Question: Represent the article for finding a single-sentence TLDR

Question: We propose a new method to train neural networks based on a novel combination of adversarial training and provable defenses. The key idea is to model training as a procedure which includes both, the verifier and the adversary. In every iteration, the verifier aims to certify the network using convex relaxation while the adversary tries to find inputs inside that convex relaxation which cause verification to fail. We experimentally show that this training method is promising and achieves the best of both worlds – it produces a model with state-of-the-art accuracy (74.8%) and certified robustness (55.9%) on the challenging CIFAR-10 dataset with a 2/255 L-infinity perturbation. This is a significant improvement over the currently known best of 68.3% accuracy and 53.9% certified robustness, achieved using a 5 times larger network than our work. The discovery of adversarial examples in deep learning has increased the importance of creating new training methods which produce accurate and robust neural networks with provable guarantees. Existing work: adversarial and provable defenses Adversarial training provides a basis framework which augments the training procedure with adversarial inputs produced by an adversarial attack. instantiated adversarial training using a strong iterative adversary and showed that their approach can train models which are highly robust against the strongest known adversarial attacks . This method has also been used to train robust ImageNet models . While promising, the main drawback of the method is that when instantiated in practice, via an approximation of an otherwise intractable optimization problem, it provides no guarantees -it does not produce a certificate that there are no possible adversarial attacks which could potentially break the model. To address this lack of guarantees, recent line of work on provable defenses; has proposed to train neural networks which are certifiably robust under a specific attacker threat model. However, these guarantees come at the cost of a significantly lower standard accuracy than models trained using adversarial training. This setting raises a natural question -can we leverage ideas from both, adversarial training techniques and provable defense methods, so to obtain models with high accuracy and certified robustness? This work: combining adversarial and provable defenses In this work, we take a step towards addressing this challenge. We show that it is possible to train more accurate and provably robust neural networks using the same convex relaxations as those used in existing, state-of-the-art provable defense methods, but with a new, different optimization procedure inspired by adversarial training. Our optimization works as follows: (i) to certify a property (e.g., robustness) of the network, the verifier produces a convex relaxation of all possible intermediate vector outputs in the neural network, then (ii) an adversary now searches over this (intermediate) convex regions in order to find, what we refer to as a latent adversarial example -a concrete intermediate input contained in the relaxation that when propagated through the network causes a misclassification that prevents verification, and finally (iii) the ing latent adversarial examples are now incorporated into our training scheme using adversarial training. Overall, we can see this method as bridging the gap between adversarial training and provable defenses (it can conceptually be instantiated with any convex relaxation). We experimentally show that the method is promising and in a neural network with state-of-theart 78.8% accuracy and 58.1% certified robustness on the challenging CIFAR-10 dataset with 2/255 L ∞ perturbation (the best known existing are 68.3% accuracy and 53.9% certified robustness using 5 times larger network). • A new method we refer to as layerwise adversarial training which can train provably robust neural networks and conceptually bridges the gap between adversarial training and existing provable defense methods. • Instantiation of layerwise adversarial training using linear convex relaxations used in prior work (accomplished by introducing a projection operator). • Experimental showing layerwise adversarial training can train neural network models which achieve both, state-of-the-art accuracy and certified robustness on CIFAR-10 with 2/255 L ∞ perturbation. Overall, we believe the method presented in this work is a promising step towards training models that enjoy both, higher accuracy and higher certification guarantees. An interesting item for future work would be to explore instantiations of the method with other convex relaxations than the one considered here. We now discuss some of the closely related work on robustness of neural networks. Heuristic adversarial defenses After the first introduction of adversarial examples , defense mechanisms to train robust neural networks were built based on the inclusion of adversarial examples to the training set . Models trained using adversarial training with projected gradient descent (PGD) were shown to be robust against the strongest known attacks . This is in contrast to other defense mechanisms which have been broken by new attack techniques . While models trained using adversarial training achieve robustness against strong adversaries, there are no guarantees that model is robust against any kind of adversarial attack under the threat model considered. Provable adversarial defenses Another line of work proposes to learn classifiers which come with robustness guarantees. These approaches are based on linear or semidefinite (; a) relaxations, hybrid zonotope or interval bound propagation . While these approaches currently obtain robustness guarantees, accuracy of these networks is relatively small and limits practical use of these methods. There has also been recent work on certification of general neural networks, not necessarily trained in a special way. These methods are based on SMT solvers , mixed-integer linear programs, abstract interpretation, restricted polyhedra (b) or combinations of those (a). Another line of work proposes to replace neural networks with a randomized classifier (; ; a) which comes with probabilistic guarantees on its robustness. While these approaches scale to larger datasets such as ImageNet (although with probabilistc instead of exact guarantees), their bounds come from the relationship between L 2 robustness and Gaussian distribution. In this paper, we consider general verification problem where input is not necessarily limited to an L p ball, but arbitrary convex set. In this work we consider a threat model where an adversary is allowed to transform an input x ∈ R d0 into any point from a convex set S 0 (x) ⊆ R d0. For example, for a threat model based on L ∞ perturbations, the convex set will be defined as Figure 1: An iteration of layerwise adversarial training. Latent adversarial example x 1 is found in the convex region C 1 (x) and propagated through the rest of the layers in a forward pass which is shown with the blue line. During backward pass, gradients are propagated through the same layers, shown with the red line. Note that the first convolutional layer does not receive any gradients. We now describe our layerwise adversarial training approach which yields a provable defense that bridges the gap between standard adversarial training and existing provable defenses. Motivation: latent adversarial examples Consider an already trained neural network model h θ which we would like to certify using convex relaxations. A fundamental issue here is that certification methods based on convex relaxations can struggle to prove the target property (e.g., robustness) due to the iterative accumulation of errors introduced by the relaxation. More precisely, assume the neural network actually satisfies the property from Equation 1 for an input x, meaning that. Naturally, this also implies that the neural network behaves correctly in the latent space of its first hidden layer in the region S 1 (x). Formally, this means that c T h 2:k θ (x 1)+d < 0, ∀x 1 ∈ S 1 (x). However, if one would use a certification method which replaces the region S 1 (x) by its convex relaxation C 1 (x), then it is possible that we would fail to certify our desired property. This is due to the fact that there may exist an input Of course, we could repeat the above thought experiment and possibly find more violating latent inputs in the set C i (x) \ S i (x) of any hidden layer i. The existence of points found in the difference between a convex relaxation and the true region is a fundamental reason for the failure of certification methods based on convex approximations. For convenience, we refer to such points as latent adversarial examples. Next, we describe a method which trains the neural network in a way that aims to minimize the number of latent adversarial examples. Layerwise provable optimization via convex relaxations Our key observation is that the two families of defense methods described earlier are in fact different ends of the same spectrum: methods based on adversarial training maximize the cross-entropy loss in the first convex region C 0 (x) while provable defenses maximize the same loss, but in the last convex region C k (x). Both methods then backpropagate the loss through the network and update the parameters using SGD. However, as explained previously, certification methods may fail even before the last layer due to the presence of latent adversarial examples in the difference of the regions C i (x) and S i (x). A natural question then is -can we leverage adversarial training so to eliminate latent adversarial examples from hidden layers and obtain a provable network? To this end, we propose adversarial training in layerwise fashion. The initial phase of training is equivalent to adversarial training as used by. In this phase in the inner loop we repeatedly find an input in C 0 (x) which maximizes the cross-entropy loss and update the parameters of the neural network so to minimize this loss using SGD. Note that the outcome of this phase is a model which is highly robust against strong multi-step adversaries. However, certification of this fact often fails due to the previously mentioned accumulation of errors in the particular convex relaxation being used. The next step of our training method is visually illustrated in Figure 1. Here, we propagate the initial convex region through the first layer of the network and obtain the convex relaxation C 1 (x). We then solve the optimization problem to find a concrete point x 1 inside of C 1 (x) which produces Algorithm 1: Layerwise adversarial training via convex relaxations Data: k-layer neural network h θ, training set (X, Y), learning rate η, step size α, inner steps n Result: Update in parallel n times: Freeze parameters θ l+1 of layer l + 1; 12 end the maximum loss when this point is propagated further through the network (this forward pass is shown with the blue line). Finally, we backpropagate the final loss (red line) and update the parameters of the network so to minimize the loss. Critically, we do not backpropagate through the convex relaxation in the first layer as standard provable defenses do ). We instead freeze the first layer and stop backpropagation after the update of the second layer. Because of this, our optimization problem is significantly easier -the neural network only has to learn to behave well on the concrete points that were found in the convex region C l (x). This can be viewed as an extension of the robust optimization method that found to work well in practice. We then proceed with the above process for later layers. Formally, this training process amounts to (approximately) solving the following min-max optimization problem at the l-th step: Note that for l = 0 this formulation is equivalent to the standard min-max formulation in Equation 2 because C 0 (x) = S 0 (x). Our approach to solve this min-max optimization problem for every layer l is shown in Algorithm 1. We initialize every batch by random sampling from the corresponding convex region. Then, in every iteration we use projected gradient descent (PGD) to maximize the inner loss in 3. We first update x j in the direction of the gradient of the loss and then project it back to C l (x j) using the projection operator Π. Note that this approach assumes the existence of an efficient projection method to the particular convex relaxation the method is instantiated with. In the next section, we show how to instantiate the training algorithm described above to a particular convex relaxation which is generally tighter than a hyperrectangle and where we derive an efficient projection operation. So far we described the general approach of layerwise adversarial training. Now we show how to instantiate it for a particular convex relaxation based on linear approximations. If instead one would use interval approximation ) as the convex relaxation, then all regions C l (x) will be hyperrectangles and projection to these sets is fast and simple. However, the interval relaxation provides a coarse approximation which motivates the need to train with relaxations that provide tighter bounds. Thus, we consider linear relaxations which are generally tighter than those based on intervals. In particular we leverage the same relaxation which was previously proposed in;; as an effective way to certify neural networks. Here, each convex region is represented as a set Vector a l represents the center of the set and the matrix A l represents the affine transformation of the hypercube [−1, 1] m l. The initial convex region C 0 (x) is represented using a 0 = x and A 0 = I d0 is a diagonal matrix. Propagation of these convex regions through the network is out of the scope of this paper -a full description can be found in or. At a high level, the convolutional and fully connected layers are handled by multiplying A l and a l by appropriate matrices. To handle the ReLU activation, for ReLU units which cross 0, we apply a convex relaxation which amounts to multiplying A l and a l by appropriately chosen scalar values, depending whether the ReLU is activated or not. Using this relaxation of ReLU, we can recursively obtain all convex regions C l (x). In practice, A l e can be computed without explicitly constructing matrix A l because A l e = W l Λ l−1 W l−2 · · · M 0 e. Then we can perform matrix-vector multiplication right to left to obtain vector A l e. We provide more detailed description of this propagation in Appendix A. Projection to linear convex regions To use our training method we now need to instantiate Algorithm 1 with a suitable projection operator Π C l (x). The key insight here is that the vector x ∈ C l (x) is uniquely determined by auxiliary vector e ∈ [−1, 1] m l where x = a l + A l e. Then instead of directly solving for x which requires projecting to C l (x), we can solve for e instead which would uniquely determine x. Crucially, the domain of e is a hyperrectangle [−1, 1] m l which is easy to project to. To visualize this further we provide an example in Figure 2. The goal is to project the red point x in the right picture to the convex region C l (x). To project, we first perform change of variables to substitute x with e and then project e to the square [−1, 1] × [−1, 1] to obtain the blue point Π(e) on the left. Then, we again perform change of variables to obtain the blue point Π(x) on the right, the projection of x we were looking for. Based on these observations, we modify Line 7 of Algorithm 1 to first update the coefficients e j using the following update rule: e j ← clip(e j + αA Here clip is function which thresholds its argument between -1 and 1, formally clip(x, −1, 1) = min(max(x, −1), 1). This is followed by an update to x j via x j ← a l + A l e j, completing the update step. Sparse representation While our representation of convex regions with matrix A l and vector a l has clean mathematical properties, in practice, a possible issue is that the matrix A l can grow to be quite large. Because of this, propagating it through the network can be memory intensive and prohibit the use of larger batches. To overcome this difficulty, we first observe that A l is quite sparse. We start with a very sparse, diagonal matrix A 0 at the input. After each convolution, an element of matrix A l+1 is non-zero only if there is a non-zero element inside of its convolutional kernel in matrix A l. We can leverage this observation to precompute positions of all non-zero elements in matrix A l+1 and compute their values using matrix multiplication. This optimization is critical to enabling training to take place altogether. An interesting item for future work is further optimizing the current relaxation (via a specialized GPU implementation) or developing more memory friendly relaxations, so to scale the training to larger networks. After training a neural network via layerwise adversarial training, our goal is to certify the target property (e.g., robustness). Here we leverage certification techniques which are not fast enough to be incorporated into the training procedure, but which can significantly boost the certification performance. The linear relaxation of ReLU that we are using is parameterized by slopes λ of the linear relaxation. Prior work which employed this relaxation; ) chose these slopes in a greedy manner by minimizing the area of the relaxation. During training we also choose λ in the same way. However, during certification, we can also optimize for the values of λ that give rise to the convex region inside of which the maximum loss is minimized. This optimization problem can be written as: Solving this is computationally too expensive inside the training loop, but during certification it is feasible to approximate the solution. We solve for λ using the Adam optimizer and clipping the elements between 0 and 1 after each update. We remark that the idea of learning the slope is similar to Dvijotham et al. (2018b) who propose to optimize dual variables in a dual formulation, however here we stay in the primal formulation. Combining convex relaxations with exact bound propagation During layerwise adversarial training we essentially train the network to be certified on all regions C 0 (x),..., C k (x). While computing exact regions S l (x) ⊆ C l (x) is not feasible during training, we can afford it to some extent during certification. The idea is to first propagate the bounds using convex relaxations until one of the hidden layers l and obtain a region C l (x). If training was successful, there should not exist a concrete point x l ∈ C l (x) which, if propagated through the network, violates the correctness property in Equation 1. We can encode both, the property and the propagation of the exact bounds S l (x) using a Mixed-Integer Linear Programming (MILP) solver. Note that we can achieve this because we represent the region C l (x) using a set of linear constraints, however, for general convex shapes this may not be possible. We perform the MILP encoding using the formulation from. It is usually possible to encode only the last two layers using MILP due to the poor scalability of these solvers for realistic network sizes. One further improvement we also include is to tighten the convex regions C l (x) using refinement via linear programming as described in Singh et al. (2019a). We remark that this combination of convex relaxation and exact bound propagation does not fall under the recently introduced convex barrier to certification Salman et al. (2019b). We now present an evaluation of our training method on the challenging CIFAR-10 dataset. Experimental setup We evaluate on a desktop PC with 2 GeForce RTX 2080 Ti GPU-s and 16-core Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz. We use Gurobi as a MILP solver. Our method is implemented in PyTorch and we plan to release both, the code and the trained models. Neural network architecture All presented are on a 4-layer convolutional network with 49 402 neurons: first 3 layers are convolutional layers with filter sizes 32, 32 and 128, kernel sizes 3, 4, 4 and strides 1, 2, 2 respectively. These are followed by a fully connected layer with 250 hidden units. After each of these layers, there is a ReLU activation. Training We use batch size 50 and L1 regularization 0.00001 for training. We perform optimization using Adam with initial learning rate 0.001 which is decreased by 10× every 100 epochs. During layerwise training we start with perturbation which is 10% higher than the one we certify and we decrease it by 5% when the training progresses to the next layer. Certification After training completes, we perform certification as follows: for every image, we first try to certify it using only linear relaxations (with the improvement of learned slopes, Section 6). If this fails, we encode the last layer as MILP and try again. Finally, if this fails we encode the ReLU activation after the last convolution using additional 300 binary variables and the rest using the triangle formulation. We consider an image to be not certifiable if we fail to verify it using these methods. We always evaluate on the first 1 000 images from the test set. Comparison to prior work We first train and certify using our method for the L ∞ perturbation 2/255. Results are shown in Table 1. We always compare to the best reported and reproducible et al. 68.3 53.9 70.1 50.0 59.9 46.1 62.3 45.5 61.1 45.9, as this improvement is also orthogonal to the method here. Thus, we only consider their best single network architecture (inline with prior work which compares to a single architecture). We believe all methods listed in Table 1, including ours, would benefit from additional techniques such as cascades, pre-training and leveraging unlabeled data. Experimentally, we find that the neural network trained using our method substantially outperforms all existing approaches, both in terms of standard accuracy and certified robustness for 2/255. Note that here we are using the same linear relaxation as, but our optimization procedure is different and shows significant improvements over the one used in their work. We also run the same experiment for L ∞ perturbation 8/255. Here we do not include comparison with as their were found to be not reproducible (; ;). These are presented in Table 2. Here we substantially outperform all existing approaches in terms of standard accuracy. However, in terms of certified robustness we are not able to achieve similar to whose method is based on a combination of interval approximation and linear relaxation. The main issue is that our 4-layer network lacks capacity to solve this task -even if training only using standard adversarial training our empirical robustness does not go above ∼ 34%. We remark that capacity was found to be one of the key components necessary to obtain a robust classifier . Due to promising for 2/255, we believe achieving state-of-the-art for 8/255 is very likely an issue of instantiating our method with a convex relaxation that is more memory efficient, which we believe is an interesting item for future work. We presented a new method to train certified neural networks. The key concept was to combine techniques from provable defenses using convex relaxations with those of adversarial training. Our method achieves state-of-the-art 78.8% accuracy and 58.1% certified robustness on CIFAR-10 with a 2/255 L ∞ perturbation, significantly outperforming prior work when considering a single network (it also achieves competitive on 8/255 L ∞). The method is general and can be instantiated with any convex relaxation. A promising future work item is scaling to larger networks: this will require tight convex relaxations with a low memory footprint that allow for efficient projection. Here we provide additional details that were omitted in the main body of the paper. In this section, we describe how to propagate convex relaxations of the form C l (x) = {a l + A l e | e ∈ [−1, 1] m l } through the network, for a single input x. As explained before, these relaxations were previously proposed in;. For the sake of completeness we describe them here using our notation. Depending on the form of function h i θ representing operation applied at layer i we distinguish different cases. Here we assume we have obtained region C i−1 (x) and our goal is to compute the region C i (x) using convex relaxation g i θ of the function h i θ. Initial convex region Let be L ∞ radius that we are certifying. We then compute minimum and maximum pixel values for each pixel as x l = max(0, x −) and x u = min(1, x +). We define initial convex region as: Convolutional and fully connected layers For both convolutional and fully connected layers, the update is given by mi. We can then compute: Using this formula, we define convex region C i+1 (x) = {a i+1 + A i+1 e | e ∈ [−1, 1] mi+1 } where: We will explain the transformation of a single element x i,j = a i,j + A T i,j e. We first compute lower bound l i,j and upper bound u i,j of element x i in the set C i (x): In the other case where 0 is between l i,j and u i,j we define ReLU (x i,j) = λ i,j x i,j + µe mi+j where e mi+j ∈ [−1, 1] is a coefficient for a new error term. Formulas for λ i,j and µ i,j are the following: This computation can also be written in the matrix form as ReLU (x i) = Λ i+1 x i + M i+1 e new where Λ i+1 and M i+1 are diagonal matrices with elements computed as above. Finally, new convex region C i+1 (x) = {a i+1 + A i+1 e | e ∈ [−1, 1] mi+1 } is defined as: where [] denotes concatenation of matrices. Here we describe how we apply random projection approach from to estimate the bounds during training. While operate in dual framework, their method to statistically estimate the bounds during training can also be applied in primal framework which we use in this paper. Recall that lower and upper bound for each neuron are computed as Thus, we need to compute ||A i || 1, which is L 1 norm of each row in the matrix A i. Using the method from, based on the from , we estimate ||A i || 1 with the method of random projections. Here A i is a matrix with d i rows and m i columns, where d i is dimensionality of the output vector in the i-th layer and m i is number of unit terms in the definition of region C i (x). The method of random projections samples standard Cauchy random matrix R of dimensions m i × k (k is number of projections) and then estimates ||A i || 1 ≈ median(|A i R|). To avoid computing the entire matrix A i we substitute: In the formula above, we set M 0 = A 0. Now, Dvijotham et al. (2018a) 83.4 62.4 To calculate A i R we split R = [R 0, R 2, ..., R i−1] and compute: Crucially, each summand can now be efficiently computed due to the associativity of matrix multiplication by performing the multiplication backwards. In this section we present additional on SVHN and MNIST datasets. SVHN We evaluated on SVHN dataset. For this experiment, we used convolutional network with 2 convolutional layers of kernel size 4 and stride 1 with 32 and 128 filters respectively. These convolutional layers are followed by a fully connected layer with 200 neurons. Each of the layers is followed by a ReLU activation function. For our training, we started with perturbation 10% higher than the one we are certifying and decreased it by 5% when progressing to the next layer. We trained each layer for 50 epochs and used L 1 regularization factor 0.0001. Results of this experiment are shown in Table 3. We certified first 1 000 images in SVHN test dataset. Our network has both, higher accuracy and higher certified robustness, than networks trained using other techniques for provable defense. MNIST In the next experiment, we evaluted on MNIST dataset. For this experiment, we used convolutional network with 2 convolutional layers with kernel sizes 5 and 4, and strides 2 followed by 1 fully connected layer. Each of the layers is followed by a ReLU activation function. For our training, we started with perturbation 10% higher than the one we are certifying and decreased it by 5% when progressing to the next layer. We trained each layer for 50 epochs and used L 1 regularization factor 0.00001. We certified first 1 000 images in MNIST test dataset. For perturbation 0.1, convolutional layers have filter sizes 32 and 64, and fully connected layer has 150 neurons. Results are presented in Table 4. Here, our numbers are comparable to those of state-of-the-art approaches. For perturbation 0.3, convolutional layers have filter sizes 32 and 128, and fully connected layer has 400 neurons. Results are presented in Table 4. Here, our certified robustness is somewhat lower than state-of-the-art. We believe this is due to the imprecise estimates of lower and upper bund via random projections. This is also reflected in relatively poor performance of who also rely on the same statistical estimates. Thus, for MNIST dataset and perturbation 0.3 it is likely necessary to use exact propagation instead of the estimates. However, this also induces large cost to the runtime. During training, we use two regularization mechanisms to make our convex relaxation tighter, both previosuly proposed in. First, we use L 1 -norm regularization which is known to induce sparsity in the weights of the network. has shown that weight sparsity helps induce more stable ReLU units which in turn makes our convex relaxation tighter (as for stable ReLU units it is already precise). 98.9 97.7 99.0 94. 4 98.9 96.3 Dvijotham et al. (2018a) 98.8 95. 6 98.7 95.8 99.0 95.6 Table 5: Evaluation on MNIST dataset with L ∞ perturbation 0.3 Method Accuracy (%) Certified robustness (%) Our work 97.6 84. 6 98.3 91.9 98.5 91.5 85.1 56.9 96.6 89.3 97.3 80.7 Second, in the i-th phase of training, we explicitly introduce a loss based on the volume of convex region C i+1. To make the relaxation tighter and minimize the volume, for each neuron j in layer i + 1 we add a loss of the form max(0, −l i+1,j) max(0, u i+1,j). This loss corresponds to the area under ReLU relaxation, see e.g. for a derivation.

represent the tldr for finding the corresponding scientific article

Example:
Provided: "We propose a new video understanding benchmark, with tasks that by-design require temporal reasoning to be solved, unlike most existing video datasets." Match: "Computer vision has undergone a dramatic revolution in performance, driven in large part through deep features trained on large-scale supervised datasets. However, much of these improvements have focused on static image analysis; video understanding has seen rather modest improvements. Even though new datasets and spatiotemporal models have been proposed, simple frame-by-frame classification methods often still remain competitive. We posit that current video datasets are plagued with implicit biases over scene and object structure that can dwarf variations in temporal structure. In this work, we build a video dataset with fully observable and controllable object and scene bias, and which truly requires spatiotemporal understanding in order to be solved. Our dataset, named CATER, is rendered synthetically using a library of standard 3D objects, and tests the ability to recognize compositions of object movements that require long-term reasoning. In addition to being a challenging dataset, CATER also provides a plethora of diagnostic tools to analyze modern spatiotemporal video architectures by being completely observable and controllable. Using CATER, we provide insights into some of the most recent state of the art deep video architectures. While deep features have revolutionized static image analysis, video descriptors have struggled to outperform classic hand-crafted descriptors . Though recent works have shown improvements by merging image and video models by inflating 2D models to 3D , simpler 2D models (b) still routinely appear among top performers in video benchmarks such as the Kinetics Challenge at CVPR'17. This raises the natural question: are videos trivially understandable by simply averaging the predictions over a sampled set of frames? At some level, the answer must be no. Reasoning about high-level cognitive concepts such as intentions, goals, and causal relations requires reasoning over long-term temporal structure and order . Consider, for example, the movie clip in Fig. 1 (a), where an actor leaves the table, grabs a firearm from another room, and returns. Even though no gun is visible in the final frames, an observer can easily infer that the actor is surreptitiously carrying the gun. Needless to say, any single frame from the video seems incapable of supporting that inference, and one needs to reason over space and time in order to reach that . As a simpler instance of the problem, consider the cup-and-balls magic routine 1, or the gamblingbased shell game 2, as shown in Fig. 1 (b). In these games, an operator puts a target object (ball) under one of multiple container objects (cups), and moves them about, possibly revealing the target at various times and recursively containing cups within other cups. The task at the end is to tell which of the cups is covering the ball. Even in its simplest instantiation, one can expect any human or computer system that solves this task to require the ability to model state of the world over long temporal horizons, reason about occlusion, understand the spatiotemporal implications of containment, etc. An important aspect of both our motivating examples is the adversarial nature of the task, where the operator in control is trying to make the observer fail. Needless to say, a frame by frame prediction model would be incapable of solving such tasks. Figure 1: Real world video understanding. Consider this iconic movie scene from The Godfather in (a), where the protagonist leaves the table, goes to the bathroom to extract a hidden firearm, and returns to the table presumably with the intentions of shooting a person. While the gun itself is visible in only a few frames of the whole clip, it is trivial for us to realize that the protagonist has it in the last frame. An even simpler instantiation of such a reasoning task could be the cup-and-ball shell game in (b), where the task is to determine which of the cups contain the ball at the end of the trick. Can we design similarly hard tasks for computers? Given these motivating examples, why don't spatiotemporal models dramatically outperform their static counterparts for video understanding? We posit that this is due to limitations of existing video benchmarks. Even though video datasets have evolved from the small regime with tens of labels (; ;) to large with hundreds of labels , tasks have remained highly correlated to the scene and object context. For example, it is trivial to recognize a swimming action given a swimming pool in the (b). This is further reinforced by the fact that state of the art pose-based action recognition models are outperformed by simpler frame-level models (b) on the Kinetics benchmark, with a difference of nearly 45% in accuracy! Sigurdsson et al. also found similar for their Charades benchmark, where adding ground truth object information gave the largest boosts to action recognition performance . In this work, we take an alternate approach to developing a video understanding dataset. Inspired by the recent CLEVR dataset (that explores spatial reasoning in tabletop scenes) and inspired by the adversarial parlor games above (that require temporal reasoning), we introduce CATER, a diagnostic dataset for Compositional Actions and TEmporal Reasoning in dynamic tabletop scenes. We define three tasks on the dataset, each with an increasingly higher level of complexity, but set up as classification problems in order to be comparable to existing benchmarks for easy transfer of existing models and approaches. Specifically, we consider primitive action recognition, compositional action recognition, and adversarial target tracking under occlusion and containment. However, note that this does not limit the usability of our dataset to these tasks, and we provide full metadata with the rendered videos that can be used for more complex, structured prediction tasks like detection, tracking, forecasting, and so on. Our dataset does not model an operator (or hand) moving the tabletop objects, though this could be simulated as well in future variants, as in . Being synthetic, CATER can easily be scaled up in size and complexity. It also allows for detailed model diagnostics by controlling various dataset generation parameters. We use CATER to benchmark state-of-the-art video understanding models ), and show even the best models struggle on our dataset. We also uncover some insights into the behavior of these models by changing parameters such as the temporal duration of an occlusion, the degree of camera motion, etc., which are difficult to both tune and label in real-world video data. Spatiotemporal networks: Video understanding for action recognition has evolved from iconic hand-designed models (; ;) to sophisticated spatiotemporal deep networks (; ; ; ; ; . While similar developments Dataset Size Len Task #cls TO STR LTR CSB UCF101 13K 7s cls 101 HMDB51 5K 4s cls 51 Kinetics 300K 10s cls 400 AVA 430 15m det 80 VLOGs 114K 10s cls 30 DAHLIA 51 39m det 7 TACoS in the image domain have lead to large improvements on tasks like classification (; a; and localization , video models have struggled to out-perform previous hand-crafted descriptors . Even within the set of deep video architectures, models capable of temporal modeling, such as RNNs and 3D convolutions (; a) have not shown significantly better performance than much simpler, per-frame prediction models, such as variants of two-stream architectures (b;). Though some recent works have shown improvements by merging image and video models by inflating 2D models to 3D , simple 2D models (b) were still among the top performers in the Kinetics Challenge at CVPR'17. Video action understanding datasets: There has been significant effort put forth to collecting video benchmarks. One line of attack employs human actors to perform scripted actions. This is typically done in controlled environments (; ;), but recent work has pursued online crowd sourcing . Another direction collects videos from movies and online sharing platforms. Many popular video benchmarks follow this route for diverse, in-the-wild videos, such as UCF-101 , HMDB-51 and more recently Kinetics and VLOGs . As discussed earlier, such datasets struggle with the strong bias of actions with scenes and objects. Our underlying thesis is that the field of video understanding is hampered by such biases because they favor image-based baselines. One might argue that since such biases are common in the visual world, video benchmarks should reflect them. We take the view that a diverse set of benchmarks are needed to enable comprehensive diagnostics and validation of the state-of-affairs in video understanding. Table 1 shows that CATER fills a missing gap in the benchmark landscape, most notably because of its size, label distribution, and relative resilience to object and scene bias. Synthetic data in computer vision: Our work, being synthetically generated, is also closely related to other works in using synthetic data for computer vision applications. There has been a large body of work in this direction, with the major focus on using synthetic training data for real world applications. This includes semantic scene understanding (; ;), 3D scene understanding (; ; ;, human understanding (b;), optical flow and navigation, RL or embodied learning;; ). Our work, on the other hand, attempts to develop a benchmark for video based action understanding. Similar attempts have been made for scene understanding through abstract scenes , with more recently focusing on building a complex reasoning benchmark, CLEVR . In the video domain, Long et al. proposed Flash-MNIST, with the task of recognizing all the digits that appear. We build upon CLEVR and extend it for spatiotemporal reasoning in videos, defining tasks that truly require spatiotemporal reasoning to be solved.: CATER dataset and tasks. Sampled frames from a random video from CATER. We show some of the actions afforded by objects in this video, as labeled on the top using arrows. We define three tasks on these videos. Task 1 requires identifying all active actions in the video. Task 2 requires identifying all active compositional actions. Task 3 requires quantized spatial localization of the snitch object at the end of the video. Note that, as in this case, the snitch may be occluded or'contained' by another object, and hence models would require spatiotemporal understanding to complete the task. Please refer to the supplementary video for more example videos. Object tracking: Detecting and tracking objects has typically been used as an initial representation for long-term video and activity understanding (; ;). Extensions include adversarial tracking, where the objects are designed to be hidden from plain view. It has typically been used for tasks such as determining if humans are carrying an object or abandoned / exchanging objects . We embrace this direction of work and include state-of-the-art deep trackers in our benchmark evaluation. CATER provides a video understanding dataset that requires long term temporal reasoning to be solved. Additionally, it provides diagnostic tools that can evaluate video models in specific scenarios, such as with or without camera motion, with varying number of objects and so on. This control over the dataset parameters is achieved by synthetically rendering the data. These videos come with a ground truth structure that can be used to design various different video understanding tasks, including but not limited to object localization and spatiotemporal action composition. Unlike existing video understanding benchmarks, this dataset is free of object or scene bias, as the same set of simple objects are used to render the videos. Fig. 2 describes the dataset and the associated tasks. We provide sample videos from the dataset in the supplementary video. The CATER universe is built upon CLEVR , inheriting most of the standard object shapes, sizes, colors and materials present in it. This includes three object shapes (cube, sphere, cylinder), in three sizes (small, medium, large), two materials (shiny metal and matte rubber) and eight colors, as well as a large "table" plane on which all objects are placed. In addition to these objects, we add two new object shapes: inverted cones and a special object called a'snitch'. Cones also come in the same set of sizes, materials and colors. The'snitch' is a special object shaped like three intertwined toruses in metallic gold color. Actions: We define four atomic actions:'rotate','pick-place','slide' and'contain'; a subset of which is afforded by each object. The'rotate' action means that the object rotates by 90°about its Y (or horizontal) axis, and is afforded by cubes, cylinders and the snitch. The'pick-place' action means the object is picked up into the air along the Y axis, moved to a new position, and placed down. This is afforded by all objects. The'slide' action means the object is moved to a new location by sliding along the bottom surface, and is also afforded by all objects. Finally,'contain' is a special operation, only afforded by the cones, in which a cone is pick-placed on top of another object, which may be a sphere, a snitch or even a smaller cone. This allows for recursive containment, as a cone can contain a smaller cone that contains another object. Once a cone'contains' an object, it is constrained to only'slide' actions and effectively slides all objects contained within the cone. This Figure 3: Allen's temporal algebra. Exhaustive list of temporal relations between intervals, as defined by Allen's algebra . For simplicity, we group them into three broad relations to define classes for composite actions, although in principle we could use all thirteen. Figure courtesy of (Alspaugh). holds until the top-most cone is pick-placed to another location, effectively ending the containment for that top-most cone. Animation process: We start with an initial setup similar to CLEVR. A random number (N) of objects with random parameters are spawned at random locations at the beginning of the video. They exist on a 6 × 6 portion of a 2D plane with the global origin in the center. In addition to the random objects, we ensure that every video has a snitch and a cone. For the purposes of this work, we render 300-frame 320x240px videos, at 24 FPS, making it comparable to standard benchmarks (; ;). We split the video into 30-frame slots, and each action is contained within these slots. At the beginning of each slot, we iterate through up to K objects in a random order and attempt to add an action afforded by that object one by one without colliding with another object. As we describe later, we use K = 2 for our initial tasks and K = N for the final task. For each action, we pick a random start and end time from within the 30-frame slot. To further add to the diagnostic ability of this dataset, we render an additional set of videos with camera motion, with all other aspects of the data similarly distributed as the static camera case. For this, the camera is always kept pointed towards the global origin, and moved randomly between a predefined set of 3D coordinates. These coordinates include X and Y ∈ {−10, 10} and Z ∈ {8, 10, 12}. Every 30 frames, we randomly pick a new location from the Cartesian product of X, Y, Z, and move the camera to that location over the next 30 frames. However, we do constrain the camera to not change both X and Y coordinates at the same time, as that causes a jarring viewpoint shift as the camera passes over the (0, 0, Z) point. Also, we ensure all the camera motion videos start from the same viewpoint, to make it easy to register the axes locations for localization task. Spatiotemporal compositions: We wish to label our animations with the atomic actions present, as well as their compositions. Atomic actions have a well-defined spatiotemporal footprint, and so we can define composites using spatial relations ("a cylinder is rotating behind a sliding red ball"), similar to CLEVR. Unique to CATER is the ability to designate temporal relationships ("a cylinder rotates before a ball is picked-and-placed"). Because atomic actions occupy a well-defined temporal extent, we need temporal logic that reasons about relations between intervals rather than instantaneous events. While the latter can be dealt with timestamps, the former can be described with Allen's interval algebra with thirteen basic relations (Figure 3) along with composition operations. For simplicity, we group those into three broad relations. However, our dataset contains examples of all such interval relations and can be used to explore fine-grained temporal relationships. Given this CATER universe with videos, ground truth objects and their actions at any time point, we can define arbitrarily complex tasks for a video understanding system. Our choice of tasks is informed by two of the main goals of video understanding: 1) Recognizing the states of the actor, including spatiotemporal compositions of those atomic actions. For example, a spatiotemporal composition of atomic human body movements can be described as an exercise or dance routine. And 2) Recognizing the effect of those actions on the state of the world. For example, an action involving picking and placing a cup would change the position of the cup and any constituent objects contained within it, and understanding this change in the world state would implicitly require understanding the action itself. Given these two goals, we define three tasks on CATER. Each has progressively higher complexity, and tests for a higher level reasoning ability. To be consistent with existing popular benchmarks (; ; ;), we stick to standard single or multi-label classification setup, with standard evaluation metrics, as described next. For each of these tasks, we start by rendering 5500 total videos, to be comparable in size with existing popular benchmarks . Since tasks 1 and 2 (defined next) explicitly require recognizing individual actions, we use K = 2 for the videos rendered to keep the number of actions happening in any given video small. For task 3, we set K = N as the task is to recognize the end effect of actions, and not necessarily the actions themselves. We split the data randomly in 70:30 ratio into a training and test set. We similarly render a same size dataset with camera motion, and define tasks and splits in the same way as for the static camera. Task 1: Atomic action recognition. This first task on CATER is primarily designed as a simple debugging task, which should be easy for contemporary models to solve. Given the combinations of object shapes and actions afforded by them, we define 14 classes such as'slide(cone)','rotate(cube)' and so on. Since each video can have multiple actions, we define it as a multi-label classification problem. The task is to produce 14 probability values, denoting the likelihood of that action happening in the video. The performance is evaluated using average precision per-class. Final dataset-level performance is computed by mean over all classes, to get mean average precision (mAP). This is a popular metric used in other multi-label action classification datasets . Task 2: Compositional action recognition. While recognizing individual objects and motions is important, it is clearly not enough. Real world actions tend to be composite in nature, and humans have no difficulty recognizing them in whole or in parts. To that end, we construct a compositional action recognition task through spatiotemporal composition of the basic actions used in Task 1. For simplicity, we limit composites to pairs of 14 atomic actions, where the temporal relation is grouped into broad categories of'before','during' and'after' as shown in Figure 3. Combining all possible atomic actions with the three possible relations, we get a total of 14 × 14 × 3 = 588 classes, and removing duplicates (such as 'X after Y' is a duplicate of 'Y before X'), leaves 301 classes. Similar to task 1, multiple compositions can be active in any given video, so we set it up as a multi-label classification problem, evaluated using mAP. If certain compositions never occur in the dataset, those are ignored for the final evaluation. Task 3: Snitch localization. The final, and the flagship task in CATER, tests models' ability to recognize the effect of actions on the environment. Just as in the case of cup-and-ball trick, the ability of a model to recognize location of objects after some activity can be thought of as an implicit evaluation of its ability to understand the activity itself. The task now is to predict the location of the special object introduced above, the Snitch. While it may seem trivial to localize it from the last frame, it may not always be possible to do that due to occlusions and recursive containments. The snitch can be contained by other objects (cones), which can further be contained by other larger cones. All objects move together until'uncontained', so the final location of the snitch would require long range reasoning about these interactions. For simplicity, we pose this as a classification problem by quantizing the 6 × 6 grid into 36 cells and asking which cell the snitch is in, at the end of the video. We ablate the grid size in experiments. Since the snitch can only be at a single location at the end of the video, we setup the problem as a single label classification, and evaluate it using standard percentage accuracy metrics such as top-1 and top-5 accuracy. However, one issue with this metric is that is would penalize predictions where the snitch is slightly over the cell boundaries. While the top-5 metric is somewhat robust to this issue, we also report mean L 1 distance of predicted grid cell from the ground truth, as a metric that is congnizant of the grid structure in this task. Hence, it would penalize confusion between adjacent cells less than those between distant cells. The data is also amenable to a purely regression-style evaluation, though we leave that to future work. We now experiment with CATER using recently introduced state of the art video understanding and temporal reasoning models . I3D , called R3D when implemented using a ResNet (a) in, brings the best of image models to video domain by inflating it into 3D for spatiotemporal feature learning. Non-local networks further build upon that to add a spatiotemporal interaction layer that gives strong improvements and out-performs many multi-stream architectures (that use audio, flow etc) on Kinetics and Charades benchmarks. For our main task, snitch localization, we also experiment with a 2D-conv based approach, Temporal Segment Networks (TSN) (b), which another top performing method on standard benchmarks . This approaches uses both RGB and flow modalities. All these architectures learn a model for individual frames or short clips, and at test time aggregate the predictions by averaging over those clips. While simple averaging works well enough on most recent datasets (; ;), it clearly loses all temporal information and may not be well suited to our set of tasks. Hence, we also experiment with a learned aggregation strategy: specifically using an LSTM for aggregation, which is the tool of choice for temporal modelling in various domains including language and audio. We use a common LSTM implementation for aggregating either (b) or ) that operates on the last layer features (before logits). We extract these features for subclips from train and test videos, and train a 2-layer LSTM with 512 hidden units in each layer on the train subclips. The LSTM produces an output at each clip it sees, and we enforce a classification loss at the end, once the model has seen all the clips. At test time we take the prediction from the last clip as the aggregated prediction. We report the LSTM performance averaged over three runs to control for random variation. It is worth noting that LSTMs have been previously used for action recognition in videos , however with only marginal success over simple average pooling. As we show later, LSTMs actually perform significantly better on CATER, indicating the importance of temporal reasoning. For task 3, we also experiment with a state-of-the-art visual tracking method . We start by using the GT information of the starting position of snitch, and project it to screen coordinates using the render camera parameters. We defined a fixed size box around it to initialize the tracker, and run it until the end of the video. At the last frame, we project the center point of the tracked box to the 3D plane (and eventually, the class label) by using a homography transformation between the image and the 3D plane. This provides a more traditional, symbolic reasoning baseline for our dataset, and as we show in , is also not enough to solve the task. Finally, we do note that many other video models have been proposed in literature involving 2.5D convolutions , VLAD-style aggregation and other multi-modal architectures (a;). We focus on the most popular and best performing models, and leave a more comprehensive study to future work. A random baseline is also provided for all tasks, computed as the average performance of random scores passed into the evaluation functions. Implementation details for all baselines are provided in the supplementary and code will be released. Task 1: Atomic action recognition: Table 2 (a) shows the performance of R3D with and without the non-local (NL) blocks, using different number of frames in the clips. We use a fixed sampling rate of 8, but experiment with different clip sizes. Adding more frames helps significantly in this case. Given the ease of the task, R3D obtains fairly strong performance for static camera, but not so much for moving camera, suggesting potential future work in building models agnostic to camera motion. Task 2: Compositional action recognition: Next we experiment with the compositional action recognition task. The training and testing is done in the same way as Task 1, except this predicts confidence over 301 classes. As evident from Table 2 (b), this task is harder for the existing models, presumably as recognizing objects and simple motions would no longer solve it, and models need to reason about spatiotemporal compositions as well. It is interesting to note that non-local blocks now add to the final performance, which was not the case for Task 1, suggesting modeling spatiotemporal relations is more useful for this task. LSTM aggregation also helps quite a bit as the model can learn to reason about long-range temporal compositions. As expected, moving camera makes the problem harder. Task 3: Snitch localization: Finally we turn to the localization task. Since this is setup as a single label classification, we use softmax cross entropy loss to train and classification accuracy for evaluation. For tracking, no training is required as we use the pre-trained model from and run it on the validation videos. Table 3: Long term reasoning. Comparing the best reported performance of standard models on existing datasets and CATER (task 3). Unlike previous benchmarks, temporal modeling using LSTM helps and local temporal cues (flow) are not effective by itself on CATER. 2S here refers to'Two Stream'. TSN performance from (; 2016). evaluated at different clip lengths and frame rates. For this task we also experiment with TSN (b), though it ends up performing significantly worse than R3D. Note that this contrasts with standard video datasets , where it tends to perform similar to R3D . We also experiment with the flow modality and observe it obtains even lower performance, which is expected as this task requires recognizing objects which is much harder from flow. Again, note that flow models obtain similar if not better performance as RGB on standard datasets . We also note higher performance on considering longer clips with higher sample rate. This is not surprising as a task like this would require long term temporal reasoning, which is aided by looking at longer videos. This is also reinforced by the observation that using LSTM for aggregation leads to a major improvement in performance for most models. Finally, the tracking approach also only solves about a third of the videos, as even the state of the art tracker ends up drifting due to occlusions and contain operations. In Table 4, we ablate the performance with respect to the underlying grid granularity, with 6 × 6 being the default used in Table 2 (c). We observe tracking is a stronger baseline as the localization task gets more fine-grained. Finally in Table 3 we compare performance of some of these models on existing benchmarks and CATER. Analysis: Having close control over the dataset generation process enables us to perform diagnostics impossible with any previous dataset. We use the R3D+NL, 32-frame, static camera model with average (or LSTM, when specified) pooling for all following visualizations. We first analyze aggregate performance of our model over multiple bins in Figure 4, and observe some interesting phenomena. (a) Performance drops if the snitch keeps moving until the end. This makes sense: if the snitch reaches its final position early in the video, models have a lot more frames to reinforce their hypothesis of its final location. Between LSTM and avg-pooling, LSTM is much better able to handle the motion of the snitch, as expected. Perhaps not surprisingly, the tracker is much less effected by snitch movement, indicating the power of such classic computational pipelines for longterm spatiotemporal understanding. (b) Drops if the snitch is contained in the end. Being contained in the final frame makes the snitch harder to spot and track (just like the cups and ball game!), hence the lower performance.: Diagnostic analysis of localization performance. We bin the test set using certain parameters. For each, we show the test set distribution with the bar graph, the performance over that bin using the line plot, and performance of that model on the full val set with the dotted line. We find that localization performance, (a) Drops significantly if the snitch is kept moving till the end. This is possibly because for cases when snitch only moves in the beginning and is static after, the models have a lot more evidence to predict the correct location from. Interestingly the tracker is much less affected by this, as it tracks the snitch until the very end; (b) Drops if the snitch is'contain'-ed by another object in the end, and the tracker is the worst affected by it; (c) Drops initially with increasing displacement of the snitch from its start position, but is stable after that; and (d) Is relatively stable with different number of objects in the scene. Next, we visualize the videos that our models gets right or wrong. We sort all validation videos based on the softmax confidence score for the ground truth class, and visualize the top and bottom six in Figure 5 (full video in supplementary). We find that the easiest videos for avg-pooled model tend to be ones with little snitch motion, i.e. the object stays at the position it starts off in. On the other hand, the LSTM-aggregated model fares better with snitch motion, as long as it happens early in the video. The hardest videos for both tend to be ones with sudden motion of the snitch towards the end of the video, as shown by the bright golden trail denoting the motion towards the end (better viewed in supplementary video). These observations are supported by the quantitative plots in Figure 4 (a) and (c). We use CATER to analyze several leading network designs on hard spatiotemporal tasks. We find most models struggle on our proposed dataset, especially on the snitch localization task which requires long term reasoning. Interestingly, average pooling clip predictions or short temporal cues (optical flow) perform rather poorly on CATER, unlike most previous benchmarks. Such temporal reasoning challenges are common in the real world (eg. Fig. 1 (a) ), and solving those would be the cornerstone of the next improvements in machine video understanding. We believe CATER would serve as an intermediary in building systems that will reason over space and time to understand actions. That said, CATER is, by no means, a complete solution to the video understanding problem. Like any other synthetic or simulated dataset, it should be considered in addition to real world benchmarks. While we have focused on classification tasks for simplicity, our fully-annotated dataset can be used for much richer parsing tasks such as spacetime action localization. One of our findings is that while high-level semantic tasks such as activity recognition may be addressable with current architectures given a richly labeled dataset, "mid-level" tasks such as tracking still pose tremendous challenges, particularly under long-term occlusions and containment. We believe addressing such challenges will enable broader temporal reasoning tasks that capture intentions, goals, and causal behavior. We analyze the top most confident a) correct and b) incorrect predictions on the test videos for localization task. For each video, we show the last frame, followed by a top-down view of the 6 × 6 grid. The grid is further overlayed with: 1) the ground truth positions of the snitch over time, shown as the golden trail, which fades in color over time =⇒ brighter yellow depicts later positions; and 2) the softmax prediction confidence scores for each location (black is low, white is high). The model has easiest time classifying the location when the snitch does not move much or moves early on in the video. Full video in supplementary. We use the provided implementation for ResNet-3D (R3D) and non-local (NL) block from, and temporal segment networks (TSN) from (b) for all our experiments. For, all the models are based on ResNet-50 base architecture, and trained with hyperparameters scaled down from Kinetics as per CATER size. For non-local (NL) experiments, we replace the conv3 and conv4 blocks in ResNet with the NL blocks. All models are trained with classification loss implemented using sigmoid cross-entropy for Task 1 and 2 (multi-label classification task), and softmax cross-entropy for task 3. At test time, we split the video into 10 temporal clips and 3 spatial clips. When aggregating using average pooling, we average the predictions from all 30-clips. For LSTM, we train and test on the 10 center clips. We experiment with varying the number of frames (#frames) and sampling rate (SR). For TSN (b), the model is based on BN-inception , with hyperparamters following their implementation on HMDB given its similar size and setup to our dataset. For optical flow we use the TVL1 (Sánchez Pérez et al., 2013) implementation. At test time we aggregate the predictions over 250 frames uniformly sampled from the video, either by averaging or using LSTM. While CATER videos look different from real world, we found the networks much easier to optimize with the ImageNet initialization for both approaches. This is consistent with prior work (b) that finds ImageNet initialization is useful even when training diverse modalities (such as optical flow). We will make the code, generated data and models available for more implementation details. Figure 6 shows the data distribution over classes for each of the tassk. The supplementary video 3 visualizes: 1. Sample videos from the dataset (with and without camera motion). 2. Easiest and hardest videos for task 3. We rank all validation videos for task 3 based on their softmax probability for the correct class. We show the top-6 (easiest) and bottom-6 (hardest) for 32-frame stride-8 non-local + LSTM model. We observe the hardest ones involve sudden motion towards the end of the video. This reinforces the observation made in Figure 5 (a) in the main paper, that videos where snitch keeps moving till the end are the hardest. If the snitch stops moving earlier, models have more evidence for the final location of the snitch, making the task easier. 3. Tracking . We visualize the of tracking the snitch over the video as one approach to solving task 3. We observe that while it works in the simple scenarios, it fails when there is a lot of occlusion or complex contain operations. 4. Model bottom-up attention. We visualize where does the model look for Task 3. As suggested in , we visualize the l 2 -norm of the last layer features from our 32-frame stride-8 non-local model on the center video crop. The deep red color denotes large norm value at that spatiotemporal location. We find that the model automatically learns to focus on the snitch towards the end of clips, which makes sense as that is the most important object for solving the localization task. 35 30 23 1 31 13 3 20 33 16 17 26 27 18 9 32 6 28 24 11 2 14 15 4 34 19 21 7 22 12 10 8 Histograms of training and validation data distribution for different tasks we define on the dataset. (a) requires the model to recognize atomic actions, such as'a sphere slides'. We defined 13 such classes. (b) requires recognizing spatiotemporal compositions of actions, such as'a sphere slides while a cube rotates'. Since there are a total of 588 combinations, we omit the labels here for ease of visualization. Finally (c) evaluates the snitch localization task, where the model needs to answer where the snitch is on the board, quantized into a 6 × 6 grid, at the end of the video. This is defined as a 36-way classification problem."

We propose a novel combination of adversarial training and provable defenses which produces a model with state-of-the-art accuracy and certified robustness on CIFAR-10.

represent this text to find a much much longer article about it with say hundreds-thousands of words

This paper identifies classes of problems for which adversarial examples are inescapable, and derives fundamental bounds on the susceptibility of any classifier to adversarial examples.