Question: Represent the scientific article to find a short TLDR

Question: In this paper, we study a new graph learning problem: learning to count subgraph isomorphisms. Although the learning based approach is inexact, we are able to generalize to count large patterns and data graphs in polynomial time compared to the exponential time of the original NP-complete problem. Different from other traditional graph learning problems such as node classification and link prediction, subgraph isomorphism counting requires more global inference to oversee the whole graph. To tackle this problem, we propose a dynamic intermedium attention memory network (DIAMNet) which augments different representation learning architectures and iteratively attends pattern and target data graphs to memorize different subgraph isomorphisms for the global counting. We develop both small graphs (<= 1,024 subgraph isomorphisms in each) and large graphs (<= 4,096 subgraph isomorphisms in each) sets to evaluate different models. Experimental show that learning based subgraph isomorphism counting can help reduce the time complexity with acceptable accuracy. Our DIAMNet can further improve existing representation learning models for this more global problem. Graphs are general data structures widely used in many applications, including social network analysis, molecular structure analysis, natural language processing and knowledge graph modeling, etc. Learning with graphs has recently drawn much attention as neural network approaches to representation learning have been proven to be effective for complex data structures (; ; b; ; ;). Most of existing graph representation learning algorithms focus on problems such as node classification, linking prediction, community detection, etc. (a). These applications are of more local decisions for which a learning algorithm can usually make inferences by inspecting the local structure of a graph. For example, for the node classification problem, after several levels of neighborhood aggregation, the node representation may be able to incorporate sufficient higher-order neighborhood information to discriminate different classes . In this paper, we study a more global learning problem: learning to count subgraph isomorphisms (counting examples are shown as Figure 1). Although subgraph isomorphism is the key to solve graph representation learning based applications , tasks of identifying or counting subgraph isomorphisms themselves are also significant and may support broad applications, such as bioinformatics , chemoinformatics , and online social network analysis . For example, in a social network, we can solve search queries like "groups of people who like X and visited Y-city/state." In a knowledge graph, we can answer questions like "how many languages are there in Africa speaking by people living near the banks of the Nile River?" Many pattern mining algorithms or graph database indexing based approaches have been proposed to tackle subgraph isomorphism problems (; ; ; ;). However, these approaches cannot be applied to large-scale graphs because of the exponential time complexity. Thanks to the powerful graph representation learning models which can effectively capture local structural information, we can use a learning algorithm to learn how to count subgraph isomorphisms from a lot of examples. Then the algorithm can scan a large graph and memorize all necessary local information based on a query pattern graph. In this case, although learning based approaches can be inexact, we can roughly estimate the range of the number of subgraph isomorphism. This can already help many applications that do not require exact match or need a more efficient pre- processing step. To this end, in addition to trying different representation learning architectures, we develop a dynamic intermedium attention memory network (DIAMNet) to iteratively attend the query pattern and the target data graph to memorize different local subgraph isomorphisms for global counting. To evaluate the learning effectiveness and efficiency, we develop a small (≤ 1,024 subgraph isomorphisms in each graph) and a large (≤ 4,096 subgraph isomorphisms in each graph) dataset and evaluate different neural network architectures. Our main contributions are as follows. • To our best knowledge, this is the first work to model the subgraph isomorphism counting problem as a learning problem, for which both the training and prediction time complexities are polynomial. • We exploit the representation power of different deep neural network architectures in an end-toend learning framework. In particular, we provide universal encoding methods for both sequence models and graph models, and upon them we introduce a dynamic intermedium attention memory network to address the more global inference problem for counting. • We conduct extensive experiments on developed datasets which demonstrate that our framework can achieve good on both relatively large graphs and large patterns compared to existing studies. Subgraph Isomophism Problems. Given a pattern graph and a data graph, the subgraph isomorphism search aims to find all occurrences of the pattern in the data graph with bijection mapping functions. Subgraph isomorphism is an NP-complete problem among different types of graph matching problems (monomorphism, isomorphism, and subgraph isomorphism). Most subgraph isomorphism algorithms are based on backtracking. They first obtain a series of candidate vertices and update a mapping table, then recursively revoke their own subgraph searching functions to match one vertex or one edge at a time. Ullmann's algorithm , VF2 , and GraphQL belong to this type of algorithms. However, it is still hard to perform search when either the pattern or the data graph grows since the search space grows exponentially as well. Some other algorithms are designed based on graph-index, such as gIndex , which can be used as filters to prune out many unnecessary graphs. However, graph-index based algorithms have a problem that the time and space in indexing also increase exponentially with the growth of the graphs . TurboISO and VF3 add some weak rules to find candidate subregions and then call the recursive match procedure on subregions. These weak rules can significantly reduce the searching space in most cases. Graph Representation Learning. Graph (or network) representation learning can be directly learning an embedding vector of each graph node (; ;). This approach is not easy to generalize to unseen nodes. On the other hand, graph neural networks (GNNs) provide a solution to representation learning for nodes which can be generalized to new graphs and unseen nodes. Many graph neural networks have been proposed since 2005 but rapidly developed in recent years. Most of them focus on generalizing the idea of convolutional neural networks for general graph data structures (; ; b;) or relational graph structures with multiple types of relations . More recently, propose a graph isomorphism network (GIN) and show its discriminative power. Others use the idea of recurrent neural networks (RNNs) which are originally proposed to deal with sequence data to work with graph data . Interestingly, with external memory, sequence models can work well on complicated tasks such as language modeling and shortest path finding on graphs . There is another branch of research called graph kernels (; ; ; ;) which also convert graph isomorphism to a similarity learning problem. However, they usually work on small graphs and do not focus on subgraph isomorphism identification or counting problems. We begin by introducing the subgraph isomophism problems and then provide the general idea of our work by analyzing the time complexities of the problems. Traditionally, the subgraph isomorphism problem is defined between two simple graphs or two directed simple graphs, which is an NP-complete problem. We generalize the problem to a counting problem over directed heterogeneous multigraphs, whose decision problem is still NP-complete. A graph or a pattern is defined as G = (V, E, X, Y) where V is the set of vertices. E ⊆ V × V is the set of edges, X is a label function that maps a vertex to a vertex label, and Y is a label function that maps an edge to a set of edge labels. We use an edge with a set of edge labels to represent multiedges with the same source and the same target for clarity. That is, there are no two edges in a graph such that they have the same source, same target, and the same edge label. To simplify the statement, we assume In this paper, we discuss isomorphic mappings that preserve graph topology, vertex labels and edge labels, but not vertex ids. More precisely, a pattern Furthermore, G P being isomorphic to a graph G G is denoted as G P G G and the function f is named as an isomorphism. The subgraph isomorphism counting problem is defined as to find the number of all different subgraph isomorphisms between a pattern graph G P and a graph G G. Examples are shown in Figure 1. Intuitively, we need to compute O(P erm(|V G |, |V P |) · d |V P | ) to solve the subgraph isomorphism counting problem by enumeration, where P erm(n, k) = n! (n−k)!, |V G | is the number of graph nodes, |V P | is the number of pattern nodes, d is the maximum degree. The first subgraph isomorphism algorithm, Ullmann's algorithm , reduces the seaching time to. If the pattern and the graph are both small, the time is acceptable because both of two factors are not horrendously large. However, since the computational cost grows exponentially, it is impossible to count as either the graph size or the pattern size increases. If we use neural networks to learn distributed representations for V G and V P or E G and E P, we can reduce the complexity to O(via source attention and self-attention. Assuming that we can further learn a much higher level abstraction without loss of representation power for G P, then the computational cost can be further reduced to However, the complexity of the latter framework is still not acceptable when querying over large graphs. If we do not consider self-attention, the computational cost will be O(|V G |) or O(|E G |), but missing the self-attention will hurt the performance. In this work, we hope to use attention mechanism and additional memory networks to further reduce the complexity compared with while keeping the performance acceptable on the counting problem. A graph (or a pattern) can be represented as a sequence of edges or a series of adjacent matrices and vertex features. For sequence inputs we can use CNNs , RNNs such as GRU , or Transformer-XL to extract high-level features. While if the inputs are modeled as series of adjacent matrices and vertex features, we can use RGCN to learn vertex representations with message passing from neighborhoods. After obtaining the pattern representation and the graph representation, we feed them into an interaction module to extract the correlated features from each side. Then we feed the output context of the interaction module into a fully-connected layer to make predictions. A general framework is shown in Figure 2 and the difference between sequence encoding and graph encoding is shown in Figure 3. In sequence models, the minimal element of a graph (or a pattern) is an edge. By definition, at least three attributes are required to identify an edge e, which are the source vertex id u, the target vertex id v, and its edge label y ∈ Y(e). We further add two attributes of vertices' labels to form a 5-tuple (u, v, X (u), y, X (v)) to represent an edge e, where X (u) is the source vertex label and X (v) is the target vertex label. A list of 5-tuple is referred as a code. We follow the order defined in gSpan to compare pairs of code lexicographically; the detailed definition is given in Appendix A. The minimum code is the code with the minimum lexicographic order with the same elements. Finally, each graph can be represented by the corresponding minimum code, and vice versa. Given that a graph is represented as a minimum code, or a list of 5-tuples, the next encoding step is to encode each 5-tuple into a vector. Assuming that we know the max values of |V|, |X |, |Y| in a dataset in advance, we can encode each vertex id v, vertex label x, and edge label y into Bnary digits, where B is the base and each digit d ∈ {0, 1, · · ·, B − 1}. It is easy to replace each digit with a one-hot vector so that each 5-tuple can be vectorized as a multi-hot vector which is the concatenation of one-hot vectors. The length of the multi-hot vector of a 5-tuple is Then we can easily calculate the graph dimension d g and the pattern dimension d p. Furthermore, the minimum code can be encoded into a multi-hot matrix, G ∈ R |E G |×dg for a graph G G or P ∈ R |E P |×dp for a pattern G P according to this encoding method. This encoding method can be extended when we have larger values of |V|, |X |, |Y|. A larger value, e.g., |V|, only increases the length of one-hot vectors corresponding to its field. Therefore, we can regard new digits as the same number of zeros in previous data. As long as we process previous one-hot vectors carefully to keep these new dimensions from modifying the original distributed representations, we can also extend these multi-hot vectors without affecting previous models. A simple but effective way is to initialize additional new weights related to new dimensions as zeros. Given the encoding method in Section 4.1.1, we can simply embed graphs as multi-hot matrices. Then we can use general strategies of sequence modeling to learn dependencies among edges in graphs. Convolutional Neural Networks (CNNs) have been proved to be effective in sequence modeling . In our experiments, we apply multiple layers of the convolution operation to obtain a sequence of high-level features. Recurrent Neural Networks (RNNs), such as GRU , are widely used in many sequence modeling tasks. Transformer-XL (TXL) is a variant of the Transformer architecture and enables learning long dependencies beyond a fixed length without disrupting temporal coherence. Unlike the original autoregressive settings, in our model the Transformer-XL encoder works as a feature extractor, in which the attention mechanism has a full, unmasked scope over the whole sequence. However, its computational cost grows quadratically with the size of inputs, so the tradeoff between performance and efficiency would be considered. In graph models, each vertex has a feature vector and edges are used to pass information from its source to its sink. GNNs do not need vertex ids and edge ids explicitly because the adjacency information is included in a adjacent matrix. As explained in Section 4.1.1, we can vectorize vertex labels into multi-hot vectors as vertex features. In a simple graph or a simple directed graph, the adjacent information can be stored in a sparse matrix to reduce the memory usage and improve the computation speed. As for heterogeneous graphs, behaviors of edges should depend on edge labels. RGCNs have relation-specific transformations so that each edge label and topological information are mixed into the message to the sink. We follow this method and use basis-decomposition for parameter sharing . Relational Graph Convolutional Networks (RGCNs) are developed specifically to handle multi-relational data in realistic knowledge bases. Each relation corresponds to a transformation matrix to transform relation-specific information from a neighbor to the center vertex. Two decomposition methods are proposed to address the rapid growth in the number of parameters with the number of relations: basis-decomposition and block-diagonal-decomposition. We use the first method, which is equivalent to the MLPs in GIN . The original RGCN uses the mean aggregator, but find that the sum-based GNNs can capture graph structures better. We implement both and named them as RGCN and RGCN-SUM respectively. Figure 4: Illustration of dynamic intermedium attention memory network (DIAMNet). Φ 1 represents Eqs. and, Φ 2 represents Eqs. and, and two types of gates are Eqs. and. After obtaining a graph representationǦ and a pattern representationP from a sequence model or a graph model where their column vectors are d-dimensional, we feed them as inputs of interaction layers to extract the correlated context between the pattern and the graph. A naive idea is to use attention modules to model interactions between these two representations and interactions over the graph itself. However, this method is not practical due to its complexity, To address the problem of high computational cost in the attention mechanism, we propose the Dynamic Intermedium Attention Memory Network (DIAMNet), using an external memory as an intermedium to attend both the pattern and the graph in order. To make sure that the memory has the knowledge of the pattern while attending the graph and vice-versa, this dynamic memory is designed as a gated recurrent network as shown in Figure 4. Assuming that the memory size is M and we have T recurrent steps, the time complexity is decreased into, which means the method can be easily applied to large-scale graphs. The external memory is divided into M blocks {m 1, ..., m M}, where m j ∈ R d. At each time step t, {m j} is updated by the pattern and the graph in order via multi-head attention mechanism . Specifically, the update equations of our DIAMNet are given by: Here M ultiHead is the attention method described in , σ represents the logistic sigmoid function, s j is the intermediate state of the j th block of memory that summarizes information from the pattern, and s for information from both the pattern and the graph. z j and z j are two gates designed to control the updates on the states in the j th block. U P, V P, U G, V G ∈ R d×d are trainable parameters. In this section, we report our major experimental . More can be found in the Appendix. In order to train and evaluate our neural models for the subgraph isomorphism counting problem, we need to generate enough graph-pattern data. As there's no special constraint on the pattern, the pattern generator may produce any connected multigraph without identical edges, i.e., parallel edges with identical label. In contrast, the ground truth number of subgraph isomorphisms must be tractable in our synthetic graph data. Therefore, our graph generator first generates multiple disconnected components, possibly with some subgraph isomorphisms. We use the idea of neighborhood equivalence class (NEC) in TurboISO to control the necessary conditions of a subgraph isomorphism in the graph generation process. The detailed algorithms are shown in Appendix B. Then the generator merges these components into a larger graph and ensures that there is no more subgraph isomorphism generated in the merge process. The subgraph isomorphism search can be done during these components subgraphs in parallel. Using the pattern generator and the graph generator above, we can generate many patterns and graphs for neural models. We are interested in follow research questions: whether sequence models and graph convolutional networks can perform well given limited data, whether their running time is acceptable, and whether memory can help models make better predictions even faced with a NPcomplete problem. To evaluate different neural architectures and different prediction networks, we generate two datasets in different graph scales and the statistics are reported in Table 1. There are 187 unique patterns in whole pairs, where 75 patterns belong to the small dataset, 122 patterns belong to the large dataset. Target data graphs are not required similar so they are generated randomly. The generation details are reported in Appendix C. Instead of directly feeding multi-hot encoding vectors into representation modules, we use two simple linear layers separately to transform graph multi-hot vectors and pattern multi-hot vectors to lower-dimensional, distributed ones. To improve the efficiency, we also add a filtering layer to filter out irrelevant parts before all representation modules. The details of this filter layer is shown in Section D.1. In our experiments, we implemented five different representation models: CNN is a 3-layer convolutional layers followed by max-pooling layers. The convolutional kernels are 2,3,4 respectively and strides are 1. The pooling kernels are 2,3,4 and strides are 1. RNN is a simple 3-layer GRU model. TXL is a 6-layer Transformer encoder with additional memory. RGCN is a 3-layer RGCN with the basis decomposition. We follow the same setting in that ordinal paper to use meanpooling in the message propagation part. RGCN-SUM is a modification of RGCN to replace the mean-pooling with sum-pooling. After getting a graph representationǦ and a pattern representationP from the representation learning modules, we feed them into the following different types of interaction layers for comparison. SumPool: A simple sum-pooling is applied forǦ andP to obtainǧ andp, and the model sends Concate(ǧ,p,ǧ −p,ǧ p) with the graph size and the pattern size information into the next fully connected (FC) layers. MeanPool: Similar settings as SumPool, but to replace the pooling method with mean-pooling. MaxPool: Similar settings as SumPool, but to replace the pooling method with max-pooling. AttnPool: We want to use attention modules without much computational cost so the self-attention is not acceptable. We simplify the attention by first applying a pooling mechanism for the pattern graph and then use the pooled vector to perform attention over the data graph rather than simply perform pooling over it. Other settings are similar with pooling methods. The detailed information is provided in Appendix D.2. We only report of mean-pooling based attention, because it is the best of the three variants. We compare the performance and efficiency of our DIAMNet proposed in Section 4.3 with above interaction networks. The initialization strategy we used is shown in Appendix D.3. And we feed the whole memory with size information into the next FC layers. For fair comparison, we set embedding dimensions, dimensions of all representation models, and the numbers of filters all 64. The segment size and memory size in TXL are also 64 due to the computation complexity. The length of memory is fixed to 4 and the number of recurrent steps is fixed to 3 in the DIAMNet for both small and large datasets. We use the mean squared error (MSE) to train models and evaluate the validation set to choose best models. The optimizer is Adam with learning rate 0.001. L2 penalty is added and the coefficient is set as 0.001. To avoid gradient explosion and overfitting, we add gradient clipping and dropout with a dropout rate 0.2. We use Leaky ReLU as activation functions in all modules. Due to the limited number of patterns, the representation module for patterns are easy to overfit. Therefore, we use the same module with shared parameters to produce representation for both the pattern and the graph. We also find that using curriculum learning can help models to converge better. Hence, all models in Table 3 are fine-tuned based on the best models in small in the same settings. Training and evaluating were finished on one single NVIDIA GTX 1080 Ti GPU under the PyTorch framework. As we model this subgraph isomorphism counting problem as a regression problem, we use common metrics in regression tasks, including the root mean square error (RMSE) and the mean absolute error (MAE). In this task, negative predictions are meaningless, so we only evaluate ReLU (Y i) as final prediction . Considering that about 75% of countings are 0's in our dataset, we also use evaluation metrics for the binary classification to analyze behaviors of different models. We report F1 scores for both zero data (F1 zero) and nonzero data (F1 nonzero). Two trivial baselines, Zero that always predicts 0 and Avg that always predicts the average counting of training data, are also used in comparison. We first report for small dataset in Table 2 and for large dataset in Table 3. In addition to the trivial all-zero and average baselines and other neural network learning based baselines, we are also curious about to what extent our neural models can be faster than traditional searching algorithms. Therefore, we also compare the running time. Considering the graph generation strategy we used, we decide to compare with VF2 algorithm to avoid unnecessary interference from the similar searching strategy. From the experiments, we can draw following observations and . Comparison of different representation architectures. As shown in Table 2, in general, graph models outperform most of the sequence models but cost more time to do inference. CNN is the worst model for the graph isomorphism counting problem. The most possible reason is that the sequence encoding method is not suitable for CNN. The code order does not consider the connectivity of adjacent vertices and relevant label information. Hence, convolutional operations and pooling operations cannot extract useful local information but may introduce much noise. From of the large dataset, we can see that F1 nonzero =0.180 is even worse than others. In fact, we find that CNN always predicts 0 for large graphs. RNN and TXL are widely used in modeling sequences in many applications. The two models with simple pooling can perform well. We note that RNN with sum-pooling is better than TXL with memory. RNN itself holds a memory but TXL also has much longer memory. However, the memory in RNN can somehow memorize all information that Under review as a conference paper at ICLR 2020 has been seen previously but the memory of TXL is the representation of the previous segment. In our experiments, the segment size is 64 so that TXL can not learn the global information at a time. A part of the structure information misleads TXL, which is consistent with CNN. A longer segment set for TXL may lead to better , but it will require much more GPU memory and much longer time for training. RGCN-SUM is much better than RGCN and other sequence models, which shows that sum aggregator is good at modeling vertex representation in this task. The mean aggregator can model the distribution of neighbor but the distribution can also misguide models. Effectiveness of the memory. Table 2 shows the effectiveness of our dynamic attention memory network as the prediction layer. It outperforms the other three pooling methods as well as the simple attention mechanism for all representation architectures. Sum, Mean, and Attention pooling are all Figure 5: Model behaviors of three models in small dataset. The x-axis is the example id and the y-axis is the count value. We mark the ground truth value as orange + and the predictions as blue ×. We use two green dashed lines to separate patterns into three blocks based on numbers of vertices (3,4, and 8). In each block, the examples are sorted based on the data graphs' sizes. comparable with each other, because they all gather the global information of the pattern and graph representations. Prediction layer based on max pooling, however, performs the worst, and even worse when the representation layer is CNN or Transformer-XL. This observation indicates that every context of the pattern representation should be counted and we need a better way to compute the weights between each context. The dynamic attention memory with global information of both the pattern and the graph achieves the best in most of the cases. One of the most interesting observations is that it can even help extract the context of pattern and graph while the representation layer (such as CNN) does not perform very well, which proves the power of our proposed method of DIAMNet. Performance on larger graphs. Table 3 shows our models can be applied to larger-scale graphs. For the large dataset, we only choose the best pooling method for each of the baselines to report. We can find most of the are consistent to the small dataset, which means RGCN is the best representation method in our task and the dynamic memory is effective. In terms of the running time, all learning based models are much faster than the traditional VF2 algorithm for subgraph isomorphism counting. Model behaviors. As shown in Figure 5, we compare the model behaviors of the best model (RGCN+SUM) and the worst model (CNN), as well as the great improvement of CNN when memory is added. We can find that CNN+SumPool tends to predict the count value below 400 and has the same behavior between three patterns. This may come from the fact that CNN can only extract local information of a sequence and Sum pooling is not a good way to aggregate it. However, the memory can memorize local information to each memory cell so it can improve the representation power of CNN and can gain a better performance. RGCN, on the other hand, can better represent the graph structure, so it achieves a better , especially on the largest pattern (the third block of each figure) compared with CNN. More can be found in Appendix F. In this paper, we study the challenging subgraph isomorphism counting problem. With the help of deep graph representation learning, we are able to convert the NP-complete problem to a learning based problem. Then we can use the learned model to predict the subgraph isomorphism counts in polynomial time. Counting problem is more related to a global inference rather than only learning node or edge representations. Therefore, we have developed a dynamic intermedium attention memory network to memorize local information and summarize for the global output. We build two datasets to evaluate different representation learning models and global inference models. Results show that learning based method is a promising direction for subgraph isomorphism detection and counting and memory networks indeed help the global inference. We also performed detailed analysis of model behaviors for different pattern and graph sizes and labels. Results show that there is much space to improve when the vertex label size is large. Moreover, we have seen the potential real-world applications of subgraph isomorphism counting problems such as question answering and information retrieval. It would be very interesting to see the domain adaptation power of our developed pretrained models on more real-world applications. The lexicographic order is a linear order defined as follows: If A = (a 0, a 1, · · ·, a m) and B = (b 0, b 1, · · ·, b n) are the codes, then A ≤ B iff either of the following is true: 2. ∀0 ≤ k ≤ m, a k = b k, and n ≥ m. In our setting, ) iff one of the following is true: B PATTERN GENERATOR AND GRAPH GENERATOR As proposed in Section 5.1, two generators are required to generate datasets. The algorithm about the pattern generator is shown in Algorithm 1. The algorithm first uniformly generates a directed tree. Then it adds the remaining edges with random labels. Vertex labels and edge labels are also uniformly generated but each label is required to appear at least once. Algorithm 2 shows the process of graph generation. Two hyperparameters control the density of subisomorphisms: α ∈ decides the probability of adding subisomorphisms rather than random edges; β ∈ N + is the parameter of Dirichlet distribution to sample sizes of components. After generating several directed trees and satisfying the vertex number requirement, the algorithm starts to add remaining edges. It can add edges in one component and try to add subgraph isomorphisms, or it can randomly add edges between two components or in one component. The following merge subroutine aims to merge these components into a large graph. Shuffling is also required to make datasets hard to be hacked. The search of subisomorphisms in the whole graph is equivalent to the search in components respectively because edges between any two components do not satisfy the necessary conditions. Algorithm 1 Pattern Generator. Input: the number of vertices N v, the number of edges N e, the number of vertex labels L v, the number of edge labels L e. 1: P:= GenerateDirectedTree(N v) 2: AssignNodesLabels(P, L v) 3: AddRandomEdges(P, P, null, N e − N v + 1) 4: AssignEdgesLabels(P, L e) Output: the generated pattern P In Algorithm 1 and Algorithm 2, the function AddRandomEdges adds required edges from one component to the other without generating new subgraph isomorphisms. The two component can also be the same one, which means to add in one component. The NEC tree is utilized in TurboISO to explore the candidate region for further matching. It takes O(|V p | 2) time but can significant reduce the searching space in the data graph. It records the equivalence classes and necessary conditions of the pattern. We make sure edges between two components dissatisfy necessary conditions in the NEC tree when adding random edges between them. This data structure and this idea help us to generate more data and search subisomorphisms compared with random generation and traditional subgraph isomorphism searching. We can generate as many examples as possible using two graph generators. However, we limit the numbers of training, dev, and test examples whether learning based models can generalize to Intuitively, not all vertices and edges in graphs can match certain subisomorphisms so we simply add a FilterNet to adjust graph encoding as follows: where G is the graph representation in the pattern space, σ is the sigmoid function, f i is the gate that decides to filter the j th vertex or the j th edge, W G ∈ R dp×dg and W F ∈ R 1×dp are trainable. Thanks to the multi-hot encoding, We can simply use Eq. to accumulate label information of patterns. After this filter layer, only relevant parts of the graphs will be passed to the next representation layer. The computation process of the AttnPool (Mean) is: Combing with the pooling strategy to makeP as P ∈ R 1×d, the time complexity is decreased to We also implement three variants with sum-pooling, mean-pooling, and max-pooling respectively. Results of AttnPool (Sum) and AttnPool (Max) are shown in the Appendix E. There are many ways to initialize the memory {m where s is the stride and k is the kernel size. In Table 5, we compared two additional pooling methods with MeanPool in Eq.. Table 5 shows of different representation models with different interaction networks in the small dataset. AttnPool (Mean) and DIAMNet (MeanInit) usually perform better compared with other pooling methods. As shown in Figure 7, different interaction modules perform differently in different views. We can find MaxPool always predicts higher counting values when the pattern is small and the graph is large, while AttnPool always predicts very small numbers except when the pattern vertex size is 8, and the graph vertex size is 64. The same appears when we use edge sizes as the x-axis. This observation shows that AttnPool has difficulties predicting counting values when either of the pattern and the graph is small. It shows that attention focuses more on the zero vector we added rather than the pattern pooling . Our DIAMNet, however, performs the best in all pattern/graph sizes. When the bins are ordered by vertex label sizes or edge label sizes, the performance of all the three interaction modules among the distribution are similar. When bins are ordered by vertex label sizes, we have the same discovery that AttnPool prefers to predict zeros when then patterns are small. MaxPool fails when facing complex patterns with more vertex labels. DIAMNet also performs not so good over these patterns. As for edge labels, look good for MaxPool and DIAMNet but AttnPool is not satisfactory. As shown in Figure 8, different representation modules perform differently in different views. CNN performs badly when the graph size is large (shown in Figure 8a and 8d) and patterns become complicated (show in Figure 8g and 8j), which further indicates that CNN can only extract the local information and suffers from issues when global information is need in larger graphs. RNN, on the other hand, performs worse when the graph are large, especially when patterns are small (show in Figure 8e), which is consistent with its nature, intuitively. On the contrary, RGCN-SUM with DIAMNet is not affected by the edge sizes because it directly learns vertex representations rather than edge representations.

In this paper, we study a new graph learning problem: learning to count subgraph isomorphisms.

Represent the short summary for finding the corresponding scientific article (long)


Question: Represent the article for finding a single-sentence TLDR

Question: Domain adaptation is an open problem in deep reinforcement learning (RL). Often, agents are asked to perform in environments where data is difficult to obtain. In such settings, agents are trained in similar environments, such as simulators, and are then transferred to the original environment. The gap between visual observations of the source and target environments often causes the agent to fail in the target environment. We present a new RL agent, SADALA (Soft Attention DisentAngled representation Learning Agent). SADALA first learns a compressed state representation. It then jointly learns to ignore distracting features and solve the task presented. SADALA's separation of important and unimportant visual features leads to robust domain transfer. SADALA outperforms both prior disentangled-representation based RL and domain randomization approaches across RL environments (Visual Cartpole and DeepMind Lab). RL agents learn to maximize rewards within a task by taking actions based on observations. The advent of deep learning has enabled RL agents to learn in high dimensional feature spaces and complex action spaces . Deep RL methods have beat human performance in a variety of tasks, such as Go . However, deep RL has two crippling drawbacks: high sample complexity and specificity to training task. There are many domains where data collection is expensive and time consuming, such as healthcare, autonomous vehicles, and robotics . Thus, agents are often trained in simulation and must transfer the ing knowledge to reality. While this solves the issue of sample complexity, reality and simulated domains are sufficiently different that it is infeasible to naively train a deep RL agent in a simulation and transfer. This is known as the reality gap . Jumping the reality gap is difficult for two orthogonal reasons. The first is that dynamics of a simulation are an approximation to the dynamics of the real world. Prior work has shown success in transfer between domains with different dynamics (; ;). In this paper, we address the second difficulty: the difference in visual observations of states. Due to limitations in current photorealistic rendering, simulation and the real world are effectively two different visual domains . We present a method of robust transfer between visual RL domains, using attention and a β variational autoencoder to automatically learn a state representation sufficient to solve both source and target domains. By learning disetangled and relevant state representation, our approach does not require target domain samples when training. The state representation enables the RL agent to attend to only the relevant state information and ignore all other, potentially distracting information. Domain randomization is currently the most popular transfer method between different visual domains in RL (; ;). By training on many source domains, an RL agent implicitly learns to ignore factors of variation present. Sample complexity scales with the number of source domains and randomized factors. Modes of variation are maually selected. When faced with different variation, domain randomization will fail. Furthermore, there is evidence that domain randomization can destablize the training of some RL algorithms, such as A3C and DDPG . Though domain randomization has shown success in transfer, it has three downsides: high sample complexity, manual selection of irrelevant features, and ustable training . Some visual domain adaptation work is based on image to image translation (; ;). These methods learn a mapping from source domain inputs to target domain inputs, utilizing adversarial methods, such as Generative adversarial Networks trained on data from both the source and target domain. During inference, the target domain input is translated to the source domain before being processed. While these methods have shown promising , they have two downsides. First, translation incurs additional overhead at inference time. This overhead is especially large since the inputs are high-dimensional images. Second, these methods require samples from the target domain. In applications such as robotics, sampling the target domain is expensive and difficult to obtain. Further, the target domain may not be known at training time. Some recent work focuses on modifying the inputs from the source domain so that they are similar to the target domain, effectively matching their distributions . This approach uses a GAN to refine images from a (simulated) source domain to match images from the target domain: the real world. While this directly addresses domain shift and does not add any additional overhead at inference time in the target domain, it still assumes that samples from the target domain are present during training. It enables transfer between two differing visual domains, but it does not enable adaptation to previously unseen domains. There is a body of work that takes this idea further. Rather than translating from the target domain to the source domain, it learns to map all domains to a canonical domain in which the RL agent operates . By learning to translate from randomized domains to a canonical domain, effectively training a translation network using domain randomization. While this approach has shown simulation to reality transfer, it icurrs overhead through the use of the mapping network; Rather than learning to map to a canoical domain, it would be more efficient to map to a disentagled representation of the canoical environment. Other work learns to map image inputs to a latent space for use in RL. Specifically, it utilizes a β Variational Autoencoder (β-VAE) to learn a compressed, disentagled state representation . While this work focuses on domain adaptation in the RL setting, it utilizes a generalpurpose generative model. Thus, the state representation is not tailored to the task posed; it preserves information needed to reconstruct the image that may not be needed to solve the RL task given. Additionally, unlike image translation, this method does not attempt to match the distribution of inputs from source and target domains. Since the β-VAE is trained to reconstruct input states, the distributions of compressed and input states will match. Accordingly, the distribution shift between source and target domains will be preserved, even when using compressed states. To circumvent this issue, the RL agent is trained on multiple source domains, as in domain randomization. We formalize the concept of transfer between related MDPs. We denote the source domain as D S and the target domain as D T. Both domains are MDPs, defined as D = (S, A, T, R), where S are states, A are actions, T is the transition function, and R is the reward function. We assume that both D S and D T share a discount factor γ. In general transfer, states and actions may be quite different, while transition and reward functions are similar. We denote a family of related MDPs as M. Within M, transitions, rewards, and actions are the same across MDPs, and states are different. These states are generated from a set of latent state factors S z, each passed through a different MDPspecific renderer G U for some MDP U ∈ M. In the case of visual cartpole, S z contains the position and velocity of the cart, the angle and position of the pole, and the colors of the cart, pole, axle, and track. The observed states are then rendered by the renderer. Specifically,, where G U and G V are any two MDPs within M. In this paper, we target transfers where. Namely, when target dynamics are similar to source dynamics, rewards, actions, and true states are identical, but observed states S S and S T differ due to differing renderers G S and G T. Deep RL agents learn a mapping from states s ∈ S to actions a ∈ A, either by directly maximizing reward or through a Q function, using a deep neural network. The deep network implicitly learns a mapping function F: S U →Ŝ z, for some MDP U ∈ M and a policy function π:Ŝ z → A that maps from latent state factors to actions. These functions are learned as a of the feed-forward nature of deep neural networks. The policy π is a function of the last layer of the network. The output of the last layer of the neural network is a highly processed feature representation of the input that is optimized for use in generating π. While this implicit mapping is sufficient for a deep RL agent to solve a single MDP from M, it is not general enough to transfer to other MDPs within M. By optimizing for π F overfits to the specific S U from the source domain U. To circumvent this overfitting, DARLA proposed learning a feature extractor F that maps from any observed state S X to the latent state factors S z . The RL agent is the trained on the (approximate) extracted latent state factorsŜ z, separating the "vision" and "action" of the RL agent. DARLA uses a β variational autoencoder to learn the mapping F . The extracted latent state factorsŜ z are (mostly) disentangled in practice, leading to better transfer than a baseline RL agent. The factors each correlate with an independent factor in the true state S z of the task. However, it preserves all latent state variables z ∈ S z, incorrectly assuming that they are all relevant to solving the MDP. When attempting to locate an object such as an enemy in a video game, an object for a robot, or a road for an autonomous vehicle, the position and orientation of the object are the most important factors. Visual distractions such as the color of the enemy, opacity of the object, or texture of the road are entirely irrelevant to its localization. Dependence on these distracting factors causes the RL agent to fail to robustly transfer to target visual domains. SADALA is similar to DARLA, but has one key difference-it explicitly learns to ignore irrelevant extracted latent state variables. SADALA learns the same mapping function F: S U →Ŝ z as DARLA, also utilizing a β variational autoencoder. It then learns a policy π:Ŝ z → A, but utilizes a soft attention mechanism to ignore irrelevant features. Using this mechanism, it implicitly learns two functions: A:Ŝ z → S a that maps from extracted latent state factors to latent state factors relevant to solving the MDP, and π A: S a → A that maps from relevant latent state factors to actions. Soft attention mechanisms learn an importance weight w i ∈ for each feature z i in part of a neural network. These weights are then multiplied element-wise with the corresponding feature. Thus, the attention layer can be defined as follows: where W is the vector of importance weights w i and is element-wise multiplication. W is defined as W = σ(h(Z)) where h is a differentiable function parameterized by dense layers of a neural network. Thus, the values w i ∈ W are constrained between 0 and 1, inclusive. This allows the RL agent to ignore a feature z i by setting w i to 0. It also allows the agent to down-weight the importance of a feature by setting w i to a fractional value or pay full attention by setting w i to 1. The SADALA framework is shown in Figure 1. At inference time, an input state s ∈ S is fed into a β variational autoencoder. The bottleneck representation of the β-VAE is then used as extracted latent state factorsŜ z. Those features are then fed into the attention mechanism, which outputs the weighted features S a, according to the formula f above. Finally, the weighted features are used as the inputs to the deep reinforcement learning algorithm. Though the feature selection and policy learning stages are represented separately in figure 1, they are contained within the same neural network and optimized jointly. Training SADALA requires a few steps. First, the β variational autoencoder, shown in figure 2 must be trained. To do so, we use the loss term of a variational autoencoder, modified to fit the β-VAE . The standard VAE loss is where β is a weighting term that pressures the encoder q to output a latent space similar to an isotropic unit gaussian. Increasing the value of β encourages disentanglement of the latent space while sacrificing minor reconstruction details. We sample states from the environment, following a random policy. We then train the β-VAE to reconstruct these images and freeze the network weights. As shown by DARLA, freezing the network weights of the β-VAE is necessary . If the weights are allowed to train jointly with the policy network on the source domain, they will optimize for and overfit to the source domain. When using one source domain, this will cause SADALA to be equivalent to a single-task learner. When using multiple source domains, SADALA would be equivalent to a domain randomization agent. The feature selection and policy learning stages are then jointly optimized. The SADALA framework can utilize any deep RL algorithm (A3C, REINFORCE, DQN, etc), with minor modification. Specifically, we add a loss term to the loss function L RL of the original algorithm. Our new loss is where W is the learned attention weights. This added term is an L1 regularization on the attention weights, which encourages sparsity in feature selection . We additionally test one other modification to the loss term. We make the assumption that the ordering of the extracted latent state variablesŜ z does not change between subsequent frames within an episode. This, the weight w i for some latent state factor z i should not change based on the frame. To enforce this loss on the feature selection stage, we use the following loss where W j is vector of weights corresponding to the jth extracted latent state factor vector across the set of training data and Var is the variance. This loss is added to enforce w i corresponding to the feature z i to be the same regardless of input. This is similar to learning a pseudo-attention weight vector, rather than an attention weight vector. See the appendix for additional training details. We test the SADALA framework on two transfer learning tasks, using A3C as the deep RL algorithm. The first task is Visual Cartpole. This domain is the same as Cartpole-v1 in OpenAI Gym with two key differences . The observed state is now the pixel rendering of the cartpole as well as the velocities of the cart and pole. Thus, the agent must learn to predict the position of the cart and pole from the rendering. Additionally, we modify this domain to include a transfer task. The agent must learn to transfer its knowledge of the game across different color configurations for the cart, pole, and track. Thus, Visual Cartpole is defined as a family of MDPs M where the true state S z is the positions and velocities of the cart and pole and the observed state S U = G U (S z) for an MDP U ∈ M is the pixel observations and velocity values. Optimally, the agent should learn to ignore the factors in extracted latent state factorsŜ z that correspond to color, as they do not aid the agent in balancing the pole. This task tests the agent's ability to ignore irrelevant latent state factors. The second task is the "Collect Good Objects" task from Deepmind Lab . The agent must learn to navigate in first person and pick up "good" objects while avoiding "bad" objects. This task is defined as a family of MDPs M where the true state S z contains the position of the agent, the position of good and bad objects, the type of good and bad objects, and the color of the walls and floor. In a single MDP U ∈ M, all good objects are hats or all good objects are balloons. Similarly, all bad objects are either cans or cakes. The walls and floor can either take a green and orange colorscheme or a red and blue colorscheme. The agent is trained on hats/cans with the green/orange colorscheme and balloons/cakes with both colorschemes. It is then tested on hats/cans with the red/blue colorscheme. Optimally, the agent should learn to ignore the color of the floor and walls. Additionally, it should use the type of object to determine if it is good or bad. This task tests the agent's ability to ignore distracting latent state factors (the color of the walls and floor) while attending to relevant factors (the positions and types of objects and its own position). To test the of the SADALA algorithm, we first test the reconstruction and disentanglement properties of the β-VAE used in the state representation stage. Note that this stage is identical to that of DARLA . As such, we expect the disentanglement properties to be similar. See figure 3 for reconstructions of the cartpole state. Based on the reconstructions, it is apparent that the β-VAE has learned to represent cart position and pole angle. Though the angle of the poles is slightly incorrect in the first set of images, the pole is tilted in the correct direction, yielding sufficiently correct extracted latent state factors. Additionally, the color of the cart, pole, and is incorrect in the third pair of images. While this demonstrates that the identification and reconstructions of colors is not infallible, the position of the cart and pole remains correct, yielding a set of extracted latent state parameters that is sufficient to solve the MDP. See figure 5 for a visualization of reconstruction with attention. In the original image, the pole is standing straight and the cart is centered. In the reconstruction, the cart is centered, and the pole is almost upright. However, the reconstruction does not include the colors of the cart or pole. Instead it fills the cart and pole with the mean color of the dataset. This shows that the attention weights are properly learning to ignore color and instead pay attention to the position of the cart and pole. Figures 6 and 7 gives a comparison of the performance of the algorithms across environments. Note that all of the algorithms are sufficient at solving the source task, with the single-task learner performing slightly better. This is due to the fact that the single-task learner can optimize its con- The single-task learner achieves better rewards on all source tasks than any of the transfer-specific agents. Domain randomization performs less well because of the complexity of the domain randomization task. Rather than optimizing reward for a single domain, the agent must optimize reward across a large set of domains. DARLA, SADALA, and SADALA with reduced variance also perform less well on the source task than the baseline agent. This is due to imperfections in the β-VAE. Though the β-VAE attempts to reconstruct the input image, it does not do so perfectly, as shown in figure 3. This shows that its extraction of latent state features is not perfect, leading to potentially confusing states given to the RL agent. Additionally, while the β-VAE's goal is to learn a disentangled representation, it does not do so perfectly. As such, (partially) entangled latent state factors may further confuse the RL agent. The single-task learner fails to transfer its policy to the target domain. DARLA transfers some of its knowledge to the target domain. Domain randomization also transfers some knowledge. Finally, SADALA transfers more of its knowledge. The single-task agent has no incentive to learn a factored state representation that enables transfer. Its convolutional filters will directly optimize to maximize reward in the source policy. Thus, if the filters are searching for a hat on a blue floor but tested on a hat on a red floor the convolutional filters will fail to transfer. DARLA learns a state representation that is mostly disentangled. This allows the RL agent to learn to ignore unimportant features such as cart color and utilize important features such as cart position. The factored state representation forces the RL agent to learn a more robust policy. However, the neural network parameterization of the RL policy must implicitly learn to ignore unimportant factors. Therefore, when presented with unseen information, the RL agent may not properly ignore unimportant factors. Domain randomization forces the neural network to implicitly learn a state representation sufficient to transfer between tasks. This requires large amounts of training data and is less robust than explicit modeling of latent state factors. SADALA builds on DARLA by adding an explicit attention mechanism, allowing it to more effectively ignore unimportant features. Due to the use of the sigmoid activation in the attention mechanism, the attention weights W are bounded between 0 and 1. In addition to providing a direct weight on the importance of a feature, this bound prevents high variance of attention weights across different inputs. SADALA with the variance reduction term performs worse than both DARLA and SADALA without variance reduction on the Deepmind lab task but better on the other two. In the scenario where the extracted latent state factors from the β-VAE are perfectly disentangled, static attention weights should be sufficient to solve the source task and should transfer better to the target task, as in the Visual Cartpole task. However, the β-VAE does not output perfectly disentangled factors, especially in more complex visual domains such as the Deepmind lab. Thus, the amount of attention paid to each feature from the β-VAE may differ across tasks, violating the assumption that attention weights should be zero variance. In this paper we propose SADALA, a three stage method for zero-shot domain transfer. First, SADALA learns a feature extractor that represents input states (images) as disentangled factors. It then filters these latent factors using an attention mechanism to select those most important to solving a source task. Jointly, it learns a policy for the source task that is robust to changes in states, and is able to transfer to related target tasks. We validate the performance of SADALA on both a high-dimensional continuous-control problem (Visual Cartpole) and a 3D naturalistic first-person simulated environments (Deepmind Lab). We show that the attention mechanism introduced is able to differentiate between important and unimportant latent features, enabling robust transfer. are constrained to be outside of a hypersphere of radius 0.1 the test environment. When evaluating source domain performance, the agents trained on multiple source domains are all evaluated on the same domain, randomly sampled from the set of source domains. The single task learner is evaluated on the source domain it is trained on. The second task is the Collect Good Objects task from Deepmind Lab . This environment can be defined as a family of MDPs that share transition function, reward function, and action space. The goal of the agent is to pick up as many "good" objects (+1 reward) and avoid picking up "bad" objects (−1 reward) as it can within one minute. These objects can be hats, cans, cakes, and balloons. Additionally the color combinations of the walls and floors can vary between green walls and orange floors or red walls and blue floors. These variations in state space correspond to the different MDPs within the family N of Deepmind Lab MDPs. The β-VAE is trained on a set of MDPs covering all latent state factor combinations, the RL network and attention mechanism is trained on a subset of N and tested on a held-out MDP. The neural network for the Visual Cartpole task consists of two parts: the β-VAE network and the policy network. First, the encoder for the β-VAE network is composed of three convolutional layers, each with kernel size 3 and stride 1. In order, they have 32, 32, and 64 filters. The output of the last convolutional layer is then frozen and passed through a dense layer with 256 neurons. This is then passed through another dense layer with 64 neurons, which outputs the latent space. The latent space is composed of 32 gaussians, each parameterized by a mean and variance. The decoder is an inverse of the encoder, utilizing deconvolutional layers. The encoder from the β-VAE is then frozen and used as a feature extractor for the policy network. The policy network takes the encoders outputs and passes them through one dense layer with 64 neurons, which outputs the attention weights. These weights are multiplied elementwise with the encoder's outputs and passed through two dense layers, each with 128 neurons. Finally, the output is passed through a dense layer with two neurons, outputting the policy given the input state. The output is also passed through a dense layer with one neuron, which outputs the value of the input state. The networks used for the Domain Randomization agent and Single-Task learner have a similar structure. They first pass the input through three convolutional filters, identical in architecture to the encoder. They then pass the outputs of the convolutional filters through two dense layers, each with 128 neurons. Finally, this output is passed through the dense layer with two neurons which outputs the policy, and the dense layer with one neuron, which outputs the value. The neural networks used for the Deepmind Lab task are slight modifications to the neural networks described above. They have four convolutional layers instead of three, with 32, 32, 64, and 64 filters, respectively. Additionally, the hidden dense layers in the policy network have 256 rather than 128 neurons. As in DARLA, the reconstruction loss of the β-VAE for Deepmind Lab takes place in the latent space of a denoising autoencoder with 100 latent factors. Relu activations are used throughout. All Visual Cartpole networks are trained with Adam with a learning rate of 5e − 4 and all Deepmind Lab networks are trained Adam with a learning rate of 1e − 4. The β-VAE networks are trained on a set of 1, 000, 000 images sampled from the observed state space of source policies. The RL networks are trained on 1, 000, 000 and 16, 000, 000 states, actions, and rewards for the Visual Cartpole and Deepmind Lab tasks, respectively. The domain randomization agent is trained on 3, 000, 000 Visual Cartpole states, actions, and rewards. C DOMAIN RANDOMIZATION DETAILS Domain randomization was implemented by varying parameters me

Represent this text to find a much much longer article about it with say hundreds-thousands of words

We present an agent that uses a beta-vae to extract visual features and an attention mechanism to ignore irrelevant features from visual observations to enable robust transfer between visual domains.

Represent the short summary for finding the corresponding scientific article (long):

We leverage deterministic autoencoders as generative models by proposing mixing functions which combine hidden states from pairs of images. These mixes are made to look realistic through an adversarial framework.


Question: Represent the scientific article to find a short TLDR

Question: Robustness verification that aims to formally certify the prediction behavior of neural networks has become an important tool for understanding the behavior of a given model and for obtaining safety guarantees. However, previous methods are usually limited to relatively simple neural networks. In this paper, we consider the robustness verification problem for Transformers. Transformers have complex self-attention layers that pose many challenges for verification, including cross-nonlinearity and cross-position dependency, which have not been discussed in previous work. We resolve these challenges and develop the first verification algorithm for Transformers. The certified robustness bounds computed by our method are significantly tighter than those by naive Interval Bound Propagation. These bounds also shed light on interpreting Transformers as they consistently reflect the importance of words in sentiment analysis. Deep neural networks have been successfully applied to many domains. However, a major criticism is that these black box models are difficult to analyze and their behavior is not guaranteed. Moreover, it has been shown that the predictions of deep networks become unreliable and unstable when tested in unseen situations, e.g., in the presence of small and adversarial perturbation to the input (; ;). Therefore, neural network verification has become an important tool for analyzing and understanding the behavior of neural networks, with applications in safety-critical applications (; ;), model explanation and robustness analysis (; c; ; ; ; ;). Formally, a neural network verification algorithm aims to provably characterize the prediction of a network within some input space. For example, given a K-way classification model f: R d → R K, we can verify some linear specification (defined by a vector c) as below: where S is a predefined input space. For example, in the robustness verification problem that we are going to focus on in this paper, S = {x | x−x 0 p ≤} is defined as some small p -ball around the original example x 0, and setting up c = 1 y0 − 1 y can verify whether the logit output of class y 0 is always greater than another class y within S. This is a nonconvex optimization problem which makes computing the exact solution challenging, and thus algorithms are recently proposed to find lower bounds of Eq. in order to efficiently obtain a safety guarantee (; ; ;). Moreover, extension of these algorithms can be used for verifying some properties beyond robustness, such as rotation or shift invariant , conservation of energy and model correctness . However, most of existing verification methods focus on relatively simple neural network architectures, such as feed-forward and recurrent neural networks, and cannot handle complex structures. In this paper, we develop the first robustness verification algorithm for Transformers with self-attention layers. Transformers have been widely used in natural language processing (; ;) and many other domains (; ; b; ; a). For frames under perturbation in the input sequence, we aim to compute a lower bound such that when these frames are perturbed within p -balls centered at the original frames respectively and with a radius of, the model prediction is certified to be unchanged. To compute such a bound efficiently, we adopt the linear-relaxation framework -we recursively propagate and compute linear lower bound and upper bound for each neuron with respect to the input within perturbation set S. We resolve several particular challenges in verifying Transformers. First, Transformers with selfattention layers have a complicated architecture. Unlike simpler networks, they cannot be written as multiple layers of linear transformations or element-wise operations. Therefore, we need to propagate linear bounds differently for self-attention layers. Second, dot products, softmax, and weighted summation in self-attention layers involve multiplication or division of two variables under perturbation, namely cross-nonlinearity, which is not present in feed-forward networks. proposed a gradient descent based approach to find linear bounds, however it is inefficient and poses a computational challenge for transformer verification as self-attention is the core of transformers. In contrast, we derive closed-form linear bounds that can be computed in O complexity. Third, neurons in each position after a self-attention layer depend on all neurons in different positions before the self-attention (namely cross-position dependency), unlike the case in recurrent neural networks where outputs depend on only the hidden features from the previous position and the current input. Previous works (; ;) have to track all such dependency and thus is costly in time and memory. To tackle this, we introduce an efficient bound propagating process in a forward manner specially for self-attention layers, enabling the tighter backward bounding process for other layers to utilize bounds computed by the forward process. In this way, we avoid cross-position dependency in the backward process which is relatively slower but produces tighter bounds. Combined with the forward process, the complexity of the backward process is reduced by O(n) for input length n, while the computed bounds remain comparably tight. Our contributions are summarized below: • We propose an effective and efficient algorithm for verifying the robustness of Transformers with self-attention layers. To our best knowledge, this is the first method for verifying Transformers. • We resolve key challenges in verifying Transformers, including cross-nonlinearity and crossposition dependency. Our bounds are significantly tighter than those by adapting Interval Bound Propagation (IBP) (; . • We quantitatively and qualitatively show that the certified lower bounds consistently reflect the importance of input words in sentiment analysis, which justifies that the computed bounds are meaningful in practice. Robustness Verification for Neural Networks. Given an input x 0 and a small region B p (x 0,):= {x | x − x 0 p ≤}, the goal of robustness verification is to verify whether the prediction of the neural network is unchanged within this region. This problem can be mathematically formulated as Eq.. If Eq. can be solved optimally, then we can derive the minimum adversarial perturbation of x by conducting binary search on. Equivalently, we obtain the maximum such that any perturbation within B p (x 0,) cannot change the predicted label. Several works focus on solving Eq. exactly and optimally, using mixed integer linear programming (MILP) , branch and bound (BaB), and satisfiability modulo theory (SMT) . Unfortunately, due to the nonconvexity of model f, solving Eq. is NP-hard even for a simple ReLU network . Therefore, we can only hope to compute a lower bound of Eq. efficiently by using relaxations. Many algorithms can be seen as using convex relaxations for non-linear activation functions , including using duality (;, abstract domains (; ; ;), layer-by-layer reachability analysis (b; ; ; and semi-definite relaxations (; . Additionally, robustness verification can rely on analysis on local Lipschitz constants . However, existing methods are mostly limited to verifying networks with relatively simple architectures, such as feed-forward networks and RNNs (a; ;), while none of them are able to handle Transformers. Transformers and Self-Attentive Models. Transformers based on the selfattention mechanism, further with pre-training on large-scale corpora, such as BERT , XLNet , RoBERTa , achieved state-of-the-art performance on many NLP tasks. Self-attentive models are also useful beyond NLP, including VisualBERT for extracting features from both text and images (b;), image transformer for image generation , acoustic models for speech recognition, sequential recommendation and graph embedding (a). The robustness of NLP models has been studied, especially many methods have been proposed to generate adversarial examples (; ; ; ;). In particular, showed that Transformers are more robust than LSTMs. However, there is not much work on robustness verification for NLP models. verified RNN/LSTM.; used Interval Bound Propagation (IBP) for certified robustness training of CNN and LSTM. In this paper, we propose the first verification method for Transformers. We aim to verify the robustness of a Transformer whose input is a sequence of frames We take binary text classification as an running example, where x (i) is a word embedding and the model outputs a score y c (X) for each class c (c ∈ {0, 1}). Nevertheless, our method for verifying Transformers is general and can also be applied in other applications. 0 ] correctly classified by the model, let P = {r 1, r 2, · · ·, r t}(1 ≤ r k ≤ n) be the set of perturbed positions, where t is the number of perturbed positions. Thus the perturbed input will belong to S: Assuming that c is the gold class, the goal of robustness verification is to compute {min X∈S y c (X) − y 1−c (X)}:= δ (X). If δ (X) > 0, the output score of the correct class will always be larger than the incorrect one within S. As mentioned previously, computing the exact values of δ (X) is NP-hard, and thus our goal is to efficiently compute a lower bound δ L (X) ≤ δ (X). We obtain δ L (X) by computing the bounds of each neuron when X is perturbed within S (δ L can be regarded as a final neuron). A Transformer layer can be decomposed into a number of sub-layers, where each sub-layer contains neurons after some operation. These operations can be categorized into three categories: 1) linear transformations, 2) unary nonlinear functions, and 3) operations in self-attention. Each sub-layer contains n positions in the sequence and each position contains a group of neurons. We assume that the Transformer we verify has m sub-layers in total, and the value of the j-th neuron at the i-th position in the l-th sub-layer is Φ vector for the specified sub-layer and position. Specially, Φ (0,i) = x (i) taking l = 0. We aim to compute a global lower bound f We compute bounds from the first sub-layer to the last sub-layer. For neurons in the l-th layer, we aim to represent their bounds as linear functions of neurons in a previous layer, the l -th layer: where,U are parameters of linear lower and upper bounds respectively. Using linear bounds enables us to efficiently compute bounds with a reasonable tightness. We initially have Generally, we use a backward process to propagate the bounds to previous sub-layers, by substituting Φ (l,i) with linear functions of previous neurons. It can be recursively conducted until the input layer l = 0. Since is constant, we can regard the bounds as linear functions of the perturbed embeddings, and take the global bounds for where 1/p + 1/q = 1 with p, q ≥ 1. These steps resemble to CROWN which is proposed to verify feed-forward networks. We further support verifying self-attentive Transformers which are more complex than feed-forward networks. Moreover, unlike CROWN that conducts a full backward process, we combine the backward process with a forward process (see Sec. 3.3) to reduce the computational complexity of verifying Transformers. Linear transformations and unary nonlinear functions are basic operations in neural networks. We show how bounds Eq. at the l -th sub-layer are propagated to the (l − 1)-th layer. Linear Transformations If the l -th sub-layer is connected with the (l − 1)-th sub-layer with a linear transformation are parameters of the linear transformation, we propagate the bounds to the (l −1)-th layer by substituting Φ (l,k) (X): where "L/U " means that the equations hold for both lower bounds and upper bounds respectively. If the l -th layer is obtained from the (l − 1)-th layer with an unary nonlinear function Φ, to propagate linear bounds over the nonlinear function, we first bound are parameters such that the inequation holds for all Φ (l −1,k) j (X) within its bounds computed previously. Such linear relaxations can be done for different functions, respectively. We provide detailed bounds for functions involved in Transformers in Appendix B. We then back propagate the bounds: mean to retain positive and negative elements in vector respectively and set other elements to 0. Self-attention layers are the most challenging parts for verifying Transformers. We assume that Φ (l−1,i) (X) is the input to a self-attention layer. We describe our method for computing bounds for one attention head, and bounds for different heads of the multi-head attention in Transformers can be easily concatenated., and values v (l,i) (X) with different linear projections, and their bounds can be obtained as described in Sec. 3.2. We also keep their linear bounds that are linear functions of the perturbed embeddings., where ⊕ indicates vector concatenation, and thereby we represent the linear bounds as linear functions of x (r): where q/k/v and q/k/v mean that the inequation holds for queries, keys and values respectively. We then bound the output of the self-attention layer starting from We bound multiplications and divisions in the selfattention mechanism with linear functions. We aim to bound bivariate function z = xy or z = We provide a proof in Appendix C. However, directly bounding z = x y is tricky; fortunately, we can bound it indirectly by first bounding a unary function y = 1 y and then bounding the multiplication z = xy. For the self-attention mechanism, instead of using the backward process like CROWN , we compute bounds with a forward process which we will show later that it can reduce the computational complexity. Attention scores are computed from q (l,i) (X) and, it is bounded by: We then obtain the bounds of S ), In this way, linear bounds of q (l,i) (X) and k (l,i) (X) are forward propagated to S (l) i,j. Attention scores are normalized into attention probabilities with a softmax, i.e. S (l) is an unary nonlinear function and can be bounded by α, where: By summing up bounds of each exp(S i,k) ready, we forward propagate the bounds toS (l) i,j with a division similarly to bounding q, which can be regarded as a dot product ofS with a transposing. Therefore, bounds ofS similarly to bounding S (l) i,j. In this way, we obtain the output bounds of the self-attention: Recall that x (r) is a concatenation of into t vectors with equal dimensions, Ω, Ω, such that Eq. becomes Backward Process to Self-Attention Layers When computing bounds for a later sub-layer, the lth sub-layer, using the backward process, we directly propagate the bounds at the the closest previous self-attention layer assumed to be the l -th layer, to the input layer, and we skip other previous sublayers. The bounds propagated to the l -th layer are as Eq.. We substitute Φ (l,k) (X) with linear bounds in Eq.: We take global bounds as Eq. and Eq. to obtain the bounds of the l-th layer. Introducing a forward process can significantly reduce the complexity of verifying Transformers. With the backward process only, we need to compute, where the major cost is on Λ (l,i,l,k) and there are O(m 2 n 2) such matrices to compute. The O(n 2) factor is from the dependency between all pairs of positions in the input and output respectively, which makes the algorithm inefficient especially when the input sequence is long. In contrast, the forward process represents the bounds as linear functions of the perturbed positions only instead of all positions by computing Ω (l,i) and Θ (l,i). Imperceptible adversarial examples may not have many perturbed positions , and thus we may assume that the number of perturbed positions, t, is small. The major cost is on Ω (l,i) while there are only O(mn) such matrices and the sizes of Λ (l,i,l,k) and Ω (l,i) are relatively comparable for a small t. We combine the backward process and the forward process. The number of matrices Ω is O(mn) in the forward process, and for the backward process, since we do not propagate bounds over self-attention layers and there is no cross-position dependency in other sub-layers, we only compute Λ (l,i,l,k) such that i = k, and thus the number of matrices Λ is reduced to O(m 2 n). So the total number of matrices Λ and Ω we compute is O(m 2 n) and is O(n) times smaller than O(m 2 n 2) when only the backward process is used. Moreover, the backward process makes bounds tighter compared to solely the forward one, as we show in Appendix D. We conduct experiments on two sentiment analysis datasets: Yelp and SST-2 . Yelp consists of 560,000/38,000 examples in the training/test set and SST-2 consists of 67,349/872/1,821 examples in the training/development/test set. Each example is a sentence or a sentence segment (for the training data of SST-2 only) labeled with a sentiment polarity. We verify the robustness of Transformers trained from scratch. For the main experiments, we consider N -layer models (N ≤ 3), with 4 attention heads, hidden sizes of 256 and 512 for self-attention and feed-forward layers respectively, and we use ReLU activations for feed-forward layers. We remove the variance related terms in layer normalization, making Transformers verification bounds tighter while the clean accuracies remain comparable (see Appendix E for discussions). Although our method can be in principal applied to Transformers with any number of layers, we do not use large-scale pre-trained models such as BERT because they are too challenging to be tightly verified for now. Current state-of-the-art verification methods for feed-forward networks either produce loose bounds for large networks , or do not scale due to computational limits (; ; Transformers contain more nonlinear operations than feed-forward networks so they are even more challenging for verification. Dataset N Acc. Table 1 : Clean accuracies and computed bounds for 1-position perturbation. Bounds include upper bounds (obtained by an enumeration based method), certified lower bounds by IBP and our method respectively. We also report the gap between upper bounds and our lower bounds (represented as the percentage of lower bounds relative to upper bounds). We compute bounds for each possible option of perturbed positions and report the minimum ("Min") and average ("Avg") among them. Table 2: Bounds by IBP and our method for 2-position perturbation constrained by 2 -norm. We compute certified lower bounds for different models on different datasets. We include 1-position perturbation constrained by 1 / 2 / ∞ -norms and 2-position perturbation constrained by 2 -norm. We compare our lower bounds with those computed by the Interval Bound Propagation (IBP) baseline. For 1-position perturbation, we also compare with upper bounds computed by enumerating all the words in the vocabulary and finding the word closest to the original one such that the word substitution alters the predicted label. This method has an exponential complexity with respect to the vocabulary size and can hardly be extended to perturbations on 2 or more positions; thus we do not include upper bounds for 2-position perturbation. For each example, we enumerate possible options of perturbed positions (there are n t options), and we integrate from different options by taking the minimum or average respectively. We report the average on 10 correctly classified random test examples with sentence lengths no more than 32 for 1-position perturbation and 16 for 2-position perturbation. Table 1 and Table 2 present the for 1-position and 2-position perturbation respectively. Our certified lower bounds are significantly larger and thus tighter than those by IBP. For 1-position perturbation, the lower bounds are consistently smaller than the upper bounds, and the gap between the upper bounds and our lower bounds are reasonable compared with that in previous work on verification of feed-forward networks, e.g. in the upper bounds are in the order of 10 times larger than lower bounds. This demonstrates that our proposed method can compute robustness bounds for Transformers in a similar quality to the bounds of simpler neural networks. Table 3: Comparison of certified lower bounds and computation time (sec) by different methods. In the following, we show the effectiveness of combining the backward process with a forward process. We compare our proposed method (Backward & Forward) to two variations: FullyForward propagates bounds in a forward manner for all sub-layers besides self-attention layers; Fully-Backward computes bounds for all sub-layers including self-attention layers using the backward bound propagation and without the forward process. We compare the tightness of bounds and computation time of the three methods. We use smaller models with the hidden sizes reduced by half, and we use 1-position perturbation only, to accommodate Fully-Backward with large computational cost. Experiments are conducted on an NVIDIA TITAN X GPU. Table 4: Average importance scores of the most/least important words identified from 100 examples respectively on SST by different methods. For the most important words identified, larger important scores are better, and vice versa. Additionally, we show most/least important words identified from 10 examples on the Yelp dataset. Boldfaced words are considered to have strong sentiment polarities, and they should appear as most important words rather than least important ones. The certified lower bounds can reflect how sensitive a model is to the perturbation of each input token. Intuitively, if a word is more important to the prediction, the model is more sensitive to its perturbation. Therefore, the certified lower bounds can be used to identify important words. In the following, we conduct an experiment to verify whether important words can be identified by our certified lower bounds. We use a 1-layer Transformer classifier under 1-position perturbation constrained by 2 -norm. We compare our method with two baselines that also estimate local vulnerability: Upper uses upper bounds; Gradient identifies the word whose embedding has the largest 2 -norm of gradients as the most important and vice versa. Quantitative Analysis on SST SST contains sentiment labels for all phrases on parse trees, where the labels range from very negative to very positive, and 2 for neutral. For each word, assuming its label is x, we take |x − 2|, i.e. the distance to the neutral label, as the importance score, since less neutral words tend to be more important for the sentiment polarity of the sentence. We evaluate on 100 random test input sentences and compute the average importance scores of the most or least important words identified from the examples. In Table 4, compared to the baselines ("Upper" and "Grad"), the average importance score of the most important words identified by our lower bounds are the largest, while the least important words identified by our method have the smallest average score. This demonstrates that our method identifies the most and least important words more accurately compared to baseline methods. We further analyze the on a larger dataset, Yelp. Since Yelp does not provide per-word sentiment labels, importance scores cannot be computed as on SST. Thus, we demonstrate a qualitative analysis. We use 10 random test examples and collect the words identified as the most and least important word in each example. In Table 4, most words identified as the most important by certified lower bounds are exactly the words reflecting sentiment polarities (boldfaced words), while those identified as the least important words are mostly stopwords. Baseline methods mistakenly identify more words containing no sentiment polarity as the most important. This again demonstrates that our certified lower bounds identify word importance better than baselines and our bounds provide meaningful interpretations in practice. While gradients evaluate the sensitivity of each input word, this evaluation only holds true within a very small neighborhood (where the classifier can be approximated by a first-order Taylor expansion) around the input sentence. Our certified method gives valid lower bounds that hold true within a large neighborhood specified by a perturbation set S, and thus it provides more accurate . We propose the first robustness verification method for Transformers, and tackle key challenges in verifying Transformers, including cross-nonlinearity and cross-position dependency, for efficient and effective verification. Our method computes certified lower bounds that are significantly tighter than those by IBP. Quantitative and qualitative analyses further show that our bounds are meaningful and can reflect the importance of different words in sentiment analysis. A ILLUSTRATION OF DIFFERENT BOUNDING PROCESSES Figure 1: Illustration of three different bounding processes: Fully-Forward (a), Fully-Backward (b), and Backward&Forward (c). We show an example of a 2-layer Transformer, where operations can be divided into two kinds of blocks, "Feed-forward" and "Self-attention". "Self-attention" contains operations in the self-attention mechanism starting from queries, keys, and values, and "Feed-forward" contains all the other operations including linear transformations and unary nonlinear functions. Arrows with solid lines indicate the propagation of linear bounds in a forward manner. Each backward arrow A k → B k with a dashed line for blocks A k, B k indicates that there is a backward bound propagation to block B k when computing bounds for block A k. Blocks with blue rectangles have forward processes inside the blocks, while those with green rounded rectangles have backward processes inside. Backward & Forward algorithm, we use backward processes for the feed-forward parts and forward processes for self-attention layers, and for layers after self-attention layers, they no longer need backward bound propagation to layers prior to self-attention layers. In this way, we resolve the cross-position dependency in verifying Transformers while still keeping bounds comparably tight as those by using fully backward processes. Empirical comparison of the three frameworks are presented in Sec. 4.3. We show in Sec. 3.2 that linear bounds can be propagated over unary nonlinear functions as long as the unary nonlinear functions can be bounded with linear functions. Such bounds are determined for each neuron respectively, according to the bounds of the input for the function. Specifically, for a unary nonlinear function σ(x), with the bounds of x obtained previously as x ∈ [l, u], we aim to derive a linear lower bound α L x + β L and a linear upper bound where parameters α L, β L, α U, β U are dependent on l, u and designed for different functions σ(x) respectively. We introduce how the parameters are determined for different unary nonlinear functions involved in Transformers such that the linear bounds are valid and as tight as possible. Bounds of ReLU and tanh has been discussed by , and we further derive bounds of e x, 1 x, x 2, √ x. x 2 and √ x is only used when the layer normalization is not modified for experiments to study the impact of our modification. For the following description, we define the endpoints of the function to be bounded within the range as (l, σ(l)) and (u, σ(u)). We describe how the lines corresponding to the linear bounds of different functions can be determined, and thereby parameters α L, β L, α U, β U can be determined accordingly. ReLU For ReLU activation, σ(x) = max(x, 0). ReLU σ(x) is inherently linear on segments (−∞, 0] and [0, ∞) respectively, so we make the linear bounds exactly σ(x) for u ≤ 0 or l ≥ 0; and for l < 0 < u, we take the line passing the two endpoints as the upper bound; and take σ L (x) = 0 when u < |l| and σ L (x) = 1 when u ≥ |l| as the lower bound, to minimize the gap between the lower bound and the original function. 1+e −2x. tanh is concave for l ≥ 0, and thus we take the line passing the two endpoints as the lower bound and take a tangent line passing ((l+u)/2, σ((l+u)/2) as the upper bound. For u ≤ 0, tanh is convex, and thus we take the line passing the two endpoints as the upper bound and take a tangent line passing ((l + u)/2, σ((l + u)/2) as the lower bound. For l < 0 < u, we take a tangent line passing the right endpoint and as the lower bound, and take a tangent line passing the left endpoint and L and d U can be found with a binary search. Exp σ(x) = exp(x) = e x is convex, and thus we take the line passing the two endpoints as the upper bound and take a tangent line passing (d, σ(d)) as the lower bound. Preferably, we take d = (l + u)/2. However, e x is always positive and used in the softmax for computing normalized attention probabilities in self-attention layers, i.e. exp(S (l) i,j ) and i,k ) appears in the denominator of the softmax, and to make reciprocal function 1 x finitely bounded the range of x should not pass 0. Therefore, we impose a constraint to force the lower bound function to be always positive, i.e. Reciprocal For the reciprocal function, σ(x) = 1 x. It is used in the softmax and layer normalization and its input is limited to have l > 0 by the lower bounds of exp(x), and √ x. With l > 0, σ(x) is convex. Therefore, we take the line passing the two endpoints as the upper bound. And we take the tangent line passing ((l + u)/2, σ((l + u)/2)) as the lower bound. Square For the square function, σ(x) = x 2. It is convex and we take the line passing the two endpoints as the upper bound. And we tan a tangent line passing (d, σ(d)) (d ∈ [l, u] ) as the lower bound. We still prefer to take d = (l+u)/2. x 2 appears in computing the variance in layer normalization and is later passed to a square root function to compute a standard derivation. To make the input to the square root function valid, i.e. non-negative, we impose a constraint σ 2 is the tangent line passing (d, σ(d) ). For u ≤ 0, x 2 is monotonously decreasing, the constraint we impose is equivalent to σ L (u) = 2du − d 2 ≥ 0, and with d ≤ 0, we have d ≥ 2u. So we take d = max((l + u)/2, 2u). For l ≥ 0, x 2 is monotonously increasing, the constraint we impose is equivalent to σ L (l) = 2dl − d 2 ≥ 0, and with 2 is negative for d = 0 and is zero for d = 0. And for l < 0 < u, the constraint we impose is equivalent to σ L = −d 2 ≥ 0, and thus we take d = 0. Square root For the square root function, σ(x) = √ x. It is used the to compute a standard derivation in the layer normalization and its input is limited to be positive by the lower bounds of x 2 and a smoothing constant, so l > 0. σ(x) is concave, and thus we take the line passing the two endpoints as the lower bound and take the tangent line passing ((l + u)/2, σ((l + u)/2)) as the upper bound. We provide a mathematical proof of optimal parameters for linear bounds of multiplications used in Sec. 3.3. We also show that linear bounds of division can be indirectly obtained from bounds of multiplications and the reciprocal function. For each multiplication, we aim to bound z = xy with two linear bounding planes z, where x and y are both variables and x ∈ [l x, u x], y ∈ [l y, u y] are concrete bounds of x, y obtained from previous layers, such that: Our goal is to determine optimal parameters of bounding planes U, such that the bounds are as tight as possible. We define a difference function F L (x, y) which is the difference between the original function z = xy and the lower bound z To make the bound as tight as possible, we aim to minimize the integral of the difference function, which is equivalent to maximizing For an optimal bounding plane, there must exist a point To ensure that F L (x, y) ≥ 0 within the concerned area, we need to ensure that the minimum value of F L (x, y) is be non-negative. We show that we only need to check cases when (x, y) is any of (l x, l y), (l x, u y), (u x, l y), (u x, u y), i.e. points at the corner of the considered area. The partial derivatives of F L are: y 1 ) and (x 1, y 1) cannot be the point with the minimum value of F L (x, y). On the other hand, if there is (x 1, y 1)(x 1 = l x, y 1 ∈ (l y, u y)), i.e. on one border of the concerned area but not on any corner, This property holds for the other three borders of the concerned area. Therefore, other points within the concerned area cannot have smaller function value F L (x, y), so we only need to check the corners, and the constraints on F L (x, y) become We substitute γ L in Eq. with Eq., yielding where We have shown that the minimum function value F L (x, y) within the concerned area cannot appear in (l x, u x) × (l y, u y), i.e. it can only appear at the border, while (x 0, y 0) is a point with a minimum function value F L (x 0, y 0) = 0, (x 0, y 0) can also only be chosen from the border of the concerned area. At least one of x 0 = l x and x 0 = u x holds. If we take x 0 = l x: And from Eq. we obtain For the other case if we take x 0 = u x: We take α L = u y similarly as in the case when x 0 = l x, and then, so we can simply adopt the first one. We also notice that V L 1, V L 2 are independent of y 0, so we may take any y 0 within [l y, u y] such as y 0 = l y. Thereby, we obtain the a group of optimal parameters of the lower bounding plane: We derive the upper bound similarly. We aim to minimize If we take x 0 = l x: To minimize V U 1, we take α U = u y, and then For the other case if we take x 0 = u x: (l x − u x)α U ≥ −u x y 0 + max(l x l y − β U (l y − y 0), l x u y − β U (u y − y 0)) = max(l x l y − u x l y, l x u y − u x u y) = (l x − u x) min(l y, u y) = (l x − u x)l y So α U ≤ l y To minimize V U 2, we take α U = l y, and then Since V We have shown that closed-form linear bounds of multiplications can be derived. However, we find that directly bounding z = x y is tricky. If we try to derive a lower bound z L = α L xβ L y + γ for z = x y as Appendix C.1, the difference function is The partial derivatives of F L are: If there is (x 1, y 1) ∈ (l x, u x) × (l y, u y) such that

Represent the TLDR for finding the corresponding scientific article

We propose the first algorithm for verifying the robustness of Transformers.

This paper identifies classes of problems for which adversarial examples are inescapable, and derives fundamental bounds on the susceptibility of any classifier to adversarial examples.