set of atomic propositions P is formed by applying the predicate symbols P s to the objects Os (respecting arities). One proposition p is formed by applying an ordered set of objects o ⊆ O to one predicate ps, respecting its arity. For example, applying the predicate (block on ? a ?b) with arity 2 to the ordered set of objects {blockA, blockB} forms the proposition (block on blockA blockB). This process is called "grounding" and is denoted with: ground(ps, χ) = p where χ ⊆ O is an ordered set of objects. Similarly the set of primitive numeric expressions (PNEs) V are formed by applying the function symbols V s to Os. A state s consists of a time t ∈ R, a logical part s l ⊆ P, and a numeric part s v that describes the values for the PNE's at that state. The initial state I is the state at time t = 0.The goal G = g 1,..., g n is a set of constraints over P and V that must hold at the end of an action sequence for a plan to be valid. More specifically, for an action sequence φ = a 1, a 2,..., a n each with a respective time denoted by Dispatch(a i), we use the definition of plan validity from (Fox and Long 2003) (Definition 15 "Validity of a Simple Plan"). A simple plan is the sequence of actions φ which defines a happening sequence, t i=0...k and a sequence of states, s i=0...k+1 such that s 0 = I and for each i = 0... k, s i+1 is the of executing the happening at time t i. The simple plan φ is valid if s k+1 |= G.Each time window w ∈ W is a tuple w = w lb, w ub, w v where w v is a proposition which becomes true or a numeric effect which acts upon some n ∈ V. w lb ∈ R is the time at which the proposition becomes true, or the numeric effect is applied. w ub ∈ R is the time at which the proposition becomes false. The constraint w lb < w ub must hold. Note that the numeric effect is not effected at w ub.Similar to propositions and PNEs, the set of ground actions A is generated from the substitution of objects for operator parameters with respect to it's arity. Each ground action is defined as follows:Definition 2 A ground action a ∈ A has a duration Dur(a) which constrains the length of time that must pass between the start and end of a; a start (end) condition P re (a) (P re (a)) which must hold at the state that a starts (ends); an invariant condition P re ↔ (a) which must hold throughout the entire execution of a; add effects Eff (a) +, Eff (a) + ⊆ P that are made true at the start and ends of the action respectively; delete effects Eff (a) −, Eff (a) − ⊆ P that are made false at the start and end of the action respectively; and numeric effects Eff (a) DISPLAYFORM0 n that act upon some n ∈ V. We use as a running example the following planning model. FIG1 shows the domain D. The domain describes a scenario in which a robot is able to move between connected waypoints and mark them as visited. The domain contains three predicate symbols (robot at, connected, visited) with arities 2, 2, and 1 respectively. The domain includes only a single function symbol travel time with arity 2.There is a single operator goto waypoint. FIG2 shows the problem P rob. The problem specifies 7 objects: wp0, wp1, wp2, wp3, wp4, wp5 and kenny. The initial state specifies which propositions are initially true, such as the current location of the robot (robot at kenny wp0), and the initial values of the PNEs, e.g. (= (travel time wp5 wp3) 4.68). The goal is specified as a constraint over P ∪ V, in this example it is that the robot has visited all of the locations. FIG4 shows an example plan that solves this problem. This plan might appear sub-optimal. The robot moves from waypoint wp2 to wp1 and then immediately returns to wp2. This second action might seem redundant to the user. However, upon closer inspection of the connectivity of waypoints (shown in FIG3) we can see that the plan is in fact the optimal one. Visiting waypoint wp1 is a goal of the problem, and it is only connected to waypoints wp0 and wp2, both of which have already been visited. Waypoint wp0 is only (define (problem task) (:domain turtlebot_demo) (:objects wp0 wp1 wp2 wp3 wp4 wp5 -waypoint kenny -robot) (:init (robot_at kenny wp0) (visited wp0) (connected wp0 wp2) (connected wp0 wp4) (connected wp1 wp0) (connected wp1 wp2) (connected wp2 wp1) (connected wp2 wp4) (connected wp2 wp5) (connected wp3 wp5) (connected wp5 wp0) (connected wp5 wp2) (connected wp5 wp3) (= (travel_time wp0 wp2) 1.45) (= (travel_time wp0 wp4) 2)... (:goal (and (visited wp1) (visited wp2) (visited wp3) (visited wp4) (visited wp5) ))) The robot is only allowed to move along the directed arrows. connected to waypoints wp2 and wp4, wp2 has been visited and wp4 is a dead end. For these reasons combined, the only logical option is to move back to wp2 after completing the goal of visiting wp1. This type of behaviour similarly happens between waypoints wp3 and wp5.A graphical representation such as FIG3 is not always available, and so even for this simple model and plan, deducing the reasoning behind the planned actions is not trivial. This is an example of where XAIP is useful. Using our proposed approach the user could have asked the question: "Why do we use the action (goto waypoint kenny wp1 wp2), rather than not using Figure 6: The hypothetical plan that accounts for the user's suggestion, avoiding the action of moving from wp1 to wp2. The cost of the plan is its duration (20.81).it?". From this question we could generate a contrastive plan with this constraint enforced (shown in Figure 6). Comparing the actions and costs of the original and the new plan could shed light on why the action needed to be used. The user can carry on asking questions until they were satisfied. Definition 3 An explanation problem is a tuple E = Π, φ, Q, in which Π is a planning model (Definition 1), φ is the plan generated by the planner, and Q is the specific question posed by the user. The problem is to provide insight that helps the user to answer question Q.In this paper, we assume that the user knows the model Π and the plan φ, so answers such as stating the goal of the problem will not increase their understanding. Given this, we propose the following set of questions, and provide a formal description for compilations of this set of formal questions of temporal plans: 1. Why is action a used in state s, rather than action b? (Section 4.1) 2. Why is action a not used in the plan, rather than being used? (Section 4.2) 3. Why is action a used in the plan, rather than not being used? (Section 4.3) 4. Why is action a used outside of time window w, rather than only being allowed within w? (Section 4.4) 5. Why is action a not used in time window w, rather than being used within w? (Section 4.5) 6. Why is action a used at time t, rather than at least some time t after/before t? (Section 4.6) 7. Why is action a not performed before (after) action b, rather than a being performed after (before) b? (Section 4.7) These questions were derived by systematically assessing ways that counterfactual situations could occur in plans, and choosing those that would be useful over many applications. This is not an exhaustive list of possible constraints that can be enforced upon the original model, however, it does represent a list of questions that would be useful in specific contexts and applications. Part of being able to answer these questions is the ability to reason about what would happen in the counterfactual cases. We approach this problem by generating plans for the counterfactual cases via compilations. A compilation of a planning instance where the model is given by Π, and a question is given by Q is shown as Compilation(Π, Q) = Π where: Π = P s, V s, As, arity, Os, I, G, W We call Π the hypothetical model, or HModel. However, Π can also be used as the input model so that the user can iteratively ask questions about some model, i.e: DISPLAYFORM0 This allows the user to stack questions, further increasing their understanding of the plan through combining compilations. Combining compilations this way provides a much wider set of possible constraints. After the HModel is formed, it is solved to give the HPlan. Any new operators that are used in the compilation to enforce some constraint are trivially renamed back to the original operators they represent. For each iteration of compilation the HPlan is validated against the original model Π. Given a plan φ, a formal question Q is asked of the form:Why is the operator o with parameters χ used in state s, rather than the operator n with parameters χ? where o = n or χ = χ For example, given the example plan in FIG4 the user might ask:"Why is (goto waypoint kenny wp2 wp5) used, rather than (goto waypoint kenny wp2 wp4)? " They might ask this because a goal of the problem is to visit wp4. As the robot visits wp5 from wp3 later in the plan, it might make sense to the user for the robot to visit wp4 earlier, as wp5 will be visited at a later point. To generate the HPlan, a compilation is formed such that the ground action b = ground(n, χ) appears in the plan in place of the action a i = ground(o, χ). Given the example above b = ground(goto waypoint, {kenny, wp2, wp4}), and a i = ground(goto waypoint, {kenny, wp2, wp5}). Given a plan: φ = a 1, a 2,..., a n The ground action a i at state s is replaced with b, which is executed, ing in state I, which becomes the new initial state in the HModel. A time window is created for each durative action that is still executing in state s. These model the end effects of the concurrent actions. A plan is then generated from this new state with these new time windows for the original goal, which gives us the plan: DISPLAYFORM0 The HPlan is then the initial actions of the original plan φ concatenated with b and the new plan φ: a 1, a 2,..., a i−1, b, a 1, a 2,..., a n Specifically, the HModel Π is: Π = P s, V s, As, arity, Os, I, G, W ∪ C where:• I is the final state obtained by executing 1 a 1, a 2,..., a i−1, b from state I.• C is a set of time windows w x, for each durative action a j that is still executing in the state I. For each such action, w x specifies that the end effects of that action will become true at the time point at which the action is scheduled to complete. Specifically: DISPLAYFORM1 In the case in which an action a j that is executing in state I has an overall condition that is violated, this is detected when the plan is validated against the original model. As an example, given the user question above, the new initial state I from the running example is shown below:(:init (robot at kenny wp4) (visited wp2) (visited wp1) (visited wp4) (connected wp0 wp2) (connected wp0 wp4) (connected wp1 wp0) (connected wp1 wp2 In this state the robot has visited the waypoints wp2, wp1, and wp4, and is currently at wp4. This new initial state is then used to plan for the original goals to get the plan φ, which, along with b and φ, gives the HPlan. However, the problem is unsolvable from this state as there are no connections from wp4 to any other waypoint. By applying the user's constraint, and showing there are no more applicable actions, it answers the above question: "because by doing this there is no way to complete the goals of the problem".This compilation keeps the position of the replaced action in the plan, however, it may not be optimal. This is because we are only re-planning after the inserted action has been performed. The first half of the plan, because it was originally planned to support a different set of actions, may now be inefficient, as shown by BID1 .If the user instead wishes to replace the action without necessarily retaining its position in the plan, then the following constraints on adding and removing an action from the plan can be applied iteratively, as mentioned previously. Given a plan φ, a formal question Q is asked of the form:Why is the operator o with parameters χ not used, rather than being used?1 We use VAL to validate this execution. We use the add and delete effects of each action, at each happening (provided by VAL), up to the replacement action to compute I. For example, given the example plan in FIG4 the user might ask: "Why is (goto waypoint kenny wp2 wp4) not used, rather than being used?" They might ask this because a goal of the problem is to visit wp4. As the robot is at wp2 early in the plan, and you can visit wp4 from wp2, it might make sense to the user for the robot to visit wp4 at that time. To generate the HPlan, a compilation is formed such that the action a = ground(o, χ) must be applied for the plan to be valid. The compilation introduces a new predicate has done a, which represents which actions have been applied. Using this, the goal is extended to include that the user suggested action has been applied. The HModel Π is: Π = P s, V s, As, arity, Os, I, G, W where • P s = P s ∪ {has done a}• As = {o} ∪ As \ {o}• arity (x) = arity(x), ∀x ∈ arity• arity (has done a) = arity (o) = arity(o)• G = G ∪ {ground(has done a, χ)} where the new operator o extends o with the add effect has done a with corresponding parameters, i.e. DISPLAYFORM0 For example, given the user question above, the operator goto waypoint from the running example is extended to goto waypoint with the additional add effect has done a:(:durative-action goto_waypoint':parameters (?v -robot ?from ?to -waypoint):duration(= ?duration (travel_time ?from ?to)):condition (at start (robot_at ?v ?from) (over all (connected ?from ?to)):effect (and (at end (visited ?to)) (at start (not (robot_at ?v ?from))) (at end (robot_at ?v ?to)) (at end (has done goto waypoint' ?v ?from ?to))))) and the goal is extended to include the proposition: (has done goto waypoint kenny wp2 wp4). Given a plan φ, a formal question Q is asked of the form:Why is the operator o with parameters χ used, rather than not being used?For example, given the example plan in FIG4 the user might ask: "Why is (goto waypoint kenny wp1 wp2) used, rather than not being used?" A user might ask this because the robot has already satisfied the goal to visit wp2 before this point with the action (goto waypoint kenny wp0 wp2). The user might think the second action (goto waypoint kenny wp1 wp2) seems redundant. The specifics of the compilation is similar to the compilation in Section 4.2. The HModel is extended to introduce a new predicate not done action which represents actions that have not yet been performed. The operator o is extended with the new predicate as an additional delete effect. The initial state and goal are then extended to include the user selected grounding of not done action. Now, when the user selected action is performed it deletes the new goal and so invalidates the plan. This ensures the user suggested action is not performed. For example, given the user question above, an HPlan is generated that does not include the action (goto waypoint kenny wp1 wp2), and is shown in Figure 6. Given a plan φ, a formal question Q is asked of the form:Why is the operator o with parameters χ used outside of time lb < t < ub, rather than only being allowed within this time window?For example, given the example plan in FIG4 the user might ask: "Why is (goto waypoint kenny wp0 wp4) used outside of times 0 and 2, rather than being restricted to that time window?" A user can ask this because the action (goto waypoint kenny wp0 wp4) is used at the end of the plan, the robot starts at wp0 and must visit wp4 to satisfy a goal. The user might think that satisfying this goal earlier in the plan will free up time for the robot to complete the other goals. To generate the HPlan, the planning model is compiled such that the ground action a = ground(o, χ) can only be used between times lb and ub. To do this, the original operator o is replaced with two operators o a and o ¬a, which extend o with extra constraints. Operator o ¬a replaces the original operator o for all other actions ground(o, χ), where χ = χ. The action ground(o ¬a, χ) cannot be used (this is enforced using the compilation for forbidding an action described in Section 4.3). Operator o a acts as the operator o specifically for the action a = ground(o, χ), which has an added constraint that it can only be performed between lb and ub. Specifically, the HModel Π is: Π = P s, V s, As, arity, Os, I, G, W where:• P s = P s ∪ {can do a, not done a} DISPLAYFORM0 where the new operators o ¬a and o a extend o with the delete effect not done a and the precondition can do a, respectively. i.e: DISPLAYFORM1 As the proposition ground(can do a, χ) must be true for ground(o a, χ) to be performed, this ensures that the action a can only be performed within the times lb and ub. Other actions from the same operator can still be applied at any time using the new operator o ¬a. As in Section 4.3 we make sure the ground action ground(o ¬a, χ) can never appear in the plan. For example, given the user question above, the operator goto waypoint from FIG1 The initial state is extended to include the proposition (not done goto waypoint kenny wp0 wp4) and the time window 0, 2, (can do goto waypoint kenny wp0 wp4). This time window enforces that the proposition (can do goto waypoint kenny wp0 wp4) is true between times 0 and 2. The ing HPlan is:Following the user suggestion, the action is no longer applied outside of the time window, and in fact does not appear in the plan at all. Given a plan φ, a formal question Q is asked of the form:Why is the operator o with parameters χ not used at time lb < t < ub, rather than being used in this time window? For example, given the example plan in FIG4 the user might ask:"Why is (goto waypoint kenny wp0 wp4) not used between times 0 and 2, rather than being used in this time window? " The HPlan given in Section 4.4 shows the user that there is a better plan which does not have the action in this time window. However, the user may only be satisfied once they have seen a plan where the action is performed in their given time window. To allow this the action may have to appear in other parts of the plan as well. This constraint differs from Section 4.4 in two ways: first the action is now forced to be applied in the time window, and second the action can be applied at other times in the plan. This constraint is useful in cases such as a robot that has a fuel level. As fuel is depleted when travelling between waypoints, the robot must refuel, possibly more than once. The user might ask "why does the robot not refuel between the times x and y (as well as the other times it refuels)?".To generate the HPlan, the planning model is compiled such that the ground action a = ground(o, χ) is forced to be used between times lb and ub, but can also appear at any other time. This is done using a combination of the compilation in Section 4.2 and a variation of the compilation in Section 4.4. Simply, the former ensures that new action ground(o a, χ) must appear in the plan, and the latter ensures that the action can only be applied within the time window. The variation of the latter compilation is that the operator o ¬a is not included, and instead the original operator is kept in the domain. This allows the original action a = ground(o, χ) to be applied at other times in the plan. Given this, the HModel Π is: Π = P s, V s, As, arity, Os, I, G, W where:• P s = P s ∪ {can do a, has done a} • As = {o a} ∪ As • arity (x) = arity(x), ∀x ∈ arity • arity (can do a) = arity (has done a) = arity (o a) = arity(o) • G = G ∪ {ground(has done a, χ)} • W = W ∪ {lb, ub, ground(can do a, χ) } As wp4 is a dead end there is no valid HPlan following this suggestion. Given a plan φ, a formal question Q is asked of the form:Why is the operator o with parameters χ used at time t, rather than at least some duration t after/before t? For example, given the example plan in FIG4 the user might ask:"Why is (goto waypoint kenny wp2 wp5) used at time 5.45, rather than at least 4 seconds earlier? " A user might ask this question in general because they expected an action to appear earlier or later in a plan. This could happen for a variety of reasons. In domains with resources that are depleted by specific actions, and are replenished by others, such as fuel for vehicles, these questions may arise often. A user might want an explanation for why a vehicle was refueled earlier or later than what was expected. In this case the refuel action can be delayed or advanced to answer this question. For this particular example the user might want the action (goto waypoint kenny wp2 wp5) to be advanced nearer the start of the plan. The user might see that in the original plan the robot goes from wp2 to wp1 at time 1.45 and then instantly goes back again. The user might think that a better action would be to go from wp2 to wp5 before this. The user might notice that wp5 is connected to more waypoints than wp1. Having these extra options might prevent redundant actions that revisit waypoints. To generate the HPlan, the planning model is compiled such that the ground action a = ground(o, χ) is forced to be used in time window w which is at least t before/after t. This compilation is an example of a combination of two other compilations: adding an action (in Section 4.2) and forbidding the action outside of a time window (in Section 4.4). The latter enforces that the action can only be applied within the user specified time window, while the former enforces that the action must be applied. The HModel Π is: Π = P s, V s, As, arity, Os, I, G, W where:• P s = P s ∪ {can do a, not done a, has done a} DISPLAYFORM0 ground(not done a, χ), ground(has done a, χ) }• W = W ∪ bef ore: 0, tReal, ground(can do a, χ) af ter: tReal, inf, ground(can do a, χ) where the new operators o a and o ¬a both extend o. The latter with the delete effect not done a, while o a extends o with the precondition can do a and add effect has done a; i.e.: DISPLAYFORM1 This ensures that the ground action a = ground(o a, χ) must be present in the plan between the times 0 and tReal, or tReal and inf, depending on the user question, and between those times only. In addition, the user selected action is forced to be performed using the same approach as in Section 4.2. Given the user question above, the HPlan is: Given a plan φ, a formal question Q is asked of the form:Why is the operator o with parameters χ used before (after) the operator n with parameters χ, rather than after (before)? where o = n or χ = χFor example, given the example plan in FIG4 the user might ask:"Why is (goto waypoint kenny wp2 wp1) used before (goto waypoint kenny wp2 wp5), rather than after?"A user might ask this because there are more connections from wp5 than wp2. The user might think that if the robot has more choice of where to move to, the planner could make a better choice, giving a more efficient plan. The compilation to the HModel is performed in the following way. First, a directed-acyclic-graph (DAG) N, E is built to represent each ordering between actions suggested by the user. For example the ordering of Q is a ≺ b where a = ground(o, χ) and b = ground(n, χ).This DAG is then encoded into the model Π to create Π. For each edge (a, b) ∈ E two new predicates are added: ordered ab representing that an edge exists between a and b in the DAG, and traversed ab representing that the edge between actions a and b has been traversed. For each node representing a ground action a ∈ N, the action is disallowed using the compilation from Section 4.3. Also, for each such action a new operator o a is added to the domain, with the same functionality of the original operator o. The arity of the new operator, arity(o a) is the combined arity of the original operator plus the arity of all of a's sink nodes. Specifically, the HModel Π is: Π = P s, V s, As, arity, Os, I, G, W where: DISPLAYFORM0 • As = {o a} ∪ As, ∀a ∈ N • arity (x) = arity(x), ∀x ∈ arity DISPLAYFORM1 where χ and χ are the parameters of a and b, respectively. In the above, we abuse the arity notation to specify the arity of an action to mean the arity of the operator from which it was ground; e.g. arity(a) = arity(o) where a = ground(o, χ).Each new operator o a extends o with the precondition that all incoming edges must have been traversed, i.e. the source node has been performed. The effects are extended to add that its outgoing edges have been traversed. That is:P re (o a) = P re (o) ∪ {ordered ab ∈ P s, ∀b} ∪ {traversed ca ∈ P s, ∀c} DISPLAYFORM2 This ensures that the ordering the user has selected is maintained within the HPlan. As the operator o a has a combined arity of the original operator plus the arity of all of a's sink nodes, there exists a large set of possible ground actions. However, for all b ∈ N, ordered ab is a precondition of o a; and for each edge (a, b) ∈ E the ground proposition ground(ordered ab, χ, χ) is added to the initial state to represent that the edge exists in the DAG. Therefore, the only grounding of the operator that can be performed is the action with parameters χ + χ. This drastically reduces the size of the search space. For example given the user question above, two new operators node goto waypoint kenny wp2 wp5 (shown in FIG5) and node goto waypoint kenny wp2 wp1 are added to the domain. These extend operator goto waypoint from FIG1 as described above. The HPlan generated is shown below: In this paper we have presented an approach to compiling a set of formal contrastive questions into domain independent constraints. These are then used within the XAI paradigm to provide explanations. We have described how these compilations form a part of a series of stages which start with a user question and end with an explanation. This paper formalises and provides examples of these compilations in PDDL 2.1 for temporal and numeric domains and planners. DISPLAYFORM3 We have defined a series of questions which we believe a user may have about a plan in a PDDL2.1 setting. These questions cover a large set of scenarios, and can be stacked to create new interesting constraints which may answer a much richer set of questions. We acknowledge that the questions we provide compilations for do not cover the full set of contrastive questions one may have about a plan. For example the question, "Why is the operator o with parameters χ used at time lb < t < ub, rather than not being used in this time window?", can be answered using a variant of Section 4.5. For future work we plan to investigate which compilations will form an atomic set whose elements can be stacked to cover the full set of possible contrastive questions. We also acknowledge that the compilations we have formalised may have equivalent compilations. However, the ones we have described have proven successful for explanations. In future work, we will look to extend this work in several ways. While we define how to calculate plans for contrastive cases, we do not take full advantage of contrastive explanations by explaining the difference between two plans BID11. In particular, we will look to extend the presentation beyond just plans into showing the difference between two causal chains as well. We will explore contrastive explanations with preferences in PDDL 3 BID5.We will look at producing a language for expressing questions and constraints on plans. LTL will likely play a role in defining the semantics of any such language. Additional concepts concerning plan structure, such as the ability to specify that an action is part of the causal support for a goal or sub-goal, will be needed. As it stands when we add a constraint to include an action, the constraint may be satisfied in trivial ways not relevant to answering the users question. The action may be redundant, or undone in the HPlan as described in BID4. In this case the explanation may not be deemed satisfactory. These additional concepts will help solve this problem, as well as allowing users to ask more expressive questions such as, "Why did you use action A rather than action B for achieving P?".Finally, we will provide functional and humanbehavioural evaluations of our explanations, to assess their effectiveness. To make sure they are both satisfactory from a user perspective, and that they provide actionable insight into the plan.

Represent this text to find a much much longer article about it with say hundreds-thousands of words:

This paper introduces domain-independent compilations of user questions into constraints for contrastive explanations.

This paper introduces partial grounding to tackle the problem that arises when the full grounding process, i.e., the translation of a PDDL input task into a ground representation like STRIPS, is infeasible due to memory or time constraints.


Question: Represent the scientific article to find a short TLDR

Question: Methods that learn representations of nodes in a graph play a critical role in network analysis since they enable many downstream learning tasks. We propose Graph2Gauss - an approach that can efficiently learn versatile node embeddings on large scale (attributed) graphs that show strong performance on tasks such as link prediction and node classification. Unlike most approaches that represent nodes as point vectors in a low-dimensional continuous space, we embed each node as a Gaussian distribution, allowing us to capture uncertainty about the representation. Furthermore, we propose an unsupervised method that handles inductive learning scenarios and is applicable to different types of graphs: plain/attributed, directed/undirected. By leveraging both the network structure and the associated node attributes, we are able to generalize to unseen nodes without additional training. To learn the embeddings we adopt a personalized ranking formulation w.r.t. the node distances that exploits the natural ordering of the nodes imposed by the network structure. Experiments on real world networks demonstrate the high performance of our approach, outperforming state-of-the-art network embedding methods on several different tasks. Additionally, we demonstrate the benefits of modeling uncertainty - by analyzing it we can estimate neighborhood diversity and detect the intrinsic latent dimensionality of a graph. Graphs are a natural representation for a wide variety of real-life data, from social and rating networks (Facebook, Amazon), to gene interactions and citation networks (BioGRID, arXiv). Node embeddings are a powerful and increasingly popular approach to analyze such data BID0. By operating in the embedding space, one can employ proved learning techniques and bypass the difficulty of incorporating the complex node interactions. Tasks such as link prediction, node classification, community detection, and visualization all greatly benefit from these latent node representations. Furthermore, for attributed graphs by leveraging both sources of information (network structure and attributes) one is able to learn more useful representations compared to approaches that only consider the graph BID33 BID24 BID5.All existing (attributed) graph embedding approaches represent each node by a single point in a low-dimensional continuous vector space. Representing the nodes simply as points, however, has a crucial limitation: we do not have information about the uncertainty of that representation. Yet uncertainty is inherent when describing a node in a complex graph by a single point only. Imagine a node for which the different sources of information are conflicting with each other, e.g. pointing to different communities or even revealing contradicting underlying patterns. Such discrepancy should be reflected in the uncertainty of its embedding. As a solution to this problem, we introduce a novel embedding approach that represents nodes as Gaussian distributions: each node becomes a full distribution rather than a single point. Thereby, we capture uncertainty about its representation. To effectively capture the non-i.i.d. nature of the data arising from the complex interactions between the nodes, we further propose a novel unsupervised personalized ranking formulation to learn the embeddings. Intuitively, from the point of view of a single node, we want nodes in its immediate neighborhood to be closest in the embedding space, while nodes multiple hops away should become increasingly more distant. This ordering between the nodes imposed by the network structure w.r.t the distances between their embeddings naturally leads to our ranking formulation. Taking into account this natural ranking from each node's point of view, we learn more powerful embeddings since we incorporate information about the network structure beyond first and second order proximity. Furthermore, when node attributes (e.g. text) are available our method is able to leverage them to easily generate embeddings for previously unseen nodes without additional training. In other words, Graph2Gauss is inductive, which is a significant benefit over existing methods that are inherently transductive and do not naturally generalize to unseen nodes. This desirable inductive property comes from the fact that we are learning an encoder that maps the nodes' attributes to embeddings. The main contributions of our approach are summarized as follows: a) We embed nodes as Gaussian distributions allowing us to capture uncertainty. b) Our unsupervised personalized ranking formulation exploits the natural ordering of the nodes capturing the network structure at multiple scales.c) We propose an inductive method that generalizes to unseen nodes and is applicable to different types of graphs: plain/attributed, directed/undirected. The focus of this paper is on unsupervised learning of node embeddings for which many different approaches have been proposed. For a comprehensive recent survey see BID0, BID8. Approaches such as DeepWalk and node2vec BID25 BID9 look at plain graphs and learn an embedding based on random walks by extending or adapting the Skip-Gram BID21 architecture. LINE BID30 uses first-and second-order proximity and trains the embedding via negative sampling. SDNE similarly has a component that preserves second-order proximity and exploits first-order proximity to refine the representations. GraRep BID1 is a factorization based method that considers local and global structural information. Tri-Party Deep Network Representation (TRIDNR) BID24 considers node attributes, network structure and potentially node labels. CENE BID28 similarly to BID5 treats the attributes as special kinds of nodes and learns embeddings on the augmented network. Text-Associated DeepWalk (TADW) BID33 performs low-rank matrix factorization considering graph structure and text features. Heterogeneous networks are consider in BID29, while Huang et al. similarly to considers labels. GraphSAGE is an inductive method that generates embeddings by sampling and aggregating attributes from a nodes local neighborhood and requires the edges of the new nodes. Graph convolutional networks are another family of approaches that adapt conventional CNNs to graph data BID16 BID3 BID13 BID22 BID23 BID26. They utilize the graph Laplacian and the spectral definition of a convolution and boil down to some form of aggregation over neighbors such as averaging. They can be thought of as implicitly learning an embedding, e.g. by taking the output of the last layer before the supervised component. See BID22 for an overview. In contrast to this paper, most of these methods are (semi-)supervised. The graph variational autoencoder (GAE) BID17 ) is a notable exception that learns node embeddings in an unsupervised manner. Few approaches consider the idea of learning an embedding that is a distribution. BID31 are the first to learn Gaussian word embeddings to capture uncertainty. Closest to our work, BID12 represent knowledge graphs and Dos BID4 study heterogeneous graphs for node classification. Both approaches are not applicable for the context of unsupervised learning of (attributed) graphs that we are interested in. The method in BID12 learns an embedding for each component of the triplets (head, tail, relation) in the knowledge graph. Note that we cannot naively employ this method by considering a single relation "has an edge" and a single entity "node". Since their approach considers similarity between entities and relations, all nodes would be trivially similar to the single relation. Considering the semi-supervised approach proposed in Dos BID4, we cannot simply "turn off" the supervised component to adapt their method for unsupervised learning, since given the defined loss we would trivially map all nodes to the same Gaussian. Additionally, both of these approaches do not consider node attributes. In this section we introduce our method Graph2Gauss (G2G) and detail how both the attributes and the network structure influence the learning of node representations. The embedding is carried out in two steps: (i) the node attributes are passed through a non-linear transformation via a deep neural network (encoder) and yield the parameters associated with the node's embedding distribution; (ii) we formulate an unsupervised loss function that incorporates the natural ranking of the nodes as given by the network structure w.r.t. a dissimilarity measure on the embedding distributions. Problem definition. Let G = (A, X) be a directed attributed graph, where A ∈ R N ×N is an adjacency matrix representing the edges between N nodes and X ∈ R N ×D collects the attribute information for each node where x i is a D dimensional attribute vector of the i th node. 1 V denotes the set of all nodes. We aim to find a lower-dimensional Gaussian distribution embedding DISPLAYFORM0 such that nodes similar w.r.t. attributes and network structure are also similar in the embedding space given a dissimilarity measure ∆(h i, h j). In FIG4 for example we show nodes that are embedded as two dimensional Gaussians. To capture the structural information of the network in the embedding space, we propose a personalized ranking approach. That is, locally per node i we impose a ranking of all remaining nodes w.r.t. their distance to node i in the embedding space. More precisely, in this paper we exploit the k-hop neighborhoods of each node. Given some anchor node i, we define N ik = {j ∈ V |i = j, min(sp(i, j), K) = k} to be the set of nodes who are exactly k hops away from node i, where V is the set of all nodes, K is a hyper-parameter denoting the maximum distance we are wiling to consider, and sp(i, j) returns either the length of the shortest path starting at node i and ending in node j or ∞ if node j is not reachable. Intuitively, we want all nodes belonging to the 1-hop neighborhood of i to be closer to i w.r.t. their embedding, compared to the all nodes in its 2-hop neighborhood, which in turn are closer than the nodes in its 3-hop neighborhood and so on up to K. Thus, the ranking that we want to ensure from the perspective of node i is DISPLAYFORM0 or equivalently, we aim to satisfy the following pairwise constraints DISPLAYFORM1 Going beyond mere first-order and second-order proximity this enables us to capture the network structure at multiple scales incorporating local and global structure. Dissimilarity measure. To solve the above ranking task we have to define a suitable dissimilarity measure between the latent representation of two nodes. Since our latent representations are distributions, similarly to Dos BID4 and BID12 we employ the asymmetric KL divergence. This gives the additional benefit of handling directed graphs in a sound way. More specifically, given the latent Gaussian distribution representation of two nodes h i, h j we define DISPLAYFORM2 Here we use the notation µ i, Σ i to denote the outputs of some functions µ θ (x i) and Σ θ (x i) applied to the attributes x i of node i and tr denotes the trace of a matrix. The asymmetric KL divergence also applies to the case of an undirected graph by simply processing both directions of the edge. We could alternatively use a symmetric dissimilarity measure such as the Jensen-Shannon divergence or the expected likelihood (probability product kernel). The functions µ θ (x i) and Σ θ (x i) are deep feed-forward non-linear neural networks parametrized by θ. It is important to note that these parameters are shared across instances and thus enjoy statistical strength benefits. Additionally, we design µ θ (x i) and Σ θ (x i) such that they share parameters as well. More specifically, a deep encoder f θ (x i) processes the node's attributes and outputs an intermediate hidden representation, which is then in turn used to output µ i and Σ i in the final layer of the architecture. We focus on diagonal covariance matrices. 2 The mapping from the nodes' attributes to their embedding via the deep encoder is precisely what enables the inductiveness of Graph2Gauss. Since it is intractable to find a solution that satisfies all of the pairwise constraints defined in Sec. 3.1 we turn to an energy based learning approach. The idea is to define an objective function that penalizes ranking errors given the energy of the pairs. More specifically, denoting the KL divergence between two nodes as the respective energy, E ij = D KL (N j ||N i), we define the following loss to be optimized DISPLAYFORM0 where DISPLAYFORM1 } is the set of all valid triplets. The E ij k terms are positive examples whose energy should be lower compared to the energy of the negative examples E ij l. Here, we employed the so called square-exponential loss BID18 which unlike other typically used losses (e.g. hinge loss) does not have a fixed margin and pushes the energy of the negative terms to infinity with exponentially decreasing force. In our setting, for a given anchor node i, the energy E ij should be lowest for nodes j in his 1-hop neighborhood, followed by a higher energy for nodes in his 2-hop neighborhood and so on. Finally, we can optimize the parameters θ of the deep encoder such that the loss L is minimized and the pairwise rankings are satisfied. Note again that the parameters are shared across all instances, meaning that we share statistical strength and can learn them more easily in comparison to treating the distribution parameters (e.g. µ i, Σ i) independently as free variables. The parameters are optimized using Adam BID15 ) with a fixed learning rate of 0.001.Sampling strategy. For large graphs, the complete loss is intractable to compute, confirming the need for a stochastic variant. The naive approach would be to sample triplets from D t uniformly, i.e. replace (i,j k,j l)∈Dt with E (i,j k,j l)∼Dt in Eq. 1. However, with the naive sampling we are less likely to sample triplets that involve low-degree nodes since high degree nodes occur in many more pairwise constraints. This in turn means that we update the embedding of low-degree nodes less often which is not desirable. Therefore, we propose an alternative node-anchored sampling strategy. Intuitively, for every node i, we randomly sample one other node from each of its neighborhoods (1-hop, 2-hop, etc.) and then optimize over all the corresponding pairwise constraints DISPLAYFORM2 Naively applying the node-anchored sampling strategy and optimizing Eq. 1, however, would lead to biased estimates of the gradient. Theorem 1 shows how to adapt the loss such that it is equal in expectation to the original loss under our new sampling strategy. As a consequence, we have unbiased estimates of the gradient using stochastic optimization of the reformulated loss. Theorem 1 For all i, let (j 1, . . ., j K) be independent uniform random samples from the sets (N i1, . . ., N iK) and |N i * | the cardinality of each set. Then L is equal in expectation to DISPLAYFORM3 We provide the proof in the appendix. For cases where the number of nodes N is particularly large we can further subsample mini-batches, by selecting anchor nodes i at random. Furthermore, in our experimental study, we analyze the effect of the sampling strategy on convergence, as well as the quality of the stochastic variant w.r.t. the obtained solution and the reached local optima.2 To ensure that they are positive definite, in the final layer we outputσ id ∈ R and obtain σ id = elu(σ id)+1. Inductive learning. While during learning we need both the network structure (to evaluate the ranking loss) and the attributes, once the learning concludes, the embedding for a node can be obtained solely based on its attributes. This enables our method to easily handle the issue of obtaining representations for new nodes that were not part of the network during training. To do so we simply pass the attributes of the new node through our learned deep encoder. Most approaches cannot handle this issue at all, with a notable exception being SDNE and GraphSAGE. However, both approaches require the edges of the new node to get the node's representation, and cannot handle nodes that have no existing connections. In contrast, our method can handle even such nodes, since after the model is learned we rely only on the attribute information. Plain graph embedding. Even though attributed graphs are often found in the real-world, sometimes it is desirable to analyze plain graphs. As already discussed, our method easily handles plain graphs, when the attributes are not available, by using one-hot encoding of the nodes instead. As we later show in the experiments we are able to learn useful representations in this scenario, even outperforming some attributed approaches. Naturally, in this case we lose the inductive ability to handle unseen nodes. We compare the one-hot encoding version, termed G2G oh, with our full method G2G that utilizes the attributes, as well as all remaining competitors. Encoder architecture. Depending on the type of the node attributes (e.g. images, text) we could in principle use CNNs/RNNs to process them. We could also easily incorporate any of the proposed graph convolutional layers inheriting their benefits. However, we observe that in practice using simple feed-forward architecture with rectifier units is sufficient, while being much faster and easier to train. Better yet, we observed that Graph2Gauss is not sensitive to the choice of hyperparameters such as number and size of hidden layers. We provide more detailed information and sensible defaults in the appendix. Complexity. The time complexity for computing the original loss is O(N 3) where N is the number of nodes. Using our node-anchored sampling strategy, the complexity of the stochastic version is O(K 2 N) where K is the maximum distance considered. Since a small value of K ≤ 2 consistently showed good performance, K 2 becomes negligible and thus the complexity is O(N), meaning linear in the number of nodes. This coupled with the small number of epochs T needed for convergence (T ≤ 2000 for all shown experiments, see e.g. FIG2) and an efficient GPU implementation also made our method faster than most competitors in terms of wall-clock time. We compare Graph2Gauss with and without considering attributes (G2G, G2G oh) to several competitors namely: TRIDNR and TADW BID24 BID33 as representatives that consider attributed graphs, GAE BID17 as the unsupervised graph convolutional representative, and node2vec BID9 as a representative of the random walk based plain graph embeddings. Additionally, we include a strong Logistic Regression baseline that considers only the attributes. As with all other methods we train TRIDNR in a unsupervised manner, however, since it can only process raw text as attributes (rather than e.g. bag-of-words) it is not always applicable. Furthermore, since TADW, and GAE only support undirected graphs we must symmetrize the graph before using them -giving them a substantial advantage, especially in the link prediction task. Moreover, in all experiments if the competing techniques use an L dimensional embedding, G2G's embedding is actually only half of this dimensionality so that the overall number of'parameters' per node (mean vector + variance terms of the diagonal Σ i) matches L.Dataset description. We use several attributed graph datasets. Cora BID20 is a well-known citation network labeled based on the paper topic. While most approaches report on a small subset of this dataset we additionally extract from the original data the entire network and name these two datasets CORA (N = 19793, E = 65311, D = 8710, K = 70) and CORA-ML (N = 2995, E = 8416, D = 2879, K = 7) respectively. CITESEER (N = 4230, E = 5358, D = 2701, K = 6) BID6, DBLP (N = 17716, E = 105734, D = 1639, K = 4) and PUBMBED (N = 18230, E = 79612, D = 500, K = 3) BID27 are other commonly used citation datasets. We provide all datasets, the source code of G2G, and further supplementary material (https://www.kdd.in.tum.de/g2g). Setup. Link prediction is a commonly used task to demonstrate the meaningfulness of the embeddings. To evaluate the performance we hide a set of edges/non-edges from the original graph and train on the ing graph. Similarly to BID17 and we create a validation/test set that contains 5%/10% randomly selected edges respectively and equal number of randomly selected non-edges. We used the validation set for hyper-parameter tuning and early stopping and the test set only to report the performance. As by convention we report the area under the ROC curve (AUC) and the average precision (AP) scores for each method. To rank the candidate edges we use the negative energy −E ij for Graph2Gauss, and the exact same approach as in the respective original methods (e.g. dot product of the embeddings).Performance on real-world datasets. TAB0 shows the performance on the link prediction task for different datasets and embedding size L = 128. As we can see our method significantly outperforms the competitors across all datasets which is a strong sign that the learned embeddings are useful. Furthermore, even the constrained version of our method G2G oh that does not consider attributes at all outperforms the competitors on some datasets. While GAE achieves comparable performance on some of the datasets their approach doesn't scale to large graphs. In fact, for graphs beyond 15K nodes we had to revert to slow training on the CPU since the data did not fit on the GPU memory (12GB). The simple Logistic Regression baseline showed surprisingly strong performance, even outperforming some of the more complicated methods. We also include the performance on the so called "Cora-ML Easy" dataset, obtained from the Cora-ML dataset by making it undirected and selecting the nodes in the largest connected component. We see that while node2vec struggles on the original real-world data, it significantly improves in this "easy" setting. On the contrary, Graph2Gauss handles both settings effortlessly. This demonstrates that Graph2Gauss can be readily applied in realistic scenarios on potentially messy real-world data. Sensitivity analysis. In Figs.1(a) and 1(b) we show the performance w.r.t. the dimensionality of the embedding, averaged over 10 trials. G2G is able to learn useful embeddings with strong performance even for relatively small embedding sizes. Even for the case L = 2, where we embed the points as one dimensional Gaussian distributions (L = 1 + 1 for the mean and the sigma of the Gaussian), G2G still outperforms all of the competitors irrespective of their much higher embedding sizes. Finally, we evaluate the performance w.r.t. the percentage of training edges varying from 15% to 85%, averaged over 10 trials. We can see in Figs.1(c) and 1(d) Graph2Gauss strongly outperforms the competitors, especially for small number of training edges. The dashed line indicates the percent-age above which we can guarantee to have every node appear at least once in the training set. 3 The performance below that line is then indicative of the performance in the inductive setting. Since, the structure only methods are unable to compute meaningful embeddings for unseen nodes we cannot report their performance below the dashed line. Setup. Node classification is another task commonly used to evaluate the strength of the learned embeddings -after they have been trained in an unsupervised manner. We evaluate the node classification performance for three datasets (Cora-ML, Citeseer and DBLP) that have ground-truth classes. First, we train the embeddings on the entire training data in an unsupervised manner (excluding the class labels). Then, following BID25 we use varying percentage of randomly selected nodes and their learned embeddings along with their labels as training data for a logistic regression, while evaluating the performance on the rest of the nodes. We also optimize the regularization strength for each method/dataset via cross-validation. We show averaged over 10 trials. Performance on real-world datasets. Figs. 2 compares the methods w.r.t. the classification performance for different percentage of labeled nodes. We can see that our method clearly outperforms the competitors. Again, the constrained version of our method that does not consider attributes is able to outperform some of the competing approaches. Additionally, we can conclude that in general our method shows stable performance regardless of the percentage of labeled nodes. This is a highly desirable property since it shows that should we need to perform classification it is sufficient to train only on a small percentage of labeled nodes. Figure 3(a) shows the validation set ROC score for the link prediction task w.r.t. the number of triplets (i, j k, j l) seen. We can see that both sampling strategies are able to reach the same performance as the full loss in significantly fewer (< 4.2%) number of pairs seen (note the log scale). It also shows that the naive random sampling converges slower than the node-anchored sampling strategy. FIG2 gives us some insight as to why -our node-anchored sampling strategy achieves significantly lower loss. Finally, FIG2 shows that our node-anchored sampling strategy has lower variance of the gradient updates, which is another contributor to faster convergence. Our node-anchored sampling Naive random sampling Full loss 10 4 10 5 10 6 10 7 10 8 10 9Number of pairs seen Learning an embedding that is a distribution rather than a point-vector allows us to capture uncertainty about the representation. We perform several experiments to evaluate the benefit of modeling uncertainty. FIG3 shows that the learned uncertainty is correlated with neighborhood diversity, where for a node i we define diversity as the number of distinct classes among the nodes in its p-hop neighborhood (1≤k≤p N ik). Since the uncertainty for a node i is an L-dimensional vector (diagonal covariance) we show the average across the dimensions. In line with our intuition, nodes with less diverse neighborhood have significantly lower variance compare to more diverse nodes whose immediate neighbors belong to many different classes, thus making their embedding more uncertain. The figure shows the on the Cora dataset for p = 3 hop neighborhood. Similar hold for the other datasets. This is particularly impressive given the fact that we learn our embedding in a completely unsupervised manner, yet the uncertainty was able to capture the diversity w.r.t. the class labels of the neighbors of a node, which were never seen during training. Figure 4(b) shows that using the learned uncertainty we are able to detect the intrinsic latent dimensionality of the graph. Each line represents the average variance (over all nodes) for a given dimension l for each epoch. We can see that as the training progresses past the stopping criterion (link prediction performance on validation set) and we start to overfit, some dimensions exhibit a relatively stable average variance, while for others the variance increases with each epoch. By creating a simply rule that monitors the average change of the variance over time we were able to automatically detect these relevant latent dimensions (colored in red). This holds for multiple datasets and is shown here for Cora-ML. Interestingly, the number of detected latent dimensions is close to the number of ground-truth communities.The next obvious question is then how does the performance change if we remove these highly uncertain dimensions whose variance keeps increasing with training. FIG3 (c) answers exactly that. By removing progressively more and more dimensions, starting with the most uncertain first we see imperceptibly small change in performance. Only once we start removing the true latent dimension we see a noticeable degradation in performance. The dashed lines show the performance if we re-train the model, setting L = 6, equal to the detected number of latent dimensions. As a last study of uncertainty, in a use case analysis, the nodes with high uncertainty reveal additional interesting patterns. For example in the Cora dataset, one of the highly uncertain nodes was the paper "The use of word shape information for cursive script recognition" by R.J. Whitrow -surprisingly, all citations (edges) of that paper (as extracted from the dataset) were towards other papers by the same author. As discussed in Sec. 3.4 G2G is able to learn embeddings even for nodes that were not part of the networks structure during training time. Thus, it not only supports transductive but also inductive learning. To evaluate how our approach generalizes to unseen nodes we perform the following experiment: (i) first we completely hide 10%/25% of nodes from the network at random; (ii) we proceed to learn the node embeddings for the rest of the nodes; (iii) after learning is complete we pass the (new) unseen test nodes through our deep encoder to obtain their embedding; (iv) we evaluate by calculating the link prediction performance (AUC and AP scores) using all their edges and same number of non-edges. As the in TAB1 clearly show, since we are utilizing the rich attribute information, we are able to achieve strong performance for unseen nodes. This is true even when a quarter of the nodes are missing. This makes our method applicable in the context of large graphs where training on the entire network is not feasible. Note that SDNE and GraphSAGE ) cannot be applied in this scenario, since they also require the edges for the unseen nodes to produce an embedding. Graph2Gauss is the only inductive method that can obtain embeddings for a node based only on the node attributes. One key application of node embedding approaches is creating meaningful visualizations of a network in 2D/3D that support tasks such as data exploration and understanding. Following BID30 and Pan et al. FORMULA4 we first learn a lower-dimensional L = 128 embedding for each node and then map those representations in 2D with TSNE BID19. Additionally, since our method is able to learn useful representations even in low dimensions we embed the nodes as 2D Gaussians and visualize the ing embedding. This has the added benefit of visualizing the nodes' uncertainty as well. FIG4 shows the visualization for the Cora-ML dataset. We see that Graph2Gauss learns an embedding in which the different classes are clearly separated. We proposed Graph2Gauss -the first unsupervised approach that represents nodes in attributed graphs as Gaussian distributions and is therefore able to capture uncertainty. Analyzing the uncertainty reveals the latent dimensionality of a graph and gives insight into the neighborhood diversity of a node. Since we exploit the attribute information of the nodes we can effortlessly generalize to unseen nodes, enabling inductive reasoning. Graph2Gauss leverages the natural ordering of the nodes w.r.t. their neighborhoods via a personalized ranking formulation. The strength of the learned embeddings has been demonstrated on several tasks -specifically achieving high link prediction performance even in the case of low dimensional embeddings. As future work we aim to study personalized rankings beyond the ones imposed by the shortest path distance. A PROOF OF THEOREM 1To prove Theorem 1 we start with the loss L s (Eq. 2), and show that by applying the expectation operator we will obtain the original loss L (Eq. 1). From there it trivially follows that taking the gradient with respect to L s for a set of samples gives us an unbiased estimate of the gradient of L.First we notice that both L and L s are summing over i, thus it is sufficient to show that the losses are equal in expectation for a single node i. Denoting with L (i)s the loss for a single node i and with E i,k,l = E ij k 2 + exp −Eij l for notational convenience we have: DISPLAYFORM0 In step we have expanded the sum over k < l in independent terms. In step we have marginalized the expectation over the variables that do not appear in the expression, e.g. for the term E (j1,...,j K)∼(Ni1,...,N iK) |N i1 | · |N i2 | · E i12 we can marginalize over j p where p = 1 and p = 2 since the term doesn't depend on them. In step we have expanded the expectation term. In step we have substituted p(j p) with 1 |Nij p | since we are sampling uniformly at random. Since DISPLAYFORM1 s is equal to L (i) in expectation it follows that ∇L s based on a set of samples is an unbiased estimate of ∇L. Architecture and hyperparameters. We observed that Graph2Gauss is not sensitive to the choice of hyperparameters such as number and size of hidden layers. Better yet, as shown in Sec. 4.4, Graphs2Gauss is also not sensitive to the size of the embedding L. Thus, for a new graph, one can simply pick a relatively large embedding size and if required prune it later similarly to the analysis performed in FIG3.As a sensible default we recommend an encoder with a single hidden layer of size s 1 = 512. More specifically, to obtain the embeddings for a node i we have DISPLAYFORM0 where x i are node attributes, relu and elu are the rectified linear unit and exponential linear unit respectively. In practice, we found that the softplus works equally well as the elu for making sure that σ i are positive and in turn Σ i is positive definite. We used Xavier initialization BID7 for the weight matrices W ∈ R D×s1, b ∈ R s1, W µ ∈ R s1×L/2, b µ ∈ R L/2, W Σ ∈ R s1×L/2, b Σ ∈ R L/2. As discussed in Sec. 3.4, multiple hidden layers, or other architectures such as CNNs/RNNs can also be used based on the specific problem. Unlike other approaches using Gaussian embeddings BID31 BID12 BID4 we do not explicitly regularize the norm of the means and we do not clip the covariance matrices. Given the self-regularizing nature of the KL divergence this is unnecessary, as was confirmed in our experiments. The parameters are optimized using Adam BID15 ) with a fixed learning rate of 0.001 and no learning rate annealing/decay. Edge cover. Some of the methods such as node2vec BID9 are not able to produce an embedding for nodes that have not been seen during training. Therefore, it is important to make sure that during the train-validation-test split of the edge set, every node appears at least once in the train set. Random sampling of the edges does not guarantee this, especially when allocating a low percentage of edges in the train set during the split. To guarantee that every node appears at least once in the train set we have to find an edge cover. An edge cover of a graph is a set of edges such that every node of the graph is incident to at least one edge of the set. The minimum edge cover problem is the problem of finding an edge cover of minimum size. The dashed line in FIG0 and 1(d) indicates exactly the size of the minimum edge cover. This condition had to be satisfied for the competing methods, however, since Graph2Gauss is inductive, it does not require that every node is in the train set.

Represent the short summary for finding the corresponding scientific article (long).

We embed nodes in a graph as Gaussian distributions allowing us to capture uncertainty about their representation.

Represent the TLDR for finding the corresponding scientific article

We leverage deterministic autoencoders as generative models by proposing mixing functions which combine hidden states from pairs of images. These mixes are made to look realistic through an adversarial framework.


Question: Represent the text to find a very short summary (1-2 sentences max)

Question: While great progress has been made at making neural networks effective across a wide range of tasks, many are surprisingly vulnerable to small, carefully chosen perturbations of their input, known as adversarial examples. In this paper, we advocate for and experimentally investigate the use of logit regularization techniques as an adversarial defense, which can be used in conjunction with other methods for creating adversarial robustness at little to no cost. We demonstrate that much of the effectiveness of one recent adversarial defense mechanism can be attributed to logit regularization and show how to improve its defense against both white-box and black-box attacks, in the process creating a stronger black-box attacks against PGD-based models. Neural networks, despite their high performance on a variety of tasks, can be brittle. Given data intentionally chosen to trick them, many deep learning models suffer extremely low performance. This type of data, commonly referred to as adversarial examples, represent a security threat to any machine learning system where an attacker has the ability to choose data input to a model, potentially allowing the attacker to control a model's behavior. Today, adversarial examples are typically created by small, but carefully chosen transformations of data that models are otherwise high-performant on. This is primarily due to the ease of experimentation with existing datasets BID4, though the full threat of adversarial examples is only limited by the ability and creativity of an attacker's example generation process. Even with the limited threat models considered in current research, performance on adversarially chosen examples can be dramatically worse than unperturbed data -for example, white-box accuracy on adversarially chosen examples for the CIFAR-10 image classification task BID10 ) is lower than 50%, even for the most robust defenses known today BID12 BID9, while unperturbed accuracy can be as high as 98. 5%.Current defenses against adversarial examples generally come in one of a few flavors. Perhaps the most common approach is to generate adversarial examples as part of the training procedure and explicitly train on them ("adversarial training"). Another approach is to transform the model's input representation in a way that thwarts an attacker's adversarial example construction mechanism. While these methods can be effective, care must be taken to make sure that they are not merely obfuscating gradients BID1. Last, generative models can be built to model the original data distribution, recognizing when the input data is out of sample and potentially correcting it BID18 BID16. Of these, perhaps the most robust today is adversarial logit pairing BID9, which extends the adversarial training work of BID12 by incorporating an additional term to make the logits (pre-softmax values) of an unperturbed and adversarial example more similar. In this work, we show that adversarial logit pairing derives a large fraction of its benefits from regularizing the model's logits toward zero, which we demonstrate through simple and easy to understand theoretical arguments in addition to empirical demonstration. Investigating this phenomenon further, we examine two alternatives for logit regularization, finding that both in improved robustness to adversarial examples, sometimes surprisingly so -for example, using the right amount of label smoothing BID21 can in greater than 40% robustness to a projected gradient descent (PGD) attack BID12 on CIFAR-10 while training only on the original, unperturbed training examples, and is also a compelling black-box defense. We then present an alternative formulation of adversarial logit pairing that separates the logit pairing and logit regularization effects, improving the defense. The end of these investigations is a defense that sets a new state-of-the-art for PGD-based adversaries on CIFAR-10 for both white box and black box attacks, while requiring little to no computational overhead on top of adversarial training. Before proceeding with our analysis, it is prudent to review existing work on adversarial training for context. While adversarial examples have been examined in the machine learning community in some capacity for many years BID3, their study has drawn a sharp focus in the current renaissance of deep learning, starting with BID20 and BID5. In BID5, adversarial training is presented as training with a weighted loss between an original and adversarial example, i.e. with a loss of DISPLAYFORM0 where g(x) is a function representing the adversarial example generation process, originally presented as g(x) = x + · sign(∇ x J(θ, x, y)), α is a weighting term between the original and adversarial examples typically set to 0.5, and as usual θ are the model parameters to learn, J is a cross-entropy loss, m is the dataset size, x (i) is the ith input example, and y (i) is its label. Due to the use of a single signed gradient with respect to the input example, this method was termed the "fast gradient sign method" (FGSM), requiring a single additional forward and backward pass of the network to create. BID11 extended FGSM into a multi-step attack, iteratively adjusting the perturbation applied to the input example through several rounds of FGSM. This was also the first attack that could be described as a variant of projected gradient descent (PGD). Both of these approaches primarily target an L ∞ threat model, where the L ∞ norm between the original and adversarial example is constrained to a small value. BID12 built upon these works by initializing the search process for the adversarial perturbation randomly, and is the strongest attack currently available to the best of our knowledge. Through extensive experiments, they showed that even performing PGD with a single random initialization is able to approximate the strongest adversary found with current first-order methods. However, as with multi-step FGSM, performing adversarial training with this approach can be rather expensive, taking an order of magnitude longer than standard training due to requiring N +1 forward and backward passes of the model, where N is the number of PGD iterations. Improving on PGD-based adversarial training, BID9 introduced adversarial logit pairing (ALP), which adds a term to the adversarial training loss function that encourages the model to have similar logits for original and adversarial examples: DISPLAYFORM1 where L was set to an L 2 loss in experiments and f (x, θ) returns the logits of the model corresponding to example x. Adversarial logit pairing has the motivation of increasing the amount of structure in the learning process, by encouraging the model to have similar prediction patterns on the original and adversarial examples, a process reminiscent of distillation BID7. BID9 also studied a baseline version of ALP, called "clean logit pairing", which paired randomly chosen unperturbed examples together. Surprisingly, this worked reasonably well, inspiring them to experiment with a similar idea they call "clean logit squeezing", regularizing the L 2 norm of the model's logits, which worked even more effectively, though this idea itself was not combined with adversarial training. It is this aspect of the work that is most related to what we study in this paper. We now show how adversarial logit pairing BID9 acts as a logit regularizer. For notational convenience, denote DISPLAYFORM0 c as the logit of the model for class c on example i in its original, unperturbed form, and˜ DISPLAYFORM1 c as the logit for the corresponding adversarial example. The logit pairing term in adversarial logit pairing is a simple L 2 loss: DISPLAYFORM2 While it is obvious that minimizing this term will have the effect of making the original and adversarial logits more similar in some capacity, what precise effect does it have on the model during training? To examine this, we look at the gradient of this loss term with respect to the logits themselves: DISPLAYFORM3 Under the assumption that the adversarial example moves the model's predictions away from the correct label (as should be the case with any reasonable adversarial example, such as an untargeted PGD-based attack), we have that DISPLAYFORM4 is the correct category, and DISPLAYFORM5 otherwise. Keeping in mind that model updates move in the direction opposite of the gradient, then the update to the model's weights will attempt to make the original logits smaller and the adversarial logits larger when c = y (i) and will otherwise attempt to make the original logits larger and the adversarial logits smaller. However, this must be considered in the context of the adversarial training lossJ -in particular, the standard cross-entropy loss used inJ for the adversarial example g(x (i) ) already encourages the adversarial logits to be higher for the correct category and smaller for all incorrect categories, and furthermore the scale of the lossJ typically is an order of magnitude larger than the adversarial pairing loss. Thus, we argue that the main effect of adversarial logit pairing is actually in the remaining two types of updates, encouraging the logits of the original example to be smaller for the correct category and larger for all incorrect categories. These two updates have very similar effects to simply regularizing model logits, e.g. in a manner similar to "logit squeezing" BID9 or label smoothing BID21.We can also view this from a different perspective by explicitly incorporating the scale of the logits in the logit pairing term. If we factor out a shared scale factor γ from each logit, the logit pairing term becomes DISPLAYFORM6 implying that DISPLAYFORM7 meaning that the model would always attempt to update the scale of the logits in the opposite direction of the sign of γ, i.e. toward zero, so long as the logits were not identical. In practice, this affect is counterbalanced by the adversarial training term, which requires non-identical logits to minimize its cross-entropy loss. Given this interpretation, in this work we now explore 1) whether this can be verified experimentally, explicitly into a form where the effect of logit regularization and pairing can be disentangled, and 4) whether the above analysis can yield insights to making more adversarially robust methods. Perhaps the most straightforward way to test our hypothesis is to examine the logits of a model trained with ALP vs one trained with standard adversarial training. If true, the model trained with ALP will have logits that are generally smaller in magnitude. We do this in FIG0 We see that it is indeed the case that the logits for a model trained with ALP are of smaller magnitude than those of a model trained with PGD, with a variance reduction of the logits from 8.31 to 4.02 on clean test data (distributions on a set of PGD adversarial examples are very similar). This provides evidence that ALP does have the effect of regularizing logits, though this data alone is not sufficient to determine if this is a key mechanism in improved performance. To answer this, we can examine if standard adversarial training can be improved by explicitly regularizing the logits. If adversarial robustness can be improved, but similar improvements can not be made to ALP, then at least some of the benefits of ALP can be attributed to logit regularization. We present the of this experiments in FIG0 (right), implemented using the "logit squeezing" form of regularization (L 2 -regularization on the logits).These show that incorporating regularization on model logits is able to recover slightly more than half of the improvement from logit pairing, with too little regularization having only a small effect, and too much regularization approaching the point of being harmful. However, when added to a model already trained with ALP, regularizing the logits does not lead to any improvement, and in fact hurts performance, likely due to putting too much strength into logit regularization. This evidence makes clear that one of the key improvements from logit pairing is due to a logit regularization effect. We would like to emphasize that these are not meant to diminish ALP in any sense -adversarial logit pairing works, and our goals are to investigate the mechanism by which it works and explore if it can be generalized or improved. Given these , it is worth examining other methods that have an effect of regularizing logits in order to tell whether this is a more general phenomenon. Label Smoothing. Label smoothing is the process of replacing the one-hot training distribution of labels with a softer distribution, where the probability of the correct class has been smoothed out onto the incorrect classes BID21. Concretely, label smoothing uses the target DISPLAYFORM0 c is the target probability for class c for example i, C is the number of categories and s ∈ [0, 1 − 1 C] is the smoothing strength. Label smoothing was originally introduced as a form of regularization, designed to prevent models from being too confident about training examples, with the goal of improved generalization. It can be easily implemented as a preprocessing step on the labels, and does not affect model training time in any significant way. Interestingly, BID11 found that disabling the small amount of label smoothing present in a model trained on ImageNet actually improved adversarial robustness roughly by 1%. Here we find a different effect, with the caveat of relatively different experimental setups from BID11.In FIG2 (left) we show the effect label smoothing has on the performance of a model trained only on clean (i.e. non-adversarial) training data. Very surprisingly, using only label smoothing can in a model that is nearly as robust as models trained with PGD-based adversarial training or adversarial logit pairing and take an order of magnitude less time to train -though we note that when PGD and ALP-based models are trained only on adversarial examples rather than a mixture of clean and adversarial data, their robustness exceeds this performance by around 5%. Furthermore, this benefit of label smoothing comes at no significant loss in accuracy on unperturbed test data, while generally, adversarial training tends to trade off original vs adversarial performance. Another curiosity is that adding in any label smoothing at all dramatically improves robustness to FGSMbased adversaries (adding label smoothing of s = .01 brought accuracy up from 6.1% to 38.3%), while PGD-based attacks saw much more gradual improvement. Examining the logits FIG2, we see a striking difference between the models -the model trained with label smoothing both has a dramatically smaller dynamic range of logits and also presents a much more bimodal logit distribution than the model trained without label smoothing. In other words, it has learned to predict extremely consistent values for logits, which is what we attribute its adversarial robustness to. Anecdotally, we observed that this behavior held for all positive values of s, with a stronger effect the higher s was. Additional experiments with label smoothing are given in Section 5.3. Recently, a new form of data augmentation was found that, in contrast to standard label-preserving data augmentation, combined different training examples together, dramatically altering both the appearance of the training examples and their labels. Introduced concurrently by BID8; BID22, these types of data augmentation typically have the form of element-wise weighted averaging of two input examples (typically images), with the training label also determined as a weighted average of the original two training labels (represented as one-hot vectors). Besides making target labels soft (i.e. not 1-of-K) during training time, these methods also encourage models to behave linearly between examples, which may improve robustness to out of sample data. Interestingly, found that this type of data augmentation improved robustness to FGSM attacks on ImageNet BID15, but BID9 found that the method did not improve robustness against a targeted attack with a stronger PGD-based adversary. In our experiments we found evidence agreeing with both -when applying mixup, we found a sizeable increase in robustness to FGSM adversaries, going from 6.1% on CIFAR-10 by training without mixup to 30.8% with mixup, but did not observe a significant change when evaluated against a PGD-based adversary. While robustness to a PGD adversary with only 5 steps increased by a tiny amount (from 0.0% to 0.5%), robustness to a 10-step PGD adversary remained at 0%. In our experiments, we use VH-mixup, the slightly improved version of mixup from BID19. While we have now considered alternate methods by which logits can be regularized, at this point it is still not clear exactly how they might be used with or interact with the logit regularization effect of adversarial logit pairing. Doing so requires separating out the logit pairing and logit regularization effects of ALP.In adversarial logit pairing BID9, the logit pairing term is implemented as an L 2 loss: DISPLAYFORM0 though other losses such as an L 1 or Huber loss are also possible. We would like to break L into separate pairing and regularization terms: DISPLAYFORM1 where the purpose of the first term is explicitly for making the logits more similar (with as little logit regularization as possible), and the second term is explicitly for regularizing the logits toward zero. There are several natural choices for h, such as the the Jensen-Shannon divergence, a cosine similarity, or any similarity metric that does not have a significant regularization effect. We have found that simply taking the cross entropy between the distributions induced by the logits was effective -depending on the actual values of the logits, this can either still have a mild squeezing effect (if the logits are very different), a mild expanding effect (if the logits are very similar), or something in between. One implementation detail worth noting is that it can be difficult to reason about and set the relative strengths of the pairing loss and adversarial training loss. To that end, we set the strength of the pairing loss h as a constant fraction of the adversarial loss, implemented by setting the coefficient of the loss as a constant multiplied by a non-differentiable version of the ratio between the losses. By decomposing adversarial logit pairing explicitly into logit pairing and logit regularization terms in this way, adversarial robustness to a 10-step PGD attack improves by an absolute 1.9% over ALP, or 5.6% over standard PGD-based adversarial training. In the experiments on CIFAR-10 throughout this paper, we used a ResNet BID6, equivalent to the "simple" model of BID12, with a weight decay of 2 · 10 −4 and a momentum optimizer with strength of 0.9. Standard data augmentation of random crops and horizontal flips was used. After a warm up period of 5 epochs, the learning rate peaked at 0.1 and decayed by a factor of 10 at 100 and 150 epochs, training for a total of 200 epochs for models not trained on adversarial examples and 101 epochs for models using adversarial training -adversarial accuracy tends to increase for a brief period of time after a learning rate decay, then quickly drop by a small amount, an empirical finding also echoed by. The minibatch size was 128.Adversarial examples were constrained to a maximum L ∞ norm of.03, and all PGD-based attacks used a step size of 0.0078. Adversarial attacks were constructed using the CleverHans library BID13, implemented in TensorFlow BID0. All experiments were done on two Nvidia Geforce GTX 1080 Ti GPUs. Given these forms of logit regularization, perhaps the most natural question is whether they can be combined to create an even more robust model. Thus, in this section we focus exclusively on making a model (and comparable baselines) as robust as possible to PGD-based attacks. In particular, for baseline methods (PGD-based adversarial training BID12 and adversarial logit pairing ), we opt to train exclusively on adversarial examples, effectively setting α = 0 in Equation 1, which roughly trades off accuracy of 4 − 5% for clean test examples for a similar gain in adversarial performance. To combine the logit regularization methods together, we use a small amount of label smoothing (s = 0.1), use VH-mixup BID19 on the input examples, use the logit pairing formulation of Section 4.1 with β = 10 −3, and set the ratio between the adversarial training loss and the pairing loss to 0.125, which focuses the loss on keeping adversarial and original examples similar. These parameters were not tuned much due to resource constraints. We refer to this combination simply as LRM ("Logit Regularization Methods").White-box performance is shown in Table 1. LRM achieves the highest level of adversarial robustness of the methods considered for all PGD-based attacks, and to the best of our knowledge represents the most robust method on CIFAR-10 to date. However, like other adversarial defenses, this comes at the cost of performance on the original test set, which makes sense -from the perspective of adversarial training, a clean test image is simply the center of the set of feasible adversarial examples. Nonetheless, it is interesting that the tradeoff between adversarial and non-adversarial performance can continue to be pushed further, with the optimal value of that tradeoff dependent on application (e.g. whether worst-case performance is more important than performance on unperturbed examples).Next, black-box performance is shown in TAB1. As is standard in most black-box evaluations of adversarial defenses, this is performed by generating adversarial examples with one model (the "Source") and evaluating them on a separate independently trained model (the "Target"). As found in other works (e.g. BID12), the success of a black-box attack depends both on how similar the training procedure was between the source and target models and on the strength of the source model -for example, LRM uniformly in a stronger black-box attack than ALP BID9, which itself is a uniformly stronger black-box attack than adversarial training with. As such, using LRM as the source mildly damages the black-box defenses of PGD and ALP. In both the white-box and black-box analyses, we found that label smoothing was surprisingly effective given its near-zero cost. For black-box attacks in particular TAB1, label smoothing was generally among the most robust models across all different sources, with the label smoothing target network having the highest minimum performance across sources, a fact which was not shared even by any of the adversarially-trained models. Inspired by this, we conducted further investigation where we have found similarly surprising mixed behavior. In this experiment, we investigated the robustness of a model trained with label smoothing to stronger white-box attacks, noting that performance on PGD-based attacks from TAB0 dropped considerably when moving from 5 iterations of PGD to 10 and 20 iterations. We found that this trend continued, with accuracy dropping all the way to 13.6% when performing a 200-iteration PGD attack, a trend that was not observed with any of the three models trained on PGD attacks. This suggests that label smoothing, while providing only a mild amount of worst-case adversarial robustness, can actually make the adversarial optimization problem much more challenging, which we believe is also the underlying reason for its effectiveness against black-box attacks. The exact mechanism by which it does this, however, remains elusive, which we think is an interesting avenue for further research in black-box defenses. In this work, we have shown the usefulness of logit regularization for improving the robustness of neural networks to adversarial examples. We first presented an analysis of adversarial logit pairing, the current state-of-the-art in adversarial defense, showing that roughly half of its improvement over adversarial training can be attributed to a non-obvious logit regularization effect. Based on this, we investigated two other forms of logit regularization, demonstrating the benefits of both, and then presented an alternative method for adversarial logit pairing that more cleanly decouples the logit pairing and logit regularization effects while also improving performance. By combining these logit regularization techniques together, we were able to create both a stronger defense against white-box PGD-based attacks and also a stronger attack against PGD-based defenses, both of which come at almost no additional cost to PGD-based adversarial training. We also showed the surprising strength of label smoothing as a black-box defense and its corresponding weakness to only highly-optimized white-box attacks. We anticipate that future work will push the limits of logit regularization even further to improve defenses against adversarial examples, possibly using more techniques originally devised for other purposes BID14. We also hope that these investigations will yield insights into training adversarially-robust models without the overhead of multi-step adversarial training, an obstacle that has made it challenge to scale up adversarial defenses to larger datasets without a sizable computational budget.

represent the short summary for finding the corresponding scientific article (long)

Logit regularization methods help explain and improve state of the art adversarial defenses

Represent the TLDR for finding the corresponding scientific article!

We show that posterior collapse in linear VAEs is caused entirely by marginal log-likelihood (not ELBO). Experiments on deep VAEs suggest a similar phenomenon is at play.