Question: represent the article for finding a single-sentence tldr

Question: Machine learning algorithms are vulnerable to poisoning attacks: An adversary can inject malicious points in the training dataset to influence the learning process and degrade the algorithm's performance. Optimal poisoning attacks have already been proposed to evaluate worst-case scenarios, modelling attacks as a bi-level optimization problem. Solving these problems is computationally demanding and has limited applicability for some models such as deep networks. In this paper we introduce a novel generative model to craft systematic poisoning attacks against machine learning classifiers generating adversarial training examples, i.e. samples that look like genuine data points but that degrade the classifier's accuracy when used for training. We propose a Generative Adversarial Net with three components: generator, discriminator, and the target classifier. This approach allows us to model naturally the detectability constrains that can be expected in realistic attacks and to identify the regions of the underlying data distribution that can be more vulnerable to data poisoning. Our experimental evaluation shows the effectiveness of our attack to compromise machine learning classifiers, including deep networks. Despite the advancements and the benefits of machine learning, it has been shown that learning algorithms are vulnerable and can be the target of attackers, who can gain a significant advantage by exploiting these vulnerabilities . At training time, learning algorithms are vulnerable to poisoning attacks, where small fractions of malicious points injected in the training set can subvert the learning process and degrade the performance of the system in an indiscriminate or targeted way. Data poisoning is one of the most relevant and emerging security threats in applications that rely upon the collection of large amounts of data in the wild . Some applications rely on the data from users' feedback or untrusted sources of information that often collude towards the same malicious goal. For example, in IoT environments sensors can be compromised and adversaries can craft coordinated attacks manipulating the measurements of neighbour sensors evading detection . In many applications curation of the whole training dataset is not possible, exposing machine learning systems to poisoning attacks. In the research literature optimal poisoning attack strategies have been proposed against different machine learning algorithms (; ; Muñoz-González et al., 2017;), allowing to assess their performance in worst-case scenarios. These attacks can be modelled as a bi-level optimization problem, where the outer objective represents the attacker's goal and the inner objective corresponds to the training of the learning algorithm with the poisoned dataset. Solving these bi-level optimization problems is challenging and can be computationally demanding, especially for generating poisoning points at scale. This limits its applicability against some learning algorithms such as deep networks or where the training set is large. In many cases, if no detectability constraints are considered, the poisoning points generated are outliers that can be removed with data filtering (a). Furthermore, such attacks are not realistic as real attackers would aim to remain undetected in order to be able to continue subverting the system in the future. As shown in , detectability constraints for these optimal attack strategies can be modelled, however they further increase the complexity of the attack, limiting even more the application of these techniques. Taking an entirely different and novel approach, in this paper we propose a poisoning attack strategy against machine learning classifiers with Generative Adversarial Nets (GANs) . This allows us to craft poisoning points in a more systematic way, looking for regions of the data distribution where the poisoning points are more influential and, at the same time, difficult to detect. Our proposed scheme, pGAN, consists on three components: generator, discriminator and target classifier. The generator aims to generate poisoning points that maximize the error of the target classifier but minimize the discriminator's ability to distinguish them from genuine data points. The classifier aims to minimize some loss function evaluated on a training dataset that contains a fraction of poisoning points. As in a standard GAN, the problem can be formulated as a minimax game. pGAN allows to systematically generate adversarial training examples, which are similar to genuine data points but that can degrade the performance of the system when used for training. The use of a generative model allows us to produce poisoning points at scale, enabling poisoning attacks against learning algorithms where the number of training points is large or in situations where optimal attack strategies with bi-level optimization are intractable or difficult to compute, as it can be the case for deep networks. Additionally, our proposed model also includes a mechanism to control the detectability of the generated poisoning points. For this, the generator maximizes a convex combination of the losses for the discriminator and the classifier evaluated on the poisoning data points. Our model allows to control the aggressiveness of the attack through a parameter that controls the weighted sum of the two losses. This induces a trade-off between effectiveness and detectability of the attack. In this way, pGAN can be applied for systematic testing of machine learning classifiers at different risk levels. Our experimental evaluation in synthetic and real datasets shows that pGAN is capable of compromising different machine learning classifiers bypassing different defence mechanisms, including outlier detection Paudice et al. (2018a), , PCA-based defences and label sanitization Paudice et al. (2018b). We analyse the trade-off between detectability and effectiveness of the attack: Too conservative strategies will have a reduced impact on the target classifier but, if the attack is too aggressive, most poisoning points can be detected as outliers. The first practical poisoning attacks were proposed in the context of spam filtering and anomaly detection . But these attacks do not easily generalize to different learning algorithms. presented a more systematic approach, modelling optimal poisoning attacks against SVMs for binary classification as a bi-level optimization problem, which can be solved by exploiting the Karush-Kuhn-Tucker conditions in the inner problem. A similar approach is proposed by for poisoning embedded feature selection methods, including LASSO, ridge regression, and elastic net. proposed a more general framework to model and solve optimal poisoning attacks for convex classifiers. They exploit the implicit function theorem to compute the gradients required to solve the corresponding bi-level optimization problem. Muñoz-González et al. proposed back-gradient optimization to estimate the gradients required to solve bi-level optimization problems for optimal poisoning attacks against multi-class classifiers. This approach allows to attack a broader range of learning algorithms and reduces the computational complexity with respect to previous works. However, all these techniques are limited to compromise deep networks trained with a large number of training points, where many poisoning points are required even to compromise a small fraction of the training dataset. Previous attacks did not model explicitly appropriate detectability constraints. Thus, the ing poisoning points can be far from the genuine data distribution and can be easily identified as outliers (a; ; b). showed that it is still possible to craft attacks capable of bypassing outlier-detection-based defences with an iterative constrained bi-level optimization problem, where, at each iteration, the constraints change according to the current solution of the bi-level problem. However, the high computational complexity of this attack limits its practical application in many scenarios. proposed a different approach to craft targeted attacks against deep networks by exploiting influence functions. This approach allows to create adversarial training examples by learning small perturbations that, when added to some specific genuine training points, change the predictions for a target set of test points. showed that it is possible to perform targeted attacks when the adversary is not in control of the labels for the poisoning points. introduced a poisoning attack with generative models using autoencoders to generate the malicious points. Although this method is more scalable than attacks based on bi-level optimization, the authors do not provide a mechanism to control the detectability of the poisoning points. Our model, pGAN, is a GAN-based model with three components (generator, discriminator and target classifier) to generate systematically adversarial training examples. First, we shortly describe the considered model for the attacker. Then, we introduce the formulation of pGAN and, finally, we provide some practical considerations for the implementation of pGAN. The attacker's knowledge of the targeted system depends on different aspects: the learning algorithm, the objective function optimized, the feature set or the training data. In our case we consider perfect knowledge attacks, where we assume the attacker knows everything about the target system: the training data, the feature set, the loss function and the machine learning model used by the victim. Although unrealistic in most practical scenarios, this assumption allows us to perform worst-case analysis of the performance of the system under attack. However, our proposed attack strategy also supports limited knowledge, exploiting the transferability property of poisoning attacks (Muñoz-González et al., 2017). For the attacker's capabilities, we consider here a causative attack (; 2010), where the attacker can manipulate a fraction of the training data to influence the learning algorithm. We assume that the attacker can manipulate all the features to craft the poisoning points as long as the ing points are within the feasible domain for the distribution of genuine training points. Finally, we also assume that the attacker can also control the labels of the injected poisoning points. In a multi-class classification task, let X ∈ R d be the d-dimensional feature space, where data points x are drawn from a distribution p x (x) and Y is the space of class labels. The learning algorithm, C, aims to learn the mapping f: X → Y by minimizing a loss function, L C, evaluated on a set of training points S tr. The objective of the attacker is to introduce a fraction, λ ∈, of malicious points in S tr to maximize L C when evaluated on the poisoned training set. The Generator, G, aims to generate poisoning points by learning a data distribution that is effective at increasing the error of the target classifier, but that is also close to the distribution of genuine data points, i.e. the generated poisoning points are similar to honest data points to evade detection. Thus, G receives some noise z ∼ p z (z|Y p) as input and implicitly defines a distribution of poisoning points, p p (x), which is the distribution of the samples G(z|Y p) conditioned on Y p ⊂ Y, the set of target class labels for the attacker. The Discriminator, D, aims to distinguish between honest training data and the generated poisoning points. It estimates D(x|Y p), the probability that x came from the genuine data distribution p x rather than p p. As in G, the samples used in the discriminator are conditioned on the set of labels Y p. The Classifier, C, is representative for the attacked algorithm. In perfect knowledge attacks C can have the same structure as the actual target classifier. For blackbox attacks we can exploit attack transferability, and then, use C as a surrogate model that can be somewhat similar to the actual (unknown) classifier. During the training of pGAN, C is fed honest and poisoning training points from p x and p p respectively, where the fraction of poisoning points is controlled by a parameter λ ∈. In contrast to traditional GAN schemes, G in pGAN plays a game against both D and C. This can also be formalized as a minimax game where the maximization problem involves both D and C. Similar to conditional GANs , the objective function for D (which also depends on G) can be written as: (The objective function for C is given by: where λ is the fraction of poisoning points introduced in the training dataset and L C is the loss function used to train C. Note that the poisoning points in belong to a subset of poisoning class labels Y p, whereas the genuine points used to train the classifier are from all the classes. The objective in is just the negative loss used to train C evaluated on a mixture of honest and poisoning points (from the set of classes in Y p) controlled by λ. Given and, pGAN can then be formulated as the following minimax problem: with α ∈. In this case, the maximization problem can be seen as a multi-objective optimization problem to learn the parameters of both the classifier and the discriminator. Whereas for C and D the objectives are decoupled, the generator optimizes a convex combination of the two objectives in and. The parameter α controls the importance of each of the two objective functions towards the global goal. So, for high values of α, the attack points will prioritize evading detection, rendering attacks with (possibly) a reduced effectiveness. Note that for α = 1 we have the same minimax game as in a standard conditional GAN . On the other hand, low values of α will in attacks with higher impact in the classifier's performance. However the generated poisoning points will be more detectable by outlier detection systems. For α = 0, pGAN does not consider any detectability constraint and the generated poisoning points are only constrained by the output activation functions in the G. In this case pGAN can serve as a suboptimal approximation of the optimal attack strategies in (; ; Muñoz-González et al., 2017) where no detectability constraints are imposed. Similar to we train pGAN following a coordinated gradient-based strategy to solve the minimax problem in. We sequentially update the parameters of the three components using mini-batch stochastic gradient descent/ascent. For the generator and the discriminator data points are sampled from the conditional distribution on the subset of poisoning labels Y p. For the classifier, honest data points are sampled from the data distribution including all the classes. A different number of iterations can be considered for updating the parameters of the three blocks. The details of the training algorithm are provided in Appendix A. The formulation of pGAN in allows to perform both error-generic and error-specific poisoning attacks (Muñoz-González et al., 2017), which aim to increase the error of the classifier in an indiscriminate or a specific way. However, the nature of these errors can be limited by Y p, i.e. the classes for which the attacker can inject poisoning points. To generate targeted attacks or to produce more specific types of errors in the system we need to use a surrogate model for the target classifier in pGAN, including only the classes or samples considered in the attacker's goal. For example, if the attacker wants to inject poisoning points labelled as i to increase the classification error for class j, we can use a binary classifier in pGAN considering only classes i and j, where the generator aims to produce samples from class i. As in other GAN schemes, pGAN can also be difficult to train and can be prone to mode collapse. To mitigate these problems, we used in our experiments some of the standard techniques proposed to improve GANs training, such as dropout or batch-normalization . We also applied one-side label smoothing, not only for the labels in the discriminator but also for the labels of the genuine points in the classifier. As suggested by , to avoid small gradients for G from the discriminator's loss function, especially in early stages where the quality of the samples produced by G is poor, we train G to maximize log(D(G(z|Y p))) rather than minimizing log(1 − D(G(z|Y p))). In contrast to standard GANs, in pGAN the learned distribution of poisoning points p p is expected to be different from the distribution of genuine points p x. Thus, the accuracy of the discriminator in pGAN will always be greater that 0.5. Then, the stopping criteria for training pGAN cannot be based on the discriminator's accuracy. We need to find a saddle point where the objectives in and are maximized for D and G respectively (i.e. pGAN finds local maxima) and the the combined objective in is minimized w.r.t. G (i.e. pGAN finds a local minimum). Finally, the value of λ plays an important role in the training of pGAN. If λ is small, the gradients for G from the classifier's loss in can be very small compared to the gradients from the discriminator's loss in. Thus, the generator focuses more on evading detection by the discriminator rather than increasing the error of the target classifier, ing in blunt attacks. Then, even if the expected fraction of poisoning points to be injected in the target system is small, larger values of λ are preferred to generate more successful poisoning attacks. In our experiments in Sect. 4 we analyse the effectiveness of the attack as a function of λ. To illustrate how pGAN works we first performed a synthetic experiment with a binary classification problem, generating two bivariate Gaussian distributions that slightly overlap. We trained pGAN for different values of α with 500 training points from each Gaussian distribution. We targeted a logistic regression classifier with λ = 0.8. In Fig. 1 we show the distribution of poisoning (red dots) and genuine (green and blue dots) data points. The poisoning points are labelled as the green data points. Thus, G aims to generate malicious points, similar to the green ones (i.e. D aims to discriminate between red and green data points). For α = 1 we have the same as in a standard GAN, so that the distribution of red points matches the distribution of the green ones. But, as we decrease the value of α, the distribution of red points shifts towards the region where both green and blue distributions overlap. We can observe that for α = 0.2 the poisoning points are still close to genuine green points, i.e. we cannot consider the red points as outliers in most cases. For α = 0 the generator does not have detectability constraints, focusing only on increasing the error of the classifier. It is interesting to observe that, in this case, pGAN does not produce points interpolating the distribution of the two genuine classes, but the distribution learned by the generator is far from the region where the distributions of the blue and green points overlap. 1 This suggests that for α = 0 pGAN is not just producing a simple interpolation between the two classes, but G looks for regions close to the decision boundary where the classifier is weaker. The complete details of the experiment and the effect on the decision boundary after injecting the poisoning points can be found in Appendix B. We performed our experimental evaluation on MNIST , Fashion-MNIST (FM-NIST) , and CIFAR-10 datasets, using Deep Neural Networks (DNNs) for MNIST and FMNIST and Convolutional Neural Networks (CNNs) for CIFAR. All details about the datasets used and the experimental settings in our experiments are described in Appendix C. To test the effectiveness of pGAN to generate stealthy poisoning attacks we applied the defence strategy proposed by Paudice et al. (2018a): We assumed that the defender has a fraction of trusted data points that can be used to train one outlier detector for each class in the classification problem. Thus, we pre-filter the (genuine and malicious) training data points with these outlier detectors before training. As in (a) we used the distance-based anomaly detector proposed by , which was proven to be effective against optimal poisoning attacks (; Muñoz-González et al., 2017). The outlierness score is computed based on the euclidean distance between the tested data point and its k-nearest neighbours from a subset of s points, which are sampled without replacement from the set of points used to train the outlier detector. In our experiments we used the same values proposed in (a): k = 5 for the number of neighbours and s = 20 for the number of training points to be sampled. We set the threshold of the outlier detector so that the α-percentile is 0.95. The α-percentile controls the fraction of genuine points that is expected to be retained after applying the outlier detector (i.e. 95% in our case). To provide a better understanding of the behaviour of pGAN we first trained and tested our attack targeting binary classifiers. For this, in MNIST we selected digits 3 and 5, for FMNIST we picked the classes sneaker and ankle boot and, for CIFAR, automobile and truck classes. The poisoning points were labelled as 5, ankle boot and truck respectively. First, we analysed the effectiveness of the attack as a function of α. For each dataset we trained 5 different generators for each value of α explored, [0.0, 0.1, 0.3, 0.5, 0.7, 0.9]. We set λ = 0.9·Pr(Y p), where Pr(Y p) is the prior probability of the samples from the poisoning class, Y p (i.e. digit 5, ankle boot, and truck). For testing, we used 500 (genuine) samples per class to train the outlier detectors and 500 samples per class to train a separate classifier. We evaluated the effectiveness of the attack varying the fraction of poisoning points, exploring values in the range 0 − 40%. To preserve the ratio between classes we substitute genuine samples from the poisoning class with the malicious points generated by pGAN (rather than adding the poisoning points to the given training dataset). For each pGAN generator and for each value of the fraction of poisoning points explored, we did 10 independent runs with independent splits for the outlier detectors and the classifier training sets. In Fig. 2 we show the test classification error for MNIST and FMNIST as a function of the fraction of poisoning points averaged over the 5 generators and the 10 runs for each generator. In MNIST, the attack is more effective for α = 0.1, increasing the error from 2.5% when there's no attack to more than 12% when 40% of the training dataset is compromised. For bigger values of α the effect of the attack is more limited. For α = 0, i.e. when no detectability constraints are considered the effect of the attack is more limited than for α = 0.1, although in this case, the points capable of bypassing the outlier detector can still produce some degradation in the target system. Similarly, for FMNIST the attack with α = 0.1 produces more effective poisoning data points, although the overall effect of the attack is more limited compared to MNIST. For α = 0 the attack is mitigated by the outlier detector in most cases, and has only some effectiveness for larger fractions of poisoning points. It is interesting to observe that, despite the baseline error (i.e. when there is no attack) is lower for MNIST (2.5% vs 4.75% in FMNIST), it is more difficult to poison FMNIST. This suggests that the impact of the attack not only depends on the separation between the two classes but also on the topology of the classification problem. In Fig. 3 we show some of the poisoning examples generated by pGAN (with α = 0.3). For MNIST the malicious data points (labelled as 5) exhibit features from both, digits 3 and 5. In some cases, although the poisoning digits are similar to a 3, it is difficult to automatically detect these points as outliers, as many of the pixels that represent these malicious digits follow a similar pattern compared to genuine 5s, i.e. they just differ in the upper trace of the generated digits. In other cases, the malicious digits look like a 5 that have some characteristics that make them closer to 3s. In the case of FMNIST, the samples generated by pGAN (labelled as ankle boots) can be seen as an interpolation of the two classes. The malicious images look like high-top sneakers or low-top ankle boots. Thus, it is difficult to detect them as malicious points, as they clearly resemble some of the genuine ankle boots in the genuine training set. Actually, for some of the genuine images, it is difficult to identify them as a sneaker or an ankle boot. More examples for different values of α are also shown in Appendix D. The in Fig. 4(left) show that for α = 0, i.e. with no detectability constraints, the attack is significantly more effective than for the other values of α explored. In this case, we observed that the outlier detector can be easily bypassed in this dataset, as the number of features and the complexity of the classification tasks are higher compared to MNIST and FMNIST. This shows some of the limitations of some existing defences to mitigate data poisoning attacks. We can observe that in this case, the test classification error increases from 12% to 24% after injecting 40% of poisoning points. The increase is more moderate for larger values of α. In Fig. 4 (right) we show some of the examples generated by pGAN with α = 0.3, which exhibit characteristics from the two classes: cars and trucks. Outlier detection: In Fig. 5 (centre) we show the fraction of data points pre-filtered by the outlier detectors in MNIST dataset as a function of α. We explored two values for the α-percentile (the threshold of the detectors): 0.90 and 0.95. As expected, the fraction of rejected genuine data points is, on average, 10% and 5% respectively. However, the fraction of rejected malicious points for α ≥ 0.1 is smaller than for the genuine points for the two detectors. This is because the generator pays less attention to samples that are in low density regions for the data distribution of the genuine points, and then, the generated poisoning points are conservative. For α = 0 the fraction of rejected malicious points is also not very high. This can be due to the similarity between the two classes. Then, even if the generated poisoning points, labelled as 5, look like a 3 they are still close to the distribution of genuine 5s when targeting a non-linear classifier. Sensitivity w.r.t. λ: For analysing the sensitivity of pGAN w.r.t. λ, the fraction of poisoning points used for C, we performed an experiment on MNIST dataset (digits 3 and 5). We set α = 0.2 and explored different values for λ = λ/Pr(Y p) ranging from 0.1 to 1. With the same experimental settings as before we trained 5 generators for each value of λ. We also tested the effectiveness of the attack on a separate classifier, with 10 independent runs for each generator and value of λ explored. For the attacks we injected 20% of poisoning points. In Fig. 5 (left) we show the averaged classification error on the test dataset as a function of λ. We can observe that, for small λ, the effect of the attack is more limited. The reason is that, when training pGAN the effect of the poisoning points on C is very reduced, and then, the gradients of w.r.t. the parameters of G can be very small compared to the gradients coming from the discriminator. Then, G focuses more on optimizing the discriminator's objective. In this case, even for λ = 1 the attack is still effective, just slightly decreasing the error rate compared to λ = 0.9. Comparison with existing poisoning attacks in the research literature is challenging: Optimal poisoning attacks as in Muñoz-González et al. are computationally very expensive for the size of the networks and datasets used in our experiments in Fig. 2. This is even worse if we consider detectability constraints as in. On the other side, comparing with standard label flipping in an unfair comparison for pGAN, as label flipping do not consider detectability constraints. In other words, we can expect label flipping to be more effective than pGAN when no defence is applied, but this attack is clearly more detectable (b). To provide a fairer comparison, we implemented an heuristic for generating label flipping attacks with detectability constraints. Thus, we flipped the labels of training samples from the target class that are closer to the source class. For this, we computed the distance of the training points from the target class to the mean of the training points of the source class. Then, we flipped the labels of the closest points, so that the malicious points should be more difficult to detect. In Fig. 6 we show the comparison of this label flipping strategy with pGAN (α = 0.1) for MNIST, using the same settings as in the experiment in Fig. 2. We can observe that pGAN is more effective than the label flipping attack and that the effect of the two attacks is different. Label flipping increases both the false positive and false negative rates of the target classifier, whereas pGAN aims only to increase the false positive rate, i.e. pGAN is producing an error-specific attack, giving the attacker more control on the kind of errors to be produced in the classifier. Attack effectiveness as a function of the number of training points: In Fig. 5 (right) we show how the number of training data points impact the effect of the attack. For this, we trained 5 pGAN generators with α = 0.1 and tested on classifiers with different number of training points ranging from 1, 000 to 10, 000 and injecting 20% of poisoning points. For each generator and value of the number of training points explored we did 5 independent runs. We also used 500 samples per class to train the outlier detectors. The in Fig. 5 (right) show that the difference in performance between the poisoned and the clean classifier reduces as the number of training samples increases. This is expected, as the stability of the learning algorithm increases with the number of training data points, limiting the ability of the attacker to perform indiscriminate poisoning attacks. This does not mean that learning algorithms trained with large datasets are not vulnerable to data poisoning, as attackers can still be very successful at performing targeted attacks, focusing on increasing the error on particular instances or creating backdoors . In these scenarios we can also use pGAN to generate more targeted attacks using a surrogate model for the classifier including the subset of samples that the attacker aims to misclassify. Finally we performed an error-specific attack on MNIST using the 10 classes. In this case the objective of the attacker is to increase the error of digit 3 being misclassified as a 5. For this, we trained pGAN using a surrogate classifier including only digits 3 and 5, and then, tested against a multi-class classifier trained on 10, 000 data points (see the details of the architecture used in Appendix C). For pGAN we used α = 0.1 and λ = 0.9 · Pr(Y p). We varied the fraction of poisoning points exploring values in the range 0−4%. The in Fig. 7 (left) show that, although the overall test classification error only increases slightly, the test error of digit 3 being classified as a 5 is significantly affected by the attack, increasing from 1.1%, when there is no attack, to 13.1% with just 4% of poisoning points. In Fig. 7 (right) we show the average difference in the confusion matrix evaluated on the clean dataset and the poisoned dataset (4% poisoning). We can observe that the detection rate of digit 3 decreases up to 11%, and that this decrease is due to an increase of 12% on the error of digit 3 being incorrectly classified as a 5. This experiment support the usefulness of pGAN to generate targeted attacks, showing that even with a small fraction of poisoning points we can craft successful targeted (error-specific) attacks. Apart from the outlier detection defence described previously, we also tested pGAN against 3 different types of defences: First, we considered , a meta-algorithm for robust optimization that aims to remove outliers and points that can have a negative impact on the learning algorithm at training time. We followed the settings described in applying the algorithm separately for each class. We set the value of, the parameter that controls the fraction of points to be removed, to 0.1 ( for different values of are also shown in Appendix E.1). For the sake of computational tractability we applied Sever using the parameters in the last layer of the target classifier, as these parameters are more influenced by the poisoning attack. 2 Secondly, we considered the defence introduced by which relies on Principal Component Analysis (PCA) to detect poisoning points. This model assumes that the clean data lies in a low-rank subspace and that poisoning points will have a large component out of this subspace. As in Sever, this defence has a parameter that controls the fraction of points to be rejected. In our experiment we set = 0.05. Further for different values of are shown in Appendix E.2. Finally we also tested pGAN attack against the label sanitization technique introduced by (b), which relabels training data points according to a KNN-based algorithm so that a point is relabelled if, at least, n k neighbours have the same label, different from the label of the evaluated point. Following similar settings as in Paudice et al. (2018b), we set k = 3 for KNN and n k = 2. Using the same settings as in our previous experiments we tested the 3 defences against pGAN attacks with α = 0.1 for MNIST and FMNIST. This value of α produced the most effective attacks against the outlier detection defences as shown in Fig. 2. The in Fig. 8 show that pGAN successfully bypasses all the defences in the two datasets. We can observe that Sever performs worse than the outlier detector defence for MNIST 3 although the degradation with the increasing number of poisoning points follows a similar trend. In the case of FMNIST, Sever is more effective compared to the other defences when the number of poisoning points is reduced, but in this case, the algorithm degrades faster when we increase the fraction of malicious points. In Appendix E.1 we show that pGAN produces similar effect on Sever for different values of. The PCA-based defence performs worse than the outlier detector in MNIST, whereas in FMNIST the difference between the two defences is very small. In both cases, both algorithms degrade in the same way as we increase the number of poisoning points. In Appendix E.2 we show that for larger values of this defence performs worse. Finally, in Fig. 8 (right) we can observe that label sanitization completely fails to defend against our attack in MNIST. As pGAN produces poisoning points that are correlated, the KNN-based algorithm proposed to do the relabelling is not capable of detecting the poisoning points. Furthermore, some of the genuine points from the target class are incorrectly relabelled, making the problem even worse. Similar are obtained for FMNIST, as shown in Appendix E.3. The in Fig. 8 along with the previous in Figs. 2-4, show that pGAN not only can generate successful poisoning points at scale even when using detectability constraints but also that pGAN is successful against state-of-the-art defences published in the literature. The pGAN approach we introduce in this paper allows to naturally model attackers with different levels of aggressiveness and the effect of different detectability constraints on the robustness of the algorithms. This allows to a) study the characteristics of the attacks and identify regions of the data distributions where poisoning points are more influential, yet more difficult to detect, b) systematically generate in an efficient and scalable way attacks that correspond to different types of threats and c) study the effect of mitigation measures such as improving detectability. In addition to studying the tradeoffs involved in the adversarial model, pGAN also allows to naturally study the tradeoffs between performance and robustness of the system as the fraction of poisoning points increases. Our experimental evaluation shows that pGAN effectively bypasses different strategies to mitigate poisoning attacks, including outlier detection, label sanitization, PCA-based defences and Sever algorithm. We train pGAN following a coordinated gradient-based strategy by sequentially updating the parameters of the three components using mini-batch stochastic gradient descent/ascent. The procedure is described in Algorithm 1. For the generator and the discriminator data points are sampled from the conditional distribution on the subset of poisoning labels Y p. For the classifier, honest data points are sampled from the data distribution including all the classes. We alternate the training for the three components with the i, j and k number of steps for the discriminator, classifier, and generator respectively. In practice, we choose i, j > k, i.e. we update more often the discriminator and the classifier. For example, in our experiments we set i, j = 4 and k = 1. for number of training iterations do for i steps do sample mini-batch of m noise samples {z n |Y p} m n=1 from p z (z|Y p) get mini-batch of m training samples {x n} m n=1 from p x (x|Y p) update the discriminator by ascending its stochastic gradient end for for j steps do sample mini-batch of m noise samples {z n |Y p} m n=1 from p z (z|Y p) get mini-batch of m training samples {x n} m n=1 from p x (x) update the classifier by ascending its stochastic gradient end for for k steps do sample mini-batch of m noise samples {z n |Y p} m n=1 from p z (z|Y p) update the generator by descending its stochastic gradient end for end for For the synthetic experiment shown in the paper we sample our training and test data points from two bivariate Gaussian distributions, N (µ 0, Σ 0) and N (µ 1, Σ 1), with parameters: In Fig. 9 we show the effect of the poisoning attack on the decision boundary. For testing pGAN we trained a separate logistic regression classifier with 40 genuine training examples (20 per class) and adding extra 20% poisoning points (8 samples). We trained the classifier using Stochastic Gradient Descent (SGD) with a learning rate of 0.01 for 1, 000 epochs. In this case, no outlier detector is applied to pre-filter the training points. The in Fig. 9 show that for α = 0 the attack is very effective, although the poisoning points depicted in red (which are labelled as green) are far from the genuine distribution of green points. Then, as we increase the value of λ the attack is blunt. In this synthetic example, the classifier is quite stable: the number of features is very small (two), and the topology of the problem is simple (the classes are linearly separable and the overlapping between classes is small) and the classifier is simple. Thus, the effect of the poisoning attack when detectability constraints are considered, i.e. α = 0, is very reduced. Note that the purpose of this synthetic example is just to illustrate the behaviour of pGAN as a function of λ rather than showing an scenario where the attack can be very effective. Here we provide complete details about the settings for the experiments described in the paper. In Table 2 we show the characteristics of the datasets used in our experimental evaluation. The parameters for training pGAN for MNIST and FMNIST are shown in Table 3, whereas the parameters for CIFAR are described in Table 4. In all cases, for pGAN generator we used (independent) Gaussian noise with zero mean and unit variance. 6, 000/6, 000 1, 000/1, 000 784 CIFAR (automobile vs truck) 5, 000/5, 000 1, 000/1, 000 3, 072 For MNIST we trained pGAN for 2, 000 epochs using a batch-size of 200, setting i, j = 4 and k = 1 in Alg. 1. For FMNIST we used similar settings but training for 3, 000 epochs. For CIFAR we trained pGAN using a batch-size of 25 for 300 epochs, with i, j = 4 and k = 1. Finally, the architecture of the Deep Neural Networks (DNNs) and Convolutional Neural Networks (CNNs) trained to test the attacks is described in Tables 5 and 6. In Figs. 10 -12 we show samples generated with pGAN for different values of α in MNIST, FMNIST and CIFAR respectively. The class labels of the poisoning points are 5 and ankle boot and truck for each of the datasets. In all cases we can observe that for small values of α (but with α > 0), the generated examples exhibit characteristics from the two classes involved in the attack, although pGAN tries to preserve features from the (original) poisoning class to evade detection. For values of α close to 1, the samples generated by pGAN are similar to those we can generate with a standard GAN. Here we show the sensitivity analysis of Sever performance to pGAN attack w.r.t. its parameter, which controls the fraction of training points removed. For this, using the same experimental settings as in the paper, we tested the performance of Sever for = [0.05, 0.1, 0.2]. The in Fig. 13 show that the performance of the attack is not very sensitive to the value of for both MNIST and FMNIST. As for Sever, we tested the performance of the PCA defence for different values of, which as in the previous case, controls the fraction of training points removed. We explored the values = [0.05, 0.1, 0.2]. The in Fig. 14 show that, in this case, the performance is further degraded as we increase the value of, especially for FMNIST. In Fig. 15 we compared the performance of the label sanitization defence and the outlier detection defence for both MNIST and FMNIST. We can observe that label sanitization performs very poorly against pGAN attacks compared to outlier detection. The average test error increases up to 30% with 30% of poisoning points for MNIST, whereas for FMNIST the error increases up to 22% for the same fraction of poisoning points.

Represent this text to find a much much longer article about it with say hundreds-thousands of words.

In this paper we propose a novel generative model to craft systematic poisoning attacks with detectability constraints against machine learning classifiers, including deep networks.

represent the short summary for finding the corresponding scientific article (long)

We introduce a systematic framework for quantifying the robustness of classifiers to naturally occurring perturbations of images found in videos.


Question: Represent the scientific article to find a short TLDR

Question: The Expectation-Maximization (EM) algorithm is a fundamental tool in unsupervised machine learning. It is often used as an efficient way to solve Maximum Likelihood (ML) and Maximum A Posteriori estimation problems, especially for models with latent variables. It is also the algorithm of choice to fit mixture models: generative models that represent unlabelled points originating from $k$ different processes, as samples from $k$ multivariate distributions. In this work we define and use a quantum version of EM to fit a Gaussian Mixture Model. Given quantum access to a dataset of $n$ vectors of dimension $d$, our algorithm has convergence and precision guarantees similar to the classical algorithm, but the runtime is only polylogarithmic in the number of elements in the training set, and is polynomial in other parameters - as the dimension of the feature space, and the number of components in the mixture. We generalize further the algorithm by fitting any mixture model of base distributions in the exponential family. We discuss the performance of the algorithm on datasets that are expected to be classified successfully by those algorithms, arguing that on those cases we can give strong guarantees on the runtime. Over the last few years, the effort to find real world applications of quantum computers has greatly intensified. Along with chemistry, material sciences, finance, one of the fields where quantum computers are expected to be most beneficial is machine learning. A number of different algorithms have been proposed for quantum machine learning (; ; ; ; Subaşı et al., 2019;), both for the supervised and unsupervised setting, and despite the lack of large-scale quantum computers and quantum memory devises, some quantum algorithms have been demonstrated in proof-of-principle experiments (; ;). Here, we look at Expectation-Maximization (EM), a fundamental algorithm in unsupervised learning, that can be used to fit different mixture models and give maximum likelihood estimates with the so-called latent variable models. Such generative models are one of the most promising approaches for unsupervised problems. The goal of a generative model is to learn a probability distribution that is most likely to have generated the data collected in a training set V ∈ R n×d of n vectors of d features. Fitting the model consists in learning the parameters of a probability distribution p in a certain parameterized family that best describes our vectors v i. We will see that, thanks to this formulation, we can reduce a statistical problem into an optimization problem using maximum likelihood estimation (ML) estimation. The likelihood is the function that we use to measure how good a model is for explaining a given dataset. For a given machine learning model with parameters γ, the likelihood of our data set V is the probability that the data have been generated by the model with parameters γ, assuming each point is independent and identically distributed. We think the likelihood as a function of γ, holding the dataset V fixed. For p(v i |γ) the probability that a point v i comes from model γ, the likelihood is defined as L(γ; V):= n i=1 p(v i |γ). From this formula, we can see that in order to find the best parameters γ * of our model we need to solve an optimization problem. For numerical and analytical reasons, instead of maximizing the likelihood L, it is common practice to find the best model by maximizing the log-likelihood function (γ; V) = log L(γ; V) = n i=1 log p(v i |γ). In this context, we want to find the model that maximizes the log-likelihood: γ * M L:= arg max γ n i=1 log p(v i |γ). The procedure to calculate the log-likelihood depends on the specific model under consideration. A possible solution would be to use a gradient based optimization algorithm on. Unfortunately, due to the indented landscape of the function, gradient based techniques often do not perform well. Therefore, it is common to solve the maximum likelihood estimation (or maximum a priori) problem using the Expectation-Maximization (EM) algorithm. EM is an iterative algorithm which is guaranteed to converge to a (local) optimum of the likelihood. This algorithm has a striking variety of applications, and has been successfully used for medical imaging , image restoration , problems in computational biology , and so on. EM has been proposed in different works by different authors, but has been formalized as we know it only in 1977 . For more details, we refer to . In this work, we introduce Quantum Expectation-Maximization (QEM), a new algorithm for fitting mixture models. We detail its usage in the context of Gaussian Mixture Models, and we extend the to other distributions in the exponential family. We also generalize the by showing how to compute the MAP: the Maximum A Posteriori estimate of a mixture model. MAP estimates can be seen as the Bayesian version of maximum likelihood estimation problems. MAP estimates are often preferred over ML estimates, due to a reduced propensity to overfit. Our main can be stated as: Result (Quantum Expectation-Maximization). (see Theorem 3.9) For a data matrix V ∈ R n×d stored in an appropriate QRAM data structure and for parameters δ θ, δ µ > 0, Quantum Expectation-Maximization (QEM) fits a Maximum Likelihood (or a Maximum A Posteriori) estimate of a Gaussian Mixture Model with k components, in running time per iteration which is dominated by: where Σ is a covariance matrix of a Gaussian distribution, η is a parameter of the dataset related to the maximum norm of the vectors, δ θ, δ µ are error parameters in the QEM algorithm, µ(< √ d) is a factor appearing in quantum linear algebra and κ is the condition number of a matrix. Here we only kept the term in the running time that dominates for the range of parameters of interest. In Theorem 3.9 we explicate the running time of each step of the algorithm. The QEM algorithm runs for a number of iterations until a stopping condition is met (defined by a parameter τ > 0) which implies a convergence to a (local) optimum. Let's have a first high-level comparison of this with the standard classical algorithms. The runtime of a single iteration in the standard implementation of the EM algorithm is at least O(knd 2) . The advantage of the quantum algorithm is an exponential improvement with respect to the number of elements in the training set, albeit with a worsening on other parameters. It is crucial to find datasets where such a quantum algorithm can offer a speedup. For a reasonable range of parameters (d = 40, k = 10, η = 10, δ = 0.5, κ(V) = 25, κ(Σ) = 5, µ(Σ) = 4) which is motivated by some experimental evidence reported in Section 4, datasets where the number of samples in the order of O(10 12) might be processed faster on a quantum computer. One should expect that some of the parameters of the quantum algorithm can be improved, especially the dependence on the condition numbers and the errors, which can make enlarge the type of datasets where QEM can offer an advantage. Note that we expect the number of iterations of the quantum algorithm to be proportional to the number of iteration of the classical case. This is to be expected since the convergence rate does not change, and it is corroborated by previous experimental evidence in a similar scenario: the number of iterations needed by q-means algorithm for convergence, is proportional to the number of iterations of the classical k-means algorithm . Expectation-Maximization is widely used for fitting mixture models in machine learning . Most mixture models use a base distribution in the exponential family: Poisson , Binomial, Multinomial, log-normal , exponential (, Dirichlet multinomial , and others. EM is also used to fit mixtures of experts, mixtures of the student T distribution (which does not belong to the exponential family, and can be fitted with EM using ) and for factor analysis, probit regression, and learning Hidden Markov Models . There is a fair amount of quantum algorithms that have been proposed in the context of unsupervised learning. (Aïmeur et al., 2013; b;). Recently, classical machine learning algorithms were obtained by "dequantizing" quantum machine learning algorithms (b; a; c; Gilyén et al., 2018a;). The runtime of these classical algorithm is poly-logarithmic in the dimensions of the dataset. However, the polynomial dependence on the rank, the error, and the condition number, make these new algorithms impractical on interesting datasets, as shown experimentally by . Fast classical algorithm for GMM exists, albeit assuming only one shared covariance matrix , and without a polylogarithmic dependence in the number of elements in the training set. Independently of us, Miyahara, Aihara, and Lechner extended the q-means algorithm for Gaussian Mixture Models , using similar techniques. The main difference is that in their work the update step is performed using a hard-clustering approach (as in the k-means algorithm), that is for updating the centroid and the covariance matrices of a cluster j, only the data points for which cluster j is nearest are taken into account. In our work, we use the soft clustering approach (as in the classical EM algorithm), that is for updating the centroid and the covariance matrices of cluster j, all the data points weighted by their responsibility for cluster j are taken into account. Both approaches have merits and can offer advantages . As is common in machine learning literature, we introduce the Expectation-Maximization algorithm by using it to fit Gaussian Mixture Models (GMM). Mixture models are a popular generative model in machine learning. The intuition behind mixture models is to model complicated distributions by using a group of simpler (usually uni-modal) distributions. In this setting, the purpose of the learner is to model the data by fitting the joint probability distribution which most likely have generated our samples. In this section we describe GMM: probably the most used mixture model used to solve unsupervised classification problems. In fact, given a sufficiently large number of mixture components, it is possible to approximate any density defined in R d . In unsupervised settings, we are given a training set of unlabeled vectors v 1 · · · v n ∈ R d which we represent as rows of a matrix V ∈ R n×d. Let y i ∈ [k] one of the k possible labels for a point v i. We posit that the joint probability distribution of the data p(v i, y i) = p(v i |y i)p(y i), is defined as follow: The θ j are the mixing weights, i.e. the probabilities that y i = j, and N (µ j, Σ j) is the Gaussian distribution centered in µ j ∈ R d with covariance matrix Σ j ∈ R d×d. Note that the variables y i are unobserved, and thus are called latent variables. There is a simple interpretation for this model. We assume the data is created by first selecting an index j ∈ [k] by sampling according to Multinomial(θ), and then a vector v i is sampled from N (µ j, Σ j). Fitting a GMM to a dataset reduces to finding an assignment for the parameters: that best maximize the log-likelihood for a given dataset. Note that the algorithm used to fit GMM can return a local minimum which might be different than γ *: the model that represents the global optimum of the likelihood function. We use the letter φ to represent our base distribution, which in this case is the probability density function of a multivariate Gaussian distribution N (µ, Σ). Using this formulation, a GMM is expressed as: p(v) = k j=1 θ j φ(v; µ j, Σ j) where θ j are the mixing weights of the multinomial distribution such that k j=1 θ j = 1. The probability for an observation v i to be assigned to the component j is given by:. This value is called responsibility, and corresponds to the posterior probability of the sample i being assigned label j by the current model. As anticipated, to find the best parameters of our generative model, we maximize the log-likelihood of the data. For GMM, the likelihood is given by the following formula Alas, it is seldom possible to solve maximum likelihood estimation analytically (i.e. by finding the zeroes of the derivatives of the log-like function, and this is one of those cases. Fortunately, Expectation-Maximization is an iterative algorithm that solves numerically the optimization problem of ML estimation. To complicate things, the likelihood function for GMM is not convex, and thus we might find some local minima . If we were to know the latent variable y i, then the log-likelihood for GMM would be: This formula can be easily maximized with respect to the parameters θ, µ, and Σ. In the Expectation step we calculate the missing variables y i's, given a guess of the parameters (θ, µ, Σ) of the model. Then, in the Maximization step, we use the estimate of the latent variables obtained in the Expectation step to update the estimate of the parameters. While in the Expectation step we calculate a lower bound on the likelihood, in the Maximization step we maximize it. Since at each iteration the likelihood can only increase, the algorithm is guaranteed to converge, albeit possibly to a local optimum (see for the proof). During the Expectation step all the responsibilities are calculated, while in the Maximization step we update our estimate on the parameters γ t+1 = (θ t+1, µ t+1, Σ t+1). The stopping criterion for GMM is usually a threshold on the increment of the log-likelihood: if the log-likelihood changes less than a threshold between two iterations, then the algorithm stops. Notice that, since the value of the log-likelihood significantly depends on the amount of data points in the training sets, it is often preferable to adopt a scale-free stopping criterion, which does not depend on the number of samples. For instance, in the toolkit scikit-learn the stopping criterion is given by a tolerance on the average increment of the log-probability, which is chosen to be smaller than a certain τ, say 10 −3. More precisely, the stopping criterion is |E[log p(v i ; γ Dataset assumptions in GMM As in q-means , we have an assumption on the dataset that all elements of the mixture contribute proportionally to the total responsibility: i, e This is equivalent to requiring that clusters share a comparable amount of points in the "well-clusterability" assumption in q-means . It is also equivalent to assuming that θ j /θ l = Θ ∀j, l ∈ [k]. For convenience, in this work, we also assume that the dataset is normalized such that the shortest vector has norm 1 and define η:= max i v i 2 to be the maximum norm squared of a vector in the dataset. This is not a necessary requirement for our dataset, but it will simplify the analysis of our algorithm, allowing us to give strict bounds on the runtime. Preliminaries We assume a basic understanding of quantum computing, we recommend Nielsen and Chuang where σ is the smallest singular value which is greater than τ. With nnz(V) we mean the number of non-zero elements of the rows of V. When we say κ(V) we mean the condition number of the matrix V, that is the ratio between the biggest and the smallest (non-zero) singular value. All the tools used in this work, like quantum algorithms for computing distances and linear algebraic operations, are reported in the Supplementary Material section. In this section, we present a quantum Expectation-Maximization algorithm to fit a GMM. The algorithm can also be adapted fit other mixtures models where the probability distributions belong to the exponential family. As the GMM is both intuitive and one of the most widely used mixture models, our are presented for the GMM case. A robust version of the EM algorithm Similar to the work of , we define a ∆-robust version of the EM algorithm which we use to fit a GMM. The difference between this formalization and the original EM for GMM is simple. Here we explain the numerical error introduced in the training algorithm. Quantum access to the mixture model As in the classical algorithm, we use some subroutines to compute the responsibilities and update our current guess of the parameters. The classical algorithm has clearly two separate steps for Expectation and Maximization. In contrast, the quantum algorithm uses a subroutine to compute the responsibilities inside the step that performs the Maximization, that is the subroutines for computing responsibilities are called multiple times during the quantum Maximization step. During the quantum Maximization step, the algorithm updates the model parameters γ t by creating quantum states corresponding to parameters γ t+1 and then recovering classical estimates for these parameters using quantum tomography or amplitude amplification. In order for this subroutines to be efficient, the values of the GMM are stored in QRAM data structures and are updated following each maximization step. Definition 1 (Quantum access to a GMM). We say that we have quantum access to a GMM if the dataset V ∈ R n×d and model parameters θ j ∈ R, µ j ∈ R d, Σ j ∈ R d×d for all j ∈ [k] are stored in QRAM data structures which allow us to perform in time O(polylog(d)) the following mappings: • |j |i |0 → |j |i |σ Require: Quantum access to a GMM model, precision parameters δ θ, δ µ, and threshold τ. Ensure: A GMM γ t that maximizes locally the likelihood (γ; V), up to tolerance τ. 1: Use a heuristic described at the beginning of this section to determine an initial guess for γ 0 = (θ 0, µ 0, Σ 0), and store these parameters in the QRAM. 2: Use Lemma 3.1 to estimate the log determinant of the matrices {Σ Step 1: Get an estimate of θ t+1 such that θ t+1 − θ t+1 ≤ δ θ using Lemma 3.4. Step 2: Get an estimate {µ j t+1} k j=1 by using Lemma 3.6 to estimate each µ t+1 j and |µ Step 3: Get an estimate {Σ j t+1} k j=1 by using Lemma 3.7 to estimate Σ t+1 j F and |Σ t+1 j such that Step 4: Estimate E[p(v i ; γ t+1)] up to error τ /2 using Theorem 3.8. Step 5: Store γ t+1 in the QRAM, and use Lemma 3.1 to estimate the determinants {log det( . 10: Quantum initialization strategies exists, and are described in the Appendix. In this step of the quantum algorithm we are just showing how to compute efficiently the responsibilities as a quantum state. First, we compute the responsibilities in a quantum register, and then we show how to put them as amplitudes of a quantum state. We start by a classical algorithm used to efficiently approximate the log-determinant of the covariance matrices of the data. At each iteration of Quantum Expectation-Maximization we need to compute the determinant of the updated covariance matrices, which is done thanks to Lemma 3.1. We will see from the error analysis that in order to get an estimate of the GMM, we need to call Lemma 3.1 with precision for which the runtime of Lemma 3.1 gets subsumed by the running time of finding the updated covariance matrices through 3.7. Thus, we do not explicitly write the time to compute the determinant from now on in the algorithm and when we say that we update Σ we include an update on the estimate of log(det(Σ)) as well. Lemma 3.1 (Determinant evaluation). There is an algorithm that, given as input a matrix Σ and a parameter 0 < δ < 1, outputs an estimate log(det(Σ)) such that |log(det(Σ)) − log(det(Σ))| ≤ with probability 1 − δ in time: Now we can state the main brick used to compute the responsability: a quantum algorithm for evaluating the exponent of a Gaussian distribution. Lemma 3.2 (Quantum Gaussian Evaluation). Suppose we have stored in the QRAM a matrix V ∈ R n×d, the centroid µ ∈ R d and the covariance matrix Σ ∈ R d×d of a multivariate Gaussian distribution φ(v|µ, Σ), as well as an estimate for log(det(Σ)). Then for 1 > 0, there exists a quantum algorithm that with probability 1 − γ performs the mapping, ) is the exponent for the Gaussian probability density function. The running time of the algorithm is Using controlled operations it is simple to extend the previous Theorem to work with multiple Gaussians distributions (µ j, Σ j). That is, we can control on a register |j to do |j |i |0 → |j |i |φ(v i |µ j, Σ j). In the next Lemma we will see how to obtain the responsibilities r ij using the previous Theorem and standard quantum circuits for doing arithmetic, controlled rotations, and amplitude amplification. The Lemma is stated in a general way, to be used with any probability distributions that belong to an exponential family. Lemma 3.3 (Calculating responsibilities). Suppose we have quantum access to a GMM with parameters There are quantum algorithms that can: 1. Perform the mapping |i |j |0 → |i |j |r ij such that |r ij − r ij | ≤ 1 with probability 1 − γ in time: ij with high probability in time: Now we need to get a new estimate for the parameters of our model. This is the idea: at each iteration we recover the new parameters of the model as quantum states, and then recover it using tomography, amplitude estimation, or sampling. Once the new model has been recovered, we update the QRAM such that we get quantum access to the model γ t+1. The possibility to estimate θ comes from a call to the unitary we built to compute the responsibilities, and postselection. Lemma 3.4 (Computing θ t+1). We assume quantum access to a GMM with parameters γ t and let δ θ > 0 be a precision parameter. There exists an algorithm that estimates We use quantum linear algebra to transform the uniform superposition of responsibilities of the j-th mixture into the new centroid of the j-th Gaussian. Let R t j ∈ R n be the vector of responsibilities for a Gaussian j at iteration t. The following claim relates the vectors R t j to the centroids µ t+1 j. Claim 3.5. Let R t j ∈ R n be the vector of responsibilities of the points for the Gaussian j at time The proof is straightforward. Lemma 3.6 (Computing µ t+1 j). We assume we have quantum access to a GMM with parameters γ t. For a pre- From the ability to calculate responsibility and indexing the centroids, we derive the ability to reconstruct the covariance matrix of the Gaussians as well. Again, we use quantum linear algebra subroutines and tomography to recover an approximation of each Σ j. Recall that we have defined the matrix V ∈ R n×d Lemma 3.7 (Computing Σ t+1 j). We assume we have quantum access to a GMM with parameters γ t. We also have computed estimates µ j t+1 of all centroids such that µ j t+1 − µ t+1 j ≤ δ µ for precision parameter δ µ > 0. Then, there exists a quantum algorithm that outputs estimates for the new covariance matrices {Σ with high probability, in time, Now we are going to show how it is possible to get an estimate of the log-likelihood using a quantum procedure and access to a GMM model. A good estimate is crucial, as it is used as stopping criteria for the quantum algorithm as well. Classically, we stop to iterate the EM algorithm when | (γ t ; V) − (γ t+1 ; V)| < n, or equivalently, we can set a tolerance on the average increase in log probability:. From this we can estimate an upper bound on the log-likelihood as n log Lemma 3.8 (Quantum estimation of likelihood). We assume we have quantum access to a GMM with parameters γ t. For τ > 0, there exists a quantum algorithm that estimates E[p(v i ; γ t)] with absolute error τ in time Putting together all the previous Lemmas, we write the main of the work. Theorem 3.9 (QEM for GMM). We assume we have quantum access to a GMM with parameters γ t. For parameters δ θ, δ µ, τ > 0, the running time of one iteration of the Quantum Expectation-Maximization (QEM) algorithm is For the range of parameters of interest, the running time is dominated by T Σ. The proof follows directly from the previous lemmas. Note that the cost of the whole algorithm is given by repeating the Estimation and the Maximization steps several times, until the threshold on the log-likelihood is reached. Note also that the expression of the runtime can be simplified from the observation that the cost of performing tomography on the covariance matrices Σ j dominates the cost. In this section, we present the of some experiments on real datasets to bound the condition number and the other parameters of the runtime. Let's discuss the value of κ(Σ), κ(V), µ(Σ), and µ(V). We can thresholding the condition number by discarding small singular values of the matrix, as used in quantum linear algebra, might be advantageous. This is indeed done often in classical machine learning models, since discarding the eigenvalues smaller than a certain threshold might even improve upon the metric under consideration (i.e. often the accuracy), and is a form of regularization (, Section 6.5). This is equivalent to limiting the eccentricity of the Gaussians. We can have a similar consideration on the condition number of the dataset κ(V). As shown before, the condition number of the matrix V appearing in Lemma 3.2 is κ 2 (V). Similarly, we can claim that the value of µ(V) will not increase significantly as we add vectors to the training set. Remember that we have some choice in picking the function µ: in previous experiments we have found that choosing the maximum 1 norm of the rows of V lead to values of µ around 10, and also in this case we expect the samples of a well-clusterable dataset to be constant. Also, µ is bounded by the Frobenius norm of V. In case the matrix V can be clustered with high-enough accuracy by k-means, it has been showed that the Frobenius norm of the matrix is proportional to √ k. Given that EM is a more powerful extension of k-means, we can rely on similar observations too. Usually, the number of features d is much more than the number of components in the mixture, i.e. d k, so we expect d 2 to dominate the k 3.5 term in the cost needed to estimate the mixing weights. This makes the runtime of a single iteration proportional to: As we said, the quantum running time saves the factor that depends on the number of samples and introduces a number of other parameters. Using our experimental we can see that when the number of samples is large enough one can expect the quantum running time to be faster than the classical one. Note as well that one can expect to save some more factors from the quantum running time with a more careful analysis. Experiments. In the algorithm, we need to set the parameters δ µ and δ θ to be small enough such that the likelihood is perturbed less than τ /4. We have reasons to believe that on well-clusterable data, the value of these parameters will be large enough, such as not to impact dramatically the runtime. A quantum version of k-means algorithm has already been simulated on real data under similar assumptions . There, the authors analyzed on the MNIST dataset the performances of q-means, the δ-resistant version of the classical k-means algorithm. The experiment concluded that, for datasets that are expected to be clustered nicely by this kind of clustering algorithms, the value of the parameters δ µ, δ θ did not decrease by increasing the number of samples nor the number of features. We expect similar behaviour in the EM case, namely that for large datasets the impact on the runtime of the errors (δ µ, δ θ) does not cancel out the exponential gain in the dependence on the number of samples. For instance, in all the experiments of q-means on the MNIST dataset the value of δ µ (which in their case was called just δ) has been between 0.2 and 0.5. The value of τ is usually (for instance in scikit-learn ) chosen to be 10 −3. The value of η has always been below 11. We also analyzed some other real-world dataset, which can be fitted well with the EM algorithm (; APPML; Voxforge.org) to perform speaker recognition: the task of recognizing a speaker from a voice sample, having access to a training set of recorded voices of all the possible speakers. Details of the measurements are reported in the Supplementary Material section, here we report only the in Table 1. After this, we also experimented the impact of errors on the mixing weights in the accuracy of a ML estimate of a GMM by perturbing the trained model, by adding some random noise. With a value of δ θ = 0.035, δ µ = 0.5 we correctly classified 98.2% utterances. Table 1: We estimate some of the parameters of the VoxForge (Voxforge.org) dataset. The averages for the matrix V are taken over 34 samples, while for Σ is over 170 samples. The accuracy reported in the experiments is measured on 170 samples in the test set, after the threshold on the eigenvalues of Σ. Each model is the of the best of 3 different initializations of the EM algorithm. The first and the second column are the maximum singular values of all the covariance matrices, and the absolute value of the log-determinant. The column κ * (Σ) consist in the thresholded condition number for the covariance matrices. In , the experimental suggest that the influence of the extra parameters in the quantum running time (condition thresholds, errors, etc.) is moderate. This allows us to be optimistic that, when quantum computers with quantum access to data become a reality, our algorithm (and improved versions that reduce even more the complexity with respect to these extra parameters) could be useful in analyzing large datasets. 6 SUPPLEMENTARY MATERIAL Here we report useful Theorems, Lemmas, and Claims that we use in the main text. Theorem 6.1 (Determinant estimation ). Let M ∈ R d×d be a positive definite matrix with eigenvalues in the interval (σ min, 1). Then for all δ ∈ and > 0 there is a classical algorithm that outputs log(det(M)) such that |log(det(M)) − log(det(M))| ≤ 2 | log(det(M))| with probability at least 1 − δ in time Require: Dataset V, tolerance τ > 0. Ensure: A GMM γ t = (θ t, µ t, Σ t) that maximizes locally the likelihood (γ; V) up to tolerance τ. 1: Select γ 0 = (θ 0, µ 0, Σ 0) using classical initialization strategies described in Subsection 6.3. 2: t = 0 3: repeat Expectation ∀i, j, calculate the responsibilities as: 5: Maximization Update the parameters of the model as: 6: t=t+1 7: until 8: 9: Return Proof. We need to find the K such that for all x, y ∈ R d, we have that σ j (y) − σ j (x) ≤ K y − x. Observing that σ j is differentiable and that if we apply Cauchy-Schwarz to the statement of the Mean-Value-Theorem we derive that ∀x, y ∈ U, ∃c such that f (x) − f (y) ≤ ∇f (c) F x − y. So to show Lipschitz continuity it is enough to select K ≤ ∇σ j * The partial derivatives In our case we can deduce that: Claim 6.4. (b) Let θ be the angle between vectors x, y, and assume that θ < π/2. Then, We will also use Claim 4.5 from . Claim 6.5. Let b be the error we commit in estimating |c such that |c − |c < b, and a the error we commit in the estimating the norms, Definition 2 (Exponential Family). A probability density function or probability mass function p(v|ν), where V ⊆ R, ν ∈ R p is said to be in the exponential family if can be written as: where: • ν ∈ R p is called the canonical or natural parameter of the family, • o(ν) is a function of ν (which often is just the identity function), • T (v) is the vector of sufficient statistics: a function that holds all the information the data v holds with respect to the unknown parameters, • A(ν) is the cumulant generating function, or log-partition function, which acts as a normalization factor, • h(v) > 0 is the base measure which is a non-informative prior and de-facto is scaling constant. To prove our , we are going to use the quantum procedures listed hereafter. Theorem 6.6 (Amplitude estimation and amplification ). If there is unitary operator U such that U |0 l = |φ = sin(θ) |x, 0 + cos(θ) |G, 0 ⊥ then sin 2 (θ) can be estimated to multiplicative error η in time η sin(θ) ) and |x can be generated in expected time O(We also need some state preparation procedures. These subroutines are needed for encoding vectors in v i ∈ R d into quantum states |v i . An efficient state preparation procedure is provided by the QRAM data structures. We stress the fact that our continues to hold, no matter how the efficient quantum loading of the data is provided. For instance, the data can be accessed through a QRAM, through a block encoding, or when the data can be produced by quantum circuits. Theorem 6.7 (QRAM data structure (a) ). Let V ∈ R n×d, there is a data structure to store the rows of V such that, 1. The time to insert, update or delete a single entry v ij is O(log 2 (n)). In our algorithm we will also use subroutines for quantum linear algebra. For a symmetric matrix M ∈ R d×d with spectral norm M = 1 stored in the QRAM, the running time of these algorithms depends linearly on the condition number κ(M) of the matrix, that can be replaced by κ τ (M), a condition threshold where we keep only the singular values bigger than τ, and the parameter µ(M), a matrix dependent parameter defined as et al., 2018; Gilyén et al., 2018b). Theorem 6.8 (Quantum linear algebra (; Gilyén et al., 2018b) ). Let M ∈ R d×d such that M 2 = 1 and x ∈ R d. Let, δ > 0. If M is stored in appropriate QRAM data structures and the time to prepare |x is T x, then there exist quantum algorithms that with probability at least 1 − 1/poly(d) return a state |z such that Theorem 6.9 (Quantum linear algebra for matrix products ). Let M 1, M 2 ∈ R d×d such that M 1 = M 2 = 1 and x ∈ R d, and a vector x ∈ R d stored in QRAM. Let > 0. Then there exist quantum algorithms that with probability at least 1 − 1/poly(d) returns a state |z such that |z − |M x ≤ in time O((κ(M)(µ(M 1)T M1 + µ(M 2)T M2 )) log(1/)), where T M1, T M2 is the time needed to index the rows of M 1 and M 2. The linear algebra procedures above can also be applied to any rectangular matrix V ∈ R N ×d by considering instead The final component needed for the q-means algorithm is a linear time algorithm for vector state tomography that will be used to recover classical information from the quantum states corresponding to the new centroids in each step. Given a unitary U that produces a quantum state |x, by calling O(d log d/ 2) times U, the tomography algorithm is able to reconstruct a vector x that approximates |x such that | x − |x ≤. Theorem 6.10 (Vector state tomography ). Given access to unitary U such that U |0 = |x and its controlled version in time T (U), there is a tomography algorithm with time complexity O(T (U) ) that produces unit vector x ∈ R d such that x − x 2 ≤ with probability at least (1 − 1/poly(d)). Lemma 6.11 (Distance / Inner Products Estimation (; ; a) ). Assume for a data matrix V ∈ R N ×d and a centroid matrix C ∈ R k×d that the following unitaries |i |0 → |i |v i, and |j |0 → |j |c j can be performed in time T and the norms of the vectors are known. For any ∆ > 0 and > 0, there exists a quantum algorithm that computes | with probability at least 1 − 2∆ in time O vi cj T log(1/∆). Unlike k-means clustering, choosing a good set of initial parameters for a mixture of Gaussian is by no means trivial, and in multivariate context is known that the solution is problem-dependent. There are plenty of proposed techniques, and here we describe a few of them. Fortunately, these initialization strategies can be directly translated into quantum subroutines without impacting the overall running time of the quantum algorithm. The simplest technique is called random EM, and consists in selecting initial points at random from the dataset as centroids, and sample the dataset to estimate the covariance matrix of the data. Then these estimates are used as the starting configuration of the model, and we may repeat the random sampling until we get satisfactory . A more standard technique borrows directly the initialization strategy of k-means++ proposed in , and extends it to make an initial guess for the covariance matrices and the mixing weights. The initial guess for the centroids is selected by sampling from a suitable, easy to calculate distribution. This heuristic works as following: Let c 0 be a randomly selected point of the dataset, as first centroid. The other k −1 centroids are selected by selecting a vector v i with probability proportional to d 2 (v i, µ l(vi) ), where µ l(vi) is the previously selected centroid that is the closest to v i in 2 distance. These centroids are then used as initial centroids for a round of k-means algorithm to obtain µ 0 1 · · · µ 0 j. Then, the covariance matrices can be initialized as Σ T, where C j is the set of samples in the training set that have been assigned to the cluster j in the previous round of k-means. The mixing weights are estimated as C j /n. Eventually Σ 0 j is regularized to be a PSD matrix. There are other possible choices for parameter initialization in EM, for instance, based on Hierarchical Agglomerative Clustering (HAC) and the CEM algorithm. In CEM we run one step of EM, but with a so-called classification step between E and M. The classification step consists in a hard-clustering after computing the initial conditional probabilities (in the E step). The M step then calculates the initial guess of the parameters . In the small EM initialization method we run EM with a different choice of initial parameters using some of the previous strategies. The difference here is that we repeat the EM algorithm for a few numbers of iterations, and we keep iterating from the choice of parameters that returned the best partial . For an overview and comparison of different initialization techniques, we refer to (Blömer & ;). Quantum initialization strategies For the initialization of γ 0 in the quantum algorithm we can use the same initialization strategies as in classical machine learning. For instance, we can use the classical random EM initialization strategy for QEM. A quantum initialization strategy can also be given using the k-means++ initializion strategy from , which returns k initial guesses for the centroids c, where is the average squared distance between two points of the dataset, and is the tolerance in the distance estimation. From there, we can perform a full round of q-means algorithm and get an estimate for µ 0 1 · · · µ 0 k. With q-means and the new centroids store in the QRAM we can create the state Where l(v i) is the label of the closest centroid to the i-th point. By sampling S ∈ O(d) points from this state we get two things. First, from the frequency f j of the second register we can have an guess of θ 0 j ← |C j |/n ∼ f j /S. Then, from the first register we can estimate Σ Sampling O(d) points and creating the state in Equation takes time O(dkη) by Theorem 6.11 and the minimum finding procedure described in . Techniques illustrated in can also be used to quantize the CEM algorithm which needs a hardclustering step. Among the different possible approaches, the random and the small EM greatly benefit from a faster algorithm, as we can spend more time exploring the space of the parameters by starting from different initial seeds, and thus avoid local minima of the likelihood. What we presented in the previous section is the most general model of GMM. For simple datasets, it is common to assume some restrictions on the covariance matrices of the mixtures. The translation into a quantum version of the model should be straightforward. We distinguish between these cases: 1. Soft k-means. This algorithm is often presented as a generalization of k-means, but it can actually be seen as special case of EM for GMM -albeit with a different assignment rule. In soft k-means, the assignment function is replaced by a softmax function with stiffness parameter β. This β represents the covariance of the clusters. It is assumed to be equal for all the clusters, and for all dimensions of the feature space. Gaussian Mixtures with constant covariance matrix (i.e. Σ j = βI for β ∈ R) can be interpreted as a kind of soft or fuzzy version of k-means clustering. The probability of a point in the feature space being assigned to a certain cluster j is: where β > 0 is the stiffness parameter. 2. Spherical. In this model, each component has its own covariance matrix, but the variance is uniform in all the directions, thus reducing the covariance matrix to a multiple of the identity matrix (i.e. Σ j = σ 2 j I for σ j ∈ R). 3. Diagonal. As the name suggests, in this special case the covariance matrix of the distributions is a diagonal matrix, but different Gaussians might have different diagonal covariance matrices. 4. Tied. In this model, the Gaussians share the same covariance matrix, without having further restriction on the Gaussian. 5. Full. This is the most general case, where each of the components of the mixture have a different, SDP, covariance matrix. Lemma 6.12 (Determinant evaluation). There is an algorithm that, given as input a matrix Σ and a parameter 0 < δ < 1, outputs an estimate log(det(Σ)) such that |log(det(Σ)) − log(det(Σ))| ≤ with probability 1 − δ in time: Proof. In order to apply Theorem 6.1, we need to be sure that all the eigenvalues lie in (σ min, 1). In order to satisfy this condition, we can scale the matrix by a constant factor c, such that Σ = Σ/c. In this way, log det(Σ) = log. This will allow us to recover the value of log det(Σ) by using Theorem 6.1. We apply the Theorem with precision = 1/4 to get an estimate γ such that 2. Then, to have an estimate with absolute error, we apply Theorem 6.1 with precision = 4γ. This gives us an estimate for log(det(Σ)) with error 2 log(det(Σ)) ≤ in time: Lemma 6.13 (Error in the responsibilities of the exponential family). Let v i ∈ R n be a vector, and let {p(v i |ν j)} k j=1 be a set of k probability distributions in the exponential family, defined as p(Then, if we have estimates for each exponent with error, then we can compute each r ij such that |r ij −r ij | ≤ √ 2k for j ∈ [k]. Proof. The proof follows from rewriting the responsibility of Equation as: In this form, it is clear that the responsibilities can be seen a softmax function, and we can use Theorem 6.3 to bound the error in computing this value. Let T i ∈ R k be the vector of the exponent, that is In an analogous way we define T i the vector where each component is the estimate with error. The error in the responsibility is defined Because the function σ j is Lipschitz continuous, as we proved in Theorem 6.3 with a Lipschitz constant K ≤ √ 2, we have that, |σ j (Lemma 6.14 (Quantum Gaussian Evaluation). Suppose we have stored in the QRAM a matrix V ∈ R n×d, the centroid µ ∈ R d and the covariance matrix Σ ∈ R d×d of a multivariate Gaussian distribution φ(v|µ, Σ), as well as an estimate for log(det(Σ)). Then for 1 > 0, there exists a quantum algorithm that with probability 1 − γ performs the mapping, • U G, 1: |i |0 → |i |s i such that |s i − s i | < 1, where ) is the exponent for the Gaussian probability density function. The running time of the algorithm is, Proof. We use quantum linear algebra and inner product estimation to estimate the quadratic form µ and separately approximate each term in the sum to error 1 /4. We describe the procedure to estimate Recall that (through Lemma 3.1) we also have an estimate of the log-determinant to error 1. Thus we obtain an approximation for − + log(det(Σ))) within error 2 1. We have the upper bound, for Σ stored in a QRAM data structure. Further observing that u ≤ √ η and v i ≤ √ η, the running time for this computation is O Lemma 6.15 (Calculating responsibilities). Suppose we have quantum access to a GMM with parameters γ t = (θ t, µ t, Σ t). There are quantum algorithms that can: 1. Perform the mapping |i |j |0 → |i |j |r ij such that |r ij − r ij | ≤ 1 with probability 1 − γ in time: ij with high probability in time: Proof. For the first statement, let's recall the definition of responsibility:. With the aid of U G, 1 of Lemma 3.2 we can estimate log(φ(v i |µ j, Σ j)) for all j up to additive error 1, and then using the current estimate of θ t, we can calculate the responsibilities create the state, The estimate r ij is computed by evaluating a weighted softmax function with arguments log(φ( The estimates log(φ(v i |µ j, Σ j) are then uncomputed. The runtime of the procedure is given by calling k times Lemma 3.2 for Gaussian estimation (the arithmetic operations to calculate the responsibilities are absorbed). Let us analyze the error in the estimation of r ij. The responsibility r ij is a softmax function with arguments log(φ(v i |µ j, Σ j)) that are computed upto error 1 using Lemma 3.2. As the softmax function has a Lipschitz constant K ≤ √ 2 by Lemma 6.13, we choose precision for Lemma 3.2 to be 1 / √ 2k to get the guarantee |r ij − r ij | ≤ 1. Thus, the total cost of this step is T R1, 1 = k 1.5 T G, 1. Now let's see how to encode this information in the amplitudes, as stated in the second claim of the Lemma. We estimate the responsibilities r ij to some precision and perform a controlled rotation on an ancillary qubit to obtain, We then undo the circuit on the second register and perform amplitude amplification on the rightmost auxiliary qubit being |0 to get |R j:= Let us analyze the precision required to prepare |R j such that |R j − |R j ≤ 1. As we have estimates |r ij − r ij | < for all i, j, the 2 -norm error n. Applying Claim 6.4, the error for the normalized vector |R j can be bounded as Rj. By the Cauchy-Schwarz inequality we have that. We can use this to obtain a bound, using the dataset assumptions in section 2. If we choose such that Lemma 6.16 (Computing θ t+1). We assume quantum access to a GMM with parameters γ t and let δ θ > 0 be a precision parameter. There exists an algorithm that estimates θ t+1 ∈ R k such that θ t+1 − θ t+1 ≤ δ θ in time T, and compute a state |µ j t+1 along with an estimate for the norm V T R t j = µ j t+1 with error norm. The last step of the algorithm consists in estimating the unit vector |µ j t+1 with precision tom using tomography. Considering that the tomography depends on d, which we expect to be bigger than the precision required by the norm estimation, we can assume that the runtime of the norm estimation is absorbed. Thus, we obtain: O k Let's now analyze the total error in the estimation of the new centroids, which we want to be δ µ. For this purpose, we use Claim 6.5, and choose parameters such that 2 √ η(tom + norm) = δ µ. Since the error 3 for quantum linear algebra appears as a logarithmic factor in the running time, we can choose 3 tom without affecting the runtime. Let µ be the classical unit vector obtained after quantum tomography, and |µ be the state produced by the quantum linear algebra procedure starting with an approximation of |R t j. Using the triangle inequality we have |µ − µ < µ − |µ + |µ − |µ < tom + 1 < δ µ /2 √ η. The errors for the norm estimation procedure can be bounded We therefore choose parameters Since the amplitude estimation step we use for estimating the norms does not depends on d, which is expected to dominate the other parameters, we omit the amplitude estimation step. Substituting for T R2,δµ, we have the more concise expression for the running time of: Lemma 6.18 (Computing Σ t+1 j). We assume we have quantum access to a GMM with parameters γ t. We also have computed estimates µ j t+1 of all centroids such that µ j t+1 − µ t+1 j ≤ δ µ for precision parameter δ µ > 0. Then, there exists a quantum algorithm that outputs estimates for the new covariance matrices {Σ with high probability, in time, Proof. It is simple to check, that the update rule of the covariance matrix during the maximization step can be reduced to (, Exercise 11.2): First, note that we can use the estimates of the centroids to compute µ t+1 j (µ t+1 j) T with error δ µ µ ≤ δ µ √ η in the update rule for the Σ j. This follows from the fact that µ = µ + e where e is a vector of norm δ µ. Therefore does not depend on d, we consider it smaller than the runtime for performing tomography. Thus, the runtime for this operation is: Let's analyze the error of this procedure. We want a matrix Σ j that is √ ηδ µ -close to the correct one: Again, the error due to matrix multiplication can be taken as small as necessary, since is inside a logarithm. From Claim 6.5, we just need to fix the error of tomography and norm estimation such that η(unit + norms) < √ ηδ µ where we have used η as an upper bound on Σ j F. For the unit vectors, we require where |Σ j is the error due to tomography and |Σ j is the error due to Lemma 3.3. For this inequality to be true, we choose tom = 1 < δ µ /4 √ η. The same argument applies to estimating the norm Σ j with relative error: √ η (where here is the error of the amplitude estimation step used in Theorem 6.8 and 1 is the error in calling Lemma 3.3. Again, we choose . This can be derived from the fact that κ(A ⊗ B) = κ(A)κ(B), κ(AB) ≤ κ(A)κ(B), and Since the tomography is more costly than the amplitude estimation step, we can disregard the runtime for the norm estimation step. As this operation is repeated k times for the k different covariance matrices, the total runtime of the whole algorithm is given by O Let us also note that for each of new computed covariance matrices, we use Lemma 3.1 to compute an estimate for their log-determinant and this time can be absorbed in the time T Σ. Lemma 6.19 (Quantum estimation of likelihood). We assume we have quantum access to a GMM with parameters γ t. For τ > 0, there exists a quantum algorithm that estimates E[p(v i ; γ t)] with absolute error τ in time Proof. We obtain the likelihood from the ability to compute the value of a Gaussian distribution and quantum arithmetic. Using the mapping of Lemma 3.2 with precision 1, we can compute φ(v i |µ j, Σ j) for all the Gaussians, that is |i k−1 j=0 |j |p(v i |j; γ j). Then, by knowing θ, and by using quantum arithmetic we can compute in a register the mixture of Gaussian's: p(v i ; γ) = j∈[k] θ j p(v i |j; γ). We now drop the notation for the model γ and write p(v i) instead of p(v i ; γ). Doing the previous calculations quantumly leads to the creation of the state |i |p(v i). We perform the mapping |i |p(v i) → |i p(v i)| |0 + 1 − p(v i) |1 and estimate p(|0) E[p(v i)] with amplitude estimation on the ancilla qubit. To get a τ -estimate of p we need to decide the precision parameter we use for estimating p(v i |j; γ) and the precision required by amplitude estimation. Let p be the 1 -error introduced by using Lemma 3.2 and p the error introduced by amplitude estimation. Using triangle inequality we set p − p < p − p + p − p < τ. To have |p − p| < τ, we should set 1 such that |p − p| < τ /4, and we set the error in amplitude estimation and in the estimation of the probabilities to be τ /2. The runtime of this procedure is therefore: recognition community to extract the so-called Mel Frequency Cepstrum Coefficients (MFCCs) features . We selected d = 40 features for each speaker. Then, each speaker is modeled with a mixture of 16 different Gaussians. The test set consists of other 5 unseen utterances of the same 34 speakers (i.e. the training set and the test set have the same size). The task is to correctly label the unseen utterances with the name of the correct speaker. This is done by testing each of the GMM fitted during the training with the new voice sample, and selecting the model with the highest likelihood. Due to the differences in the speakers' audio data, the different dataset V 1... V 34 are made of a variable number of points which ranges from n = 2000 to 4000. In the vanilla configuration without thresholding, 169 among 170 utterances (5 utterances for all 34 speakers) were correctly labeled by EM with ML estimate, while all the elements in the test set were correctly recognized using the Bayesian (MAP) framework. During the training, we measured all the values of κ(Σ), κ(V), µ(V), µ(Σ). For almost all GMM fitted (choosing a diagonal covariance matrix), there is at least a Σ j (among the 16 used to model a single speaker) with bad condition number (i.e up to 2500 circa). As in we took a threshold on the matrix by discarding singular values smaller than a certain value m. Practically, we discarded any singular value smaller than 2 × 10 −2. Thresholding the covariance matrices did not impact the accuracy (the generalization error) significantly. In the MAP estimate, only one element is not correctly classified, while this number goes up to two in the case of ML estimates. The are in Table 1. To check the resistence to noise, we perturbed each of the GMM γ t, once fitted. Then, we measured variations of the accuracy on the test set. For each model, the perturbation consists of three things. First we add to θ a uniform vector (with randomly selected negative or positive entries) of 2 norm of δ θ = 0.035. Then we perturb each centroid µ j with a vector of norm smaller than δ µ = 0.5. In this error vector the sign of each noise component is chosen randomly, and the magnitude is sampled uniformly in the interval (0,). Then, we perturbed also the diagonal matrices Σ j with a vector of norm smaller than δ µ √ η, where η = 10. As we are using a diagonal GMM, this reduces to perturbing each singular value by some random noise upper bounded by ±δ µ √ η/ √ d, making sure that each of the singular value stays positive, as covariance matrices are SPD. Last, the matrices are thresholded. Since the representation of the model used by our software stores the Cholesky's decomposition of the inverse, we worked with that representation. Notably, thresholding the Σ j help to mitigate the error of noise and regularize the model. With these parameters, we were able to correctly label 167 utterances over 170. We leave for the future further experiments with bigger and different types of datasets or where the noise is also added during the training process. We used scikit-learn to run all the experiments. Maximum Likelihood is not the only way to estimate the parameters of a model, and in certain cases might not even be the best one. For instance, in high-dimensional spaces, it is pretty common for ML estimates to overfit. Moreover, it is often the case that we have prior information on the distribution of the parameters, and we would like our models to take this information into account. These issues are often addressed using a Bayesian approach, i.e. by using a so-called Maximum A Posteriori estimate (MAP) of a model (, Section 14.4.2.8). MAP estimates work by assuming the existence of a prior distribution over the parameters γ. The posterior distribution we use as objective function to maximize comes from the Bayes' rule applied on the likelihood, which gives the posterior as a product of the likelihood and the prior, normalized by the evidence. More simply, we use the Bayes' rule on the likelihood function, as p(γ; V) = p(V ;γ)p(γ) p(V). This allows us to treat the model γ as a random variable, and derive from the ML estimate a MAP estimate: Among the advantages of a MAP estimate over ML is that it avoids overfitting by having a kind of regularization effect on the model (, Section 6.5). Another feature consists in injecting into a maximum likelihood model some external information, perhaps from domain experts. This advantage comes at the cost of requiring "good" prior information on the problem, which might be non-trivial. In terms of labelling, a MAP estimates correspond to a hard

Represent the short summary for finding the corresponding scientific article (long)

It's the quantum algorithm for Expectation Maximization. It's fast: the runtime depends only polylogarithmically on the number of elements in the dataset.

Represent this text to find a much much longer article about it with say hundreds-thousands of words

This paper 1) characterizes functions representable by ReLU DNNs, 2) formally studies the benefit of depth in such architectures,  3) gives an algorithm to implement empirical risk minimization to global optimality for two layer ReLU nets.